diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch
new file mode 100644
index 0000000..8c56acb
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch
@@ -0,0 +1,40 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Thu, 15 Sep 2022 14:41:20 +0200
+Subject: [PATCH] mac80211: Fix deadlock: Don't start TX while holding
+ fq->lock
+
+ieee80211_txq_purge() calls fq_tin_reset() and
+ieee80211_purge_tx_queue(); Both are then calling
+ieee80211_free_txskb(). Which can decide to TX the skb again.
+
+There are at least two ways to get a deadlock:
+
+1) When we have a TDLS teardown packet queued in either tin or frags
+   ieee80211_tdls_td_tx_handle() will call ieee80211_subif_start_xmit()
+   while we still hold fq->lock. ieee80211_txq_enqueue() will thus
+   deadlock.
+
+2) A variant of the above happens if aggregation is up and running:
+   In that case ieee80211_iface_work() will deadlock with the original
+   task: The original tasks already holds fq->lock and tries to get
+   sta->lock after kicking off ieee80211_iface_work(). But the worker
+   can get sta->lock prior to the original task and will then spin for
+   fq->lock.
+
+Avoid these deadlocks by not sending out any skbs when called via
+ieee80211_free_txskb().
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+---
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -698,7 +698,7 @@ static void ieee80211_report_used_skb(st
+ 
+ 		if (!sdata) {
+ 			skb->dev = NULL;
+-		} else {
++		} else if (!dropped) {
+ 			unsigned int hdr_size =
+ 				ieee80211_hdrlen(hdr->frame_control);
+ 
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/342-mac80211-Ensure-vif-queues-are-operational-after-sta.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/342-mac80211-Ensure-vif-queues-are-operational-after-sta.patch
new file mode 100644
index 0000000..4310329
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/342-mac80211-Ensure-vif-queues-are-operational-after-sta.patch
@@ -0,0 +1,47 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Thu, 15 Sep 2022 15:09:46 +0200
+Subject: [PATCH] mac80211: Ensure vif queues are operational after start
+
+Make sure local->queue_stop_reasons and vif.txqs_stopped stay in sync.
+
+When a new vif is created the queues may end up in an inconsistent state
+and be inoperable:
+Communication not using iTXQ will work, allowing to e.g. complete the
+association. But the 4-way handshake will time out. The sta will not
+send out any skbs queued in iTXQs.
+
+All normal attempts to start the queues will fail when reaching this
+state.
+local->queue_stop_reasons will have marked all queues as operational but
+vif.txqs_stopped will still be set, creating an inconsistent internal
+state.
+
+In reality this seems to be race between the mac80211 function
+ieee80211_do_open() setting SDATA_STATE_RUNNING and the wake_txqs_tasklet:
+Depending on the driver and the timing the queues may end up to be
+operational or not.
+
+Cc: stable@vger.kernel.org
+Fixes: f856373e2f31 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+---
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -301,14 +301,14 @@ static void __ieee80211_wake_txqs(struct
+ 	local_bh_disable();
+ 	spin_lock(&fq->lock);
+ 
++	sdata->vif.txqs_stopped[ac] = false;
++
+ 	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
+ 		goto out;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP)
+ 		ps = &sdata->bss->ps;
+ 
+-	sdata->vif.txqs_stopped[ac] = false;
+-
+ 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
+ 		if (sdata != sta->sdata)
+ 			continue;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch
new file mode 100644
index 0000000..ff3cb7b
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch
@@ -0,0 +1,77 @@
+From 4db561ae4a90c2d0e15996634567559e292dc9e5 Mon Sep 17 00:00:00 2001
+From: Ahmed Zaki <anzaki@gmail.com>
+Date: Sat, 2 Oct 2021 08:53:29 -0600
+Subject: [PATCH] mac80211: fix a memory leak where sta_info is not freed
+
+commit 8f9dcc29566626f683843ccac6113a12208315ca upstream.
+
+The following is from a system that went OOM due to a memory leak:
+
+wlan0: Allocated STA 74:83:c2:64:0b:87
+wlan0: Allocated STA 74:83:c2:64:0b:87
+wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_add_sta)
+wlan0: Adding new IBSS station 74:83:c2:64:0b:87
+wlan0: moving STA 74:83:c2:64:0b:87 to state 2
+wlan0: moving STA 74:83:c2:64:0b:87 to state 3
+wlan0: Inserted STA 74:83:c2:64:0b:87
+wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_work)
+wlan0: Adding new IBSS station 74:83:c2:64:0b:87
+wlan0: moving STA 74:83:c2:64:0b:87 to state 2
+wlan0: moving STA 74:83:c2:64:0b:87 to state 3
+.
+.
+wlan0: expiring inactive not authorized STA 74:83:c2:64:0b:87
+wlan0: moving STA 74:83:c2:64:0b:87 to state 2
+wlan0: moving STA 74:83:c2:64:0b:87 to state 1
+wlan0: Removed STA 74:83:c2:64:0b:87
+wlan0: Destroyed STA 74:83:c2:64:0b:87
+
+The ieee80211_ibss_finish_sta() is called twice on the same STA from 2
+different locations. On the second attempt, the allocated STA is not
+destroyed creating a kernel memory leak.
+
+This is happening because sta_info_insert_finish() does not call
+sta_info_free() the second time when the STA already exists (returns
+-EEXIST). Note that the caller sta_info_insert_rcu() assumes STA is
+destroyed upon errors.
+
+Same fix is applied to -ENOMEM.
+
+Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
+Link: https://lore.kernel.org/r/20211002145329.3125293-1-anzaki@gmail.com
+[change the error path label to use the existing code]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Viacheslav Sablin <sablin@ispras.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/sta_info.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -646,13 +646,13 @@ static int sta_info_insert_finish(struct
+ 	/* check if STA exists already */
+ 	if (sta_info_get_bss(sdata, sta->sta.addr)) {
+ 		err = -EEXIST;
+-		goto out_err;
++		goto out_cleanup;
+ 	}
+ 
+ 	sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL);
+ 	if (!sinfo) {
+ 		err = -ENOMEM;
+-		goto out_err;
++		goto out_cleanup;
+ 	}
+ 
+ 	local->num_sta++;
+@@ -708,8 +708,8 @@ static int sta_info_insert_finish(struct
+  out_drop_sta:
+ 	local->num_sta--;
+ 	synchronize_net();
++ out_cleanup:
+ 	cleanup_single_sta(sta);
+- out_err:
+ 	mutex_unlock(&local->sta_mtx);
+ 	kfree(sinfo);
+ 	rcu_read_lock();
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/361-wifi-mac80211-Don-t-finalize-CSA-in-IBSS-mode-if-sta.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/361-wifi-mac80211-Don-t-finalize-CSA-in-IBSS-mode-if-sta.patch
new file mode 100644
index 0000000..dd3e934
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/361-wifi-mac80211-Don-t-finalize-CSA-in-IBSS-mode-if-sta.patch
@@ -0,0 +1,47 @@
+From 552ba102a6898630a7d16887f29e606d6fabe508 Mon Sep 17 00:00:00 2001
+From: Siddh Raman Pant <code@siddh.me>
+Date: Sun, 14 Aug 2022 20:45:12 +0530
+Subject: [PATCH] wifi: mac80211: Don't finalize CSA in IBSS mode if state is
+ disconnected
+
+commit 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 upstream.
+
+When we are not connected to a channel, sending channel "switch"
+announcement doesn't make any sense.
+
+The BSS list is empty in that case. This causes the for loop in
+cfg80211_get_bss() to be bypassed, so the function returns NULL
+(check line 1424 of net/wireless/scan.c), causing the WARN_ON()
+in ieee80211_ibss_csa_beacon() to get triggered (check line 500
+of net/mac80211/ibss.c), which was consequently reported on the
+syzkaller dashboard.
+
+Thus, check if we have an existing connection before generating
+the CSA beacon in ieee80211_ibss_finish_csa().
+
+Cc: stable@vger.kernel.org
+Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode")
+Link: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6
+Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
+Signed-off-by: Siddh Raman Pant <code@siddh.me>
+Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/ibss.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -534,6 +534,10 @@ int ieee80211_ibss_finish_csa(struct iee
+ 
+ 	sdata_assert_lock(sdata);
+ 
++	/* When not connected/joined, sending CSA doesn't make sense. */
++	if (ifibss->state != IEEE80211_IBSS_MLME_JOINED)
++		return -ENOLINK;
++
+ 	/* update cfg80211 bss information with the new channel */
+ 	if (!is_zero_ether_addr(ifibss->bssid)) {
+ 		cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/362-wifi-mac80211-Fix-UAF-in-ieee80211_scan_rx.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/362-wifi-mac80211-Fix-UAF-in-ieee80211_scan_rx.patch
new file mode 100644
index 0000000..0e58b61
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/362-wifi-mac80211-Fix-UAF-in-ieee80211_scan_rx.patch
@@ -0,0 +1,55 @@
+From 5d20c6f932f2758078d0454729129c894fe353e7 Mon Sep 17 00:00:00 2001
+From: Siddh Raman Pant <code@siddh.me>
+Date: Sat, 20 Aug 2022 01:33:40 +0530
+Subject: [PATCH] wifi: mac80211: Fix UAF in ieee80211_scan_rx()
+
+commit 60deb9f10eec5c6a20252ed36238b55d8b614a2c upstream.
+
+ieee80211_scan_rx() tries to access scan_req->flags after a
+null check, but a UAF is observed when the scan is completed
+and __ieee80211_scan_completed() executes, which then calls
+cfg80211_scan_done() leading to the freeing of scan_req.
+
+Since scan_req is rcu_dereference()'d, prevent the racing in
+__ieee80211_scan_completed() by ensuring that from mac80211's
+POV it is no longer accessed from an RCU read critical section
+before we call cfg80211_scan_done().
+
+Cc: stable@vger.kernel.org
+Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d
+Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com
+Suggested-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Siddh Raman Pant <code@siddh.me>
+Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.me
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/scan.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -461,16 +461,19 @@ static void __ieee80211_scan_completed(s
+ 	scan_req = rcu_dereference_protected(local->scan_req,
+ 					     lockdep_is_held(&local->mtx));
+ 
+-	if (scan_req != local->int_scan_req) {
+-		local->scan_info.aborted = aborted;
+-		cfg80211_scan_done(scan_req, &local->scan_info);
+-	}
+ 	RCU_INIT_POINTER(local->scan_req, NULL);
+ 	RCU_INIT_POINTER(local->scan_sdata, NULL);
+ 
+ 	local->scanning = 0;
+ 	local->scan_chandef.chan = NULL;
+ 
++	synchronize_rcu();
++
++	if (scan_req != local->int_scan_req) {
++		local->scan_info.aborted = aborted;
++		cfg80211_scan_done(scan_req, &local->scan_info);
++	}
++
+ 	/* Set power back to normal operating levels. */
+ 	ieee80211_hw_config(local, 0);
+ 
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
index 9b9f9dd..2a053de 100644
--- a/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
@@ -36,7 +36,12 @@
     file://337-mac80211-increase-quantum-for-airtime-scheduler.patch \
     file://339-mac80211-exclude-multicast-packets-from-AQL-pending-.patch \
     file://340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch \
+    file://341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch \
+    file://342-mac80211-Ensure-vif-queues-are-operational-after-sta.patch \
     file://350-bss-color-collision.patch \
+    file://360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch \
+    file://361-wifi-mac80211-Don-t-finalize-CSA-in-IBSS-mode-if-sta.patch \
+    file://362-wifi-mac80211-Fix-UAF-in-ieee80211_scan_rx.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
diff --git a/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
index 6036d7c..347d8e8 100644
--- a/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 8b72691afc0ab523e98a9737e56c7aeebd830b3f Mon Sep 17 00:00:00 2001
+From 35c54875181e0f1b0637746de7c4af6aa9ec0212 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1/8] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1/7] mt76: mt7915: rework testmode init registers
 
 ---
  mt7915/mmio.c     |  2 ++
@@ -10,7 +10,7 @@
  3 files changed, 54 insertions(+), 16 deletions(-)
 
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c1256de..c81fa09 100644
+index 7bd5f672..68d978f4 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -59,6 +59,7 @@ static const u32 mt7986_reg[] = {
@@ -21,7 +21,7 @@
  	[TMAC_CDTR]		= 0x090,
  	[TMAC_ODTR]		= 0x094,
  	[TMAC_ATCR]		= 0x098,
-@@ -132,6 +133,7 @@ static const u32 mt7915_offs[] = {
+@@ -133,6 +134,7 @@ static const u32 mt7915_offs[] = {
  };
  
  static const u32 mt7916_offs[] = {
@@ -30,7 +30,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 53061aa..1687568 100644
+index 5920e705..6d9d187a 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -30,6 +30,7 @@ enum reg_rev {
@@ -41,7 +41,7 @@
  	TMAC_CDTR,
  	TMAC_ODTR,
  	TMAC_ATCR,
-@@ -179,6 +180,12 @@ enum offs_rev {
+@@ -180,6 +181,12 @@ enum offs_rev {
  #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
  #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
  
@@ -54,7 +54,7 @@
  /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
  #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
  #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -187,6 +194,9 @@ enum offs_rev {
+@@ -188,6 +195,9 @@ enum offs_rev {
  #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
  #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
  
@@ -64,7 +64,7 @@
  #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
   #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
  #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -458,8 +468,10 @@ enum offs_rev {
+@@ -459,8 +469,10 @@ enum offs_rev {
  #define MT_AGG_PCR0_VHT_PROT		BIT(13)
  #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
  
@@ -78,7 +78,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index efb9bb8..0186602 100644
+index efb9bb82..01866028 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -175,5 +175,5 @@
  
  static void
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch b/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
index acc323f..caac8c3 100644
--- a/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
@@ -1,7 +1,7 @@
-From 879e20ba9e16a41db88087dd73e4ebbfecb1388b Mon Sep 17 00:00:00 2001
+From e7fac7c5c91fbabafa530abdf32cf11dd36834d7 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 25 Feb 2022 09:36:01 +0800
-Subject: [PATCH 2/8] mt76: testmode: rework tx antenna setting
+Subject: [PATCH 2/7] mt76: testmode: rework tx antenna setting
 
 ---
  mt7915/mcu.c      |  7 +------
@@ -10,10 +10,10 @@
  3 files changed, 8 insertions(+), 15 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7767bfe..e3123f2 100644
+index 3586a8e3..d9c9805b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2640,14 +2640,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+@@ -2642,14 +2642,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
  
  #ifdef CONFIG_NL80211_TESTMODE
  	if (phy->mt76->test.tx_antenna_mask &&
@@ -30,7 +30,7 @@
  #endif
  
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0186602..41b9949 100644
+index 01866028..41b99496 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -474,11 +474,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
@@ -69,10 +69,10 @@
  
  	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
 diff --git a/testmode.c b/testmode.c
-index 71fd3fb..74a46e9 100644
+index 0accc71a..57cdfdf6 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -443,8 +443,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
@@ -83,5 +83,5 @@
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch b/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
index d6f694c..1b0de96 100644
--- a/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
@@ -1,7 +1,7 @@
-From f8b12d3930f7c463bb0981904e648030461c1a82 Mon Sep 17 00:00:00 2001
+From 826c0c1849f01d0afaf4cfa14adfba0386f8d88f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 3 Jan 2022 17:09:53 +0800
-Subject: [PATCH 3/8] mt76: mt7915: rework rx testmode stats
+Subject: [PATCH 3/7] mt76: mt7915: rework rx testmode stats
 
 ---
  mac80211.c        |  3 +-
@@ -15,10 +15,10 @@
  8 files changed, 109 insertions(+), 17 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index a46884d..d74300f 100644
+index bc3a7514..c5ef5940 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -751,7 +751,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -752,7 +752,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -29,10 +29,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 4da77d4..94541cd 100644
+index 87db9498..e4a248a1 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -612,6 +612,8 @@ struct mt76_testmode_ops {
+@@ -638,6 +638,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -41,7 +41,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -643,6 +645,8 @@ struct mt76_testmode_data {
+@@ -669,6 +671,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -50,7 +50,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -650,6 +654,7 @@ struct mt76_testmode_data {
+@@ -676,6 +680,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -59,10 +59,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f1d7c05..e94d670 100644
+index 718f427d..f62af7a8 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1130,6 +1130,7 @@ enum {
+@@ -1138,6 +1138,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -71,7 +71,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index cd1edf5..110e4f3 100644
+index cd1edf55..110e4f36 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -83,7 +83,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 41b9949..6c05dfa 100644
+index 41b99496..6c05dfab 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
@@ -215,7 +215,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac3..a1c54c8 100644
+index 5573ac30..a1c54c89 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -266,10 +266,10 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 74a46e9..ba9ac2d 100644
+index 57cdfdf6..1d0d5d30 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -555,6 +555,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
+@@ -559,6 +559,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
  			      MT76_TM_STATS_ATTR_PAD) ||
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
@@ -280,7 +280,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d..8961326 100644
+index 5e2792d8..89613266 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
@@ -301,5 +301,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
index f8627aa..b9dc31b 100644
--- a/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,14 +1,14 @@
-From ca98c2d93f1d1b9c4702d3199e371972c15dcbed Mon Sep 17 00:00:00 2001
+From 96fcb3f5306bceb4f04ca87d097df6f7d391a147 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 4/8] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 4/7] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 1b660c9..31d1138 100644
+index b2322762..967e348c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -684,6 +684,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -32,5 +32,5 @@
  	if (id < 0)
  		return id;
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch b/recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
index 5997f90..f13b609 100644
--- a/recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
@@ -1,7 +1,7 @@
-From dfd7bee7503ff97ba433d40c08c1b45a1a36ddff Mon Sep 17 00:00:00 2001
+From dfee8e4b5b042c1a0c2fa3b9bed6c4d212091813 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Mon, 13 Jun 2022 23:10:26 +0800
-Subject: [PATCH 5/8] mt76: common: RF CR idx require 8 bits
+Subject: [PATCH 5/7] mt76: common: RF CR idx require 8 bits
 
 Change-Id: I95af9cca36052be090be776868822d0a74377c9d
 ---
@@ -9,10 +9,10 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e3123f2..9ba930a 100644
+index d9c9805b..2d6642e6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3440,8 +3440,8 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3442,8 +3442,8 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  		__le32 ofs;
  		__le32 data;
  	} __packed req = {
@@ -24,5 +24,5 @@
  	};
  	struct sk_buff *skb;
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-add-spatial-extension-index-support.patch b/recipes-kernel/linux-mt76/files/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
similarity index 89%
rename from recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-add-spatial-extension-index-support.patch
rename to recipes-kernel/linux-mt76/files/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
index 23083b2..4080c1d 100644
--- a/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-add-spatial-extension-index-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
@@ -1,7 +1,7 @@
-From 66e3f9c0cefaabcb7747f9ac52a92e8912332da9 Mon Sep 17 00:00:00 2001
+From f93eece806a777bea73ab2fcca1869b1b4b87b5c Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 13 Jul 2022 10:43:16 +0800
-Subject: [PATCH 7/8] mt76: mt7915: add spatial extension index support
+Subject: [PATCH 6/7] mt76: mt7915: add spatial extension index support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 43 insertions(+), 14 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index d033655..7b6b3aa 100644
+index 635192c8..0915eb57 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -261,6 +261,17 @@ mt76_connac_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
@@ -37,7 +37,7 @@
  void mt76_connac_power_save_sched(struct mt76_phy *phy,
  				  struct mt76_connac_pm *pm);
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 18dea8e..a9e58cf 100644
+index 34ac3d81..8b7ec64a 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -417,9 +417,6 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
@@ -50,7 +50,7 @@
  	}
  
  	if (info->flags & IEEE80211_TX_CTL_INJECTED) {
-@@ -546,6 +543,14 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+@@ -550,6 +547,14 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
  		val |= FIELD_PREP(MT_TXD6_TX_RATE, rate);
  		txwi[6] |= cpu_to_le32(val);
  		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
@@ -66,10 +66,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e94d670..17e5213 100644
+index f62af7a8..31017218 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -572,7 +572,7 @@ struct sta_rec_ra_fixed {
+@@ -580,7 +580,7 @@ struct sta_rec_ra_fixed {
  
  	struct sta_phy phy;
  
@@ -79,7 +79,7 @@
  	u8 is_5g;
  	u8 mmps_mode;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 36faefb..1ba164a 100644
+index 2557fe08..edd678ce 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -957,9 +957,6 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
@@ -93,7 +93,7 @@
  
  	phy->mt76->antenna_mask = tx_ant;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9ba930a..5fc7a24 100644
+index 2d6642e6..19a33120 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1306,6 +1306,9 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
@@ -125,7 +125,7 @@
  static int
  mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  			       struct ieee80211_vif *vif,
-@@ -1433,7 +1448,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1435,7 +1450,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  			return ret;
  	}
  
@@ -134,7 +134,7 @@
  }
  
  static void
-@@ -2646,6 +2661,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+@@ -2648,6 +2663,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
  	}
  #endif
  
@@ -145,7 +145,7 @@
  	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
  		req.switch_reason = CH_SWITCH_NORMAL;
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 110e4f3..ed94980 100644
+index 110e4f36..ed949802 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -395,6 +395,7 @@ enum {
@@ -157,7 +157,7 @@
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 6c05dfa..35345d3 100644
+index 6c05dfab..35345d35 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -473,8 +473,6 @@ mt7915_tm_update_channel(struct mt7915_phy *phy)
@@ -185,5 +185,5 @@
  
  	mt7915_tm_set_tam_arb(phy, en,
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch b/recipes-kernel/linux-mt76/files/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch
deleted file mode 100644
index 0c413a1..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From d5720c59e760004712e6bcdbdf112f82521fa72b Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Wed, 6 Jul 2022 21:52:45 +0800
-Subject: [PATCH 6/8] mt76: testmode: use random payload for tx packets
-
-Compared to fixed payload packets, random payload packets have better
-measured EVM under the same txpower. Our tests show EVM becomes at least
-3 dB better in test cases with high rate and long tx length, which also
-aligns the testing result of proprietary driver.
-
-Suggested-by: Jm Chen <jm.chen@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- testmode.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/testmode.c b/testmode.c
-index ba9ac2d..1d0d5d3 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -1,5 +1,7 @@
- // SPDX-License-Identifier: ISC
- /* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
-+
-+#include <linux/random.h>
- #include "mt76.h"
- 
- const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
-@@ -123,12 +125,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 	if (!head)
- 		return -ENOMEM;
- 
--	hdr = __skb_put_zero(head, head_len);
-+	hdr = __skb_put_zero(head, sizeof(*hdr));
- 	hdr->frame_control = cpu_to_le16(fc);
- 	memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
- 	memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
- 	memcpy(hdr->addr3, td->addr[2], ETH_ALEN);
- 	skb_set_queue_mapping(head, IEEE80211_AC_BE);
-+	get_random_bytes(__skb_put(head, head_len - sizeof(*hdr)),
-+			 head_len - sizeof(*hdr));
- 
- 	info = IEEE80211_SKB_CB(head);
- 	info->flags = IEEE80211_TX_CTL_INJECTED |
-@@ -154,7 +158,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 			return -ENOMEM;
- 		}
- 
--		__skb_put_zero(frag, frag_len);
-+		get_random_bytes(__skb_put(frag, frag_len), frag_len);
- 		head->len += frag->len;
- 		head->data_len += frag->len;
- 
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch b/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
similarity index 81%
rename from recipes-kernel/linux-mt76/files/patches/0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
rename to recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
index 35595d0..b1eb130 100644
--- a/recipes-kernel/linux-mt76/files/patches/0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
@@ -1,7 +1,7 @@
-From ebe0cc8b9878e72143f0e24fea00ba2b474cdd6b Mon Sep 17 00:00:00 2001
+From 41cd86ee3b09740a84cb1aba54e669aaadcb7d2b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 26 Jul 2022 16:04:53 +0800
-Subject: [PATCH 8/8] mt76: mt7915: set the first antenna to detect radar for
+Subject: [PATCH 7/7] mt76: mt7915: set the first antenna to detect radar for
  MT7915
 
 The default value of listening antenna set by FW might be different in
@@ -15,10 +15,10 @@
  2 files changed, 16 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 31d1138..a1d5c15 100644
+index 967e348c..11d2866b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1817,6 +1817,13 @@ static int mt7915_dfs_start_rdd(struct mt7915_dev *dev, int chain)
+@@ -1820,6 +1820,13 @@ static int mt7915_dfs_start_rdd(struct mt7915_dev *dev, int chain)
  	if (err < 0)
  		return err;
  
@@ -32,7 +32,7 @@
  	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_DET_MODE, chain,
  				       MT_RX_SEL0, 1);
  }
-@@ -1937,6 +1944,14 @@ stop:
+@@ -1940,6 +1947,14 @@ stop:
  	if (err < 0)
  		return err;
  
@@ -48,10 +48,10 @@
  	phy->mt76->dfs_state = MT_DFS_STATE_DISABLED;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 54ef2a1..836a7f1 100644
+index 1eb11617..c90a148d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -359,6 +359,7 @@ enum mt7915_rdd_cmd {
+@@ -357,6 +357,7 @@ enum mt7915_rdd_cmd {
  	RDD_DET_MODE,
  	RDD_RADAR_EMULATE,
  	RDD_START_TXQ = 20,
@@ -60,5 +60,5 @@
  	RDD_CAC_END,
  	RDD_NORMAL_START,
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 990fbfb..b93bc32 100644
--- a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,4 +1,4 @@
-From 6e089768a68a8cc86526d61d34730043fee724af Mon Sep 17 00:00:00 2001
+From dcaf9bdc667b94263fd95971d7a920934a7a1725 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
 Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
@@ -22,10 +22,10 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 17e5213..c7aeae5 100644
+index 31017218..89732676 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1119,6 +1119,12 @@ enum {
+@@ -1127,6 +1127,12 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
@@ -39,7 +39,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index b794ceb..a3474e2 100644
+index b794ceb7..a3474e2f 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -3,7 +3,7 @@
@@ -53,7 +53,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 9f21d97..0cfb606 100644
+index a4e37a52..ea512fd1 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -197,7 +197,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a1d5c15..6b0a527 100644
+index 11d2866b..00218624 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -239,6 +239,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -236,7 +236,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1ba164a..14ba84f 100644
+index edd678ce..48b8be17 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -62,7 +62,11 @@ static int mt7915_start(struct ieee80211_hw *hw)
@@ -252,7 +252,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5fc7a24..b080340 100644
+index 19a33120..e498b61f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -195,6 +195,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -267,7 +267,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3176,6 +3181,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3178,6 +3183,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -276,7 +276,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3451,6 +3458,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3453,6 +3460,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -321,7 +321,7 @@
  {
  	struct {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ed94980..bfb822f 100644
+index ed949802..bfb822fa 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -259,6 +259,10 @@ enum {
@@ -336,7 +336,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 836a7f1..60d489d 100644
+index c90a148d..8990b5b0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -347,7 +347,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -338,6 +339,29 @@ struct mt7915_dev {
+@@ -336,6 +337,29 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -377,7 +377,7 @@
  };
  
  enum {
-@@ -594,4 +618,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -592,4 +616,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -403,7 +403,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 0000000..58ba2cd
+index 00000000..58ba2cdf
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1350 @@
@@ -1759,7 +1759,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..f18c8b6
+index 00000000..f18c8b6c
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,2923 @@
@@ -4688,7 +4688,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 0000000..145fe78
+index 00000000..145fe785
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4744,7 +4744,7 @@
 +				 sizeof(req), true);
 +}
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a10..3d51d9e 100644
+index e5d4a105..3d51d9ec 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
@@ -4858,5 +4858,5 @@
  	return ret;
  }
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index 2e3abe4..d020e94 100644
--- a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,4 +1,4 @@
-From 254614674ffe5c96ae73e0079b8dbb3105b115fb Mon Sep 17 00:00:00 2001
+From 87e6f3e21a575655e449ff2d09a27e3933940842 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
 Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
@@ -17,10 +17,10 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c7aeae5..ede5923 100644
+index 89732676..90bf841e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -971,6 +971,7 @@ enum {
+@@ -979,6 +979,7 @@ enum {
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
@@ -28,7 +28,7 @@
  };
  
  enum {
-@@ -1141,6 +1142,7 @@ enum {
+@@ -1149,6 +1150,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -37,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index a3474e2..e272c82 100644
+index a3474e2f..e272c826 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,9 +1,9 @@
@@ -54,7 +54,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 489f6e7..6efa28f 100644
+index 489f6e77..6efa28fe 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -547,6 +547,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
@@ -132,7 +132,7 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b080340..9d2c813 100644
+index e498b61f..48e9e5ec 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -32,6 +32,10 @@
@@ -158,7 +158,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3458,6 +3467,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3460,6 +3469,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -268,7 +268,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index bfb822f..a27129c 100644
+index bfb822fa..a27129c2 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -480,4 +480,80 @@ enum {
@@ -353,10 +353,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 60d489d..fda264f 100644
+index 8990b5b0..4914c91d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -276,6 +276,20 @@ struct mt7915_phy {
+@@ -274,6 +274,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -377,7 +377,7 @@
  };
  
  struct mt7915_dev {
-@@ -618,6 +632,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -616,6 +630,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -392,7 +392,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
 new file mode 100644
-index 0000000..98fd9c2
+index 00000000..98fd9c2d
 --- /dev/null
 +++ b/mt7915/vendor.c
 @@ -0,0 +1,452 @@
@@ -850,7 +850,7 @@
 +}
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
 new file mode 100644
-index 0000000..9d3db2a
+index 00000000..9d3db2a7
 --- /dev/null
 +++ b/mt7915/vendor.h
 @@ -0,0 +1,60 @@
@@ -915,5 +915,5 @@
 +
 +#endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index 160bb81..e3fd6a0 100644
--- a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From 3199502dabfb1a31cc6741668ce6219fa8d1f1e9 Mon Sep 17 00:00:00 2001
+From 63af0047d060a1e8c7469a7115f9f69920f20ac5 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ede5923..865bbf3 100644
+index 90bf841e..80515382 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1142,6 +1142,8 @@ enum {
+@@ -1150,6 +1150,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,7 +26,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 6b0a527..75e2036 100644
+index 00218624..9f17f0b7 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -486,6 +486,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -41,7 +41,7 @@
  		status->flag |= RX_FLAG_8023;
  	}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 14ba84f..43daa17 100644
+index 48b8be17..c27f9b54 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -675,6 +675,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index fda264f..5551d77 100644
+index 4914c91d..32d66c4c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -231,6 +231,35 @@ struct mt7915_hif {
+@@ -229,6 +229,35 @@ struct mt7915_hif {
  	int irq;
  };
  
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -289,6 +318,8 @@ struct mt7915_phy {
+@@ -287,6 +316,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -636,6 +667,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -634,6 +665,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2..b94d787 100644
+index 98fd9c2d..b94d787e 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,353 @@ out:
@@ -491,7 +491,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a..976817f 100644
+index 9d3db2a7..976817f3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -4,6 +4,7 @@
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 286ae5d..62ecc61 100644
--- a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From cb7c232f28e31db392ffec836c4af9160e13dca1 Mon Sep 17 00:00:00 2001
+From 781871b4690c21e24ba3a86b488efb46aaa402c5 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
@@ -12,7 +12,7 @@
  4 files changed, 47 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6efa28f..37b7b54 100644
+index 6efa28fe..37b7b54a 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -582,6 +582,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9d2c813..f7a3eb1 100644
+index 48e9e5ec..ed789707 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -856,13 +856,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -49,7 +49,7 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a27129c..d3cc828 100644
+index a27129c2..d3cc8283 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -556,4 +556,10 @@ struct csi_data {
@@ -64,7 +64,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f18c8b6..e239df9 100644
+index f18c8b6c..e239df95 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
@@ -115,5 +115,5 @@
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
index 2a22b2a..7b5aabf 100644
--- a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
@@ -1,4 +1,4 @@
-From 076da9e2a0dd1bce87dac8a88cd26cbb77046076 Mon Sep 17 00:00:00 2001
+From 05302c18e285b0dbdc3d0c1ea14819c6be425bb9 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
 Subject: [PATCH 1005/1009] mt76: certification patches
@@ -16,10 +16,10 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 865bbf3..25aeedc 100644
+index 80515382..9fb75e6e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1144,6 +1144,7 @@ enum {
+@@ -1152,6 +1152,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 75e2036..6b3fa4c 100644
+index 9f17f0b7..4d777fd5 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -7,6 +7,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rxv)	((FIELD_GET(field, rxv) - 220) / 2)
  
-@@ -1738,6 +1739,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -1741,6 +1742,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -1760,6 +1776,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -1763,6 +1779,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,7 +76,7 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 43daa17..4e82904 100644
+index c27f9b54..e2f557a2 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -653,6 +653,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -109,10 +109,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f7a3eb1..f692e52 100644
+index ed789707..b4cf4d86 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3572,6 +3572,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3574,6 +3574,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -586,7 +586,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d3cc828..aab1a6a 100644
+index d3cc8283..aab1a6a3 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -396,10 +396,14 @@ enum {
@@ -820,10 +820,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5551d77..267fa7e 100644
+index 32d66c4c..f08974bb 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -664,6 +664,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -662,6 +662,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  #endif
  
  #ifdef CONFIG_MTK_VENDOR
@@ -844,7 +844,7 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e239df9..222268f 100644
+index e239df95..222268fc 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
@@ -869,7 +869,7 @@
         }
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787..7456c57 100644
+index b94d787e..7456c577 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1081,7 +1081,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f..1b08321 100644
+index 976817f3..1b08321c 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -6,6 +6,48 @@
@@ -1134,5 +1134,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
index 652c4e4..76ecbcf 100644
--- a/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
@@ -1,4 +1,4 @@
-From c98da6a8443de7aeb6104de3ddc200253f0ee116 Mon Sep 17 00:00:00 2001
+From 18093d743469680c1ae7b8f91837dc3804cc1756 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Wed, 22 Jun 2022 10:51:59 +0800
 Subject: [PATCH 1006/1009] mt76: mt7915: add L0.5 system error recovery
@@ -8,17 +8,17 @@
  mt7915/debugfs.c |  88 ++++++++++++---
  mt7915/dma.c     |  48 ++++++++
  mt7915/init.c    |   8 +-
- mt7915/mac.c     | 283 +++++++++++++++++++++++++++++++++++++----------
+ mt7915/mac.c     | 281 +++++++++++++++++++++++++++++++++++++----------
  mt7915/main.c    |  19 +++-
  mt7915/mcu.c     |  95 ++++++++++++++--
  mt7915/mcu.h     |   3 +-
  mt7915/mmio.c    |   8 +-
  mt7915/mt7915.h  |  23 ++++
  mt7915/regs.h    |  16 +++
- 10 files changed, 492 insertions(+), 99 deletions(-)
+ 10 files changed, 491 insertions(+), 98 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 0cfb606..07de2ee 100644
+index ea512fd1..0fe95f84 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -52,12 +52,17 @@ static ssize_t
@@ -142,7 +142,7 @@
  	kfree(buff);
  	return ret;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index f7e6bb1..4b594a5 100644
+index f7e6bb10..4b594a53 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -479,6 +479,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -201,7 +201,7 @@
  {
  	mt7915_dma_disable(dev, true);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 37b7b54..141c5ad 100644
+index 37b7b54a..141c5ad8 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
@@ -241,7 +241,7 @@
  
  unreg_thermal:
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 6b3fa4c..e540941 100644
+index 4d777fd5..d44af409 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -3,6 +3,7 @@
@@ -252,7 +252,7 @@
  #include "mt7915.h"
  #include "../dma.h"
  #include "mac.h"
-@@ -1315,85 +1316,187 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+@@ -1318,85 +1319,187 @@ mt7915_update_beacons(struct mt7915_dev *dev)
  		mt7915_update_vif_beacon, mphy_ext->hw);
  }
  
@@ -451,9 +451,6 @@
 -	idr_for_each_entry(&dev->mt76.token, txwi, id) {
 -		mt7915_txwi_free(dev, txwi, NULL, NULL);
 -		dev->mt76.token_count--;
--	}
--	spin_unlock_bh(&dev->mt76.token_lock);
--	idr_destroy(&dev->mt76.token);
 +	ext_phy = dev->mt76.phys[MT_BAND1];
 +	phy2 = ext_phy ? ext_phy->priv : NULL;
 +
@@ -476,7 +473,9 @@
 +	for (i = 0; i < 10; i++) {
 +		if (!mt7915_mac_reset(dev))
 +			break;
-+ 	}
+ 	}
+-	spin_unlock_bh(&dev->mt76.token_lock);
+-	idr_destroy(&dev->mt76.token);
 +	mutex_unlock(&dev->mt76.mutex);
 +
 +	if (i == 10)
@@ -500,7 +499,7 @@
  }
  
  /* system error recovery */
-@@ -1408,6 +1511,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1411,6 +1514,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	ext_phy = dev->mt76.phys[MT_BAND1];
  	phy2 = ext_phy ? ext_phy->priv : NULL;
  
@@ -537,7 +536,7 @@
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
-@@ -1433,7 +1566,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1436,7 +1569,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
@@ -546,7 +545,7 @@
  
  		mt7915_tx_token_put(dev);
  		idr_init(&dev->mt76.token);
-@@ -1482,6 +1615,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1485,6 +1618,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
  					     MT7915_WATCHDOG_TIME);
  }
  
@@ -582,7 +581,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4e82904..7a7ff86 100644
+index e2f557a2..5b25604e 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -20,17 +20,13 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
@@ -632,7 +631,7 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f692e52..5eac6ed 100644
+index b4cf4d86..3f18967a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -150,19 +150,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
@@ -726,7 +725,7 @@
  	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
  	if (seq != rxd->seq)
  		return -EAGAIN;
-@@ -2266,18 +2337,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2268,18 +2339,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  				 sizeof(req), true);
  }
  
@@ -746,7 +745,7 @@
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
  	 */
-@@ -2326,6 +2389,20 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+@@ -2328,6 +2391,20 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
  				 MCU_WA_PARAM_RED, 0, 0);
  }
  
@@ -768,7 +767,7 @@
  {
  	__mt76_mcu_restart(&dev->mt76);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aab1a6a..c485064 100644
+index aab1a6a3..c4850644 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -453,8 +453,9 @@ enum {
@@ -783,7 +782,7 @@
  	SER_SET_RECOVER_L3_RX_ABORT,
  	SER_SET_RECOVER_L3_TX_ABORT,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c81fa09..8469d8f 100644
+index 68d978f4..fd2f70e3 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -24,6 +24,7 @@ static const u32 mt7915_reg[] = {
@@ -810,7 +809,7 @@
  };
  
  static const u32 mt7915_offs[] = {
-@@ -613,10 +616,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+@@ -615,10 +618,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
  		u32 val = mt76_rr(dev, MT_MCU_CMD);
  
  		mt76_wr(dev, MT_MCU_CMD, val);
@@ -824,10 +823,10 @@
  	}
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 267fa7e..d214b18 100644
+index f08974bb..e8feba36 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -352,6 +352,15 @@ struct mt7915_dev {
+@@ -350,6 +350,15 @@ struct mt7915_dev {
  	struct work_struct reset_work;
  	wait_queue_head_t reset_wait;
  	u32 reset_state;
@@ -843,7 +842,7 @@
  
  	struct list_head sta_rc_list;
  	struct list_head sta_poll_list;
-@@ -416,6 +425,12 @@ enum {
+@@ -414,6 +423,12 @@ enum {
  	__MT_WFDMA_MAX,
  };
  
@@ -856,7 +855,7 @@
  enum {
  	MT_RX_SEL0,
  	MT_RX_SEL1,
-@@ -514,6 +529,14 @@ s8 mt7915_eeprom_get_power_delta(struct mt7915_dev *dev, int band);
+@@ -512,6 +527,14 @@ s8 mt7915_eeprom_get_power_delta(struct mt7915_dev *dev, int band);
  int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2);
  void mt7915_dma_prefetch(struct mt7915_dev *dev);
  void mt7915_dma_cleanup(struct mt7915_dev *dev);
@@ -872,7 +871,7 @@
  int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  			       struct mt7915_vif *mvif,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 1687568..3d2c15b 100644
+index 6d9d187a..e2b0ff7d 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -26,6 +26,7 @@ enum reg_rev {
@@ -883,7 +882,7 @@
  	__MT_REG_MAX,
  };
  
-@@ -107,6 +108,11 @@ enum offs_rev {
+@@ -108,6 +109,11 @@ enum offs_rev {
  #define __REG(id)			(dev->reg.reg_rev[(id)])
  #define __OFFS(id)			(dev->reg.offs_rev[(id)])
  
@@ -895,7 +894,7 @@
  /* MCU WFDMA0 */
  #define MT_MCU_WFDMA0_BASE		0x2000
  #define MT_MCU_WFDMA0(ofs)		(MT_MCU_WFDMA0_BASE + (ofs))
-@@ -559,6 +565,10 @@ enum offs_rev {
+@@ -563,6 +569,10 @@ enum offs_rev {
  #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
  #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
  
@@ -906,7 +905,7 @@
  /* WFDMA1 */
  #define MT_WFDMA1_BASE			0xd5000
  #define MT_WFDMA1(ofs)			(MT_WFDMA1_BASE + (ofs))
-@@ -704,6 +714,10 @@ enum offs_rev {
+@@ -708,6 +718,10 @@ enum offs_rev {
  #define MT_MCU_CMD_NORMAL_STATE		BIT(5)
  #define MT_MCU_CMD_ERROR_MASK		GENMASK(5, 1)
  
@@ -917,7 +916,7 @@
  /* TOP RGU */
  #define MT_TOP_RGU_BASE			0x18000000
  #define MT_TOP_PWR_CTRL			(MT_TOP_RGU_BASE + (0x0))
-@@ -979,6 +993,8 @@ enum offs_rev {
+@@ -983,6 +997,8 @@ enum offs_rev {
  #define MT_CPU_UTIL_PEAK_IDLE_CNT	MT_CPU_UTIL(0x0c)
  #define MT_CPU_UTIL_CTRL		MT_CPU_UTIL(0x1c)
  
@@ -927,5 +926,5 @@
  #define MT_LED_TOP_BASE			0x18013000
  #define MT_LED_PHYS(_n)			(MT_LED_TOP_BASE + (_n))
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 04f104d..b7d2f5b 100644
--- a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From 55e3010fdad6c8ad6e24d6502874e6a54bc3e084 Mon Sep 17 00:00:00 2001
+From e937fef1994ae95703ae1920db249a68e7da0549 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1007/1009] mt76: mt7915:add support for runtime set in-band
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5eac6ed..09a130d 100644
+index 3f18967a..a3035597 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2020,8 +2020,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2022,8 +2022,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	u8 *buf, interval;
  	int len;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2056,7 +2055,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2058,7 +2057,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
@@ -33,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index bdcb876..3dcce36 100644
--- a/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From 96aa5b1fd4b17bc3aadeff2d04fb9818aa549639 Mon Sep 17 00:00:00 2001
+From fd62d0e9fb340653b1f5e78f5492848b1e686ea5 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1008/1009] mt76: mt7915: add mt76 vendor muru onoff command
@@ -11,10 +11,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 09a130d..9a7c9d3 100644
+index a3035597..c8c8be49 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3668,6 +3668,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3670,6 +3670,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,7 +29,7 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c485064..0a77ad0 100644
+index c4850644..0a77ad0d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -403,6 +403,7 @@ enum {
@@ -41,7 +41,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7456c57..c755184 100644
+index 7456c577..c7551848 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321..a8e4ebf 100644
+index 1b08321c..a8e4ebf9 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
index 17a7013..b7d2df3 100644
--- a/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,7 +1,7 @@
-From 958bb5b8c333641344dd61cd84ee5402c4d11b32 Mon Sep 17 00:00:00 2001
+From c0238eeeaec21b5f1e0087bec4b6306d3c5aed53 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
+Subject: [PATCH] mt76: mt7915: add fw_version dump
 
 ---
  mt76.h               |  4 ++++
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 94541cd..8e81f40 100644
+index e4a248a1..b5453d35 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -811,6 +811,10 @@ struct mt76_dev {
+@@ -837,6 +837,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,12 +25,12 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 261181d..47b2bce 100644
+index ed6c9ebb..be2a2de1 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2883,6 +2883,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
- 		goto out;
- 	}
+@@ -2889,6 +2889,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+ 		 sizeof(dev->hw->wiphy->fw_version),
+ 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
  
 +	dev->wm_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
 +	memcpy(dev->wm_hdr, hdr, sizeof(*hdr));
@@ -38,7 +38,7 @@
  	release_firmware(fw);
  
  	if (!fw_wa)
-@@ -2908,6 +2911,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2914,6 +2917,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -48,7 +48,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -2978,6 +2984,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -2984,6 +2990,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
@@ -59,7 +59,7 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 222268f..cfd0b30 100644
+index 222268fc..ef0c27d2 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
@@ -70,7 +70,7 @@
 +{
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	struct mt76_dev *mdev = NULL;
-+	seq_printf(s, "Version: 2.2.3.0\n");
++	seq_printf(s, "Version: 2.2.5.0\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
diff --git a/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
index 23b457c..2179d74 100644
--- a/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From b3560ff20a0c83b70bf4e60cf98747fb5115cbe3 Mon Sep 17 00:00:00 2001
+From ee15bb2a93f96ebe3169c9bbda9855da4314d3b4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1111/1121] mt76: testmode: additional supports
+Subject: [PATCH 1111/1124] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -27,7 +27,7 @@
  19 files changed, 1961 insertions(+), 146 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 40cb910..8ea09e6 100644
+index 40cb9109..8ea09e6e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -426,8 +426,7 @@ free:
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index d74300f..e1c3332 100644
+index c5ef5940..f34a93e0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,10 +71,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 8e81f40..d03f312 100644
+index b5453d35..0e4eea16 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -610,6 +610,21 @@ struct mt76_testmode_ops {
+@@ -636,6 +636,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -96,7 +96,7 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -618,16 +633,11 @@ struct mt76_testmode_data {
+@@ -644,16 +659,11 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
@@ -113,7 +113,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -643,10 +653,37 @@ struct mt76_testmode_data {
+@@ -669,10 +679,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -152,7 +152,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1123,6 +1160,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1129,6 +1166,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -212,7 +212,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1133,7 +1223,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1139,7 +1229,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -222,7 +222,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1234,7 +1325,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1240,7 +1331,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -233,10 +233,10 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 47b2bce..e701db8 100644
+index c1ed9fef..36a2914e 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -391,6 +391,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+@@ -393,6 +393,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
  	switch (vif->type) {
  	case NL80211_IFTYPE_MESH_POINT:
  	case NL80211_IFTYPE_AP:
@@ -244,7 +244,7 @@
  		if (vif->p2p)
  			conn_type = CONNECTION_P2P_GC;
  		else
-@@ -572,6 +573,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -574,6 +575,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  	rx->rca2 = 1;
  	rx->rv = 1;
  
@@ -255,10 +255,10 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 25aeedc..cb1e94a 100644
+index 9fb75e6e..9b9878ac 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -967,6 +967,7 @@ enum {
+@@ -975,6 +975,7 @@ enum {
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
@@ -266,7 +266,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1144,6 +1145,7 @@ enum {
+@@ -1152,6 +1153,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -275,7 +275,7 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 141c5ad..538ff5c 100644
+index 141c5ad8..538ff5c3 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -576,7 +576,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -288,7 +288,7 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e540941..f0eefc6 100644
+index d44af409..471d533b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -565,16 +565,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -352,7 +352,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7a7ff86..b5c3c14 100644
+index 5b25604e..ff9fd19d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -224,7 +224,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -365,7 +365,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9a7c9d3..ecdc4fb 100644
+index c8c8be49..ff0e91e5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -434,6 +434,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -388,7 +388,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2824,14 +2830,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2826,14 +2832,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -406,7 +406,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 0a77ad0..ad85e56 100644
+index 0a77ad0d..ad85e56c 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -463,7 +463,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 8469d8f..8d966ef 100644
+index fd2f70e3..088c9f3e 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -76,6 +76,7 @@ static const u32 mt7915_offs[] = {
@@ -474,7 +474,7 @@
  	[AGG_AWSCR0]		= 0x05c,
  	[AGG_PCR0]		= 0x06c,
  	[AGG_ACR0]		= 0x084,
-@@ -150,6 +151,7 @@ static const u32 mt7916_offs[] = {
+@@ -151,6 +152,7 @@ static const u32 mt7916_offs[] = {
  	[ARB_DRNGR0]		= 0x1e0,
  	[ARB_SCR]		= 0x000,
  	[RMAC_MIB_AIRTIME14]	= 0x0398,
@@ -483,10 +483,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d214b18..99f364c 100644
+index e8feba36..798c9337 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -303,6 +303,9 @@ struct mt7915_phy {
+@@ -301,6 +301,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -496,7 +496,7 @@
  	} test;
  #endif
  
-@@ -394,6 +397,14 @@ struct mt7915_dev {
+@@ -392,6 +395,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -511,7 +511,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -572,7 +583,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -570,7 +581,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -520,7 +520,7 @@
  int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -605,6 +616,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -603,6 +614,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -529,7 +529,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 3d2c15b..05ab6d9 100644
+index e2b0ff7d..d7f71033 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -45,6 +45,7 @@ enum offs_rev {
@@ -540,7 +540,7 @@
  	AGG_AWSCR0,
  	AGG_PCR0,
  	AGG_ACR0,
-@@ -461,6 +462,8 @@ enum offs_rev {
+@@ -462,6 +463,8 @@ enum offs_rev {
  #define MT_WF_AGG_BASE(_band)		((_band) ? 0x820f2000 : 0x820e2000)
  #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
  
@@ -550,7 +550,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 35345d3..bc4cd80 100644
+index 35345d35..bc4cd809 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1881,7 +1881,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c8..01b08e9 100644
+index a1c54c89..01b08e9e 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2196,7 +2196,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1d0d5d3..7a9ed54 100644
+index 1d0d5d30..7a9ed543 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2663,7 +2663,7 @@
  		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
  		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 8961326..57949f2 100644
+index 89613266..57949f2b 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2768,7 +2768,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f6908..6e36ab2 100644
+index e3f69089..6e36ab27 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2894,7 +2894,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 65e2b7c..8b33186 100644
+index 65e2b7c1..8b33186b 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
@@ -2908,5 +2908,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch b/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
index 7ecdd8b..6d942c4 100644
--- a/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 3e0328c381fcaaa6e5fcf50494934c770d9ade49 Mon Sep 17 00:00:00 2001
+From a000ed0273b915b24a5fe83b19b85b8a9f8a45ef Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1112/1121] mt76: testmode: add pre-cal support
+Subject: [PATCH 1112/1124] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 1e41b94..e083964 100644
+index 25f67760..4c50bfe6 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,10 +37,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index d03f312..0ed4188 100644
+index 0e4eea16..b28fe32f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -611,6 +611,7 @@ struct mt76_testmode_ops {
+@@ -637,6 +637,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -49,10 +49,10 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index cb1e94a..9789380 100644
+index 9b9878ac..cb06827c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -963,6 +963,7 @@ enum {
+@@ -971,6 +971,7 @@ enum {
  
  /* ext event table */
  enum {
@@ -61,7 +61,7 @@
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 7578ac6..b980342 100644
+index 7578ac6d..b980342c 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
@@ -114,7 +114,7 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ecdc4fb..42b1abc 100644
+index ff0e91e5..d7e6df50 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -438,6 +438,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -127,7 +127,7 @@
  #endif
  	default:
  		break;
-@@ -2925,7 +2928,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2927,7 +2930,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -136,7 +136,7 @@
  		return 0;
  
  	/*
-@@ -3005,11 +3008,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3007,11 +3010,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 99f364c..fc0621e 100644
+index 798c9337..dfef078b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -381,6 +381,10 @@ struct mt7915_dev {
+@@ -379,6 +379,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -617,6 +621,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -615,6 +619,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index bc4cd80..7a49608 100644
+index bc4cd809..7a49608c 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -666,7 +666,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9..d500987 100644
+index 01b08e9e..d500987d 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -734,7 +734,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index 7a9ed54..82b8e98 100644
+index 7a9ed543..82b8e983 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -767,7 +767,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 57949f2..e2190e7 100644
+index 57949f2b..e2190e72 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -823,7 +823,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 6e36ab2..1be1ffd 100644
+index 6e36ab27..1be1ffd6 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
@@ -842,5 +842,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-kernel/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
new file mode 100644
index 0000000..7f8b21b
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
@@ -0,0 +1,243 @@
+From eefd860e1bf33fd7a222a999a8cb8eb631150952 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 12 Sep 2022 18:16:54 +0800
+Subject: [PATCH 1113/1124] mt76: testmode: add iBF command mode support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
+---
+ mt7915/testmode.c | 21 ++++++++++++++-------
+ testmode.c        | 41 +++++++++++++++++++++++++++++++++++++++++
+ testmode.h        |  2 ++
+ tools/fields.c    | 28 ++++++++++++++++++++++++++++
+ 4 files changed, 85 insertions(+), 7 deletions(-)
+
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 7a49608c..0a58ad97 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	struct ieee80211_vif *vif = phy->monitor_vif;
+ 	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
+ 	u8 pfmu_idx = val[0], nc = val[2], nr;
++	bool is_atenl = val[6];
+ 	int ret;
+ 
+ 	if (td->tx_antenna_mask == 3)
+@@ -748,7 +749,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (!ebf)
++	if (!ebf && is_atenl)
+ 		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
+ 
+ 	return 0;
+@@ -775,7 +776,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 		.group_l_m_n = val[1],
+ 		.sx2 = val[2],
+ 		.cal_type = val[3],
+-		.lna_gain_level = 0, /* for test purpose */
++		.lna_gain_level = val[4],
+ 	};
+ 	struct mt7915_tm_txbf_phase *phase =
+ 		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
+@@ -814,6 +815,8 @@ int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
+ 			phase = &phase[cal->group];
+ 			memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
+ 			phase->status = cal->status;
++			/* for passing iTest script */
++			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
+ 			break;
+ 		case IBF_PHASE_CAL_VERIFY:
+ 		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
+@@ -865,7 +868,6 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 	pfmu_data->phi11 = cpu_to_le16(phi11);
+ 	pfmu_data->phi21 = cpu_to_le16(phi21);
+ 	pfmu_data->phi31 = cpu_to_le16(phi31);
+-
+ 	if (subc_id == 63) {
+ 		struct mt7915_dev *dev = phy->dev;
+ 		struct {
+@@ -923,8 +925,8 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	u16 *val = td->txbf_param;
+ 
+-	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u\n",
+-		td->txbf_act, val[0], val[1], val[2], val[3], val[4]);
++	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
++		td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5]);
+ 
+ 	switch (td->txbf_act) {
+ 	case MT76_TM_TXBF_ACT_INIT:
+@@ -942,10 +944,17 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ 		return mt7915_tm_txbf_profile_update(phy, val, true);
+ 	case MT76_TM_TXBF_ACT_PHASE_CAL:
+ 		return mt7915_tm_txbf_phase_cal(phy, val);
++	case MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD:
+ 	case MT76_TM_TXBF_ACT_PROF_UPDATE_ALL:
+ 		return mt7915_tm_txbf_profile_update_all(phy, val);
+ 	case MT76_TM_TXBF_ACT_E2P_UPDATE:
+ 		return mt7915_tm_txbf_e2p_update(phy);
++	case MT76_TM_TXBF_ACT_APPLY_TX: {
++		u16 wlan_idx = val[0];
++		bool ebf = !!val[1], ibf = !!val[2], phase_cal = !!val[4];
++
++		return mt7915_tm_txbf_apply_tx(phy, wlan_idx, ebf, ibf, phase_cal);
++	}
+ 	default:
+ 		break;
+ 	};
+@@ -1071,7 +1080,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+ 		rate.legacy = sband->bitrates[rate.mcs].bitrate;
+ 		break;
+ 	case MT76_TM_TX_MODE_HT:
+-		rate.mcs += rate.nss * 8;
+ 		flags |= RATE_INFO_FLAGS_MCS;
+ 
+ 		if (td->tx_rate_sgi)
+@@ -1435,7 +1443,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 			if (duty_cycle < 100)
+ 				tx_time = duty_cycle * ipg / (100 - duty_cycle);
+ 		}
+-
+ 		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
+ 		mt7915_tm_set_tx_len(phy, tx_time);
+ 
+diff --git a/testmode.c b/testmode.c
+index 82b8e983..aa874a83 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -530,6 +530,42 @@ out:
+ 	return err;
+ }
+ 
++static int
++mt76_testmode_txbf_profile_update_all_cmd(struct mt76_phy *phy, struct nlattr **tb, u32 state)
++{
++#define PARAM_UNIT	5
++	static u8 pfmu_idx;
++	struct mt76_testmode_data *td = &phy->test;
++	struct mt76_dev *dev = phy->dev;
++	struct nlattr *cur;
++	u16 tmp_val[PARAM_UNIT], *val = td->txbf_param;
++	int idx, rem, ret, i = 0;
++
++	memset(td->txbf_param, 0, sizeof(td->txbf_param));
++	nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
++		if (nla_len(cur) != 2)
++			return -EINVAL;
++		idx = i % PARAM_UNIT;
++		tmp_val[idx] = nla_get_u16(cur);
++		if (idx == 1 && (tmp_val[idx] == 0xf0 || tmp_val[idx] == 0xff)) {
++			pfmu_idx = tmp_val[0];
++			return 0;
++		}
++		if (idx == PARAM_UNIT - 1) {
++			val[0] = pfmu_idx;
++			memcpy(val + 1, tmp_val, sizeof(tmp_val));
++			if (dev->test_ops->set_params) {
++				ret = dev->test_ops->set_params(phy, tb, state);
++				if (ret)
++					return ret;
++			}
++		}
++		i++;
++	}
++
++	return 0;
++}
++
+ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      void *data, int len)
+ {
+@@ -668,6 +704,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		    0, MT76_TM_TXBF_ACT_MAX))
+ 			goto out;
+ 
++		if (td->txbf_act == MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD) {
++			err = mt76_testmode_txbf_profile_update_all_cmd(phy, tb, state);
++			goto out;
++		}
++
+ 		memset(td->txbf_param, 0, sizeof(td->txbf_param));
+ 		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
+ 			if (nla_len(cur) != 2 ||
+diff --git a/testmode.h b/testmode.h
+index e2190e72..5d1fe793 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
+ 	MT76_TM_TXBF_ACT_TX_PREP,
+ 	MT76_TM_TXBF_ACT_IBF_PROF_UPDATE,
+ 	MT76_TM_TXBF_ACT_EBF_PROF_UPDATE,
++	MT76_TM_TXBF_ACT_APPLY_TX,
+ 	MT76_TM_TXBF_ACT_PHASE_CAL,
+ 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
++	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
+ 	MT76_TM_TXBF_ACT_E2P_UPDATE,
+ 
+ 	/* keep last */
+diff --git a/tools/fields.c b/tools/fields.c
+index 1be1ffd6..47fc69f9 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
+ 	[MT76_TM_TX_MODE_HE_MU] = "he_mu",
+ };
+ 
++static const char * const testmode_txbf_act[] = {
++	[MT76_TM_TXBF_ACT_INIT] = "init",
++	[MT76_TM_TXBF_ACT_UPDATE_CH] = "update_ch",
++	[MT76_TM_TXBF_ACT_PHASE_COMP] = "phase_comp",
++	[MT76_TM_TXBF_ACT_TX_PREP] = "tx_prep",
++	[MT76_TM_TXBF_ACT_IBF_PROF_UPDATE] = "ibf_prof_update",
++	[MT76_TM_TXBF_ACT_EBF_PROF_UPDATE] = "ebf_prof_update",
++	[MT76_TM_TXBF_ACT_APPLY_TX] = "apply_tx",
++	[MT76_TM_TXBF_ACT_PHASE_CAL] = "phase_cal",
++	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL] = "prof_update",
++	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD] = "prof_update_all",
++	[MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
++};
++
+ static void print_enum(const struct tm_field *field, struct nlattr *attr)
+ {
+ 	unsigned int i = nla_get_u8(attr);
+@@ -82,6 +96,17 @@ static void print_s8(const struct tm_field *field, struct nlattr *attr)
+ 	printf("%d", (int8_t)nla_get_u8(attr));
+ }
+ 
++static bool parse_u16_hex(const struct tm_field *field, int idx,
++			  struct nl_msg *msg, const char *val)
++{
++	return !nla_put_u16(msg, idx, strtoul(val, NULL, 16));
++}
++
++static void print_u16_hex(const struct tm_field *field, struct nlattr *attr)
++{
++	printf("%d", nla_get_u16(attr));
++}
++
+ static bool parse_u32(const struct tm_field *field, int idx,
+ 		      struct nl_msg *msg, const char *val)
+ {
+@@ -384,6 +409,8 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+ 	FIELD(u8, AID, "aid"),
+ 	FIELD(u8, RU_ALLOC, "ru_alloc"),
+ 	FIELD(u8, RU_IDX, "ru_idx"),
++	FIELD_ENUM(TXBF_ACT, "txbf_act", testmode_txbf_act),
++	FIELD_ARRAY(u16_hex, TXBF_PARAM, "txbf_param"),
+ 	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
+ 	FIELD_NESTED_RO(STATS, stats, "",
+ 			.print_extra = print_extra_stats),
+@@ -414,6 +441,7 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+ 	[MT76_TM_ATTR_RU_ALLOC] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
++	[MT76_TM_ATTR_TXBF_ACT] = { .type = NLA_U8 },
+ };
+ 
+ const struct tm_field msg_field = {
+-- 
+2.25.1
+
diff --git a/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
similarity index 82%
rename from recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
rename to recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 52e5e75..d5857d7 100644
--- a/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,14 +1,14 @@
-From f5924783a8130cf8f53613ffaec44a1e116dae3f Mon Sep 17 00:00:00 2001
+From fbf7d08a95e8138cb192543bbb275d4504797e66 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1113/1121] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1114/1124] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b5c3c14..551e909 100644
+index ff9fd19d..ba1b3e4b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
similarity index 74%
rename from recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
rename to recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index a4b9ab2..fb89274 100644
--- a/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From 6d7bba2a1a4d4757db3348df9486b8c55a8a5ecf Mon Sep 17 00:00:00 2001
+From e39367c6182ae57baa2ff67b69535d0754c650ef Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1114/1121] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1115/1124] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 42b1abc..eb53095 100644
+index d7e6df50..431dd37f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3556,7 +3556,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3558,7 +3558,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
@@ -24,5 +24,5 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1115-mt76-airtime-fairness-feature-off-in-mac80211.patch b/recipes-kernel/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
similarity index 69%
rename from recipes-kernel/linux-mt76/files/patches/1115-mt76-airtime-fairness-feature-off-in-mac80211.patch
rename to recipes-kernel/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
index b343205..c4c820a 100644
--- a/recipes-kernel/linux-mt76/files/patches/1115-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,17 +1,17 @@
-From 7ddf213d8c16bdea7827905e3e6c43f80beb26fd Mon Sep 17 00:00:00 2001
+From 4ae7e72fc778ee60267520bec667967e8a47f68b Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1115/1121] mt76: airtime fairness feature off in mac80211
+Subject: [PATCH 1116/1124] mt76: airtime fairness feature off in mac80211
 
 ---
  mac80211.c | 1 -
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index e1c3332..2f0605d 100644
+index f34a93e0..4eaf317b 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -428,7 +428,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
+@@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
  			WIPHY_FLAG_AP_UAPSD;
  
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
@@ -20,5 +20,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
similarity index 91%
rename from recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
rename to recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index 1f5c089..c1b5440 100644
--- a/recipes-kernel/linux-mt76/files/patches/1116-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 45b37195f796ce6f2d7ef6969e47447007aa50de Mon Sep 17 00:00:00 2001
+From 5c423096aae12eb90d5959f43f3286004f4fb97f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1116/1121] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1117/1124] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4b1a981..ee3049e 100644
+index 4b1a9811..ee3049e5 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index b980342..fb9fbfe 100644
+index b980342c..fb9fbfe2 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index eb53095..9d1dea2 100644
+index 431dd37f..f649bcaf 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2926,7 +2926,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2928,7 +2928,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2964,9 +2965,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2966,9 +2967,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2974,34 +2975,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2976,34 +2977,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3033,24 +3069,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3035,24 +3071,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
similarity index 94%
rename from recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-phy-capability-vendor-command.patch
rename to recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
index 89c8ebf..178c694 100644
--- a/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From ee5d960cf8e4d524eb5ceb5ae8a65a8bfd58b28e Mon Sep 17 00:00:00 2001
+From 119142ef3be4457a975d7ca109e44bfac5bed444 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1117/1121] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1118/1124] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index fc0621e..99796d7 100644
+index dfef078b..432f0b8a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c755184..77d71e4 100644
+index c7551848..77d71e48 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf..719b851 100644
+index a8e4ebf9..719b851f 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch b/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
similarity index 92%
rename from recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
rename to recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
index 2495a1b..e1ecea1 100644
--- a/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
@@ -1,7 +1,7 @@
-From 7e582ea905e034e2d834d415a1889c66d2269d0b Mon Sep 17 00:00:00 2001
+From 2043d4b7cd46412f5a480c6b8f8c4c1d4a0801f9 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1118/1121] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1119/1124] mt76: mt7915: add vendor subcmd EDCCA ctrl
 
 Change-Id: I92dabf8be9c5a7ecec78f35325bc5645af8d15ab
 ---
@@ -15,10 +15,10 @@
  7 files changed, 138 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9789380..2162a4a 100644
+index cb06827c..683d8542 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1148,6 +1148,7 @@ enum {
+@@ -1156,6 +1156,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -27,7 +27,7 @@
  };
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 551e909..c287de3 100644
+index ba1b3e4b..192b0a9b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -456,6 +456,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -41,10 +41,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9d1dea2..1f45d1a 100644
+index f649bcaf..7e6102b8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4251,3 +4251,41 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -4253,3 +4253,41 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -87,7 +87,7 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ad85e56..b8a433e 100644
+index ad85e56c..b8a433e5 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -789,4 +789,16 @@ enum {
@@ -108,10 +108,10 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 99796d7..730b91b 100644
+index 432f0b8a..439d071a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -725,6 +725,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -723,6 +723,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -121,7 +121,7 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e4..5a28a55 100644
+index 77d71e48..5a28a554 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,17 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -209,7 +209,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851..83c41bc 100644
+index 719b851f..83c41bc1 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -10,8 +10,27 @@ enum mtk_nl80211_vendor_subcmds {
@@ -241,5 +241,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-implement-bin-file-mode.patch b/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
similarity index 93%
rename from recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-implement-bin-file-mode.patch
rename to recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
index 6233dad..afd47c2 100644
--- a/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From dbd3c04007801a0ea439218e7850a42a06d9f2a3 Mon Sep 17 00:00:00 2001
+From 79ddf246652c86dbda37aa94526497b791ec8246 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1119/1121] mt76: mt7915: implement bin file mode
+Subject: [PATCH 1120/1124] mt76: mt7915: implement bin file mode
 
 Change-Id: I2a726341541a11cbecdb210b33a8e79aefbd6cf3
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -13,7 +13,7 @@
  4 files changed, 71 insertions(+), 11 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index e083964..5b9faf7 100644
+index 4c50bfe6..baca86fd 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -42,10 +42,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 0ed4188..4a41949 100644
+index b28fe32f..e997908a 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1009,6 +1009,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1015,6 +1015,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -54,7 +54,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index ee3049e..e5cfa5b 100644
+index ee3049e5..e5cfa5b0 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -46,26 +46,36 @@ static char *mt7915_eeprom_name(struct mt7915_dev *dev)
@@ -148,7 +148,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 730b91b..78f0b18 100644
+index 439d071a..6fe3191d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -51,6 +51,15 @@
@@ -167,7 +167,7 @@
  #define MT7915_EEPROM_SIZE		3584
  #define MT7916_EEPROM_SIZE		4096
  
-@@ -375,6 +384,7 @@ struct mt7915_dev {
+@@ -373,6 +382,7 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -176,5 +176,5 @@
  	bool ibf;
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-initialize-wcid.patch b/recipes-kernel/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch
similarity index 78%
rename from recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-initialize-wcid.patch
rename to recipes-kernel/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch
index 2172868..ceead53 100644
--- a/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 7f7b35a036ad9b53f5a53a0728eb8a095eef5c8c Mon Sep 17 00:00:00 2001
+From cf4ded769fa58acd2d98f3a795bb8663456c114f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1120/1121] mt76 mt7915 initialize wcid
+Subject: [PATCH 1121/1124] mt76 mt7915 initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,7 +9,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f0eefc6..7c11e28 100644
+index 471d533b..0631ad2c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -965,7 +965,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1121-mt76-HEMU-Add-dump-support.patch b/recipes-kernel/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch
similarity index 91%
rename from recipes-kernel/linux-mt76/files/patches/1121-mt76-HEMU-Add-dump-support.patch
rename to recipes-kernel/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch
index 2733e03..0051b6a 100644
--- a/recipes-kernel/linux-mt76/files/patches/1121-mt76-HEMU-Add-dump-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch
@@ -1,7 +1,7 @@
-From 40e89a6e3147b39899aeecc6c14c8b5046bc1b26 Mon Sep 17 00:00:00 2001
+From 7e1d446505177bebaeeac17e10f622d1f612f1e3 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1121/1121] mt76: HEMU: Add dump support
+Subject: [PATCH 1122/1124] mt76: HEMU: Add dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 27 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5a28a55..7acb330 100644
+index 5a28a554..7acb3304 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -61,7 +61,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 83c41bc..57f52f3 100644
+index 83c41bc1..57f52f3a 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -58,6 +58,7 @@ enum mtk_vendor_attr_hemu_ctrl {
@@ -73,5 +73,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-kernel/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
similarity index 93%
rename from recipes-kernel/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
rename to recipes-kernel/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 9a786d7..264fcad 100644
--- a/recipes-kernel/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,7 +1,8 @@
-From 516fcbdf41f48d71d814caaffb9e50b88778cd17 Mon Sep 17 00:00:00 2001
+From ee8f75888527b8f7114d5ac3f946a9acd21f9aa4 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 30 Aug 2022 15:29:38 +0800
-Subject: [PATCH] mt76: mt7915: add vendor subcmd three wire (PTA) ctrl
+Subject: [PATCH 1123/1124] mt76: mt7915: add vendor subcmd three wire (PTA)
+ ctrl
 
 Change-Id: Ie092d63af9a1e06bef36fc5a5bac40fdab73dba5
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -15,10 +16,10 @@
  6 files changed, 108 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 2162a4a..b777d95 100644
+index 683d8542..4cdfadc7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1147,7 +1147,7 @@ enum {
+@@ -1155,7 +1155,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -28,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1f45d1a..6931f2a 100644
+index 7e6102b8..8d74275d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4017,37 +4017,34 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4019,37 +4019,34 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,7 +95,7 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b8a433e..9d0fac4 100644
+index b8a433e5..9d0fac47 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -576,6 +576,35 @@ struct csi_data {
@@ -134,10 +135,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 78f0b18..e8ac75e 100644
+index 6fe3191d..3fcedba5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -727,6 +727,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -725,6 +725,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +147,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7acb330..7f67c0d 100644
+index 7acb3304..7f67c0d3 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -220,7 +221,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 57f52f3..e0c5fd9 100644
+index 57f52f3a..e0c5fd94 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,6 +11,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -250,5 +251,5 @@
  enum mtk_capi_control_changed {
  	CAPI_RFEATURE_CHANGED		= BIT(16),
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1123-mt76-add-ibf-control-vendor-cmd.patch b/recipes-kernel/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
old mode 100755
new mode 100644
similarity index 95%
rename from recipes-kernel/linux-mt76/files/patches/1123-mt76-add-ibf-control-vendor-cmd.patch
rename to recipes-kernel/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
index 6473cb6..d1992a2
--- a/recipes-kernel/linux-mt76/files/patches/1123-mt76-add-ibf-control-vendor-cmd.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From bb8f76430a25f016c63a62f8b1ae5995398911ef Mon Sep 17 00:00:00 2001
+From c0f1432186c58fd534715d347d4693660a3fa1fe Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH] [PATCH 1123] mt76: add ibf control vendor cmd
+Subject: [PATCH 1124/1124] mt76: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 94 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7f67c0d..cbbb084 100644
+index 7f67c0d3..cbbb0843 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -78,6 +78,16 @@ edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
@@ -105,7 +105,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index e0c5fd9..5aac559 100644
+index e0c5fd94..5aac5595 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,7 +11,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -146,5 +146,5 @@
 +
  #endif
 -- 
-2.32.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
index c7843f1..b5b407c 100644
--- a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From 3049935f79f524aa6984ccfa97075df4b1aadb41 Mon Sep 17 00:00:00 2001
+From a46e93efedae595b85fec8295e16641c2de183fb Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sun, 12 Jun 2022 16:38:45 +0800
-Subject: [PATCH 3001/3006] mt76 add wed tx support
+Subject: [PATCH 3001/3007] mt76 add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -12,13 +12,13 @@
  mt7915/mcu.c    |   2 +-
  mt7915/mmio.c   | 110 +++++++++++++++++++++++++++++++++++++++++++++++-
  mt7915/mt7915.h |   2 +
- mt7915/pci.c    |  72 +------------------------------
+ mt7915/pci.c    |  93 +---------------------------------------
  mt7915/regs.h   |  15 +++++++
  mt7915/soc.c    |  16 +++++--
- 10 files changed, 193 insertions(+), 97 deletions(-)
+ 10 files changed, 193 insertions(+), 118 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 7b6b3aa..f71ded8 100644
+index 0915eb57..9a468878 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -30,7 +30,7 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 4b594a5..ac30698 100644
+index 4b594a53..ac30698f 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -11,7 +11,10 @@ mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc, int ring_base
@@ -144,7 +144,7 @@
  			return ret;
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 7c11e28..0a13b7d 100644
+index 0631ad2c..b1788fb8 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -826,9 +826,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -160,10 +160,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c287de3..b77b3be 100644
+index 192b0a9b..3a09f3f5 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1439,14 +1439,19 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1456,14 +1456,19 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -186,10 +186,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6931f2a..a041bb2 100644
+index 8d74275d..f5caa326 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2377,7 +2377,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2379,7 +2379,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -199,7 +199,7 @@
  
  	ret = mt7915_mcu_set_mwds(dev, 1);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 8d966ef..b0d8a61 100644
+index 088c9f3e..11c90772 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -10,6 +10,9 @@
@@ -212,7 +212,7 @@
  static const u32 mt7915_reg[] = {
  	[INT_SOURCE_CSR]	= 0xd7010,
  	[INT_MASK_CSR]		= 0xd7014,
-@@ -541,7 +544,11 @@ void mt7915_dual_hif_set_irq_mask(struct mt7915_dev *dev,
+@@ -543,7 +546,11 @@ void mt7915_dual_hif_set_irq_mask(struct mt7915_dev *dev,
  	mdev->mmio.irqmask |= set;
  
  	if (write_reg) {
@@ -225,7 +225,7 @@
  		mt76_wr(dev, MT_INT1_MASK_CSR, mdev->mmio.irqmask);
  	}
  
-@@ -565,6 +572,8 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+@@ -567,6 +574,8 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
  
  	if (mtk_wed_device_active(wed)) {
  		mtk_wed_device_irq_set_mask(wed, 0);
@@ -234,7 +234,7 @@
  		intr = mtk_wed_device_irq_get(wed, dev->mt76.mmio.irqmask);
  	} else {
  		mt76_wr(dev, MT_INT_MASK_CSR, 0);
-@@ -646,6 +655,105 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
+@@ -648,6 +657,105 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
  	return IRQ_HANDLED;
  }
  
@@ -341,10 +341,10 @@
  				     void __iomem *mem_base, u32 device_id)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e8ac75e..e329f74 100644
+index 3fcedba5..1c78b882 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -536,6 +536,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
+@@ -534,6 +534,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
  {
  }
  #endif
@@ -354,7 +354,7 @@
  				     void __iomem *mem_base, u32 device_id);
  void mt7915_wfsys_reset(struct mt7915_dev *dev);
 diff --git a/mt7915/pci.c b/mt7915/pci.c
-index d74f609..c5da01a 100644
+index 728a879c..c5da01a9 100644
 --- a/mt7915/pci.c
 +++ b/mt7915/pci.c
 @@ -12,9 +12,6 @@
@@ -367,7 +367,7 @@
  static LIST_HEAD(hif_list);
  static DEFINE_SPINLOCK(hif_lock);
  static u32 hif_idx;
-@@ -95,73 +92,6 @@ static int mt7915_pci_hif2_probe(struct pci_dev *pdev)
+@@ -95,94 +92,6 @@ static int mt7915_pci_hif2_probe(struct pci_dev *pdev)
  	return 0;
  }
  
@@ -375,6 +375,7 @@
 -static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
 -{
 -	struct mt7915_dev *dev;
+-	struct mt7915_phy *phy;
 -	int ret;
 -
 -	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
@@ -388,18 +389,38 @@
 -	if (!ret)
 -		return -EAGAIN;
 -
+-	phy = &dev->phy;
+-	mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
+-
+-	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
+-	if (phy)
+-		mt76_set(dev, MT_AGG_ACR4(phy->band_idx),
+-			 MT_AGG_ACR_PPDU_TXS2H);
+-
 -	return 0;
 -}
 -
 -static void mt7915_wed_offload_disable(struct mtk_wed_device *wed)
 -{
 -	struct mt7915_dev *dev;
+-	struct mt7915_phy *phy;
 -
 -	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
 -
 -	spin_lock_bh(&dev->mt76.token_lock);
 -	dev->mt76.token_size = MT7915_TOKEN_SIZE;
 -	spin_unlock_bh(&dev->mt76.token_lock);
+-
+-	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
+-	 * MT_AGG_ACR_PPDU_TXS2H (PPDU format) even though ACR bit is set.
+-	 */
+-	phy = &dev->phy;
+-	mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
+-
+-	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
+-	if (phy)
+-		mt76_clear(dev, MT_AGG_ACR4(phy->band_idx),
+-			   MT_AGG_ACR_PPDU_TXS2H);
 -}
 -#endif
 -
@@ -441,7 +462,7 @@
  static int mt7915_pci_probe(struct pci_dev *pdev,
  			    const struct pci_device_id *id)
  {
-@@ -199,7 +129,7 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
+@@ -220,7 +129,7 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
  	mt7915_wfsys_reset(dev);
  	hif2 = mt7915_pci_init_hif2(pdev);
  
@@ -451,10 +472,10 @@
  		goto free_wed_or_irq_vector;
  
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 05ab6d9..432ed30 100644
+index d7f71033..51eb553c 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -617,6 +617,7 @@ enum offs_rev {
+@@ -621,6 +621,7 @@ enum offs_rev {
  #define MT_PCIE_RECOG_ID_MASK		GENMASK(30, 0)
  #define MT_PCIE_RECOG_ID_SEM		BIT(31)
  
@@ -462,7 +483,7 @@
  #define MT_INT_WED_MASK_CSR		MT_WFDMA_EXT_CSR(0x204)
  
  #define MT_WED_TX_RING_BASE		MT_WFDMA_EXT_CSR(0x300)
-@@ -663,6 +664,13 @@ enum offs_rev {
+@@ -667,6 +668,13 @@ enum offs_rev {
  #define MT_TXQ_EXT_CTRL(q)		(MT_Q_BASE(__TXQ(q)) + 0x600 +	\
  					 MT_TXQ_ID(q)* 0x4)
  
@@ -476,7 +497,7 @@
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
  
-@@ -681,6 +689,11 @@ enum offs_rev {
+@@ -685,6 +693,11 @@ enum offs_rev {
  #define MT_INT_RX_DONE_WA_MAIN_MT7916	BIT(2)
  #define MT_INT_RX_DONE_WA_EXT_MT7916	BIT(3)
  
@@ -488,7 +509,7 @@
  #define MT_INT_RX(q)			(dev->q_int_mask[__RXQ(q)])
  #define MT_INT_TX_MCU(q)		(dev->q_int_mask[(q)])
  
-@@ -704,6 +717,8 @@ enum offs_rev {
+@@ -708,6 +721,8 @@ enum offs_rev {
  #define MT_INT_TX_DONE_BAND0		BIT(30)
  #define MT_INT_TX_DONE_BAND1		BIT(31)
  #define MT_INT_TX_DONE_MCU_WA_MT7916	BIT(25)
@@ -498,7 +519,7 @@
  #define MT_INT_TX_DONE_MCU		(MT_INT_TX_MCU(MT_MCUQ_WA) |	\
  					 MT_INT_TX_MCU(MT_MCUQ_WM) |	\
 diff --git a/mt7915/soc.c b/mt7915/soc.c
-index 3618718..8d0b206 100644
+index 3618718d..8d0b2068 100644
 --- a/mt7915/soc.c
 +++ b/mt7915/soc.c
 @@ -1171,10 +1171,6 @@ static int mt7986_wmac_probe(struct platform_device *pdev)
@@ -539,5 +560,5 @@
  
  	return ret;
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-wds-support.patch b/recipes-kernel/linux-mt76/files/patches/3002-add-wed-tx-wds-support-on-mt7986.patch
old mode 100755
new mode 100644
similarity index 76%
rename from recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-wds-support.patch
rename to recipes-kernel/linux-mt76/files/patches/3002-add-wed-tx-wds-support-on-mt7986.patch
index aa7f160..752add2
--- a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-wds-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3002-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,22 +1,22 @@
-From f9508e4fbb8e78c849d27394c99295319ccf8a28 Mon Sep 17 00:00:00 2001
+From 33e8b84542a2d58af377c6e74eaeefbd7f29146c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
-Subject: [PATCH] 3001-add-wed-tx-wds-support-on-mt7986
+Subject: [PATCH 3002/3007] add-wed-tx-wds-support-on-mt7986
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  mac80211.c      |  5 ++++-
  mt76.h          |  2 ++
  mt7915/init.c   |  9 +++++++++
- mt7915/main.c   | 47 +++++++++++++++++++++++++++++++++++++++++++----
+ mt7915/main.c   | 52 +++++++++++++++++++++++++++++++++++++++++++------
  mt7915/mcu.c    | 12 ++++++++++--
  mt7915/mcu.h    |  1 +
- mt7915/mmio.c   |  1 +
+ mt7915/mmio.c   |  3 +++
  mt7915/mt7915.h |  4 ++++
- 8 files changed, 74 insertions(+), 7 deletions(-)
+ 8 files changed, 79 insertions(+), 9 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 4eaf317..c477d62 100644
+index 4eaf317b..c477d625 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1360,7 +1360,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
@@ -32,10 +32,10 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index 4a41949..b7da992 100644
+index e997908a..ec9bd59d 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -426,6 +426,7 @@ struct mt76_driver_ops {
+@@ -453,6 +453,7 @@ struct mt76_driver_ops {
  
  	void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta);
@@ -43,7 +43,7 @@
  };
  
  struct mt76_channel_state {
-@@ -800,6 +801,7 @@ struct mt76_dev {
+@@ -826,6 +827,7 @@ struct mt76_dev {
  	spinlock_t status_lock;
  
  	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
@@ -52,7 +52,7 @@
  
  	u64 vif_mask;
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 538ff5c..cd9d846 100644
+index 538ff5c3..cd9d846d 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -695,6 +695,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -72,7 +72,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b77b3be..144718e 100644
+index 3a09f3f5..b1fb3ddf 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -120,7 +120,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1107,6 +1135,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1124,6 +1152,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -135,16 +135,22 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1449,9 +1485,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
- 	/* fw will find the wcid by dest addr */
- 	if(is_mt7915(&dev->mt76))
- 		path->mtk_wdma.wcid = 0xff;
+@@ -1463,12 +1499,16 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	path->dev = ctx->dev;
+ 	path->mtk_wdma.wdma_idx = wed->wdma_idx;
+ 	path->mtk_wdma.bss = mvif->mt76.idx;
+-	/* fw will find the wcid by dest addr */
+-	if(is_mt7915(&dev->mt76))
+-		path->mtk_wdma.wcid = 0xff;
 -	else
 -		path->mtk_wdma.wcid = 0x3ff;
--
-+	else {
-+		if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags))
-+			path->mtk_wdma.wcid = msta->wcid.idx;
+ 
++	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
++		path->mtk_wdma.wcid = msta->wcid.idx;
++	} else {
++		/* fw will find the wcid by dest addr */
++		if(is_mt7915(&dev->mt76))
++			path->mtk_wdma.wcid = 0xff;
 +		else
 +			path->mtk_wdma.wcid = 0x3ff;
 +	}
@@ -152,10 +158,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a041bb2..73efa55 100644
+index f5caa326..21167f00 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2348,6 +2348,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2350,6 +2350,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  int mt7915_run_firmware(struct mt7915_dev *dev)
  {
  	int ret;
@@ -163,7 +169,7 @@
  
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
-@@ -2377,8 +2378,15 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2379,8 +2380,15 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -182,7 +188,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9d0fac4..1f56db6 100644
+index 9d0fac47..1f56db6b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -268,6 +268,7 @@ enum {
@@ -194,10 +200,19 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b0d8a61..de797fd 100644
+index 11c90772..6df039a7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -774,6 +774,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -736,6 +736,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+ 	/* disable dynamic tx token */
+ 	wed->wlan.offload_enable = mt7915_wed_offload_enable;
+ 	wed->wlan.offload_disable = mt7915_wed_offload_disable;
++	if (!is_mt7915(mdev))
++		wed->wlan.wcid_512 = true;
+ 
+ 	if (mtk_wed_device_attach(wed) != 0)
+ 		return 0;
+@@ -776,6 +778,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  		.sta_add = mt7915_mac_sta_add,
  		.sta_remove = mt7915_mac_sta_remove,
  		.update_survey = mt7915_update_channel,
@@ -206,7 +221,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e329f74..33c00af 100644
+index 1c78b882..486c203c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -219,7 +234,7 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -699,6 +702,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -697,6 +700,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
@@ -228,5 +243,5 @@
  void mt7915_stats_work(struct work_struct *work);
  int mt76_dfs_start_rdd(struct mt7915_dev *dev, bool force);
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch b/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
similarity index 90%
rename from recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
rename to recipes-kernel/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
index 4b7c349..d07d072 100644
--- a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
@@ -1,7 +1,7 @@
-From 3516b23f9acad60c44a13119e42636f92ca9d9a2 Mon Sep 17 00:00:00 2001
+From dfbef22fdf1a3e29f9d3c00a50083a02c69e8ad1 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 5 Jul 2022 19:42:55 +0800
-Subject: [PATCH 3002/3006] mt76 add wed rx support
+Subject: [PATCH 3003/3007] mt76 add wed rx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -17,19 +17,18 @@
  mt76x02.h         |   2 +-
  mt76x02_txrx.c    |   2 +-
  mt7915/dma.c      |  25 +++--
- mt7915/mac.c      | 103 ++++++++++++++++++-
+ mt7915/mac.c      | 101 ++++++++++++++++++-
  mt7915/mcu.c      |   3 +
  mt7915/mmio.c     |  26 ++++-
  mt7915/mt7915.h   |   7 +-
  mt7915/regs.h     |  14 ++-
  mt7921/mac.c      |   2 +-
- mt7921/mt7921.h   |   4 +-
- mt7921/pci_mac.c  |   4 +-
+ mt7921/mt7921.h   |   2 +-
  tx.c              |  34 +++++++
- 21 files changed, 460 insertions(+), 75 deletions(-)
+ 20 files changed, 456 insertions(+), 71 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 8ea09e6..3317d2b 100644
+index 8ea09e6e..3317d2b9 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -98,6 +98,63 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
@@ -480,7 +479,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 diff --git a/dma.h b/dma.h
-index fdf786f..90370d1 100644
+index fdf786f9..90370d12 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -16,6 +16,16 @@
@@ -501,7 +500,7 @@
  #define MT_RX_INFO_LEN			4
  #define MT_FCE_INFO_LEN			4
 diff --git a/mac80211.c b/mac80211.c
-index 4eaf317..731b78f 100644
+index c477d625..4a8d8d8d 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -599,11 +599,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -532,7 +531,7 @@
  
  	mt76_rx_complete(dev, &frames, napi);
 diff --git a/mt76.h b/mt76.h
-index b7da992..20fd0ec 100644
+index ec9bd59d..f19433d4 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -20,6 +20,8 @@
@@ -560,7 +559,7 @@
  };
  
  struct mt76_bus_ops {
-@@ -313,7 +317,10 @@ struct mt76_txwi_cache {
+@@ -339,7 +343,10 @@ struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
  
@@ -572,7 +571,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -411,7 +418,7 @@ struct mt76_driver_ops {
+@@ -438,7 +445,7 @@ struct mt76_driver_ops {
  	bool (*rx_check)(struct mt76_dev *dev, void *data, int len);
  
  	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
@@ -581,7 +580,7 @@
  
  	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
  
-@@ -757,6 +764,7 @@ struct mt76_dev {
+@@ -783,6 +790,7 @@ struct mt76_dev {
  	struct ieee80211_hw *hw;
  
  	spinlock_t lock;
@@ -589,7 +588,7 @@
  	spinlock_t cc_lock;
  
  	u32 cur_cc_bss_rx;
-@@ -782,6 +790,7 @@ struct mt76_dev {
+@@ -808,6 +816,7 @@ struct mt76_dev {
  	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
  
  	struct list_head txwi_cache;
@@ -597,7 +596,7 @@
  	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
  	struct mt76_queue q_rx[__MT_RXQ_MAX];
  	const struct mt76_queue_ops *queue_ops;
-@@ -795,6 +804,9 @@ struct mt76_dev {
+@@ -821,6 +830,9 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -607,7 +606,7 @@
  
  	wait_queue_head_t tx_wait;
  	/* spinclock used to protect wcid pktid linked list */
-@@ -1359,6 +1371,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1365,6 +1377,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -616,7 +615,7 @@
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1503,6 +1517,12 @@ struct mt76_txwi_cache *
+@@ -1509,6 +1523,12 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -630,7 +629,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9..2ff71c5 100644
+index 590cff9d..2ff71c53 100644
 --- a/mt7603/dma.c
 +++ b/mt7603/dma.c
 @@ -69,7 +69,7 @@ free:
@@ -643,7 +642,7 @@
  	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d9..f2ce22a 100644
+index 0fd46d90..f2ce22ae 100644
 --- a/mt7603/mt7603.h
 +++ b/mt7603/mt7603.h
 @@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -656,7 +655,7 @@
  void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7615/mac.c b/mt7615/mac.c
-index d6aae60..4774eaa 100644
+index d6aae60c..4774eaab 100644
 --- a/mt7615/mac.c
 +++ b/mt7615/mac.c
 @@ -1651,7 +1651,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -669,7 +668,7 @@
  	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 060d52c..232b0f2 100644
+index 060d52c8..232b0f29 100644
 --- a/mt7615/mt7615.h
 +++ b/mt7615/mt7615.h
 @@ -511,7 +511,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
@@ -682,10 +681,10 @@
  int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index e701db8..6ae1159 100644
+index 36a2914e..290e9711 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -1190,6 +1190,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+@@ -1192,6 +1192,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
  			   int cmd, bool enable, bool tx)
  {
  	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
@@ -693,7 +692,7 @@
  	struct wtbl_req_hdr *wtbl_hdr;
  	struct tlv *sta_wtbl;
  	struct sk_buff *skb;
-@@ -1210,6 +1211,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+@@ -1212,6 +1213,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
  	mt76_connac_mcu_wtbl_ba_tlv(dev, skb, params, enable, tx, sta_wtbl,
  				    wtbl_hdr);
  
@@ -702,7 +701,7 @@
  	ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
  	if (ret)
  		return ret;
-@@ -1220,6 +1223,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+@@ -1222,6 +1225,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
  
  	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
  
@@ -711,7 +710,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
-@@ -2634,6 +2639,7 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -2636,6 +2641,7 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			    struct mt76_wcid *wcid, enum set_key_cmd cmd)
  {
  	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
@@ -719,7 +718,7 @@
  	struct sk_buff *skb;
  	int ret;
  
-@@ -2645,6 +2651,9 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -2647,6 +2653,9 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -730,7 +729,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
 diff --git a/mt76x02.h b/mt76x02.h
-index f76fd22..0b872af 100644
+index f76fd22e..0b872af1 100644
 --- a/mt76x02.h
 +++ b/mt76x02.h
 @@ -173,7 +173,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
@@ -743,7 +742,7 @@
  irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
  void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
 diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 96fdf42..bf24d3e 100644
+index 96fdf423..bf24d3e0 100644
 --- a/mt76x02_txrx.c
 +++ b/mt76x02_txrx.c
 @@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
@@ -756,7 +755,7 @@
  	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
  	void *rxwi = skb->data;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index ac30698..197a016 100644
+index ac30698f..197a0169 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -349,6 +349,7 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
@@ -827,7 +826,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
  				       MT_RXQ_ID(MT_RXQ_BAND1),
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0a13b7d..4e1dfc9 100644
+index b1788fb8..4e0c3ec4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -217,7 +217,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -839,15 +838,6 @@
  {
  	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
  	struct mt76_phy *mphy = &dev->mt76.phy;
-@@ -234,7 +234,7 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
- 	bool unicast, insert_ccmp_hdr = false;
- 	u8 remove_pad, amsdu_info;
- 	u8 mode = 0, qos_ctl = 0;
--	struct mt7915_sta *msta;
-+	struct mt7915_sta *msta = NULL;
- 	bool hdr_trans;
- 	u16 hdr_gap;
- 	u16 seq_ctrl = 0;
 @@ -494,6 +494,27 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
  #endif
  	} else {
@@ -957,7 +947,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1107,7 +1202,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
+@@ -1110,7 +1205,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
  }
  
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -966,7 +956,7 @@
  {
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
-@@ -1141,7 +1236,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1144,7 +1239,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		dev_kfree_skb(skb);
  		break;
  	case PKT_TYPE_NORMAL:
@@ -976,10 +966,10 @@
  			return;
  		}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 73efa55..22f68da 100644
+index 21167f00..aa8bcf70 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1722,6 +1722,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1724,6 +1724,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta, bool enable)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -987,7 +977,7 @@
  	struct mt7915_sta *msta;
  	struct sk_buff *skb;
  	int ret;
-@@ -1774,6 +1775,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1776,6 +1777,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		return ret;
  	}
  out:
@@ -997,7 +987,7 @@
  				     MCU_EXT_CMD(STA_REC_UPDATE), true);
  }
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b0d8a61..111444d 100644
+index 6df039a7..6e07311d 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -28,6 +28,9 @@ static const u32 mt7915_reg[] = {
@@ -1030,7 +1020,7 @@
  };
  
  static const u32 mt7915_offs[] = {
-@@ -710,6 +719,7 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -712,6 +721,7 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
  		wed->wlan.wpdma_int = base + MT_INT_WED_SOURCE_CSR;
  		wed->wlan.wpdma_mask = base + MT_INT_WED_MASK_CSR;
@@ -1038,7 +1028,7 @@
  	} else {
  		struct platform_device *plat_dev;
  		struct resource *res;
-@@ -722,12 +732,19 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -724,12 +734,19 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  		wed->wlan.wpdma_int = base + MT_INT_SOURCE_CSR;
  		wed->wlan.wpdma_mask = base + MT_INT_MASK_CSR;
  	}
@@ -1058,9 +1048,9 @@
  	wed->wlan.nbuf = 7168;
  	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
  	wed->wlan.init_buf = mt7915_wed_init_buf;
-@@ -735,12 +752,15 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
- 	wed->wlan.offload_enable = mt7915_wed_offload_enable;
- 	wed->wlan.offload_disable = mt7915_wed_offload_disable;
+@@ -739,12 +756,15 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+ 	if (!is_mt7915(mdev))
+ 		wed->wlan.wcid_512 = true;
  
 +	wed->wlan.rx_nbuf = 65536;
 +	wed->wlan.rx_pkt_size = MTK_WED_RX_PKT_SIZE;
@@ -1078,7 +1068,7 @@
  	dev->mt76.dma_dev = wed->dev;
  	mdev->token_size = wed->wlan.token_start;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 33c00af..b805aae 100644
+index 486c203c..2da2ff8b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -81,6 +81,7 @@
@@ -1089,7 +1079,7 @@
  
  struct mt7915_vif;
  struct mt7915_sta;
-@@ -547,7 +548,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -545,7 +546,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -1100,7 +1090,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -700,7 +703,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -698,7 +701,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1110,7 +1100,7 @@
  bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 432ed30..36ef8a9 100644
+index 51eb553c..dcb40181 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -27,6 +27,9 @@ enum reg_rev {
@@ -1123,7 +1113,7 @@
  	__MT_REG_MAX,
  };
  
-@@ -564,9 +567,13 @@ enum offs_rev {
+@@ -568,9 +571,13 @@ enum offs_rev {
  #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
  
  #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
@@ -1137,7 +1127,7 @@
  
  #define MT_WFDMA0_MCU_HOST_INT_ENA	MT_WFDMA0(0x1f4)
  #define MT_WFDMA0_MT_WA_WDT_INT		BIT(31)
-@@ -664,12 +671,15 @@ enum offs_rev {
+@@ -668,12 +675,15 @@ enum offs_rev {
  #define MT_TXQ_EXT_CTRL(q)		(MT_Q_BASE(__TXQ(q)) + 0x600 +	\
  					 MT_TXQ_ID(q)* 0x4)
  
@@ -1156,11 +1146,11 @@
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
 diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 1374c15..275f367 100644
+index 9c82ec24..6b631a64 100644
 --- a/mt7921/mac.c
 +++ b/mt7921/mac.c
-@@ -555,7 +555,7 @@ out:
- EXPORT_SYMBOL_GPL(mt7921_mac_add_txs);
+@@ -680,7 +680,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
+ EXPORT_SYMBOL_GPL(mt7921_rx_check);
  
  void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
 -			 struct sk_buff *skb)
@@ -1169,51 +1159,20 @@
  	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index c161031..0a1f035 100644
+index eaba114a..54a30ca1 100644
 --- a/mt7921/mt7921.h
 +++ b/mt7921/mt7921.h
-@@ -381,7 +381,7 @@ int mt7921e_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- void mt7921_tx_worker(struct mt76_worker *w);
+@@ -408,7 +408,7 @@ void mt7921_tx_worker(struct mt76_worker *w);
  void mt7921_tx_token_put(struct mt7921_dev *dev);
+ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len);
  void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
 -			 struct sk_buff *skb);
 +			 struct sk_buff *skb, u32 info);
  void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  void mt7921_stats_work(struct work_struct *work);
  void mt7921_set_stream_he_caps(struct mt7921_phy *phy);
-@@ -417,7 +417,7 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
- 
- bool mt7921e_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7921e_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb);
-+			  struct sk_buff *skb, u32 info);
- int mt7921e_driver_own(struct mt7921_dev *dev);
- int mt7921e_mac_reset(struct mt7921_dev *dev);
- int mt7921e_mcu_init(struct mt7921_dev *dev);
-diff --git a/mt7921/pci_mac.c b/mt7921/pci_mac.c
-index e180067..ca982eb 100644
---- a/mt7921/pci_mac.c
-+++ b/mt7921/pci_mac.c
-@@ -182,7 +182,7 @@ bool mt7921e_rx_check(struct mt76_dev *mdev, void *data, int len)
- }
- 
- void mt7921e_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb)
-+			  struct sk_buff *skb, u32 info)
- {
- 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-@@ -196,7 +196,7 @@ void mt7921e_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
- 		napi_consume_skb(skb, 1);
- 		break;
- 	default:
--		mt7921_queue_rx_skb(mdev, q, skb);
-+		mt7921_queue_rx_skb(mdev, q, skb, info);
- 		break;
- 	}
- }
 diff --git a/tx.c b/tx.c
-index 8b33186..b812d06 100644
+index 8b33186b..b812d067 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -778,3 +778,37 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
@@ -1255,5 +1214,5 @@
 +}
 +EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch b/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
similarity index 77%
rename from recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
rename to recipes-kernel/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
index 7f0674a..ef9724f 100644
--- a/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
@@ -1,7 +1,7 @@
-From 2edbd3a1fc221674535ecd5addad6342adb4c73e Mon Sep 17 00:00:00 2001
+From 72230221dbb07d547dba931b7b3787cbebb2125a Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3003/3006] mt76: add fill receive path to report wed idx
+Subject: [PATCH 3004/3007] mt76: add fill receive path to report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 29ee700..0f872f5 100644
+index b1fb3ddf..fcf122cf 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1476,6 +1476,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1515,6 +1515,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -37,7 +37,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1527,5 +1545,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1566,5 +1584,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
@@ -45,5 +45,5 @@
  #endif
  };
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-ser-spport-when-wed-on.patch b/recipes-kernel/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
similarity index 92%
rename from recipes-kernel/linux-mt76/files/patches/3004-mt76-add-ser-spport-when-wed-on.patch
rename to recipes-kernel/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
index 11f84cc..cee9fe0 100644
--- a/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-ser-spport-when-wed-on.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
@@ -1,7 +1,7 @@
-From f7539f063a354671a7e8b9d769c77fd936e09f96 Mon Sep 17 00:00:00 2001
+From c3c6234cc24fd9b57bb0d57b194252d533f5f012 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 28 Jul 2022 11:16:15 +0800
-Subject: [PATCH 3004/3006] mt76 add ser spport when wed on
+Subject: [PATCH 3005/3007] mt76 add ser spport when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 76 insertions(+), 15 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 3317d2b..fa56ccf 100644
+index 3317d2b9..fa56ccfb 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -169,7 +169,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -109,7 +109,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 90370d1..083cbca 100644
+index 90370d12..083cbca4 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -58,5 +58,5 @@ enum mt76_mcu_evt_type {
@@ -120,10 +120,10 @@
 +int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
  #endif
 diff --git a/mt76.h b/mt76.h
-index fb3ae86..2ad3900 100644
+index f19433d4..9b00f53c 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1372,6 +1372,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1379,6 +1379,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,7 +132,7 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 197a016..e0a5131 100644
+index 197a0169..e0a51316 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -522,6 +522,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -203,7 +203,7 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 4e1dfc9..5b68492 100644
+index 4e0c3ec4..0cd9cad9 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -916,6 +916,8 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -234,7 +234,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1662,6 +1676,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1665,6 +1679,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -248,10 +248,10 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 111444d..1ccec14 100644
+index 6e07311d..0edea0d3 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -757,6 +757,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -761,6 +761,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
  
@@ -261,10 +261,10 @@
  	if (mtk_wed_device_attach(wed) != 0)
  		return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b10b90a..b4c8cdf 100644
+index 2da2ff8b..a4872451 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -551,6 +551,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -549,6 +549,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
@@ -273,5 +273,5 @@
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch b/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch
deleted file mode 100644
index b13a5e4..0000000
--- a/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch
+++ /dev/null
@@ -1,476 +0,0 @@
-From 369397e8762832dc633ade7407852acb235fd4aa Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
-Date: Thu, 21 Jul 2022 10:56:09 -0700
-Subject: [PATCH 3005/3006] mt76: mt7915: add statistic for H/W Tx Path
-
-Set PPDU_TXS2H_EN_B0/B1 to get PPDU txs.
-Add MT_PACKET_ID_WED for PPDU txs, and change MT_PACKET_ID_FIRST to 3
-to differentiate. We also need do byte cnt and pkt cnt for S/W path since
-we report it directly from mt7915_sta_statistics.
----
- mt76.h             | 49 ++++++++++++++++-------------
- mt76_connac.h      |  5 +--
- mt76_connac2_mac.h | 14 +++++++++
- mt76_connac_mac.c  | 77 +++++++++++++++++++++++++++++-----------------
- mt7915/mac.c       | 12 ++++----
- mt7915/main.c      | 16 +++++++++-
- mt7915/mmio.c      | 22 +++++++++++++
- mt7915/mt7915.h    |  2 --
- mt7915/regs.h      |  4 +++
- mt7921/mt7921.h    |  1 -
- 10 files changed, 141 insertions(+), 61 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index 2ad3900..c6f3ef7 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -275,6 +275,30 @@ DECLARE_EWMA(signal, 10, 8);
- #define MT_WCID_TX_INFO_TXPWR_ADJ	GENMASK(25, 18)
- #define MT_WCID_TX_INFO_SET		BIT(31)
- 
-+enum mt76_phy_type {
-+	MT_PHY_TYPE_CCK,
-+	MT_PHY_TYPE_OFDM,
-+	MT_PHY_TYPE_HT,
-+	MT_PHY_TYPE_HT_GF,
-+	MT_PHY_TYPE_VHT,
-+	MT_PHY_TYPE_HE_SU = 8,
-+	MT_PHY_TYPE_HE_EXT_SU,
-+	MT_PHY_TYPE_HE_TB,
-+	MT_PHY_TYPE_HE_MU,
-+	__MT_PHY_TYPE_HE_MAX,
-+};
-+
-+struct mt76_sta_stats {
-+	u64 tx_mode[__MT_PHY_TYPE_HE_MAX];
-+	u64 tx_bw[4];		/* 20, 40, 80, 160 */
-+	u64 tx_nss[4];		/* 1, 2, 3, 4 */
-+	u64 tx_mcs[16];		/* mcs idx */
-+	u64 tx_bytes;
-+	u32 tx_packets;
-+	u32 tx_retries;
-+	u32 tx_failed;
-+};
-+
- struct mt76_wcid {
- 	struct mt76_rx_tid __rcu *aggr[IEEE80211_NUM_TIDS];
- 
-@@ -303,6 +327,8 @@ struct mt76_wcid {
- 
- 	struct list_head list;
- 	struct idr pktid;
-+
-+	struct mt76_sta_stats stats;
- };
- 
- struct mt76_txq {
-@@ -349,7 +375,8 @@ struct mt76_rx_tid {
- #define MT_PACKET_ID_MASK		GENMASK(6, 0)
- #define MT_PACKET_ID_NO_ACK		0
- #define MT_PACKET_ID_NO_SKB		1
--#define MT_PACKET_ID_FIRST		2
-+#define MT_PACKET_ID_WED		2
-+#define MT_PACKET_ID_FIRST		3
- #define MT_PACKET_ID_HAS_RATE		BIT(7)
- /* This is timer for when to give up when waiting for TXS callback,
-  * with starting time being the time at which the DMA_DONE callback
-@@ -875,26 +902,6 @@ struct mt76_power_limits {
- 	s8 ru[7][12];
- };
- 
--enum mt76_phy_type {
--	MT_PHY_TYPE_CCK,
--	MT_PHY_TYPE_OFDM,
--	MT_PHY_TYPE_HT,
--	MT_PHY_TYPE_HT_GF,
--	MT_PHY_TYPE_VHT,
--	MT_PHY_TYPE_HE_SU = 8,
--	MT_PHY_TYPE_HE_EXT_SU,
--	MT_PHY_TYPE_HE_TB,
--	MT_PHY_TYPE_HE_MU,
--	__MT_PHY_TYPE_HE_MAX,
--};
--
--struct mt76_sta_stats {
--	u64 tx_mode[__MT_PHY_TYPE_HE_MAX];
--	u64 tx_bw[4];		/* 20, 40, 80, 160 */
--	u64 tx_nss[4];		/* 1, 2, 3, 4 */
--	u64 tx_mcs[16];		/* mcs idx */
--};
--
- struct mt76_ethtool_worker_info {
- 	u64 *data;
- 	int idx;
-diff --git a/mt76_connac.h b/mt76_connac.h
-index f71ded8..4a43838 100644
---- a/mt76_connac.h
-+++ b/mt76_connac.h
-@@ -366,9 +366,10 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- 				 struct sk_buff *skb, struct mt76_wcid *wcid,
- 				 struct ieee80211_key_conf *key, int pid,
- 				 enum mt76_txq_id qid, u32 changed);
-+bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
-+				   __le32 *txs_data, struct mt76_sta_stats *stats);
- bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
--				  int pid, __le32 *txs_data,
--				  struct mt76_sta_stats *stats);
-+				  int pid, __le32 *txs_data);
- void mt76_connac2_mac_decode_he_radiotap(struct mt76_dev *dev,
- 					 struct sk_buff *skb,
- 					 __le32 *rxv, u32 mode);
-diff --git a/mt76_connac2_mac.h b/mt76_connac2_mac.h
-index 67ce216..c7064ba 100644
---- a/mt76_connac2_mac.h
-+++ b/mt76_connac2_mac.h
-@@ -123,6 +123,12 @@ enum {
- /* VHT/HE only use bits 0-3 */
- #define MT_TX_RATE_IDX			GENMASK(5, 0)
- 
-+enum {
-+	MT_TXS_MPDU_FM0,
-+	MT_TXS_MPDU_FM1,
-+	MT_TXS_PPDU_FM
-+};
-+
- #define MT_TXS0_FIXED_RATE		BIT(31)
- #define MT_TXS0_BW			GENMASK(30, 29)
- #define MT_TXS0_TID			GENMASK(28, 26)
-@@ -158,6 +164,14 @@ enum {
- 
- #define MT_TXS4_TIMESTAMP		GENMASK(31, 0)
- 
-+/* PPDU based */
-+#define MT_TXS5_MPDU_TX_BYTE		GENMASK(22, 0)
-+#define MT_TXS5_MPDU_TX_CNT		GENMASK(31, 23)
-+
-+#define MT_TXS6_MPDU_FAIL_CNT		GENMASK(31, 23)
-+
-+#define MT_TXS7_MPDU_RETRY_CNT		GENMASK(31, 23)
-+
- /* RXD DW1 */
- #define MT_RXD1_NORMAL_WLAN_IDX		GENMASK(9, 0)
- #define MT_RXD1_NORMAL_GROUP_1		BIT(11)
-diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index a9e58cf..af265d9 100644
---- a/mt76_connac_mac.c
-+++ b/mt76_connac_mac.c
-@@ -487,6 +487,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- 		p_fmt = mt76_is_mmio(dev) ? MT_TX_TYPE_CT : MT_TX_TYPE_SF;
- 		q_idx = wmm_idx * MT76_CONNAC_MAX_WMM_SETS +
- 			mt76_connac_lmac_mapping(skb_get_queue_mapping(skb));
-+
-+		wcid->stats.tx_bytes += skb->len;
-+		wcid->stats.tx_packets++;
- 	}
- 
- 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len + sz_txd) |
-@@ -555,35 +558,26 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- }
- EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
- 
--bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
--				  int pid, __le32 *txs_data,
--				  struct mt76_sta_stats *stats)
-+bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
-+				   __le32 *txs_data, struct mt76_sta_stats *stats)
- {
- 	struct ieee80211_supported_band *sband;
- 	struct mt76_phy *mphy;
--	struct ieee80211_tx_info *info;
--	struct sk_buff_head list;
- 	struct rate_info rate = {};
--	struct sk_buff *skb;
- 	bool cck = false;
- 	u32 txrate, txs, mode;
- 
--	mt76_tx_status_lock(dev, &list);
--	skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
--	if (!skb)
--		goto out;
--
- 	txs = le32_to_cpu(txs_data[0]);
--
--	info = IEEE80211_SKB_CB(skb);
--	if (!(txs & MT_TXS0_ACK_ERROR_MASK))
--		info->flags |= IEEE80211_TX_STAT_ACK;
--
--	info->status.ampdu_len = 1;
--	info->status.ampdu_ack_len = !!(info->flags &
--					IEEE80211_TX_STAT_ACK);
--
--	info->status.rates[0].idx = -1;
-+	if (FIELD_GET(MT_TXS0_TXS_FORMAT, txs) == MT_TXS_PPDU_FM) {
-+		stats->tx_bytes +=
-+			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_BYTE);
-+		stats->tx_packets +=
-+			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_CNT);
-+		stats->tx_failed +=
-+			le32_get_bits(txs_data[6], MT_TXS6_MPDU_FAIL_CNT);
-+		stats->tx_retries +=
-+			le32_get_bits(txs_data[7], MT_TXS7_MPDU_RETRY_CNT);
-+	}
- 
- 	txrate = FIELD_GET(MT_TXS0_TX_RATE, txs);
- 
-@@ -618,7 +612,7 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
- 	case MT_PHY_TYPE_HT:
- 	case MT_PHY_TYPE_HT_GF:
- 		if (rate.mcs > 31)
--			goto out;
-+			return false;
- 
- 		rate.flags = RATE_INFO_FLAGS_MCS;
- 		if (wcid->rate.flags & RATE_INFO_FLAGS_SHORT_GI)
-@@ -626,7 +620,7 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
- 		break;
- 	case MT_PHY_TYPE_VHT:
- 		if (rate.mcs > 9)
--			goto out;
-+			return false;
- 
- 		rate.flags = RATE_INFO_FLAGS_VHT_MCS;
- 		break;
-@@ -635,14 +629,14 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
- 	case MT_PHY_TYPE_HE_TB:
- 	case MT_PHY_TYPE_HE_MU:
- 		if (rate.mcs > 11)
--			goto out;
-+			return false;
- 
- 		rate.he_gi = wcid->rate.he_gi;
- 		rate.he_dcm = FIELD_GET(MT_TX_RATE_DCM, txrate);
- 		rate.flags = RATE_INFO_FLAGS_HE_MCS;
- 		break;
- 	default:
--		goto out;
-+		return false;
- 	}
- 
- 	stats->tx_mode[mode]++;
-@@ -667,10 +661,37 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
- 	}
- 	wcid->rate = rate;
- 
--out:
--	if (skb)
--		mt76_tx_status_skb_done(dev, skb, &list);
-+	return true;
-+}
-+EXPORT_SYMBOL_GPL(mt76_connac2_mac_fill_txs);
-+
-+bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
-+				  int pid, __le32 *txs_data)
-+{
-+	struct mt76_sta_stats *stats = &wcid->stats;
-+	struct sk_buff_head list;
-+	struct sk_buff *skb;
-+
-+	if (pid < MT_PACKET_ID_FIRST)
-+		return false;
- 
-+	mt76_tx_status_lock(dev, &list);
-+	skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
-+	if (skb) {
-+		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+
-+		if (!(le32_to_cpu(txs_data[0]) & MT_TXS0_ACK_ERROR_MASK))
-+			info->flags |= IEEE80211_TX_STAT_ACK;
-+
-+		info->status.rates[0].idx = -1;
-+		info->status.ampdu_len = 1;
-+		info->status.ampdu_ack_len = !!(info->flags &
-+						IEEE80211_TX_STAT_ACK);
-+		stats->tx_failed += !(info->flags & IEEE80211_TX_STAT_ACK);
-+
-+		mt76_connac2_mac_fill_txs(dev, wcid, txs_data, stats);
-+		mt76_tx_status_skb_done(dev, skb, &list);
-+	}
- 	mt76_tx_status_unlock(dev, &list);
- 
- 	return !!skb;
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5b68492..63c702e 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -1153,13 +1153,10 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
- 	u16 wcidx;
- 	u8 pid;
- 
--	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
--		return;
--
- 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
- 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
- 
--	if (pid < MT_PACKET_ID_FIRST)
-+	if (pid < MT_PACKET_ID_WED)
- 		return;
- 
- 	if (wcidx >= mt7915_wtbl_size(dev))
-@@ -1173,8 +1170,11 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
- 
- 	msta = container_of(wcid, struct mt7915_sta, wcid);
- 
--	mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data,
--				     &msta->stats);
-+	if (pid == MT_PACKET_ID_WED)
-+		mt76_connac2_mac_fill_txs(&dev->mt76, wcid, txs_data,
-+					  &msta->wcid.stats);
-+	else
-+		mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
- 	if (!wcid->sta)
- 		goto out;
- 
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 0f872f5..b7c6cf6 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -1049,6 +1049,20 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
- 	}
- 	sinfo->txrate.flags = txrate->flags;
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
-+
-+	if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) {
-+		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
-+
-+		sinfo->tx_packets = msta->wcid.stats.tx_packets;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
-+
-+		sinfo->tx_failed = msta->wcid.stats.tx_failed;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
-+
-+		sinfo->tx_retries = msta->wcid.stats.tx_retries;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
-+	}
- }
- 
- static void mt7915_sta_rc_work(void *data, struct ieee80211_sta *sta)
-@@ -1271,7 +1285,7 @@ static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
- 	if (msta->vif->mt76.idx != wi->idx)
- 		return;
- 
--	mt76_ethtool_worker(wi, &msta->stats);
-+	mt76_ethtool_worker(wi, &msta->wcid.stats);
- }
- 
- static
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 1ccec14..bb2d1c4 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -92,6 +92,7 @@ static const u32 mt7915_offs[] = {
- 	[AGG_AWSCR0]		= 0x05c,
- 	[AGG_PCR0]		= 0x06c,
- 	[AGG_ACR0]		= 0x084,
-+	[AGG_ACR4]		= 0x08C,
- 	[AGG_MRCR]		= 0x098,
- 	[AGG_ATCR1]		= 0x0f0,
- 	[AGG_ATCR3]		= 0x0f4,
-@@ -167,6 +168,7 @@ static const u32 mt7916_offs[] = {
- 	[AGG_AWSCR0]		= 0x030,
- 	[AGG_PCR0]		= 0x040,
- 	[AGG_ACR0]		= 0x054,
-+	[AGG_ACR4]		= 0x05C,
- 	[AGG_MRCR]		= 0x068,
- 	[AGG_ATCR1]		= 0x1a8,
- 	[AGG_ATCR3]		= 0x080,
-@@ -668,9 +670,12 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
- static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
- {
- 	struct mt7915_dev *dev;
-+	struct mt7915_phy *phy;
- 	int ret;
- 
- 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	if (!dev)
-+		return -EINVAL;
- 
- 	spin_lock_bh(&dev->mt76.token_lock);
- 	dev->mt76.token_size = wed->wlan.token_start;
-@@ -681,18 +686,35 @@ static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
- 	if (!ret)
- 		return -EAGAIN;
- 
-+	phy = &dev->phy;
-+	mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
-+
-+	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
-+	if (phy)
-+		mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
-+
- 	return 0;
- }
- 
- static void mt7915_wed_offload_disable(struct mtk_wed_device *wed)
- {
- 	struct mt7915_dev *dev;
-+	struct mt7915_phy *phy;
- 
- 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	if (!dev)
-+		return;
- 
- 	spin_lock_bh(&dev->mt76.token_lock);
- 	dev->mt76.token_size = wed->wlan.token_start;//MT7915_TOKEN_SIZE;
- 	spin_unlock_bh(&dev->mt76.token_lock);
-+
-+	phy = &dev->phy;
-+	mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
-+
-+	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
-+	if (phy)
-+		mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
- }
- #endif
- 
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b4c8cdf..a1ce516 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -142,8 +142,6 @@ struct mt7915_sta {
- 	unsigned long jiffies;
- 	unsigned long ampdu_state;
- 
--	struct mt76_sta_stats stats;
--
- 	struct mt76_connac_sta_key_conf bip;
- 
- 	struct {
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 36ef8a9..dcb4018 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -52,6 +52,7 @@ enum offs_rev {
- 	AGG_AWSCR0,
- 	AGG_PCR0,
- 	AGG_ACR0,
-+	AGG_ACR4,
- 	AGG_MRCR,
- 	AGG_ATCR1,
- 	AGG_ATCR3,
-@@ -489,6 +490,9 @@ enum offs_rev {
- #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
- #define MT_AGG_ACR_BAR_RATE		GENMASK(29, 16)
- 
-+#define MT_AGG_ACR4(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR4))
-+#define MT_AGG_ACR_PPDU_TXS2H		BIT(1)
-+
- #define MT_AGG_MRCR(_band)		MT_WF_AGG(_band, __OFFS(AGG_MRCR))
- #define MT_AGG_MRCR_BAR_CNT_LIMIT		GENMASK(15, 12)
- #define MT_AGG_MRCR_LAST_RTS_CTS_RN		BIT(6)
-diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index 0a1f035..96267d5 100644
---- a/mt7921/mt7921.h
-+++ b/mt7921/mt7921.h
-@@ -100,7 +100,6 @@ struct mt7921_sta {
- 
- 	unsigned long last_txs;
- 	unsigned long ampdu_state;
--	struct mt76_sta_stats stats;
- 
- 	struct mt76_connac_sta_key_conf bip;
- };
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch b/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
similarity index 85%
rename from recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch
rename to recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
index 1d5c092..b749789 100644
--- a/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
@@ -1,25 +1,25 @@
-From f7138db4f2f9742c57bfc9dcf41c9ed7c0b9bd8f Mon Sep 17 00:00:00 2001
+From 247fa46efdeaa5ea727a3d5dde7a9f3d7aac97d4 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Fri, 5 Aug 2022 13:58:11 -0700
-Subject: [PATCH 3006/3006] mt76: mt7915: add statistic for H/W Rx Path
+Subject: [PATCH 3006/3007] mt76: mt7915: add statistic for H/W Rx Path
 
 Change-Id: Id94d663f08e91c83d296bd57e5e9b65a505ae1c7
 ---
  mt76.h            |  4 ++++
  mt76_connac.h     |  5 +++++
  mt76_connac_mcu.h | 35 +++++++++++++++++++++++++++++++++++
- mt7915/mac.c      | 26 ++++++++++++++++++++++++++
+ mt7915/mac.c      | 25 +++++++++++++++++++++++++
  mt7915/main.c     |  9 ++++++++-
  mt7915/mcu.c      | 21 +++++++++++++++++++++
  mt7915/mmio.c     |  6 ++++++
  mt7915/mt7915.h   |  3 +++
- 8 files changed, 108 insertions(+), 1 deletion(-)
+ 8 files changed, 107 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index c6f3ef7..d29bcdf 100644
+index 9b00f53c..4958d97c 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -297,6 +297,10 @@ struct mt76_sta_stats {
+@@ -278,6 +278,10 @@ struct mt76_sta_stats {
  	u32 tx_packets;
  	u32 tx_retries;
  	u32 tx_failed;
@@ -29,9 +29,9 @@
 +	u32 rx_drop;
  };
  
- struct mt76_wcid {
+ enum mt76_wcid_flags {
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 4a43838..e324c79 100644
+index 9a468878..7ecc7253 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -224,6 +224,11 @@ static inline bool is_mt76_fw_txp(struct mt76_dev *dev)
@@ -47,10 +47,10 @@
  {
  	static const u8 width_to_bw[] = {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b777d95..40de521 100644
+index 4cdfadc7..adb06f84 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1201,6 +1201,41 @@ enum {
+@@ -1210,6 +1210,41 @@ enum {
  	MCU_CE_CMD_GET_TXPWR = 0xd0,
  };
  
@@ -93,7 +93,7 @@
  	PATCH_SEM_RELEASE,
  	PATCH_SEM_GET
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 63c702e..516717c 100644
+index 0cd9cad9..35c13efd 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -940,6 +940,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
@@ -128,19 +128,11 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1175,6 +1200,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
- 					  &msta->wcid.stats);
- 	else
- 		mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
-+
- 	if (!wcid->sta)
- 		goto out;
- 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b7c6cf6..f8da685 100644
+index fcf122cf..db9d55fe 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1028,7 +1028,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1049,7 +1049,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  	struct rate_info *txrate = &msta->wcid.rate;
  	struct rate_info rxrate = {};
  
@@ -150,7 +142,7 @@
  	    !mt7915_mcu_get_rx_rate(phy, vif, sta, &rxrate)) {
  		sinfo->rxrate = rxrate;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
-@@ -1062,6 +1063,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1086,6 +1087,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  
  		sinfo->tx_retries = msta->wcid.stats.tx_retries;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
@@ -164,7 +156,7 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3d50b78..fda1ff2 100644
+index aa8bcf70..b0fa6dac 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -293,6 +293,27 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
@@ -196,7 +188,7 @@
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index bb2d1c4..c4bdf7f 100644
+index 0edea0d3..c5ce8cf7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -9,6 +9,7 @@
@@ -207,7 +199,7 @@
  
  static bool wed_enable = true;
  module_param(wed_enable, bool, 0644);
-@@ -781,6 +782,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -763,6 +764,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  
  	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
  
@@ -216,7 +208,7 @@
  	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
  	if (mtk_wed_device_attach(wed) != 0)
  		return 0;
-@@ -792,6 +795,9 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -774,6 +777,9 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  	if (ret)
  		return ret;
  
@@ -227,7 +219,7 @@
  #else
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a1ce516..7c20235 100644
+index a4872451..03486837 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -550,6 +550,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
@@ -248,5 +240,5 @@
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch b/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
index e6dc07a..4f4d700 100644
--- a/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
@@ -1,7 +1,8 @@
-From 17753f183bce83f2b2f03e9f15312f84b67558e9 Mon Sep 17 00:00:00 2001
+From 10f2c201cbeaae838ffa2489a7ff928d812d6f49 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH] mt76: mt7915: enable red per-band token drop for HW Path
+Subject: [PATCH 3007/3007] mt76: mt7915: enable red per-band token drop for HW
+ Path
 
 Limit the number of token used by each band. If a band uses too many token,
 it may hurt the throughput of the other band. The SW path can solve this
@@ -15,10 +16,10 @@
  3 files changed, 45 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1cbdf0cf..c29eb80a 100644
+index b0fa6dac..98277d27 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2410,8 +2410,13 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2412,8 +2412,13 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
  					  MCU_WA_PARAM_WED_VERSION,
  					  wed->rev_id, 0);
@@ -32,7 +33,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2421,12 +2426,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2423,12 +2428,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -46,7 +47,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4230,6 +4230,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4232,6 +4232,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -82,7 +83,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4240,17 +4269,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4242,17 +4271,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -109,7 +110,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ce50e606..230ad9db 100644
+index 1f56db6b..9181e961 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -269,6 +269,7 @@ enum {
@@ -121,7 +122,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f2081640..f2a1e615 100644
+index 03486837..30293158 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -749,11 +749,11 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
@@ -138,5 +139,5 @@
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
 -- 
-2.18.0
+2.25.1
 
diff --git a/recipes-kernel/linux-mt76/files/patches/patches.inc b/recipes-kernel/linux-mt76/files/patches/patches.inc
index 86258ac..424704c 100644
--- a/recipes-kernel/linux-mt76/files/patches/patches.inc
+++ b/recipes-kernel/linux-mt76/files/patches/patches.inc
@@ -5,9 +5,8 @@
     file://0003-mt76-mt7915-rework-rx-testmode-stats.patch \
     file://0004-mt76-mt7915-drop-undefined-action-frame.patch \
     file://0005-mt76-common-RF-CR-idx-require-8-bits.patch \
-    file://0006-mt76-testmode-use-random-payload-for-tx-packets.patch \
-    file://0007-mt76-mt7915-add-spatial-extension-index-support.patch \
-    file://0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch \
+    file://0006-mt76-mt7915-add-spatial-extension-index-support.patch \
+    file://0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch \
     file://100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
@@ -20,23 +19,23 @@
     file://1009-mt76-mt7915-add-fw_version-dump.patch \
     file://1111-mt76-testmode-additional-supports.patch \
     file://1112-mt76-testmode-add-pre-cal-support.patch \
-    file://1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1114-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
-    file://1115-mt76-airtime-fairness-feature-off-in-mac80211.patch \
-    file://1116-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
-    file://1117-mt76-mt7915-add-phy-capability-vendor-command.patch \
-    file://1118-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch \
-    file://1119-mt76-mt7915-implement-bin-file-mode.patch \
-    file://1120-mt76-mt7915-initialize-wcid.patch \
-    file://1121-mt76-HEMU-Add-dump-support.patch \
-    file://1122-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
-    file://1123-mt76-add-ibf-control-vendor-cmd.patch \
+    file://1113-mt76-testmode-add-iBF-command-mode-support.patch \
+    file://1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
+    file://1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
+    file://1116-mt76-airtime-fairness-feature-off-in-mac80211.patch \
+    file://1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
+    file://1118-mt76-mt7915-add-phy-capability-vendor-command.patch \
+    file://1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch \
+    file://1120-mt76-mt7915-implement-bin-file-mode.patch \
+    file://1121-mt76-mt7915-initialize-wcid.patch \
+    file://1122-mt76-HEMU-Add-dump-support.patch \
+    file://1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
+    file://1124-mt76-add-ibf-control-vendor-cmd.patch \
     file://3001-mt76-add-wed-tx-support.patch \
-    file://3001-mt76-add-wed-tx-wds-support.patch \
-    file://3002-mt76-add-wed-rx-support.patch \
-    file://3003-mt76-add-fill-receive-path-to-report-wed-idx.patch \
-    file://3004-mt76-add-ser-spport-when-wed-on.patch \
-    file://3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch \
-    file://3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch \
+    file://3002-add-wed-tx-wds-support-on-mt7986.patch \
+    file://3003-mt76-add-wed-rx-support.patch \
+    file://3004-mt76-add-fill-receive-path-to-report-wed-idx.patch \
+    file://3005-mt76-add-ser-spport-when-wed-on.patch \
+    file://3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch \
     file://3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch \
     "
diff --git a/recipes-kernel/linux-mt76/linux-mt76.bb b/recipes-kernel/linux-mt76/linux-mt76.bb
index 471f86d..ae48a44 100644
--- a/recipes-kernel/linux-mt76/linux-mt76.bb
+++ b/recipes-kernel/linux-mt76/linux-mt76.bb
@@ -7,7 +7,7 @@
 
 PV = "1.0"
 
-SRCREV ?= "d70546462b7b51ebc2bcdd5c534fdf3465be62a4"
+SRCREV ?= "763a1d90133bfd2efae1a533d6b571d9802bcaa3"
 SRC_URI = " \
     git://git@github.com/openwrt/mt76.git;protocol=https \
     file://COPYING;subdir=git \
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/412-v5.19-mtd-call-of_platform_populate-for-MTD-partitions.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/412-v5.19-mtd-call-of_platform_populate-for-MTD-partitions.patch
new file mode 100644
index 0000000..bc7c747
--- /dev/null
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/412-v5.19-mtd-call-of_platform_populate-for-MTD-partitions.patch
@@ -0,0 +1,72 @@
+From bcdf0315a61a29eb753a607d3a85a4032de72d94 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 10 May 2022 15:12:59 +0200
+Subject: [PATCH] mtd: call of_platform_populate() for MTD partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Until this change MTD subsystem supported handling partitions only with
+MTD partitions parsers. That's a specific / limited API designed around
+partitions.
+
+Some MTD partitions may however require different handling. They may
+contain specific data that needs to be parsed and somehow extracted. For
+that purpose MTD subsystem should allow binding of standard platform
+drivers.
+
+An example can be U-Boot (sub)partition with environment variables.
+There exist a "u-boot,env" DT binding for MTD (sub)partition that
+requires an NVMEM driver.
+
+Ref: 5db1c2dbc04c ("dt-bindings: nvmem: add U-Boot environment variables binding")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220510131259.555-1-zajec5@gmail.com
+---
+ drivers/mtd/mtdpart.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -17,6 +17,7 @@
+ #include <linux/mtd/partitions.h>
+ #include <linux/err.h>
+ #include <linux/of.h>
++#include <linux/of_platform.h>
+ 
+ #include "mtdcore.h"
+ 
+@@ -893,10 +894,16 @@ static int mtd_part_of_parse(struct mtd_
+ 	struct mtd_part_parser *parser;
+ 	struct device_node *np;
+ 	struct property *prop;
++	struct device *dev;
+ 	const char *compat;
+ 	const char *fixed = "fixed-partitions";
+ 	int ret, err = 0;
+ 
++	dev = &master->dev;
++	/* Use parent device (controller) if the top level MTD is not registered */
++	if (!IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER) && !mtd_is_partition(master))
++		dev = master->dev.parent;
++
+ 	np = mtd_get_of_node(master);
+ 	if (mtd_is_partition(master))
+ 		of_node_get(np);
+@@ -909,6 +916,7 @@ static int mtd_part_of_parse(struct mtd_
+ 			continue;
+ 		ret = mtd_part_do_parse(parser, master, pparts, NULL);
+ 		if (ret > 0) {
++			of_platform_populate(np, NULL, NULL, dev);
+ 			of_node_put(np);
+ 			return ret;
+ 		}
+@@ -916,6 +924,7 @@ static int mtd_part_of_parse(struct mtd_
+ 		if (ret < 0 && !err)
+ 			err = ret;
+ 	}
++	of_platform_populate(np, NULL, NULL, dev);
+ 	of_node_put(np);
+ 
+ 	/*
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/414-v6.1-mtd-allow-getting-MTD-device-associated-with-a-speci.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/414-v6.1-mtd-allow-getting-MTD-device-associated-with-a-speci.patch
new file mode 100644
index 0000000..6a78a67
--- /dev/null
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/414-v6.1-mtd-allow-getting-MTD-device-associated-with-a-speci.patch
@@ -0,0 +1,72 @@
+From b0321721be50b80c03a51866a94fde4f94690e18 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 15 Jun 2022 21:42:59 +0200
+Subject: [PATCH] mtd: allow getting MTD device associated with a specific DT
+ node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+MTD subsystem API allows interacting with MTD devices (e.g. reading,
+writing, handling bad blocks). So far a random driver could get MTD
+device only by its name (get_mtd_device_nm()). This change allows
+getting them also by a DT node.
+
+This API is required for drivers handling DT defined MTD partitions in a
+specific way (e.g. U-Boot (sub)partition with environment variables).
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+---
+ drivers/mtd/mtdcore.c   | 28 ++++++++++++++++++++++++++++
+ include/linux/mtd/mtd.h |  1 +
+ 2 files changed, 29 insertions(+)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -1006,6 +1006,34 @@ int __get_mtd_device(struct mtd_info *mt
+ EXPORT_SYMBOL_GPL(__get_mtd_device);
+ 
+ /**
++ * of_get_mtd_device_by_node - obtain an MTD device associated with a given node
++ *
++ * @np: device tree node
++ */
++struct mtd_info *of_get_mtd_device_by_node(struct device_node *np)
++{
++	struct mtd_info *mtd = NULL;
++	struct mtd_info *tmp;
++	int err;
++
++	mutex_lock(&mtd_table_mutex);
++
++	err = -EPROBE_DEFER;
++	mtd_for_each_device(tmp) {
++		if (mtd_get_of_node(tmp) == np) {
++			mtd = tmp;
++			err = __get_mtd_device(mtd);
++			break;
++		}
++	}
++
++	mutex_unlock(&mtd_table_mutex);
++
++	return err ? ERR_PTR(err) : mtd;
++}
++EXPORT_SYMBOL_GPL(of_get_mtd_device_by_node);
++
++/**
+  *	get_mtd_device_nm - obtain a validated handle for an MTD device by
+  *	device name
+  *	@name: MTD device name to open
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -567,6 +567,7 @@ extern int mtd_device_unregister(struct
+ extern struct mtd_info *get_mtd_device(struct mtd_info *mtd, int num);
+ extern int __get_mtd_device(struct mtd_info *mtd);
+ extern void __put_mtd_device(struct mtd_info *mtd);
++extern struct mtd_info *of_get_mtd_device_by_node(struct device_node *np);
+ extern struct mtd_info *get_mtd_device_nm(const char *name);
+ extern void put_mtd_device(struct mtd_info *mtd);
+ 
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/600-v5.12-net-extract-napi-poll-functionality-to-__napi_poll.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/600-v5.12-net-extract-napi-poll-functionality-to-__napi_poll.patch
index 35aeb96..02b5b57 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/600-v5.12-net-extract-napi-poll-functionality-to-__napi_poll.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/600-v5.12-net-extract-napi-poll-functionality-to-__napi_poll.patch
@@ -18,7 +18,7 @@
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -6325,15 +6325,10 @@ void netif_napi_del(struct napi_struct *
+@@ -6326,15 +6326,10 @@ void netif_napi_del(struct napi_struct *
  }
  EXPORT_SYMBOL(netif_napi_del);
  
@@ -35,7 +35,7 @@
  	weight = n->weight;
  
  	/* This NAPI_STATE_SCHED test is for avoiding a race
-@@ -6351,7 +6346,7 @@ static int napi_poll(struct napi_struct
+@@ -6352,7 +6347,7 @@ static int napi_poll(struct napi_struct
  	WARN_ON_ONCE(work > weight);
  
  	if (likely(work < weight))
@@ -44,7 +44,7 @@
  
  	/* Drivers must not modify the NAPI state if they
  	 * consume the entire weight.  In such cases this code
-@@ -6360,7 +6355,7 @@ static int napi_poll(struct napi_struct
+@@ -6361,7 +6356,7 @@ static int napi_poll(struct napi_struct
  	 */
  	if (unlikely(napi_disable_pending(n))) {
  		napi_complete(n);
@@ -53,7 +53,7 @@
  	}
  
  	if (n->gro_bitmask) {
-@@ -6378,12 +6373,29 @@ static int napi_poll(struct napi_struct
+@@ -6379,12 +6374,29 @@ static int napi_poll(struct napi_struct
  	if (unlikely(!list_empty(&n->poll_list))) {
  		pr_warn_once("%s: Budget exhausted after napi rescheduled\n",
  			     n->dev ? n->dev->name : "backlog");
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/601-v5.12-net-implement-threaded-able-napi-poll-loop-support.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/601-v5.12-net-implement-threaded-able-napi-poll-loop-support.patch
index 0c548f3..e613b17 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/601-v5.12-net-implement-threaded-able-napi-poll-loop-support.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/601-v5.12-net-implement-threaded-able-napi-poll-loop-support.patch
@@ -131,7 +131,7 @@
  static int __dev_open(struct net_device *dev, struct netlink_ext_ack *extack)
  {
  	const struct net_device_ops *ops = dev->netdev_ops;
-@@ -3888,6 +3910,21 @@ int gro_normal_batch __read_mostly = 8;
+@@ -3889,6 +3911,21 @@ int gro_normal_batch __read_mostly = 8;
  static inline void ____napi_schedule(struct softnet_data *sd,
  				     struct napi_struct *napi)
  {
@@ -153,7 +153,7 @@
  	list_add_tail(&napi->poll_list, &sd->poll_list);
  	__raise_softirq_irqoff(NET_RX_SOFTIRQ);
  }
-@@ -6279,6 +6316,12 @@ void netif_napi_add(struct net_device *d
+@@ -6280,6 +6317,12 @@ void netif_napi_add(struct net_device *d
  	set_bit(NAPI_STATE_NPSVC, &napi->state);
  	list_add_rcu(&napi->dev_list, &dev->napi_list);
  	napi_hash_add(napi);
@@ -166,7 +166,7 @@
  }
  EXPORT_SYMBOL(netif_napi_add);
  
-@@ -6295,9 +6338,28 @@ void napi_disable(struct napi_struct *n)
+@@ -6296,9 +6339,28 @@ void napi_disable(struct napi_struct *n)
  	hrtimer_cancel(&n->timer);
  
  	clear_bit(NAPI_STATE_DISABLE, &n->state);
@@ -195,7 +195,7 @@
  static void flush_gro_hash(struct napi_struct *napi)
  {
  	int i;
-@@ -6322,6 +6384,11 @@ void netif_napi_del(struct napi_struct *
+@@ -6323,6 +6385,11 @@ void netif_napi_del(struct napi_struct *
  
  	flush_gro_hash(napi);
  	napi->gro_bitmask = 0;
@@ -207,7 +207,7 @@
  }
  EXPORT_SYMBOL(netif_napi_del);
  
-@@ -6401,6 +6468,51 @@ static int napi_poll(struct napi_struct
+@@ -6402,6 +6469,51 @@ static int napi_poll(struct napi_struct
  	return work;
  }
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/602-v5.12-net-add-sysfs-attribute-to-control-napi-threaded-mod.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/602-v5.12-net-add-sysfs-attribute-to-control-napi-threaded-mod.patch
index bdc34a1..2911400 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/602-v5.12-net-add-sysfs-attribute-to-control-napi-threaded-mod.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/602-v5.12-net-add-sysfs-attribute-to-control-napi-threaded-mod.patch
@@ -57,7 +57,7 @@
   *	@n: NAPI context
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -3914,8 +3914,9 @@ static inline void ____napi_schedule(str
+@@ -3915,8 +3915,9 @@ static inline void ____napi_schedule(str
  
  	if (test_bit(NAPI_STATE_THREADED, &napi->state)) {
  		/* Paired with smp_mb__before_atomic() in
@@ -69,7 +69,7 @@
  		 * wake_up_process() when it's not NULL.
  		 */
  		thread = READ_ONCE(napi->thread);
-@@ -6293,6 +6294,49 @@ static void init_gro_hash(struct napi_st
+@@ -6294,6 +6295,49 @@ static void init_gro_hash(struct napi_st
  	napi->gro_bitmask = 0;
  }
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/603-v5.12-net-fix-race-between-napi-kthread-mode-and-busy-poll.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/603-v5.12-net-fix-race-between-napi-kthread-mode-and-busy-poll.patch
index 764f33e..8f93cdd 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/603-v5.12-net-fix-race-between-napi-kthread-mode-and-busy-poll.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/603-v5.12-net-fix-race-between-napi-kthread-mode-and-busy-poll.patch
@@ -45,7 +45,7 @@
  enum gro_result {
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -3921,6 +3921,8 @@ static inline void ____napi_schedule(str
+@@ -3922,6 +3922,8 @@ static inline void ____napi_schedule(str
  		 */
  		thread = READ_ONCE(napi->thread);
  		if (thread) {
@@ -54,7 +54,7 @@
  			wake_up_process(thread);
  			return;
  		}
-@@ -6081,7 +6083,8 @@ bool napi_complete_done(struct napi_stru
+@@ -6082,7 +6084,8 @@ bool napi_complete_done(struct napi_stru
  
  		WARN_ON_ONCE(!(val & NAPIF_STATE_SCHED));
  
@@ -64,7 +64,7 @@
  
  		/* If STATE_MISSED was set, leave STATE_SCHED set,
  		 * because we will call napi->poll() one more time.
-@@ -6514,16 +6517,25 @@ static int napi_poll(struct napi_struct
+@@ -6515,16 +6518,25 @@ static int napi_poll(struct napi_struct
  
  static int napi_thread_wait(struct napi_struct *napi)
  {
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/604-v5.12-net-fix-hangup-on-napi_disable-for-threaded-napi.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/604-v5.12-net-fix-hangup-on-napi_disable-for-threaded-napi.patch
index 5c48fdf..a60763d 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/604-v5.12-net-fix-hangup-on-napi_disable-for-threaded-napi.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/604-v5.12-net-fix-hangup-on-napi_disable-for-threaded-napi.patch
@@ -34,7 +34,7 @@
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -6521,7 +6521,7 @@ static int napi_thread_wait(struct napi_
+@@ -6522,7 +6522,7 @@ static int napi_thread_wait(struct napi_
  
  	set_current_state(TASK_INTERRUPTIBLE);
  
@@ -43,7 +43,7 @@
  		/* Testing SCHED_THREADED bit here to make sure the current
  		 * kthread owns this napi and could poll on this napi.
  		 * Testing SCHED bit is not enough because SCHED bit might be
-@@ -6539,6 +6539,7 @@ static int napi_thread_wait(struct napi_
+@@ -6540,6 +6540,7 @@ static int napi_thread_wait(struct napi_
  		set_current_state(TASK_INTERRUPTIBLE);
  	}
  	__set_current_state(TASK_RUNNING);
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/700-v5.5-net-core-allow-fast-GRO-for-skbs-with-Ethernet-heade.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/700-v5.5-net-core-allow-fast-GRO-for-skbs-with-Ethernet-heade.patch
index 24b76cd..aeb22f5 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/700-v5.5-net-core-allow-fast-GRO-for-skbs-with-Ethernet-heade.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/700-v5.5-net-core-allow-fast-GRO-for-skbs-with-Ethernet-heade.patch
@@ -66,7 +66,7 @@
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -5475,8 +5475,7 @@ static inline void skb_gro_reset_offset(
+@@ -5476,8 +5476,7 @@ static inline void skb_gro_reset_offset(
  	NAPI_GRO_CB(skb)->frag0 = NULL;
  	NAPI_GRO_CB(skb)->frag0_len = 0;
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/801-v6.1-nvmem-add-driver-handling-U-Boot-environment-variabl.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/801-v6.1-nvmem-add-driver-handling-U-Boot-environment-variabl.patch
new file mode 100644
index 0000000..ef3c601
--- /dev/null
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/801-v6.1-nvmem-add-driver-handling-U-Boot-environment-variabl.patch
@@ -0,0 +1,278 @@
+From f955dc14450695564926711cf9fa8e1d5d854302 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 15 Jun 2022 21:43:00 +0200
+Subject: [PATCH] nvmem: add driver handling U-Boot environment variables
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+U-Boot stores its setup as environment variables. It's a list of
+key-value pairs stored on flash device with a custom header.
+
+This commit adds an NVMEM driver that:
+1. Provides NVMEM access to environment vars binary data
+2. Extracts variables as NVMEM cells
+
+Current Linux's NVMEM sysfs API allows reading whole NVMEM data block.
+It can be used by user-space tools for reading U-Boot env vars block
+without the hassle of finding its location. Parsing will still need to
+be re-done there.
+
+Kernel-parsed NVMEM cells can be read however by Linux drivers. This may
+be useful for Ethernet drivers for reading device MAC address which is
+often stored as U-Boot env variable.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+---
+
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -230,4 +230,17 @@ config NVMEM_ZYNQMP
+ 
+ 	  If sure, say yes. If unsure, say no.
+ 
++config NVMEM_U_BOOT_ENV
++	tristate "U-Boot environment variables support"
++	depends on OF && MTD
++	select CRC32
++	help
++	  U-Boot stores its setup as environment variables. This driver adds
++	  support for verifying & exporting such data. It also exposes variables
++	  as NVMEM cells so they can be referenced by other drivers.
++
++	  Currently this drivers works only with env variables on top of MTD.
++
++	  If compiled as module it will be called nvmem_u-boot-env.
++
+ endif
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -50,3 +50,5 @@ obj-$(CONFIG_SC27XX_EFUSE)	+= nvmem-sc27
+ nvmem-sc27xx-efuse-y		:= sc27xx-efuse.o
+ obj-$(CONFIG_NVMEM_ZYNQMP)	+= nvmem_zynqmp_nvmem.o
+ nvmem_zynqmp_nvmem-y		:= zynqmp_nvmem.o
++obj-$(CONFIG_NVMEM_U_BOOT_ENV)	+= nvmem_u-boot-env.o
++nvmem_u-boot-env-y		:= u-boot-env.o
+--- /dev/null
++++ b/drivers/nvmem/u-boot-env.c
+@@ -0,0 +1,218 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (C) 2022 Rafał Miłecki <rafal@milecki.pl>
++ */
++
++#include <linux/crc32.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/mtd/mtd.h>
++#include <linux/nvmem-consumer.h>
++#include <linux/nvmem-provider.h>
++#include <linux/of_device.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++
++enum u_boot_env_format {
++	U_BOOT_FORMAT_SINGLE,
++	U_BOOT_FORMAT_REDUNDANT,
++};
++
++struct u_boot_env {
++	struct device *dev;
++	enum u_boot_env_format format;
++
++	struct mtd_info *mtd;
++
++	/* Cells */
++	struct nvmem_cell_info *cells;
++	int ncells;
++};
++
++struct u_boot_env_image_single {
++	__le32 crc32;
++	uint8_t data[];
++} __packed;
++
++struct u_boot_env_image_redundant {
++	__le32 crc32;
++	u8 mark;
++	uint8_t data[];
++} __packed;
++
++static int u_boot_env_read(void *context, unsigned int offset, void *val,
++			   size_t bytes)
++{
++	struct u_boot_env *priv = context;
++	struct device *dev = priv->dev;
++	size_t bytes_read;
++	int err;
++
++	err = mtd_read(priv->mtd, offset, bytes, &bytes_read, val);
++	if (err && !mtd_is_bitflip(err)) {
++		dev_err(dev, "Failed to read from mtd: %d\n", err);
++		return err;
++	}
++
++	if (bytes_read != bytes) {
++		dev_err(dev, "Failed to read %zu bytes\n", bytes);
++		return -EIO;
++	}
++
++	return 0;
++}
++
++static int u_boot_env_add_cells(struct u_boot_env *priv, uint8_t *buf,
++				size_t data_offset, size_t data_len)
++{
++	struct device *dev = priv->dev;
++	char *data = buf + data_offset;
++	char *var, *value, *eq;
++	int idx;
++
++	priv->ncells = 0;
++	for (var = data; var < data + data_len && *var; var += strlen(var) + 1)
++		priv->ncells++;
++
++	priv->cells = devm_kcalloc(dev, priv->ncells, sizeof(*priv->cells), GFP_KERNEL);
++	if (!priv->cells)
++		return -ENOMEM;
++
++	for (var = data, idx = 0;
++	     var < data + data_len && *var;
++	     var = value + strlen(value) + 1, idx++) {
++		eq = strchr(var, '=');
++		if (!eq)
++			break;
++		*eq = '\0';
++		value = eq + 1;
++
++		priv->cells[idx].name = devm_kstrdup(dev, var, GFP_KERNEL);
++		if (!priv->cells[idx].name)
++			return -ENOMEM;
++		priv->cells[idx].offset = data_offset + value - data;
++		priv->cells[idx].bytes = strlen(value);
++	}
++
++	if (WARN_ON(idx != priv->ncells))
++		priv->ncells = idx;
++
++	return 0;
++}
++
++static int u_boot_env_parse(struct u_boot_env *priv)
++{
++	struct device *dev = priv->dev;
++	size_t crc32_data_offset;
++	size_t crc32_data_len;
++	size_t crc32_offset;
++	size_t data_offset;
++	size_t data_len;
++	uint32_t crc32;
++	uint32_t calc;
++	size_t bytes;
++	uint8_t *buf;
++	int err;
++
++	buf = kcalloc(1, priv->mtd->size, GFP_KERNEL);
++	if (!buf) {
++		err = -ENOMEM;
++		goto err_out;
++	}
++
++	err = mtd_read(priv->mtd, 0, priv->mtd->size, &bytes, buf);
++	if ((err && !mtd_is_bitflip(err)) || bytes != priv->mtd->size) {
++		dev_err(dev, "Failed to read from mtd: %d\n", err);
++		goto err_kfree;
++	}
++
++	switch (priv->format) {
++	case U_BOOT_FORMAT_SINGLE:
++		crc32_offset = offsetof(struct u_boot_env_image_single, crc32);
++		crc32_data_offset = offsetof(struct u_boot_env_image_single, data);
++		data_offset = offsetof(struct u_boot_env_image_single, data);
++		break;
++	case U_BOOT_FORMAT_REDUNDANT:
++		crc32_offset = offsetof(struct u_boot_env_image_redundant, crc32);
++		crc32_data_offset = offsetof(struct u_boot_env_image_redundant, mark);
++		data_offset = offsetof(struct u_boot_env_image_redundant, data);
++		break;
++	}
++	crc32 = le32_to_cpu(*(uint32_t *)(buf + crc32_offset));
++	crc32_data_len = priv->mtd->size - crc32_data_offset;
++	data_len = priv->mtd->size - data_offset;
++
++	calc = crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L;
++	if (calc != crc32) {
++		dev_err(dev, "Invalid calculated CRC32: 0x%08x (expected: 0x%08x)\n", calc, crc32);
++		err = -EINVAL;
++		goto err_kfree;
++	}
++
++	buf[priv->mtd->size - 1] = '\0';
++	err = u_boot_env_add_cells(priv, buf, data_offset, data_len);
++	if (err)
++		dev_err(dev, "Failed to add cells: %d\n", err);
++
++err_kfree:
++	kfree(buf);
++err_out:
++	return err;
++}
++
++static int u_boot_env_probe(struct platform_device *pdev)
++{
++	struct nvmem_config config = {
++		.name = "u-boot-env",
++		.reg_read = u_boot_env_read,
++	};
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++	struct u_boot_env *priv;
++	int err;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++	priv->dev = dev;
++
++	priv->format = (uintptr_t)of_device_get_match_data(dev);
++
++	priv->mtd = of_get_mtd_device_by_node(np);
++	if (IS_ERR(priv->mtd)) {
++		dev_err(dev, "Failed to get %pOF MTD\n", np);
++		return PTR_ERR(priv->mtd);
++	}
++
++	err = u_boot_env_parse(priv);
++	if (err)
++		return err;
++
++	config.dev = dev;
++	config.cells = priv->cells;
++	config.ncells = priv->ncells;
++	config.priv = priv;
++	config.size = priv->mtd->size;
++
++	return PTR_ERR_OR_ZERO(devm_nvmem_register(dev, &config));
++}
++
++static const struct of_device_id u_boot_env_of_match_table[] = {
++	{ .compatible = "u-boot,env", .data = (void *)U_BOOT_FORMAT_SINGLE, },
++	{ .compatible = "u-boot,env-redundant-bool", .data = (void *)U_BOOT_FORMAT_REDUNDANT, },
++	{ .compatible = "u-boot,env-redundant-count", .data = (void *)U_BOOT_FORMAT_REDUNDANT, },
++	{},
++};
++
++static struct platform_driver u_boot_env_driver = {
++	.probe = u_boot_env_probe,
++	.driver = {
++		.name = "u_boot_env",
++		.of_match_table = u_boot_env_of_match_table,
++	},
++};
++module_platform_driver(u_boot_env_driver);
++
++MODULE_AUTHOR("Rafał Miłecki");
++MODULE_LICENSE("GPL");
++MODULE_DEVICE_TABLE(of, u_boot_env_of_match_table);
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc
index 7f9a97a..3f9acfb 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/backport-5.4/backport-5.4.inc
@@ -166,6 +166,8 @@
     file://408-v5.7-mtd-nand-spi-rework-detect-procedure-for-different-read-id-op.patch \
     file://410-mtd-fix-calculating-partition-end-address.patch \
     file://411-mtd-spinand-gigadevice-Support-GD5F1GQ5UExxG.patch \
+    file://412-v5.19-mtd-call-of_platform_populate-for-MTD-partitions.patch \
+    file://414-v6.1-mtd-allow-getting-MTD-device-associated-with-a-speci.patch \
     file://430-mtd-spinand-macronix-Add-support-for-MX31LF1GE4BC.patch \
     file://431-mtd-spinand-macronix-Add-support-for-MX31UF1GE4BC.patch \
     file://432-mtd-spinand-macronix-Add-support-for-MX35LFxGE4AD.patch \
@@ -242,6 +244,7 @@
     file://800-v5.5-scsi-core-Add-sysfs-attributes-for-VPD-pages-0h-and-.patch \
     file://801-v5.5-hwmon-Driver-for-disk-and-solid-state-drives-with-te.patch \
     file://801-v5.6-leds-populate-the-device-s-of_node.patch \
+    file://801-v6.1-nvmem-add-driver-handling-U-Boot-environment-variabl.patch \
     file://803-v5.8-i2c-pxa-use-official-address-byte-helper.patch \
     file://804-v5.8-i2c-pxa-remove-unneeded-includes.patch \
     file://805-v5.8-i2c-pxa-re-arrange-includes-to-be-in-alphabetical-or.patch \
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/defconfig b/recipes-kernel/linux/linux-mediatek-5.4/generic/defconfig
index f205921..e1a3747 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/defconfig
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/defconfig
@@ -3841,6 +3841,7 @@
 # CONFIG_NVMEM_IMX_OCOTP is not set
 # CONFIG_NVMEM_REBOOT_MODE is not set
 # CONFIG_NVMEM_SYSFS is not set
+# CONFIG_NVMEM_U_BOOT_ENV is not set
 # CONFIG_NVME_FC is not set
 # CONFIG_NVME_TARGET is not set
 # CONFIG_NVME_TCP is not set
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/250-netfilter_depends.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/250-netfilter_depends.patch
index d03cb53..17a5e75 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/250-netfilter_depends.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/250-netfilter_depends.patch
@@ -9,7 +9,7 @@
 
 --- a/net/netfilter/Kconfig
 +++ b/net/netfilter/Kconfig
-@@ -228,7 +228,6 @@ config NF_CONNTRACK_FTP
+@@ -227,7 +227,6 @@ config NF_CONNTRACK_FTP
  
  config NF_CONNTRACK_H323
  	tristate "H.323 protocol support"
@@ -17,7 +17,7 @@
  	depends on NETFILTER_ADVANCED
  	help
  	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
-@@ -1088,7 +1087,6 @@ config NETFILTER_XT_TARGET_SECMARK
+@@ -1087,7 +1086,6 @@ config NETFILTER_XT_TARGET_SECMARK
  
  config NETFILTER_XT_TARGET_TCPMSS
  	tristate '"TCPMSS" target support'
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/550-loop-Report-EOPNOTSUPP-properly.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/550-loop-Report-EOPNOTSUPP-properly.patch
index 0e5447d..29a8d84 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/550-loop-Report-EOPNOTSUPP-properly.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/550-loop-Report-EOPNOTSUPP-properly.patch
@@ -27,7 +27,7 @@
  		goto end_io;
  	}
  
-@@ -1973,7 +1973,10 @@ static void loop_handle_cmd(struct loop_
+@@ -1978,7 +1978,10 @@ static void loop_handle_cmd(struct loop_
   failed:
  	/* complete non-aio request */
  	if (!cmd->use_aio || ret) {
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/721-phy_packets.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/721-phy_packets.patch
index 89ff8ea..dfc9aa5 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/721-phy_packets.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/hack-5.4/721-phy_packets.patch
@@ -56,7 +56,7 @@
   */
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -2684,6 +2684,10 @@ static inline int pskb_trim(struct sk_bu
+@@ -2692,6 +2692,10 @@ static inline int pskb_trim(struct sk_bu
  	return (len < skb->len) ? __pskb_trim(skb, len) : 0;
  }
  
@@ -67,7 +67,7 @@
  /**
   *	pskb_trim_unique - remove end from a paged unique (not cloned) buffer
   *	@skb: buffer to alter
-@@ -2815,16 +2819,6 @@ static inline struct sk_buff *dev_alloc_
+@@ -2823,16 +2827,6 @@ static inline struct sk_buff *dev_alloc_
  }
  
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/400-mtd-add-rootfs-split-support.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/400-mtd-add-rootfs-split-support.patch
index 83a4ed3..147dfba 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/400-mtd-add-rootfs-split-support.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/400-mtd-add-rootfs-split-support.patch
@@ -37,20 +37,21 @@
  	depends on m
 --- a/drivers/mtd/mtdpart.c
 +++ b/drivers/mtd/mtdpart.c
-@@ -15,10 +15,12 @@
+@@ -15,11 +15,13 @@
  #include <linux/kmod.h>
  #include <linux/mtd/mtd.h>
  #include <linux/mtd/partitions.h>
 +#include <linux/magic.h>
  #include <linux/err.h>
  #include <linux/of.h>
+ #include <linux/of_platform.h>
  
  #include "mtdcore.h"
 +#include "mtdsplit/mtdsplit.h"
  
  /* Our partition linked list */
  static LIST_HEAD(mtd_partitions);
-@@ -38,6 +40,8 @@ struct mtd_part {
+@@ -39,6 +41,8 @@ struct mtd_part {
  	struct list_head list;
  };
  
@@ -59,7 +60,7 @@
  /*
   * Given a pointer to the MTD object in the mtd_part structure, we can retrieve
   * the pointer to that structure.
-@@ -612,6 +616,7 @@ int mtd_add_partition(struct mtd_info *p
+@@ -613,6 +617,7 @@ int mtd_add_partition(struct mtd_info *p
  	if (ret)
  		goto err_remove_part;
  
@@ -67,7 +68,7 @@
  	mtd_add_partition_attrs(new);
  
  	return 0;
-@@ -698,6 +703,29 @@ int mtd_del_partition(struct mtd_info *m
+@@ -699,6 +704,29 @@ int mtd_del_partition(struct mtd_info *m
  }
  EXPORT_SYMBOL_GPL(mtd_del_partition);
  
@@ -97,7 +98,7 @@
  /*
   * This function, given a master MTD object and a partition table, creates
   * and registers slave MTD objects which are bound to the master according to
-@@ -738,6 +766,7 @@ int add_mtd_partitions(struct mtd_info *
+@@ -739,6 +767,7 @@ int add_mtd_partitions(struct mtd_info *
  			goto err_del_partitions;
  		}
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/401-mtd-add-support-for-different-partition-parser-types.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/401-mtd-add-support-for-different-partition-parser-types.patch
index f471c62..dc1a517 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/401-mtd-add-support-for-different-partition-parser-types.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/401-mtd-add-support-for-different-partition-parser-types.patch
@@ -9,7 +9,7 @@
 
 --- a/drivers/mtd/mtdpart.c
 +++ b/drivers/mtd/mtdpart.c
-@@ -41,6 +41,10 @@ struct mtd_part {
+@@ -42,6 +42,10 @@ struct mtd_part {
  };
  
  static void mtd_partition_split(struct mtd_info *master, struct mtd_part *part);
@@ -20,7 +20,7 @@
  
  /*
   * Given a pointer to the MTD object in the mtd_part structure, we can retrieve
-@@ -703,6 +707,36 @@ int mtd_del_partition(struct mtd_info *m
+@@ -704,6 +708,36 @@ int mtd_del_partition(struct mtd_info *m
  }
  EXPORT_SYMBOL_GPL(mtd_del_partition);
  
@@ -57,7 +57,7 @@
  #ifdef CONFIG_MTD_SPLIT_FIRMWARE_NAME
  #define SPLIT_FIRMWARE_NAME	CONFIG_MTD_SPLIT_FIRMWARE_NAME
  #else
-@@ -1052,6 +1086,61 @@ void mtd_part_parser_cleanup(struct mtd_
+@@ -1061,6 +1095,61 @@ void mtd_part_parser_cleanup(struct mtd_
  	}
  }
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/402-mtd-use-typed-mtd-parsers-for-rootfs-and-firmware-split.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/402-mtd-use-typed-mtd-parsers-for-rootfs-and-firmware-split.patch
index afe3ec7..eda41f3 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/402-mtd-use-typed-mtd-parsers-for-rootfs-and-firmware-split.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/402-mtd-use-typed-mtd-parsers-for-rootfs-and-firmware-split.patch
@@ -10,7 +10,7 @@
 
 --- a/drivers/mtd/mtdpart.c
 +++ b/drivers/mtd/mtdpart.c
-@@ -745,6 +745,7 @@ run_parsers_by_type(struct mtd_part *sla
+@@ -746,6 +746,7 @@ run_parsers_by_type(struct mtd_part *sla
  
  static void split_firmware(struct mtd_info *master, struct mtd_part *part)
  {
@@ -18,7 +18,7 @@
  }
  
  static void mtd_partition_split(struct mtd_info *master, struct mtd_part *part)
-@@ -754,6 +755,12 @@ static void mtd_partition_split(struct m
+@@ -755,6 +756,12 @@ static void mtd_partition_split(struct m
  	if (rootfs_found)
  		return;
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/404-mtd-add-more-helper-functions.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/404-mtd-add-more-helper-functions.patch
index 059a440..a0dd3e0 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/404-mtd-add-more-helper-functions.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/404-mtd-add-more-helper-functions.patch
@@ -11,7 +11,7 @@
 
 --- a/drivers/mtd/mtdpart.c
 +++ b/drivers/mtd/mtdpart.c
-@@ -1165,6 +1165,24 @@ int mtd_is_partition(const struct mtd_in
+@@ -1174,6 +1174,24 @@ int mtd_is_partition(const struct mtd_in
  }
  EXPORT_SYMBOL_GPL(mtd_is_partition);
  
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/411-mtd-partial_eraseblock_write.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/411-mtd-partial_eraseblock_write.patch
index c48a144..fd0834f 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/411-mtd-partial_eraseblock_write.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/411-mtd-partial_eraseblock_write.patch
@@ -10,7 +10,7 @@
 
 --- a/drivers/mtd/mtdpart.c
 +++ b/drivers/mtd/mtdpart.c
-@@ -22,6 +22,8 @@
+@@ -23,6 +23,8 @@
  #include "mtdcore.h"
  #include "mtdsplit/mtdsplit.h"
  
@@ -19,7 +19,7 @@
  /* Our partition linked list */
  static LIST_HEAD(mtd_partitions);
  static DEFINE_MUTEX(mtd_partitions_mutex);
-@@ -206,11 +208,77 @@ static int part_erase(struct mtd_info *m
+@@ -207,11 +209,77 @@ static int part_erase(struct mtd_info *m
  {
  	struct mtd_part *part = mtd_to_part(mtd);
  	int ret;
@@ -97,7 +97,7 @@
  	instr->addr -= part->offset;
  
  	return ret;
-@@ -525,19 +593,22 @@ static struct mtd_part *allocate_partiti
+@@ -526,19 +594,22 @@ static struct mtd_part *allocate_partiti
  	remainder = do_div(tmp, wr_alignment);
  	if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) {
  		/* Doesn't start on a boundary of major erase size */
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/412-mtd-partial_eraseblock_unlock.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/412-mtd-partial_eraseblock_unlock.patch
index b23bc1b..e0e66b4 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/412-mtd-partial_eraseblock_unlock.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/412-mtd-partial_eraseblock_unlock.patch
@@ -20,7 +20,7 @@
 
 --- a/drivers/mtd/mtdpart.c
 +++ b/drivers/mtd/mtdpart.c
-@@ -293,7 +293,16 @@ static int part_lock(struct mtd_info *mt
+@@ -294,7 +294,16 @@ static int part_lock(struct mtd_info *mt
  static int part_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
  {
  	struct mtd_part *part = mtd_to_part(mtd);
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/495-mtd-core-add-get_mtd_device_by_node.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/495-mtd-core-add-get_mtd_device_by_node.patch
index a173381..d17106b 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/495-mtd-core-add-get_mtd_device_by_node.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/495-mtd-core-add-get_mtd_device_by_node.patch
@@ -17,7 +17,7 @@
 
 --- a/drivers/mtd/mtdcore.c
 +++ b/drivers/mtd/mtdcore.c
-@@ -1053,6 +1053,44 @@ out_unlock:
+@@ -1081,6 +1081,44 @@ out_unlock:
  }
  EXPORT_SYMBOL_GPL(get_mtd_device_nm);
  
@@ -64,9 +64,9 @@
  	mutex_lock(&mtd_table_mutex);
 --- a/include/linux/mtd/mtd.h
 +++ b/include/linux/mtd/mtd.h
-@@ -586,6 +586,8 @@ extern struct mtd_info *get_mtd_device(s
- extern int __get_mtd_device(struct mtd_info *mtd);
+@@ -587,6 +587,8 @@ extern int __get_mtd_device(struct mtd_i
  extern void __put_mtd_device(struct mtd_info *mtd);
+ extern struct mtd_info *of_get_mtd_device_by_node(struct device_node *np);
  extern struct mtd_info *get_mtd_device_nm(const char *name);
 +extern struct mtd_info *get_mtd_device_by_node(
 +		const struct device_node *of_node);
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/655-increase_skb_pad.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/655-increase_skb_pad.patch
index e325301..ab79395 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/655-increase_skb_pad.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/655-increase_skb_pad.patch
@@ -9,7 +9,7 @@
 
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -2650,7 +2650,7 @@ static inline int pskb_network_may_pull(
+@@ -2658,7 +2658,7 @@ static inline int pskb_network_may_pull(
   * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
   */
  #ifndef NET_SKB_PAD
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
index 9795a99..abdf445 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/generic/pending-5.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
@@ -32,7 +32,7 @@
  	__u16			tc_index;	/* traffic control index */
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -5541,6 +5541,9 @@ static enum gro_result dev_gro_receive(s
+@@ -5542,6 +5542,9 @@ static enum gro_result dev_gro_receive(s
  	int same_flow;
  	int grow;
  
@@ -42,7 +42,7 @@
  	if (netif_elide_gro(skb->dev))
  		goto normal;
  
-@@ -7484,6 +7487,48 @@ static void __netdev_adjacent_dev_unlink
+@@ -7485,6 +7488,48 @@ static void __netdev_adjacent_dev_unlink
  					   &upper_dev->adj_list.lower);
  }
  
@@ -91,7 +91,7 @@
  static int __netdev_upper_dev_link(struct net_device *dev,
  				   struct net_device *upper_dev, bool master,
  				   void *upper_priv, void *upper_info,
-@@ -7534,6 +7579,7 @@ static int __netdev_upper_dev_link(struc
+@@ -7535,6 +7580,7 @@ static int __netdev_upper_dev_link(struc
  	if (ret)
  		return ret;
  
@@ -99,7 +99,7 @@
  	ret = call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
  					    &changeupper_info.info);
  	ret = notifier_to_errno(ret);
-@@ -7627,6 +7673,7 @@ void netdev_upper_dev_unlink(struct net_
+@@ -7628,6 +7674,7 @@ void netdev_upper_dev_unlink(struct net_
  
  	__netdev_adjacent_dev_unlink_neighbour(dev, upper_dev);
  
@@ -107,7 +107,7 @@
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
  				      &changeupper_info.info);
  
-@@ -8357,6 +8404,7 @@ int dev_set_mac_address(struct net_devic
+@@ -8358,6 +8405,7 @@ int dev_set_mac_address(struct net_devic
  	if (err)
  		return err;
  	dev->addr_assign_type = NET_ADDR_SET;
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 6955aad..a05cd19 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/files-5.4/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -1051,10 +1051,9 @@
 	struct mtk_eth *eth = mac->hw;
 	struct mtk_tx_dma_v2 *desc = txd;
 	u32 data = 0;
-	u16 qid;
 
 	if(!info->qid && mac->id)
-		qid = MTK_QDMA_GMAC2_QID;
+		info->qid = MTK_QDMA_GMAC2_QID;
 
 	WRITE_ONCE(desc->txd1, info->addr);
 
@@ -1064,7 +1063,7 @@
 	WRITE_ONCE(desc->txd3, data);
 
 	data = (mac->id + 1) << TX_DMA_FPORT_SHIFT_V2; /* forward port */
-	data |= TX_DMA_SWC_V2 | QID_BITS_V2(qid);
+	data |= TX_DMA_SWC_V2 | QID_BITS_V2(info->qid);
 #if defined(CONFIG_NET_MEDIATEK_HNAT) || defined(CONFIG_NET_MEDIATEK_HNAT_MODULE)
 	if (HNAT_SKB_CB2(skb)->magic == 0x78681415) {
 		data &= ~(0xf << TX_DMA_FPORT_SHIFT_V2);
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9996-add-wed-tx-wds-support-for-mt7986.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9996-add-wed-tx-wds-support-for-mt7986.patch
index 27977ac..d17f43d 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9996-add-wed-tx-wds-support-for-mt7986.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9996-add-wed-tx-wds-support-for-mt7986.patch
@@ -5,15 +5,24 @@
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- drivers/net/ethernet/mediatek/mtk_wed.c      | 6 ++++++
+ drivers/net/ethernet/mediatek/mtk_wed.c      | 8 +++++++-
  drivers/net/ethernet/mediatek/mtk_wed_regs.h | 1 +
- include/linux/soc/mediatek/mtk_wed.h         | 1 +
- 3 files changed, 8 insertions(+)
+ include/linux/soc/mediatek/mtk_wed.h         | 3 +++
+ 3 files changed, 11 insertions(+), 1 deletion(-)
 
 diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c
-index 48b0353..2700176 100644
+index 48b0353..472726e 100644
 --- a/drivers/net/ethernet/mediatek/mtk_wed.c
 +++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -797,7 +797,7 @@ mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
+ 		val |= BIT(0);
+ 		regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
+ 	} else {
+-		mtk_wed_set_512_support(dev, true);
++		mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
+ 	}
+ 
+ 	mtk_wed_dma_enable(dev);
 @@ -809,6 +809,7 @@ mtk_wed_attach(struct mtk_wed_device *dev)
  	__releases(RCU)
  {
@@ -47,7 +56,7 @@
  #define MTK_WED_RESET					0x008
  #define MTK_WED_RESET_TX_BM				BIT(0)
 diff --git a/include/linux/soc/mediatek/mtk_wed.h b/include/linux/soc/mediatek/mtk_wed.h
-index ffd547a..631360b 100644
+index ffd547a..e914cb4 100644
 --- a/include/linux/soc/mediatek/mtk_wed.h
 +++ b/include/linux/soc/mediatek/mtk_wed.h
 @@ -42,6 +42,7 @@ struct mtk_wed_device {
@@ -58,6 +67,15 @@
  
  	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
  	struct mtk_wed_ring txfree_ring;
+@@ -72,6 +73,8 @@ struct mtk_wed_device {
+ 		u16 token_start;
+ 		unsigned int nbuf;
+ 
++		bool wcid_512;
++
+ 		u32 (*init_buf)(void *ptr, dma_addr_t phys, int token_id);
+ 		int (*offload_enable)(struct mtk_wed_device *wed);
+ 		void (*offload_disable)(struct mtk_wed_device *wed);
 -- 
 2.18.0
 
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9997-add-wed-rx-support-for-mt7896.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9997-add-wed-rx-support-for-mt7896.patch
index 64c3d33..e99920a 100644
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9997-add-wed-rx-support-for-mt7896.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9997-add-wed-rx-support-for-mt7896.patch
@@ -996,7 +996,7 @@
  		val |= BIT(0);
  		regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
  	} else {
--		mtk_wed_set_512_support(dev, true);
+-		mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
 +		/* driver set mid ready and only once */
 +		wed_w32(dev, MTK_WED_EXT_INT_MASK1,
 +			MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY);
@@ -1010,7 +1010,7 @@
 +		if (ret)
 +			return;
  	}
-+	mtk_wed_set_512_support(dev, true);
++	mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
  
  	mtk_wed_dma_enable(dev);
  	dev->running = true;
@@ -3447,7 +3447,7 @@
 +#endif
 +
 diff --git a/include/linux/soc/mediatek/mtk_wed.h b/include/linux/soc/mediatek/mtk_wed.h
-index 631360b..393f3ca 100644
+index e914cb4..cfa1120 100644
 --- a/include/linux/soc/mediatek/mtk_wed.h
 +++ b/include/linux/soc/mediatek/mtk_wed.h
 @@ -7,6 +7,9 @@
@@ -3494,7 +3494,7 @@
  struct mtk_wed_device {
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	const struct mtk_wed_ops *ops;
-@@ -47,35 +77,54 @@ struct mtk_wed_device {
+@@ -47,37 +77,56 @@ struct mtk_wed_device {
  	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
  	struct mtk_wed_ring txfree_ring;
  	struct mtk_wed_ring tx_wdma[MTK_WED_TX_QUEUES];
@@ -3543,6 +3543,8 @@
 +		unsigned int rx_pkt;
 +		unsigned int rx_pkt_size;
  
+ 		bool wcid_512;
+ 
  		u32 (*init_buf)(void *ptr, dma_addr_t phys, int token_id);
  		int (*offload_enable)(struct mtk_wed_device *wed);
  		void (*offload_disable)(struct mtk_wed_device *wed);
@@ -3554,7 +3556,7 @@
  	} wlan;
  #endif
  };
-@@ -86,6 +135,10 @@ struct mtk_wed_ops {
+@@ -88,6 +137,10 @@ struct mtk_wed_ops {
  			     void __iomem *regs);
  	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
  				 void __iomem *regs);
@@ -3565,7 +3567,7 @@
  	void (*detach)(struct mtk_wed_device *dev);
  
  	void (*stop)(struct mtk_wed_device *dev);
-@@ -97,6 +150,8 @@ struct mtk_wed_ops {
+@@ -99,6 +152,8 @@ struct mtk_wed_ops {
  
  	u32 (*irq_get)(struct mtk_wed_device *dev, u32 mask);
  	void (*irq_set_mask)(struct mtk_wed_device *dev, u32 mask);
@@ -3574,7 +3576,7 @@
  };
  
  extern const struct mtk_wed_ops __rcu *mtk_soc_wed_ops;
-@@ -129,6 +184,10 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
+@@ -131,6 +186,10 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
  	(_dev)->ops->tx_ring_setup(_dev, _ring, _regs)
  #define mtk_wed_device_txfree_ring_setup(_dev, _regs) \
  	(_dev)->ops->txfree_ring_setup(_dev, _regs)
@@ -3585,7 +3587,7 @@
  #define mtk_wed_device_reg_read(_dev, _reg) \
  	(_dev)->ops->reg_read(_dev, _reg)
  #define mtk_wed_device_reg_write(_dev, _reg, _val) \
-@@ -137,6 +196,8 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
+@@ -139,6 +198,8 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
  	(_dev)->ops->irq_get(_dev, _mask)
  #define mtk_wed_device_irq_set_mask(_dev, _mask) \
  	(_dev)->ops->irq_set_mask(_dev, _mask)
@@ -3594,7 +3596,7 @@
  #else
  static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
  {
-@@ -146,10 +207,13 @@ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
+@@ -148,10 +209,13 @@ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
  #define mtk_wed_device_start(_dev, _mask) do {} while (0)
  #define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs) -ENODEV
  #define mtk_wed_device_txfree_ring_setup(_dev, _ring, _regs) -ENODEV
diff --git a/recipes-kernel/linux/linux-mediatek_5.4.bb b/recipes-kernel/linux/linux-mediatek_5.4.bb
index db34df0..37ea0a1 100644
--- a/recipes-kernel/linux/linux-mediatek_5.4.bb
+++ b/recipes-kernel/linux/linux-mediatek_5.4.bb
@@ -7,8 +7,8 @@
 
 KBRANCH ?= "linux-5.4.y"
 
-LINUX_VERSION ?= "5.4.211"
-SRCREV_machine ?= "684cc17be897de3b0fd2e5a021a702f68046d9fe"
+LINUX_VERSION ?= "5.4.213"
+SRCREV_machine ?= "7e17397001a93541ffefdef553a3d541f9c1c8f8"
 KMETA = "kernel-meta"
 SRCREV_meta ?= "feeb59687bc0f054af837a5061f8d413ec7c93e9"
 
diff --git a/recipes-kernel/wireless-regdb/wireless-regdb_2022.06.06.bb b/recipes-kernel/wireless-regdb/wireless-regdb_2022.08.12.bb
similarity index 94%
rename from recipes-kernel/wireless-regdb/wireless-regdb_2022.06.06.bb
rename to recipes-kernel/wireless-regdb/wireless-regdb_2022.08.12.bb
index b4e4ad2..1f07d03 100644
--- a/recipes-kernel/wireless-regdb/wireless-regdb_2022.06.06.bb
+++ b/recipes-kernel/wireless-regdb/wireless-regdb_2022.08.12.bb
@@ -5,7 +5,7 @@
 LIC_FILES_CHKSUM = "file://LICENSE;md5=07c4f6dea3845b02a18dc00c8c87699c"
 
 SRC_URI = "https://www.kernel.org/pub/software/network/${BPN}/${BP}.tar.xz"
-SRC_URI[sha256sum] = "ac00f97efecce5046ed069d1d93f3365fdf994c7c7854a8fc50831e959537230"
+SRC_URI[sha256sum] = "59c8f7d17966db71b27f90e735ee8f5b42ca3527694a8c5e6e9b56bd379c3b84"
 
 FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches:"
 require files/patches/patches.inc