[rdkb][common][bsp][Refactor and sync wifi from openwrt]

[Description]
d5ae826 [MAC80211][mt76][Fix AP crash when a station connects to AP]
5ba8783 [MAC80211][misc][Add MT7996 external openwrt build]
9e48559 [MAC80211][mt76][move muru_onoff in mt7915_phy]
1477805 [mac80211][mt76][wifi: mt76: update tx statistics]

[Release-log]

Change-Id: I93284df17ea450cba0339fa97e46dd00c40f4d9b
diff --git a/recipes-wifi/hostapd/hostapd_2.10.3.bb b/recipes-wifi/hostapd/hostapd_2.10.3.bb
index fbe2e44..0f5ac38 100644
--- a/recipes-wifi/hostapd/hostapd_2.10.3.bb
+++ b/recipes-wifi/hostapd/hostapd_2.10.3.bb
@@ -67,6 +67,7 @@
     echo "CONFIG_MESH=y" >> ${B}/.config
     echo "CONFIG_WEP=y" >> ${B}/.config
     echo "CONFIG_FILS=y" >> ${B}/.config
+    echo "CONFIG_IEEE80211BE=y" >> ${B}/.config
 }
 
 do_filogic_patches() {
diff --git a/recipes-wifi/iw/iw_5.19.bb b/recipes-wifi/iw/iw_5.19.bb
index 8241477..861bf50 100644
--- a/recipes-wifi/iw/iw_5.19.bb
+++ b/recipes-wifi/iw/iw_5.19.bb
@@ -19,8 +19,12 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/patches:"
 require patches/patches.inc
 
+SRC_URI_remove = "${@bb.utils.contains('DISTRO_FEATURES', 'wifi_eht', 'file://001-nl80211_h_sync.patch', '', d)}"
+SRC_URI_remove = "${@bb.utils.contains('DISTRO_FEATURES', 'wifi_eht', 'file://120-antenna_gain.patch', '', d)}"
+
 inherit pkgconfig
 
+
 EXTRA_OEMAKE = "\
     -f '${S}/Makefile' \
     \
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/9999901-mac80211-mtk-add-rate-duration-for-EHT-rate.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/9999901-mac80211-mtk-add-rate-duration-for-EHT-rate.patch
new file mode 100644
index 0000000..0675c5e
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/9999901-mac80211-mtk-add-rate-duration-for-EHT-rate.patch
@@ -0,0 +1,464 @@
+From 06ae5e66a56e6def22c1d4d61d75815f9b1f7ee2 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Sun, 25 Dec 2022 22:43:46 +0800
+Subject: [PATCH 9999901/9999902] mac80211: mtk: add rate duration for EHT
+ rate.
+
+---
+ include/net/mac80211.h |   4 +-
+ net/mac80211/airtime.c | 349 ++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 348 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index dd9e834..f7fcefe 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1437,6 +1437,7 @@ enum mac80211_rx_encoding {
+ 	RX_ENC_HT,
+ 	RX_ENC_VHT,
+ 	RX_ENC_HE,
++	RX_ENC_EHT,
+ };
+ 
+ /**
+@@ -1499,8 +1500,7 @@ struct ieee80211_rx_status {
+ 	u32 flag;
+ 	u16 freq: 13, freq_offset: 1;
+ 	u8 enc_flags;
+-	u8 encoding:2, bw:3, he_ru:3;
+-	u8 he_gi:2, he_dcm:1;
++	u16 encoding:3, bw:3, he_ru:3, he_gi:2, he_dcm:1;
+ 	u8 rate_idx;
+ 	u8 nss;
+ 	u8 rx_flags;
+diff --git a/net/mac80211/airtime.c b/net/mac80211/airtime.c
+index e8ebd34..b1de6d0 100644
+--- a/net/mac80211/airtime.c
++++ b/net/mac80211/airtime.c
+@@ -55,10 +55,21 @@
+ #define HE_DURATION_S(shift, streams, gi, bps)		\
+ 	(HE_DURATION(streams, gi, bps) >> shift)
+ 
++/* Transmit duration for the raw data part of an average sized packet */
++#define EHT_GI_08 HE_GI_08
++#define EHT_GI_16 HE_GI_16
++#define EHT_GI_32 HE_GI_32
++
++#define EHT_DURATION(streams, gi, bps)			\
++	HE_DURATION(streams, gi, bps)
++#define EHT_DURATION_S(shift, streams, gi, bps)		\
++	HE_DURATION_S(shift, streams, gi, bps)
++
+ #define BW_20			0
+ #define BW_40			1
+ #define BW_80			2
+ #define BW_160			3
++#define BW_320			4
+ 
+ /*
+  * Define group sort order: HT40 -> SGI -> #streams
+@@ -68,17 +79,26 @@
+ #define IEEE80211_VHT_STREAM_GROUPS	8 /* BW(=4) * SGI(=2) */
+ 
+ #define IEEE80211_HE_MAX_STREAMS	8
++#define IEEE80211_HE_STREAM_GROUPS	12 /* BW(=4) * GI(=3) */
++
++#define IEEE80211_EHT_MAX_STREAMS	16
++#define IEEE80211_EHT_STREAM_GROUPS	15 /* BW(=5) * GI(=3) */
+ 
+ #define IEEE80211_HT_GROUPS_NB	(IEEE80211_MAX_STREAMS *	\
+ 				 IEEE80211_HT_STREAM_GROUPS)
+ #define IEEE80211_VHT_GROUPS_NB	(IEEE80211_MAX_STREAMS *	\
+ 					 IEEE80211_VHT_STREAM_GROUPS)
++#define IEEE80211_HE_GROUPS_NB	(IEEE80211_HE_MAX_STREAMS *	\
++				 IEEE80211_HE_STREAM_GROUPS)
++#define IEEE80211_EHT_GROUPS_NB	(IEEE80211_EHT_MAX_STREAMS *	\
++				 IEEE80211_EHT_STREAM_GROUPS)
+ 
+ #define IEEE80211_HT_GROUP_0	0
+ #define IEEE80211_VHT_GROUP_0	(IEEE80211_HT_GROUP_0 + IEEE80211_HT_GROUPS_NB)
+ #define IEEE80211_HE_GROUP_0	(IEEE80211_VHT_GROUP_0 + IEEE80211_VHT_GROUPS_NB)
++#define IEEE80211_EHT_GROUP_0	(IEEE80211_HE_GROUP_0 + IEEE80211_HE_GROUPS_NB)
+ 
+-#define MCS_GROUP_RATES		12
++#define MCS_GROUP_RATES		14
+ 
+ #define HT_GROUP_IDX(_streams, _sgi, _ht40)	\
+ 	IEEE80211_HT_GROUP_0 +			\
+@@ -203,6 +223,59 @@
+ #define HE_GROUP(_streams, _gi, _bw)					\
+ 	__HE_GROUP(_streams, _gi, _bw,				\
+ 		   HE_GROUP_SHIFT(_streams, _gi, _bw))
++
++#define EHT_BW2VBPS(_bw, r5, r4, r3, r2, r1)					\
++	(_bw == BW_320 ? r5 : _bw == BW_160 ? r4 : _bw == BW_80 ? r3 : _bw == BW_40 ? r2 : r1)
++
++#define EHT_GROUP_IDX(_streams, _gi, _bw)				\
++	(IEEE80211_EHT_GROUP_0 +					\
++	 IEEE80211_EHT_MAX_STREAMS * 3 * (_bw) +			\
++	 IEEE80211_EHT_MAX_STREAMS * (_gi) +				\
++	 (_streams) - 1)
++
++#define __EHT_GROUP(_streams, _gi, _bw, _s)				\
++	[EHT_GROUP_IDX(_streams, _gi, _bw)] = {			\
++	.shift = _s,							\
++	.duration = {							\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,   1960,   979,  489,  230,  115)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,   3920,  1958,  979,  475,  230)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,   5880,  2937, 1468,  705,  345)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,   7840,  3916, 1958,  936,  475)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  11760,  5875, 2937, 1411,  705)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  15680,  7833, 3916, 1872,  936)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  17640,  8827, 4406, 2102, 1051)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  19600,  9806, 4896, 2347, 1166)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  23520, 11764, 5875, 2808, 1411)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  26133, 13060, 6523, 3124, 1555)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  29400, 14702, 7344, 3513, 1756)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  32666, 16329, 8164, 3902, 1944)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  35280, 17640, 8820, 4212, 2106)),	\
++		EHT_DURATION_S(_s, _streams, _gi,			\
++			      EHT_BW2VBPS(_bw,  39200, 19600, 9800, 4680, 2340))	\
++        }								\
++}
++
++#define EHT_GROUP_SHIFT(_streams, _gi, _bw)				\
++	GROUP_SHIFT(EHT_DURATION(_streams, _gi,			\
++				EHT_BW2VBPS(_bw,   1960,   979,  489,  230,  115)))
++
++#define EHT_GROUP(_streams, _gi, _bw)					\
++	__EHT_GROUP(_streams, _gi, _bw,				\
++		   EHT_GROUP_SHIFT(_streams, _gi, _bw))
++
+ struct mcs_group {
+ 	u8 shift;
+ 	u16 duration[MCS_GROUP_RATES];
+@@ -376,6 +449,262 @@ static const struct mcs_group airtime_mcs_groups[] = {
+ 	HE_GROUP(6, HE_GI_32, BW_160),
+ 	HE_GROUP(7, HE_GI_32, BW_160),
+ 	HE_GROUP(8, HE_GI_32, BW_160),
++
++	/* EHT */
++	EHT_GROUP( 1, EHT_GI_08, BW_20),
++	EHT_GROUP( 2, EHT_GI_08, BW_20),
++	EHT_GROUP( 3, EHT_GI_08, BW_20),
++	EHT_GROUP( 4, EHT_GI_08, BW_20),
++	EHT_GROUP( 5, EHT_GI_08, BW_20),
++	EHT_GROUP( 6, EHT_GI_08, BW_20),
++	EHT_GROUP( 7, EHT_GI_08, BW_20),
++	EHT_GROUP( 8, EHT_GI_08, BW_20),
++	EHT_GROUP( 9, EHT_GI_08, BW_20),
++	EHT_GROUP(10, EHT_GI_08, BW_20),
++	EHT_GROUP(11, EHT_GI_08, BW_20),
++	EHT_GROUP(12, EHT_GI_08, BW_20),
++	EHT_GROUP(13, EHT_GI_08, BW_20),
++	EHT_GROUP(14, EHT_GI_08, BW_20),
++	EHT_GROUP(15, EHT_GI_08, BW_20),
++	EHT_GROUP(16, EHT_GI_08, BW_20),
++
++	EHT_GROUP( 1, EHT_GI_16, BW_20),
++	EHT_GROUP( 2, EHT_GI_16, BW_20),
++	EHT_GROUP( 3, EHT_GI_16, BW_20),
++	EHT_GROUP( 4, EHT_GI_16, BW_20),
++	EHT_GROUP( 5, EHT_GI_16, BW_20),
++	EHT_GROUP( 6, EHT_GI_16, BW_20),
++	EHT_GROUP( 7, EHT_GI_16, BW_20),
++	EHT_GROUP( 8, EHT_GI_16, BW_20),
++	EHT_GROUP( 9, EHT_GI_16, BW_20),
++	EHT_GROUP(10, EHT_GI_16, BW_20),
++	EHT_GROUP(11, EHT_GI_16, BW_20),
++	EHT_GROUP(12, EHT_GI_16, BW_20),
++	EHT_GROUP(13, EHT_GI_16, BW_20),
++	EHT_GROUP(14, EHT_GI_16, BW_20),
++	EHT_GROUP(15, EHT_GI_16, BW_20),
++	EHT_GROUP(16, EHT_GI_16, BW_20),
++
++	EHT_GROUP( 1, EHT_GI_32, BW_20),
++	EHT_GROUP( 2, EHT_GI_32, BW_20),
++	EHT_GROUP( 3, EHT_GI_32, BW_20),
++	EHT_GROUP( 4, EHT_GI_32, BW_20),
++	EHT_GROUP( 5, EHT_GI_32, BW_20),
++	EHT_GROUP( 6, EHT_GI_32, BW_20),
++	EHT_GROUP( 7, EHT_GI_32, BW_20),
++	EHT_GROUP( 8, EHT_GI_32, BW_20),
++	EHT_GROUP( 9, EHT_GI_32, BW_20),
++	EHT_GROUP(10, EHT_GI_32, BW_20),
++	EHT_GROUP(11, EHT_GI_32, BW_20),
++	EHT_GROUP(12, EHT_GI_32, BW_20),
++	EHT_GROUP(13, EHT_GI_32, BW_20),
++	EHT_GROUP(14, EHT_GI_32, BW_20),
++	EHT_GROUP(15, EHT_GI_32, BW_20),
++	EHT_GROUP(16, EHT_GI_32, BW_20),
++
++	EHT_GROUP( 1, EHT_GI_08, BW_40),
++	EHT_GROUP( 2, EHT_GI_08, BW_40),
++	EHT_GROUP( 3, EHT_GI_08, BW_40),
++	EHT_GROUP( 4, EHT_GI_08, BW_40),
++	EHT_GROUP( 5, EHT_GI_08, BW_40),
++	EHT_GROUP( 6, EHT_GI_08, BW_40),
++	EHT_GROUP( 7, EHT_GI_08, BW_40),
++	EHT_GROUP( 8, EHT_GI_08, BW_40),
++	EHT_GROUP( 9, EHT_GI_08, BW_40),
++	EHT_GROUP(10, EHT_GI_08, BW_40),
++	EHT_GROUP(11, EHT_GI_08, BW_40),
++	EHT_GROUP(12, EHT_GI_08, BW_40),
++	EHT_GROUP(13, EHT_GI_08, BW_40),
++	EHT_GROUP(14, EHT_GI_08, BW_40),
++	EHT_GROUP(15, EHT_GI_08, BW_40),
++	EHT_GROUP(16, EHT_GI_08, BW_40),
++
++	EHT_GROUP( 1, EHT_GI_16, BW_40),
++	EHT_GROUP( 2, EHT_GI_16, BW_40),
++	EHT_GROUP( 3, EHT_GI_16, BW_40),
++	EHT_GROUP( 4, EHT_GI_16, BW_40),
++	EHT_GROUP( 5, EHT_GI_16, BW_40),
++	EHT_GROUP( 6, EHT_GI_16, BW_40),
++	EHT_GROUP( 7, EHT_GI_16, BW_40),
++	EHT_GROUP( 8, EHT_GI_16, BW_40),
++	EHT_GROUP( 9, EHT_GI_16, BW_40),
++	EHT_GROUP(10, EHT_GI_16, BW_40),
++	EHT_GROUP(11, EHT_GI_16, BW_40),
++	EHT_GROUP(12, EHT_GI_16, BW_40),
++	EHT_GROUP(13, EHT_GI_16, BW_40),
++	EHT_GROUP(14, EHT_GI_16, BW_40),
++	EHT_GROUP(15, EHT_GI_16, BW_40),
++	EHT_GROUP(16, EHT_GI_16, BW_40),
++
++	EHT_GROUP( 1, EHT_GI_32, BW_40),
++	EHT_GROUP( 2, EHT_GI_32, BW_40),
++	EHT_GROUP( 3, EHT_GI_32, BW_40),
++	EHT_GROUP( 4, EHT_GI_32, BW_40),
++	EHT_GROUP( 5, EHT_GI_32, BW_40),
++	EHT_GROUP( 6, EHT_GI_32, BW_40),
++	EHT_GROUP( 7, EHT_GI_32, BW_40),
++	EHT_GROUP( 8, EHT_GI_32, BW_40),
++	EHT_GROUP( 9, EHT_GI_32, BW_40),
++	EHT_GROUP(10, EHT_GI_32, BW_40),
++	EHT_GROUP(11, EHT_GI_32, BW_40),
++	EHT_GROUP(12, EHT_GI_32, BW_40),
++	EHT_GROUP(13, EHT_GI_32, BW_40),
++	EHT_GROUP(14, EHT_GI_32, BW_40),
++	EHT_GROUP(15, EHT_GI_32, BW_40),
++	EHT_GROUP(16, EHT_GI_32, BW_40),
++
++	EHT_GROUP( 1, EHT_GI_08, BW_80),
++	EHT_GROUP( 2, EHT_GI_08, BW_80),
++	EHT_GROUP( 3, EHT_GI_08, BW_80),
++	EHT_GROUP( 4, EHT_GI_08, BW_80),
++	EHT_GROUP( 5, EHT_GI_08, BW_80),
++	EHT_GROUP( 6, EHT_GI_08, BW_80),
++	EHT_GROUP( 7, EHT_GI_08, BW_80),
++	EHT_GROUP( 8, EHT_GI_08, BW_80),
++	EHT_GROUP( 9, EHT_GI_08, BW_80),
++	EHT_GROUP(10, EHT_GI_08, BW_80),
++	EHT_GROUP(11, EHT_GI_08, BW_80),
++	EHT_GROUP(12, EHT_GI_08, BW_80),
++	EHT_GROUP(13, EHT_GI_08, BW_80),
++	EHT_GROUP(14, EHT_GI_08, BW_80),
++	EHT_GROUP(15, EHT_GI_08, BW_80),
++	EHT_GROUP(16, EHT_GI_08, BW_80),
++
++	EHT_GROUP( 1, EHT_GI_16, BW_80),
++	EHT_GROUP( 2, EHT_GI_16, BW_80),
++	EHT_GROUP( 3, EHT_GI_16, BW_80),
++	EHT_GROUP( 4, EHT_GI_16, BW_80),
++	EHT_GROUP( 5, EHT_GI_16, BW_80),
++	EHT_GROUP( 6, EHT_GI_16, BW_80),
++	EHT_GROUP( 7, EHT_GI_16, BW_80),
++	EHT_GROUP( 8, EHT_GI_16, BW_80),
++	EHT_GROUP( 9, EHT_GI_16, BW_80),
++	EHT_GROUP(10, EHT_GI_16, BW_80),
++	EHT_GROUP(11, EHT_GI_16, BW_80),
++	EHT_GROUP(12, EHT_GI_16, BW_80),
++	EHT_GROUP(13, EHT_GI_16, BW_80),
++	EHT_GROUP(14, EHT_GI_16, BW_80),
++	EHT_GROUP(15, EHT_GI_16, BW_80),
++	EHT_GROUP(16, EHT_GI_16, BW_80),
++
++	EHT_GROUP( 1, EHT_GI_32, BW_80),
++	EHT_GROUP( 2, EHT_GI_32, BW_80),
++	EHT_GROUP( 3, EHT_GI_32, BW_80),
++	EHT_GROUP( 4, EHT_GI_32, BW_80),
++	EHT_GROUP( 5, EHT_GI_32, BW_80),
++	EHT_GROUP( 6, EHT_GI_32, BW_80),
++	EHT_GROUP( 7, EHT_GI_32, BW_80),
++	EHT_GROUP( 8, EHT_GI_32, BW_80),
++	EHT_GROUP( 9, EHT_GI_32, BW_80),
++	EHT_GROUP(10, EHT_GI_32, BW_80),
++	EHT_GROUP(11, EHT_GI_32, BW_80),
++	EHT_GROUP(12, EHT_GI_32, BW_80),
++	EHT_GROUP(13, EHT_GI_32, BW_80),
++	EHT_GROUP(14, EHT_GI_32, BW_80),
++	EHT_GROUP(15, EHT_GI_32, BW_80),
++	EHT_GROUP(16, EHT_GI_32, BW_80),
++
++	EHT_GROUP( 1, EHT_GI_08, BW_160),
++	EHT_GROUP( 2, EHT_GI_08, BW_160),
++	EHT_GROUP( 3, EHT_GI_08, BW_160),
++	EHT_GROUP( 4, EHT_GI_08, BW_160),
++	EHT_GROUP( 5, EHT_GI_08, BW_160),
++	EHT_GROUP( 6, EHT_GI_08, BW_160),
++	EHT_GROUP( 7, EHT_GI_08, BW_160),
++	EHT_GROUP( 8, EHT_GI_08, BW_160),
++	EHT_GROUP( 9, EHT_GI_08, BW_160),
++	EHT_GROUP(10, EHT_GI_08, BW_160),
++	EHT_GROUP(11, EHT_GI_08, BW_160),
++	EHT_GROUP(12, EHT_GI_08, BW_160),
++	EHT_GROUP(13, EHT_GI_08, BW_160),
++	EHT_GROUP(14, EHT_GI_08, BW_160),
++	EHT_GROUP(15, EHT_GI_08, BW_160),
++	EHT_GROUP(16, EHT_GI_08, BW_160),
++
++	EHT_GROUP( 1, EHT_GI_16, BW_160),
++	EHT_GROUP( 2, EHT_GI_16, BW_160),
++	EHT_GROUP( 3, EHT_GI_16, BW_160),
++	EHT_GROUP( 4, EHT_GI_16, BW_160),
++	EHT_GROUP( 5, EHT_GI_16, BW_160),
++	EHT_GROUP( 6, EHT_GI_16, BW_160),
++	EHT_GROUP( 7, EHT_GI_16, BW_160),
++	EHT_GROUP( 8, EHT_GI_16, BW_160),
++	EHT_GROUP( 9, EHT_GI_16, BW_160),
++	EHT_GROUP(10, EHT_GI_16, BW_160),
++	EHT_GROUP(11, EHT_GI_16, BW_160),
++	EHT_GROUP(12, EHT_GI_16, BW_160),
++	EHT_GROUP(13, EHT_GI_16, BW_160),
++	EHT_GROUP(14, EHT_GI_16, BW_160),
++	EHT_GROUP(15, EHT_GI_16, BW_160),
++	EHT_GROUP(16, EHT_GI_16, BW_160),
++
++	EHT_GROUP( 1, EHT_GI_32, BW_160),
++	EHT_GROUP( 2, EHT_GI_32, BW_160),
++	EHT_GROUP( 3, EHT_GI_32, BW_160),
++	EHT_GROUP( 4, EHT_GI_32, BW_160),
++	EHT_GROUP( 5, EHT_GI_32, BW_160),
++	EHT_GROUP( 6, EHT_GI_32, BW_160),
++	EHT_GROUP( 7, EHT_GI_32, BW_160),
++	EHT_GROUP( 8, EHT_GI_32, BW_160),
++	EHT_GROUP( 9, EHT_GI_32, BW_160),
++	EHT_GROUP(10, EHT_GI_32, BW_160),
++	EHT_GROUP(11, EHT_GI_32, BW_160),
++	EHT_GROUP(12, EHT_GI_32, BW_160),
++	EHT_GROUP(13, EHT_GI_32, BW_160),
++	EHT_GROUP(14, EHT_GI_32, BW_160),
++	EHT_GROUP(15, EHT_GI_32, BW_160),
++	EHT_GROUP(16, EHT_GI_32, BW_160),
++
++	EHT_GROUP( 1, EHT_GI_08, BW_320),
++	EHT_GROUP( 2, EHT_GI_08, BW_320),
++	EHT_GROUP( 3, EHT_GI_08, BW_320),
++	EHT_GROUP( 4, EHT_GI_08, BW_320),
++	EHT_GROUP( 5, EHT_GI_08, BW_320),
++	EHT_GROUP( 6, EHT_GI_08, BW_320),
++	EHT_GROUP( 7, EHT_GI_08, BW_320),
++	EHT_GROUP( 8, EHT_GI_08, BW_320),
++	EHT_GROUP( 9, EHT_GI_08, BW_320),
++	EHT_GROUP(10, EHT_GI_08, BW_320),
++	EHT_GROUP(11, EHT_GI_08, BW_320),
++	EHT_GROUP(12, EHT_GI_08, BW_320),
++	EHT_GROUP(13, EHT_GI_08, BW_320),
++	EHT_GROUP(14, EHT_GI_08, BW_320),
++	EHT_GROUP(15, EHT_GI_08, BW_320),
++	EHT_GROUP(16, EHT_GI_08, BW_320),
++
++	EHT_GROUP( 1, EHT_GI_16, BW_320),
++	EHT_GROUP( 2, EHT_GI_16, BW_320),
++	EHT_GROUP( 3, EHT_GI_16, BW_320),
++	EHT_GROUP( 4, EHT_GI_16, BW_320),
++	EHT_GROUP( 5, EHT_GI_16, BW_320),
++	EHT_GROUP( 6, EHT_GI_16, BW_320),
++	EHT_GROUP( 7, EHT_GI_16, BW_320),
++	EHT_GROUP( 8, EHT_GI_16, BW_320),
++	EHT_GROUP( 9, EHT_GI_16, BW_320),
++	EHT_GROUP(10, EHT_GI_16, BW_320),
++	EHT_GROUP(11, EHT_GI_16, BW_320),
++	EHT_GROUP(12, EHT_GI_16, BW_320),
++	EHT_GROUP(13, EHT_GI_16, BW_320),
++	EHT_GROUP(14, EHT_GI_16, BW_320),
++	EHT_GROUP(15, EHT_GI_16, BW_320),
++	EHT_GROUP(16, EHT_GI_16, BW_320),
++
++	EHT_GROUP( 1, EHT_GI_32, BW_320),
++	EHT_GROUP( 2, EHT_GI_32, BW_320),
++	EHT_GROUP( 3, EHT_GI_32, BW_320),
++	EHT_GROUP( 4, EHT_GI_32, BW_320),
++	EHT_GROUP( 5, EHT_GI_32, BW_320),
++	EHT_GROUP( 6, EHT_GI_32, BW_320),
++	EHT_GROUP( 7, EHT_GI_32, BW_320),
++	EHT_GROUP( 8, EHT_GI_32, BW_320),
++	EHT_GROUP( 9, EHT_GI_32, BW_320),
++	EHT_GROUP(10, EHT_GI_32, BW_320),
++	EHT_GROUP(11, EHT_GI_32, BW_320),
++	EHT_GROUP(12, EHT_GI_32, BW_320),
++	EHT_GROUP(13, EHT_GI_32, BW_320),
++	EHT_GROUP(14, EHT_GI_32, BW_320),
++	EHT_GROUP(15, EHT_GI_32, BW_320),
++	EHT_GROUP(16, EHT_GI_32, BW_320),
+ };
+ 
+ static u32
+@@ -422,6 +751,9 @@ static u32 ieee80211_get_rate_duration(struct ieee80211_hw *hw,
+ 	case RATE_INFO_BW_160:
+ 		bw = BW_160;
+ 		break;
++	case RATE_INFO_BW_320:
++		bw = BW_320;
++		break;
+ 	default:
+ 		WARN_ON_ONCE(1);
+ 		return 0;
+@@ -443,11 +775,20 @@ static u32 ieee80211_get_rate_duration(struct ieee80211_hw *hw,
+ 		idx = status->rate_idx;
+ 		group = HE_GROUP_IDX(streams, status->he_gi, bw);
+ 		break;
++	case RX_ENC_EHT:
++		streams = status->nss;
++		idx = status->rate_idx;
++		group = EHT_GROUP_IDX(streams, status->he_gi, bw);
++		break;
+ 	default:
+ 		WARN_ON_ONCE(1);
+ 		return 0;
+ 	}
+ 
++	if (WARN_ON_ONCE((status->encoding != RX_ENC_EHT && streams > 8) ||
++			 (status->encoding == RX_ENC_EHT && streams > 16)))
++		return 0;
++
+ 	if (WARN_ON_ONCE((status->encoding != RX_ENC_HE && streams > 4) ||
+ 			 (status->encoding == RX_ENC_HE && streams > 8)))
+ 		return 0;
+@@ -517,7 +858,9 @@ static bool ieee80211_fill_rate_info(struct ieee80211_hw *hw,
+ 	stat->nss = ri->nss;
+ 	stat->rate_idx = ri->mcs;
+ 
+-	if (ri->flags & RATE_INFO_FLAGS_HE_MCS)
++	if (ri->flags & RATE_INFO_FLAGS_EHT_MCS)
++		stat->encoding = RX_ENC_EHT;
++	else if (ri->flags & RATE_INFO_FLAGS_HE_MCS)
+ 		stat->encoding = RX_ENC_HE;
+ 	else if (ri->flags & RATE_INFO_FLAGS_VHT_MCS)
+ 		stat->encoding = RX_ENC_VHT;
+@@ -529,7 +872,7 @@ static bool ieee80211_fill_rate_info(struct ieee80211_hw *hw,
+ 	if (ri->flags & RATE_INFO_FLAGS_SHORT_GI)
+ 		stat->enc_flags |= RX_ENC_FLAG_SHORT_GI;
+ 
+-	stat->he_gi = ri->he_gi;
++	stat->he_gi = (ri->flags & RATE_INFO_FLAGS_EHT_MCS) ? ri->eht_gi : ri->he_gi;
+ 
+ 	if (stat->encoding != RX_ENC_LEGACY)
+ 		return true;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/9999902-mac80211-mtk-add-EHT-BA1024-support.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/9999902-mac80211-mtk-add-EHT-BA1024-support.patch
new file mode 100644
index 0000000..76dd9ef
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/9999902-mac80211-mtk-add-EHT-BA1024-support.patch
@@ -0,0 +1,114 @@
+From 85dde30ef0509def7bfec494aef7e5395e656c50 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Sun, 25 Dec 2022 22:43:46 +0800
+Subject: [PATCH 9999902/9999902] mac80211: mtk: add EHT BA1024 support
+
+---
+ include/linux/ieee80211.h |  2 ++
+ net/mac80211/agg-tx.c     | 45 +++++++++++++++++++++++++++++++++++++--
+ 2 files changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 6f70394..27321f2 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -1270,6 +1270,8 @@ struct ieee80211_mgmt {
+ 					__le16 status;
+ 					__le16 capab;
+ 					__le16 timeout;
++					/* followed by BA Extension */
++					u8 variable[0];
+ 				} __packed addba_resp;
+ 				struct{
+ 					u8 action_code;
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index 318c71e..7f750c1 100755
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -66,10 +66,17 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct sk_buff *skb;
+ 	struct ieee80211_mgmt *mgmt;
++	struct ieee80211_addba_ext_ie *addba_ext;
++	u8 *pos;
+ 	u16 capab = 0;
+ 	bool amsdu = ieee80211_hw_check(&local->hw, SUPPORTS_AMSDU_IN_AMPDU);
+ 
+-	skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
++	if (agg_size >= 1024)
++		skb = dev_alloc_skb(sizeof(*mgmt) +
++				    2 + sizeof(struct ieee80211_addba_ext_ie) +
++				    local->hw.extra_tx_headroom);
++	else
++		skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+ 
+ 	if (!skb)
+ 		return;
+@@ -108,6 +115,15 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+ 	mgmt->u.action.u.addba_req.start_seq_num =
+ 					cpu_to_le16(start_seq_num << 4);
+ 
++	if (agg_size >= 1024 ) {
++		pos = skb_put_zero(skb, 2 + sizeof(struct ieee80211_addba_ext_ie));
++		*pos++ = WLAN_EID_ADDBA_EXT;
++		*pos++ = sizeof(struct ieee80211_addba_ext_ie);
++		addba_ext = (struct ieee80211_addba_ext_ie *)pos;
++		addba_ext->data = u8_encode_bits(agg_size >> IEEE80211_ADDBA_EXT_BUF_SIZE_SHIFT,
++						 IEEE80211_ADDBA_EXT_BUF_SIZE_MASK);
++	}
++
+ 	ieee80211_tx_skb_tid(sdata, skb, tid, -1);
+ }
+ 
+@@ -469,8 +485,11 @@ static void ieee80211_send_addba_with_timeout(struct sta_info *sta,
+ 	sta->ampdu_mlme.addba_req_num[tid]++;
+ 	spin_unlock_bh(&sta->lock);
+ 
+-	if (sta->sta.deflink.he_cap.has_he) {
++	if (sta->sta.deflink.eht_cap.has_eht) {
+ 		buf_size = local->hw.max_tx_aggregation_subframes;
++	} else if (sta->sta.deflink.he_cap.has_he) {
++		buf_size = min_t(u16, local->hw.max_tx_aggregation_subframes,
++				 IEEE80211_MAX_AMPDU_BUF_HE);
+ 	} else {
+ 		/*
+ 		 * We really should use what the driver told us it will
+@@ -960,13 +979,35 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
+ {
+ 	struct tid_ampdu_tx *tid_tx;
+ 	struct ieee80211_txq *txq;
++	struct ieee802_11_elems *elems;
+ 	u16 capab, tid, buf_size;
+ 	bool amsdu;
++	int ext_ie_len;
+ 
+ 	capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
+ 	amsdu = capab & IEEE80211_ADDBA_PARAM_AMSDU_MASK;
+ 	tid = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_TID_MASK);
+ 	buf_size = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
++	ext_ie_len = len - offsetof(struct ieee80211_mgmt,
++				    u.action.u.addba_resp.variable);
++
++	if (ext_ie_len < 0)
++		goto next;
++
++	elems = ieee802_11_parse_elems(mgmt->u.action.u.addba_resp.variable,
++				       ext_ie_len, true, NULL);
++
++	if (elems && !elems->parse_error) {
++		if (sta->sta.deflink.eht_cap.has_eht && elems->addba_ext_ie) {
++			u8 buf_size_1k = u8_get_bits(elems->addba_ext_ie->data,
++						     IEEE80211_ADDBA_EXT_BUF_SIZE_MASK);
++			buf_size |= buf_size_1k << IEEE80211_ADDBA_EXT_BUF_SIZE_SHIFT;
++		}
++	}
++
++	if (elems)
++		kfree(elems);
++next:
+ 	buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
+ 
+ 	txq = sta->sta.txq[tid];
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
index d3dc6b5..0cb625c 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -33,4 +33,6 @@
     file://99900-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch \
     file://99902-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi.patch \
     file://99999-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch \
+    file://9999901-mac80211-mtk-add-rate-duration-for-EHT-rate.patch \
+    file://9999902-mac80211-mtk-add-EHT-BA1024-support.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 2ebf984..a6336d6 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,4 +1,4 @@
-From c1c5febad5b40bba3026976061a2d6c234f8ad25 Mon Sep 17 00:00:00 2001
+From ecececeedd9e0b8ed6589ed4e25d5fdf6789a59b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
 Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
@@ -11,18 +11,18 @@
  mt7915/main.c         |    4 +
  mt7915/mcu.c          |   48 +-
  mt7915/mcu.h          |    4 +
- mt7915/mt7915.h       |   44 +
+ mt7915/mt7915.h       |   43 +
  mt7915/mt7915_debug.h | 1363 +++++++++++++++++++
  mt7915/mtk_debugfs.c  | 3003 +++++++++++++++++++++++++++++++++++++++++
  mt7915/mtk_mcu.c      |   51 +
  tools/fwlog.c         |   44 +-
- 12 files changed, 4642 insertions(+), 14 deletions(-)
+ 12 files changed, 4641 insertions(+), 14 deletions(-)
  create mode 100644 mt7915/mt7915_debug.h
  create mode 100644 mt7915/mtk_debugfs.c
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a5e6ee4d..cbe0c52a 100644
+index a5e6ee4..cbe0c52 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1151,6 +1151,7 @@ enum {
@@ -46,7 +46,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index f033116c..cbcb64be 100644
+index f033116..cbcb64b 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -4,7 +4,7 @@ EXTRA_CFLAGS += -DCONFIG_MT76_LEDS
@@ -59,7 +59,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 5a46813a..f1f3f2f3 100644
+index 5a46813..f1f3f2f 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -203,7 +203,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 97ca55d2..1ba4096d 100644
+index 97ca55d..1ba4096 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -299,6 +299,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -242,7 +242,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3bbccbdf..94ecded5 100644
+index 3bbccbd..94ecded 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -258,7 +258,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f151ce86..ff718f78 100644
+index f151ce8..ff718f7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -342,7 +342,7 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b9ea297f..da863601 100644
+index b9ea297..da86360 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -278,6 +278,10 @@ enum {
@@ -357,7 +357,7 @@
  };
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3cbfb9b6..19880099 100644
+index 3cbfb9b..5fcc8ac 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -368,7 +368,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -373,6 +374,29 @@ struct mt7915_dev {
+@@ -373,6 +374,28 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -391,14 +391,13 @@
 +		bool dump_rx_raw;
 +		u32 token_idx;
 +		u8 sku_disable;
-+		u8 muru_onoff;
 +	} dbg;
 +	const struct mt7915_dbg_reg_desc *dbg_reg;
 +#endif
  };
  
  enum {
-@@ -651,4 +675,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -651,4 +674,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -425,7 +424,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 00000000..ca553dca
+index 0000000..ca553dc
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1363 @@
@@ -1794,7 +1793,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 00000000..4fb845b0
+index 0000000..4fb845b
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,3003 @@
@@ -4803,7 +4802,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 00000000..143dae26
+index 0000000..143dae2
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4859,7 +4858,7 @@
 +				 sizeof(req), true);
 +}
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a105..3d51d9ec 100644
+index e5d4a10..3d51d9e 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
@@ -4973,5 +4972,5 @@
  	return ret;
  }
 -- 
-2.18.0
+2.39.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 08c1be9..30c30f1 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,33 +1,43 @@
-From b2fbeb0f208704fa5e6bb2a5e6a32e5f77be4e96 Mon Sep 17 00:00:00 2001
+From f45e6908cbe43d1dd02f92569ed2549e021822e1 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
  debugfs
 
 ---
- mt7915/init.c        |  1 +
- mt7915/mcu.c         | 11 ++++++++---
+ mt7915/init.c        |  2 ++
+ mt7915/mcu.c         | 12 +++++++++---
  mt7915/mcu.h         |  6 ++++++
+ mt7915/mt7915.h      |  2 ++
  mt7915/mtk_debugfs.c | 33 +++++++++++++++++++++++++++++++++
- 4 files changed, 48 insertions(+), 3 deletions(-)
+ 5 files changed, 52 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 06ac261f..f73d34a9 100644
+index 06ac261..3897ac4 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -687,6 +687,7 @@ static void mt7915_init_work(struct work_struct *work)
- 	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
- 	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
- 	mt7915_txbf_init(dev);
-+	dev->dbg.muru_onoff = OFDMA_DL | MUMIMO_UL | MUMIMO_DL;
+@@ -433,6 +433,8 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+ 		mphy->leds.cdev.brightness_set = mt7915_led_set_brightness;
+ 		mphy->leds.cdev.blink_set = mt7915_led_set_blink;
+ 	}
++
++	phy->muru_onoff = OFDMA_DL | MUMIMO_UL | MUMIMO_DL;
  }
  
- void mt7915_wfsys_reset(struct mt7915_dev *dev)
+ static void
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 59cce553..a46b714d 100644
+index 59cce55..cf9a3e2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -876,13 +876,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -864,6 +864,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+ 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
+ {
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct mt7915_phy *phy = mvif->phy;
+ 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
+ 	struct sta_rec_muru *muru;
+ 	struct tlv *tlv;
+@@ -876,13 +877,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  
  	muru = (struct sta_rec_muru *)tlv;
  
@@ -37,20 +47,20 @@
 +	muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
 +			        mvif->cap.vht_mu_ebfer ||
 +			        mvif->cap.vht_mu_ebfee) &&
-+			       !!(dev->dbg.muru_onoff & MUMIMO_DL);
++			       !!(phy->muru_onoff & MUMIMO_DL);
  	if (!is_mt7915(&dev->mt76))
  		muru->cfg.mimo_ul_en = true;
  	muru->cfg.ofdma_dl_en = true;
  
-+	muru->cfg.mimo_ul_en = !!(dev->dbg.muru_onoff & MUMIMO_UL);
-+	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
-+	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
++	muru->cfg.mimo_ul_en = !!(phy->muru_onoff & MUMIMO_UL);
++	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
++	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
 +
  	if (sta->deflink.vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c776417b..275a0ece 100644
+index c776417..275a0ec 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -609,4 +609,10 @@ struct csi_data {
@@ -64,8 +74,21 @@
 +#define MUMIMO_UL                      BIT(3)
 +
  #endif
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index df0d7a1..e94970b 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -307,6 +307,8 @@ struct mt7915_phy {
+ 	u32 rx_ampdu_ts;
+ 	u32 ampdu_ref;
+ 
++	u8 muru_onoff;
++
+ 	struct mib_stats mib;
+ 	struct mt76_channel_state state_ts;
+ 
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 4fb845b0..1aafe040 100644
+index 4fb845b..1aafe04 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2558,6 +2558,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
@@ -74,31 +97,31 @@
  
 +static int mt7915_muru_onoff_get(void *data, u64 *val)
 +{
-+       struct mt7915_dev *dev = data;
++	struct mt7915_phy *phy = data;
 +
-+       *val = dev->dbg.muru_onoff;
++	*val = phy->muru_onoff;
 +
-+       printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
-+               !!(dev->dbg.muru_onoff & MUMIMO_UL),
-+               !!(dev->dbg.muru_onoff & MUMIMO_DL),
-+               !!(dev->dbg.muru_onoff & OFDMA_UL),
-+               !!(dev->dbg.muru_onoff & OFDMA_DL));
++	printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
++		    !!(phy->muru_onoff & MUMIMO_UL),
++		    !!(phy->muru_onoff & MUMIMO_DL),
++		    !!(phy->muru_onoff & OFDMA_UL),
++		    !!(phy->muru_onoff & OFDMA_DL));
 +
-+       return 0;
++	return 0;
 +}
 +
 +static int mt7915_muru_onoff_set(void *data, u64 val)
 +{
-+       struct mt7915_dev *dev = data;
++	struct mt7915_phy *phy = data;
 +
-+       if (val > 15) {
-+               printk("Wrong value! The value is between 0 ~ 15.\n");
-+               goto exit;
-+       }
++	if (val > 15) {
++		printk("Wrong value! The value is between 0 ~ 15.\n");
++		goto exit;
++	}
 +
-+       dev->dbg.muru_onoff = val;
++	phy->muru_onoff = val;
 +exit:
-+       return 0;
++	return 0;
 +}
 +
 +DEFINE_DEBUGFS_ATTRIBUTE(fops_muru_onoff, mt7915_muru_onoff_get,
@@ -111,10 +134,10 @@
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
-+	debugfs_create_file("muru_onoff", 0600, dir, dev, &fops_muru_onoff);
++	debugfs_create_file("muru_onoff", 0600, dir, phy, &fops_muru_onoff);
  	debugfs_create_file("fw_debug_module", 0600, dir, dev,
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.18.0
+2.39.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
index 483bfab..1c216ec 100644
--- a/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
@@ -1,4 +1,4 @@
-From d3944b59509bc65831997e973cf800f1e3f2b205 Mon Sep 17 00:00:00 2001
+From a3246b4d0ebb9b123c552f05226b0dc612c70788 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
 Subject: [PATCH 1005/1009] mt76: mt7915: certification patches
@@ -10,13 +10,13 @@
  mt7915/mcu.c         | 466 +++++++++++++++++++++++++++++++++++++++++++
  mt7915/mcu.h         | 207 ++++++++++++++++++-
  mt7915/mt7915.h      |  13 ++
- mt7915/mtk_debugfs.c |   7 +-
+ mt7915/mtk_debugfs.c |  25 +--
  mt7915/vendor.c      | 187 +++++++++++++++++
  mt7915/vendor.h      |  42 ++++
- 9 files changed, 956 insertions(+), 5 deletions(-)
+ 9 files changed, 965 insertions(+), 14 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 60161c9e..ff114cb9 100644
+index 60161c9..ff114cb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1199,6 +1199,7 @@ enum {
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 547519cc..599d328d 100644
+index 547519c..599d328 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -76,7 +76,7 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3ded65de..e4d1c27b 100644
+index 3ded65d..05a5fbc 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -678,6 +678,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -84,12 +84,12 @@
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
 +#ifdef CONFIG_MTK_VENDOR
-+	struct mt7915_phy *phy;
++	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
 +#endif
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -705,7 +708,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -705,7 +708,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -99,20 +99,18 @@
 +		return ret;
 +
 +#ifdef CONFIG_MTK_VENDOR
-+	if (dev->dbg.muru_onoff & MUMIMO_DL_CERT) {
-+		phy = mvif->mt76.band_idx ? mt7915_ext_phy(dev) : &dev->phy;
++	if (phy->muru_onoff & MUMIMO_DL_CERT)
 +		mt7915_mcu_set_mimo(phy, 0);
-+	}
 +#endif
 +	return 0;
  }
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a46b714d..40b17b5f 100644
+index cf9a3e2..c15dce3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3938,6 +3938,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3939,6 +3939,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -120,7 +118,7 @@
 +{
 +	u8 mode, val;
 +	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mt7915_dev *dev =  mvif->phy->dev;
++	struct mt7915_phy *phy = mvif->phy;
 +
 +	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
 +	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
@@ -128,13 +126,13 @@
 +	switch (mode) {
 +	case RATE_PARAM_FIXED_OFDMA:
 +		if (val == 3) /* DL 20 and 80 */
-+			dev->dbg.muru_onoff = OFDMA_DL; /* Enable OFDMA DL only */
++			phy->muru_onoff = OFDMA_DL; /* Enable OFDMA DL only */
 +		else
-+			dev->dbg.muru_onoff = val;
++			phy->muru_onoff = val;
 +		break;
 +	case RATE_PARAM_FIXED_MIMO:
 +		if (val == 0)
-+			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
++			phy->muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
 +		break;
 +	}
 +}
@@ -586,7 +584,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 275a0ece..714bc44d 100644
+index 275a0ec..714bc44 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -416,10 +416,14 @@ enum {
@@ -820,10 +818,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9a9d7f55..018fd23e 100644
+index e94970b..8b292c3 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -721,6 +721,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -722,6 +722,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -844,32 +842,32 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 1aafe040..f8d2cbbb 100644
+index 1aafe04..e0af645 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2564,7 +2564,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+@@ -2564,7 +2564,8 @@ static int mt7915_muru_onoff_get(void *d
  
-        *val = dev->dbg.muru_onoff;
+ 	*val = phy->muru_onoff;
  
--       printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
-+	   printk("cert mumimo dl:%d, mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
-+               !!(dev->dbg.muru_onoff & MUMIMO_DL_CERT),
-                !!(dev->dbg.muru_onoff & MUMIMO_UL),
-                !!(dev->dbg.muru_onoff & MUMIMO_DL),
-                !!(dev->dbg.muru_onoff & OFDMA_UL),
-@@ -2577,8 +2578,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+-	printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
++	printk("cert mumimo dl:%d, normal mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
++		    !!(phy->muru_onoff & MUMIMO_DL_CERT),
+ 		    !!(phy->muru_onoff & MUMIMO_UL),
+ 		    !!(phy->muru_onoff & MUMIMO_DL),
+ 		    !!(phy->muru_onoff & OFDMA_UL),
+@@ -2577,8 +2578,8 @@ static int mt7915_muru_onoff_set(void *d
  {
-        struct mt7915_dev *dev = data;
+ 	struct mt7915_phy *phy = data;
  
--       if (val > 15) {
--               printk("Wrong value! The value is between 0 ~ 15.\n");
-+       if (val > 31) {
-+               printk("Wrong value! The value is between 0 ~ 31.\n");
-                goto exit;
-        }
+-	if (val > 15) {
+-		printk("Wrong value! The value is between 0 ~ 15.\n");
++	if (val > 31) {
++		printk("Wrong value! The value is between 0 ~ 31.\n");
+ 		goto exit;
+ 	}
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787e..7456c577 100644
+index b94d787..beb0583 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1029,7 +1027,7 @@
 +		mt7915_mcu_set_ppdu_tx_type(phy, val8);
 +	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA]) {
 +		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA]);
-+		if (FIELD_GET(OFDMA_UL, dev->dbg.muru_onoff) == 1)
++		if (FIELD_GET(OFDMA_UL, phy->muru_onoff) == 1)
 +			mt7915_mcu_set_nusers_ofdma(phy, MURU_UL_USER_CNT, val8);
 +		else
 +			mt7915_mcu_set_nusers_ofdma(phy, MURU_DL_USER_CNT, val8);
@@ -1081,7 +1079,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f3..1b08321c 100644
+index 976817f..1b08321 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -6,6 +6,48 @@
@@ -1134,5 +1132,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.18.0
+2.39.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 2df0a9c..92f3f59 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From dede9889b01c531a5e71c4b1beffaef33b799a0b Mon Sep 17 00:00:00 2001
+From 7197b9ba537a486c3ba398d2e0a806f093b682a3 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1007/1009] mt76: mt7915: add mt76 vendor muru onoff command
@@ -11,25 +11,25 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f7ed1049..6ec12fd2 100644
+index 3a0e87a..62d83bf 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3957,6 +3957,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3958,6 +3958,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
- 			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
+ 			phy->muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
 +	case RATE_PARAM_AUTO_HEMU:
 +		if (val < 0 || val > 15) {
 +			printk("Wrong value! The value is between 0-15.\n");
 +			break;
 +		}
-+		dev->dbg.muru_onoff = val;
++		phy->muru_onoff = val;
 +		break;
  	}
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 714bc44d..aaea3230 100644
+index 714bc44..aaea323 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -423,6 +423,7 @@ enum {
@@ -41,7 +41,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7456c577..c7551848 100644
+index beb0583..5acbd2d 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321c..a8e4ebf9 100644
+index 1b08321..a8e4ebf 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.18.0
+2.39.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
index 7ccc7d8..eaa50d3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
@@ -1,16 +1,16 @@
-From 12952f6d361dd09ed3e7c27ef54d0c2acd00ad6f Mon Sep 17 00:00:00 2001
+From 805623e9a7556fc147bd167a50bfe5538e924c7b Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
 Subject: [PATCH 1124/1133] mt76: mt7915: Add hemu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
- mt7915/vendor.c | 25 +++++++++++++++++++++++++
+ mt7915/vendor.c | 24 ++++++++++++++++++++++++
  mt7915/vendor.h |  1 +
- 2 files changed, 26 insertions(+)
+ 2 files changed, 25 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 2484e25f..f7becce9 100644
+index f712d67..83f38e0 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -21,7 +21,7 @@
  };
  
  static const struct nla_policy
-@@ -1004,6 +1005,29 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
+@@ -1004,6 +1005,28 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -33,14 +33,13 @@
 +{
 +	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 +	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
 +	int len = 0;
 +
 +	if (*storage == 1)
 +		return -ENOENT;
 +	*storage = 1;
 +
-+	if (nla_put_u8(skb, MTK_VENDOR_ATTR_HEMU_CTRL_DUMP, dev->dbg.muru_onoff))
++	if (nla_put_u8(skb, MTK_VENDOR_ATTR_HEMU_CTRL_DUMP, phy->muru_onoff))
 +		return -ENOMEM;
 +	len += 1;
 +
@@ -51,7 +50,7 @@
  static int
  mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1190,6 +1214,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1190,6 +1213,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
  			WIPHY_VENDOR_CMD_NEED_RUNNING,
  		.doit = mt7915_vendor_hemu_ctrl,
@@ -60,7 +59,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 72319717..c19ffe72 100644
+index 7231971..c19ffe7 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
@@ -72,5 +71,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.18.0
+2.39.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch b/recipes-wifi/linux-mt76/files/patches/3010-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch
new file mode 100644
index 0000000..d76e753
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3010-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch
@@ -0,0 +1,230 @@
+From aecf943a183c8b1e0ea7d503e406b88ebed57d06 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 18 Jan 2023 16:37:22 +0800
+Subject: [PATCH 3010/3015] wifi: mt76: mt7915: add wa command to get tx msdu
+ count
+
+---
+ mt76.h             |  2 +-
+ mt76_connac2_mac.h |  1 +
+ mt76_connac_mac.c  |  9 ++++----
+ mt76_connac_mcu.h  |  1 +
+ mt7915/main.c      |  8 ++++---
+ mt7915/mcu.c       | 56 +++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/mcu.h       | 11 +++++++++
+ mt7915/mt7915.h    |  1 +
+ 8 files changed, 78 insertions(+), 11 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index a36a978b..0d1f3cbf 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -285,7 +285,7 @@ struct mt76_sta_stats {
+ 	u64 tx_mcs[16];		/* mcs idx */
+ 	u64 tx_bytes;
+ 	/* WED TX */
+-	u32 tx_packets;
++	u32 tx_packets;		/* unit: MSDU */
+ 	u32 tx_retries;
+ 	u32 tx_failed;
+ 	/* WED RX */
+diff --git a/mt76_connac2_mac.h b/mt76_connac2_mac.h
+index f33171bc..101e7602 100644
+--- a/mt76_connac2_mac.h
++++ b/mt76_connac2_mac.h
+@@ -164,6 +164,7 @@ enum {
+ 
+ #define MT_TXS6_MPDU_FAIL_CNT		GENMASK(31, 23)
+ 
++#define MT_TXS7_MPDU_RETRY_BYTE		GENMASK(22, 0)
+ #define MT_TXS7_MPDU_RETRY_CNT		GENMASK(31, 23)
+ 
+ /* RXD DW1 */
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index 614df85e..57e02aec 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -491,7 +491,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ 
+ 		/* counting non-offloading skbs */
+ 		wcid->stats.tx_bytes += skb->len;
+-		wcid->stats.tx_packets++;
++
++		if (is_mt7915(dev))
++			wcid->stats.tx_packets++;
+ 	}
+ 
+ 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len + sz_txd) |
+@@ -575,9 +577,8 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 	/* PPDU based reporting */
+ 	if (FIELD_GET(MT_TXS0_TXS_FORMAT, txs) > 1) {
+ 		stats->tx_bytes +=
+-			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_BYTE);
+-		stats->tx_packets +=
+-			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_CNT);
++			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_BYTE) -
++			le32_get_bits(txs_data[7], MT_TXS7_MPDU_RETRY_BYTE);
+ 		stats->tx_failed +=
+ 			le32_get_bits(txs_data[6], MT_TXS6_MPDU_FAIL_CNT);
+ 		stats->tx_retries +=
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 130a8d25..34df625a 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1003,6 +1003,7 @@ enum {
+ 	MCU_EXT_EVENT_BF_STATUS_READ = 0x35,
+ 	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
+ 	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
++	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
+ 	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
+ 	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
+ 	MCU_EXT_EVENT_CSI_REPORT = 0xc2,
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 8ebea612..dca93cd8 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1103,9 +1103,6 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
+ 
+-		sinfo->tx_packets = msta->wcid.stats.tx_packets;
+-		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
+-
+ 		sinfo->tx_failed = msta->wcid.stats.tx_failed;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
+ 
+@@ -1121,6 +1118,11 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 		}
+ 	}
+ 
++	if (!mt7915_mcu_get_tx_stat_wa(phy->dev, msta->wcid.idx)) {
++		sinfo->tx_packets = msta->wcid.stats.tx_packets;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
++	}
++
+ 	sinfo->ack_signal = (s8)msta->ack_signal;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index b5a0967b..07681902 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -168,7 +168,9 @@ mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
+ 	}
+ 
+ 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
+-	if (seq != rxd->seq)
++
++	if (seq != rxd->seq &&
++	    !(rxd->eid == MCU_CMD_EXT_CID && rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
+ 		return -EAGAIN;
+ 
+ 	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
+@@ -420,13 +422,14 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	struct mt76_connac2_mcu_rxd *rxd;
+ 
+ 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
+-	if (rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
++	if ((rxd->ext_eid == MCU_EXT_EVENT_THERMAL_PROTECT ||
+ 	    rxd->ext_eid == MCU_EXT_EVENT_FW_LOG_2_HOST ||
+ 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
+ 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
+ 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
+ 	    rxd->ext_eid == MCU_EXT_EVENT_BF_STATUS_READ ||
+-	    !rxd->seq)
++	    !rxd->seq) &&
++	    !(rxd->eid == MCU_CMD_EXT_CID && rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
+ 		mt7915_mcu_rx_unsolicited_event(dev, skb);
+ 	else
+ 		mt76_mcu_rx_event(&dev->mt76, skb);
+@@ -4086,6 +4089,53 @@ out:
+ 	return ret;
+ }
+ 
++int mt7915_mcu_get_tx_stat_wa(struct mt7915_dev *dev, u16 wlan_idx)
++{
++	struct {
++		__le32 cmd;
++		__le32 num;
++		__le32 __rsv;
++		__le16 wlan_idx;
++	} req = {
++		.cmd = cpu_to_le32(MCU_WA_QUERY_GET_TX_STAT),
++		.num = cpu_to_le32(1),
++		.wlan_idx = cpu_to_le16(wlan_idx),
++	};
++	struct mt7915_mcu_wa_tx_stat *res;
++	struct mt76_wcid *wcid;
++	struct sk_buff *skb;
++	int ret;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
++					&req, sizeof(req), true, &skb);
++	if (ret)
++		return ret;
++
++	if (!is_mt7915(&dev->mt76))
++		skb_pull(skb, 4);
++
++	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
++
++	if (le16_to_cpu(res->wlan_idx) != wlan_idx) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	rcu_read_lock();
++
++	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
++	if (wcid)
++		wcid->stats.tx_packets += le32_to_cpu(res->tx_msdu_cnt);
++	else
++		ret = -EINVAL;
++
++	rcu_read_unlock();
++out:
++	dev_kfree_skb(skb);
++
++	return ret;
++}
++
+ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 				struct cfg80211_he_bss_color *he_bss_color)
+ {
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 24d0efd3..5f6c7c80 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -292,6 +292,17 @@ enum {
+ 	MCU_WA_PARAM_RED_SETTING = 0x40,
+ };
+ 
++enum {
++	MCU_WA_QUERY_GET_TX_STAT = 0x15,
++};
++
++struct mt7915_mcu_wa_tx_stat {
++	__le16 wlan_idx;
++	u8 __rsv2[2];
++	__le32 tx_bytes;
++	__le32 tx_msdu_cnt;
++};
++
+ enum mcu_mmps_mode {
+ 	MCU_MMPS_STATIC,
+ 	MCU_MMPS_DYNAMIC,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 594dfcd5..d76ca390 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -712,6 +712,7 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state);
+ int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
+ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 			   struct ieee80211_sta *sta, struct rate_info *rate);
++int mt7915_mcu_get_tx_stat_wa(struct mt7915_dev *dev, u16 wcid);
+ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
+ 				     struct cfg80211_chan_def *chandef);
+ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3011-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch b/recipes-wifi/linux-mt76/files/patches/3011-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch
new file mode 100644
index 0000000..64f073e
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3011-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch
@@ -0,0 +1,246 @@
+From 08fd3173f9a7e7b7ae1112f43358068ea83faa56 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 11 Jan 2023 10:56:27 +0800
+Subject: [PATCH 3011/3015] wifi: mt76: get tx count and tx failed from mcu
+ command
+
+---
+ mt76.h            |   1 +
+ mt76_connac_mac.c |   2 -
+ mt76_connac_mcu.h |   1 +
+ mt7915/main.c     |   8 ++--
+ mt7915/mcu.c      | 108 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/mcu.h      |  22 ++++++++++
+ mt7915/mt7915.h   |   1 +
+ 7 files changed, 138 insertions(+), 5 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index 0d1f3cbf..22c6531a 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -286,6 +286,7 @@ struct mt76_sta_stats {
+ 	u64 tx_bytes;
+ 	/* WED TX */
+ 	u32 tx_packets;		/* unit: MSDU */
++	u32 tx_mpdu_cnt;
+ 	u32 tx_retries;
+ 	u32 tx_failed;
+ 	/* WED RX */
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index 57e02aec..05a7a215 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -579,8 +579,6 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 		stats->tx_bytes +=
+ 			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_BYTE) -
+ 			le32_get_bits(txs_data[7], MT_TXS7_MPDU_RETRY_BYTE);
+-		stats->tx_failed +=
+-			le32_get_bits(txs_data[6], MT_TXS6_MPDU_FAIL_CNT);
+ 		stats->tx_retries +=
+ 			le32_get_bits(txs_data[7], MT_TXS7_MPDU_RETRY_CNT);
+ 	}
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 34df625a..747ae7e9 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1163,6 +1163,7 @@ enum {
+ 	MCU_EXT_CMD_EDCA_UPDATE = 0x27,
+ 	MCU_EXT_CMD_DEV_INFO_UPDATE = 0x2A,
+ 	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
++	MCU_EXT_CMD_GET_TX_STAT = 0x30,
+ 	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
+ 	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
+ 	MCU_EXT_CMD_SET_FEATURE_CTRL = 0x38,
+diff --git a/mt7915/main.c b/mt7915/main.c
+index dca93cd8..51129341 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1103,9 +1103,6 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
+ 
+-		sinfo->tx_failed = msta->wcid.stats.tx_failed;
+-		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
+-
+ 		sinfo->tx_retries = msta->wcid.stats.tx_retries;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
+ 
+@@ -1123,6 +1120,11 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
+ 	}
+ 
++	if (!mt7915_get_tx_stat(phy, msta->wcid.idx)) {
++		sinfo->tx_failed = msta->wcid.stats.tx_failed;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
++	}
++
+ 	sinfo->ack_signal = (s8)msta->ack_signal;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 07681902..e9856c1b 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -4136,6 +4136,114 @@ out:
+ 	return ret;
+ }
+ 
++static int mt7915_mcu_get_tx_stat_v1(struct mt7915_phy *phy,
++				     u16 wlan_idx)
++{
++#define to_wcid(hi, lo) (hi << 8 | lo)
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_phy *mphy = phy->mt76;
++	struct mt7915_mcu_tx_stat_v1 *res;
++	struct mt76_wcid *wcid;
++	struct sk_buff *skb;
++	struct {
++		__le32 category;
++		u8 wlan_idx_lo;
++		u8 band;
++		u8 wlan_idx_hi;
++		u8 __rsv[5];
++	} __packed req = {
++		.category = cpu_to_le32(MCU_GET_TX_STAT_CNT),
++		.band = mphy->band_idx,
++		.wlan_idx_lo = to_wcid_lo(wlan_idx),
++		.wlan_idx_hi = to_wcid_hi(wlan_idx),
++	};
++	int ret;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(GET_TX_STAT),
++					&req, sizeof(req), true, &skb);
++	if (ret)
++		return ret;
++
++	res = (struct mt7915_mcu_tx_stat_v1 *)skb->data;
++
++	if (to_wcid(res->wlan_idx_hi, res->wlan_idx_lo) != wlan_idx) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	rcu_read_lock();
++
++	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
++	if (wcid) {
++		wcid->stats.tx_mpdu_cnt += le32_to_cpu(res->tx_cnt);
++		wcid->stats.tx_failed += le32_to_cpu(res->tx_failed);
++	} else {
++		ret = -EINVAL;
++	}
++
++	rcu_read_unlock();
++out:
++	dev_kfree_skb(skb);
++
++	return ret;
++}
++
++static int mt7915_mcu_get_tx_stat_v2(struct mt7915_phy *phy,
++				     u16 wlan_idx)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_phy *mphy = phy->mt76;
++	struct mt7915_mcu_tx_stat_v2 *res;
++	struct mt76_wcid *wcid;
++	struct sk_buff *skb;
++	struct {
++		u8 category;
++		u8 band;
++		__le16 wcid;
++	} __packed req = {
++		.category = MCU_GET_TX_STAT_CNT,
++		.band = mphy->band_idx,
++		.wcid = cpu_to_le16(wlan_idx),
++	};
++	int ret;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(GET_TX_STAT),
++					&req, sizeof(req), true, &skb);
++	if (ret)
++		return ret;
++
++	res = (struct mt7915_mcu_tx_stat_v2 *)skb->data;
++
++	if (le16_to_cpu(res->wlan_idx) != wlan_idx) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	rcu_read_lock();
++
++	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
++	if (wcid) {
++		wcid->stats.tx_mpdu_cnt += le32_to_cpu(res->tx_cnt);
++		wcid->stats.tx_failed += le32_to_cpu(res->tx_failed);
++	} else {
++		ret = -EINVAL;
++	}
++
++	rcu_read_unlock();
++out:
++	dev_kfree_skb(skb);
++
++	return ret;
++}
++
++int mt7915_get_tx_stat(struct mt7915_phy *phy, u16 wlan_idx)
++{
++	if (is_mt7915(&phy->dev->mt76))
++		return mt7915_mcu_get_tx_stat_v1(phy, wlan_idx);
++
++	return mt7915_mcu_get_tx_stat_v2(phy, wlan_idx);
++}
++
+ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 				struct cfg80211_he_bss_color *he_bss_color)
+ {
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 5f6c7c80..7b611fb7 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -1018,6 +1018,28 @@ struct mt7915_muru {
+ /* DL&UL User config */
+ #define MURU_USER_CNT                   BIT(4)
+ 
++struct mt7915_mcu_tx_stat_v1 {
++	u8 wlan_idx_lo;
++	u8 band_idx;
++	u8 wlan_idx_hi;
++	u8 __rsv1[29];
++	__le32 tx_cnt;
++	__le32 tx_failed;
++	u8 __rsv2[26];
++};
++
++struct mt7915_mcu_tx_stat_v2 {
++	u8 __rsv1[4];
++	__le16 wlan_idx;
++	u8 __rsv2[2];
++	__le32 tx_cnt;
++	__le32 tx_failed;
++};
++
++enum {
++	MCU_GET_TX_STAT_CNT = 8,
++};
++
+ enum {
+    CAPI_SU,
+    CAPI_MU,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index d76ca390..ac019270 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -713,6 +713,7 @@ int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
+ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 			   struct ieee80211_sta *sta, struct rate_info *rate);
+ int mt7915_mcu_get_tx_stat_wa(struct mt7915_dev *dev, u16 wcid);
++int mt7915_get_tx_stat(struct mt7915_phy *phy, u16 wlan_idx);
+ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
+ 				     struct cfg80211_chan_def *chandef);
+ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3012-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch b/recipes-wifi/linux-mt76/files/patches/3012-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch
new file mode 100644
index 0000000..666f277
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3012-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch
@@ -0,0 +1,122 @@
+From 8af0601319706314171a8f9ed9117dd3fada484f Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 18 Jan 2023 11:50:38 +0800
+Subject: [PATCH 3012/3015] wifi: mt76: mt7915: enable PPDU-TxS to host when
+ wed enable
+
+Calculate tx bytes and tx retries from PPDU-TxS
+---
+ mt76_connac_mac.c |  2 --
+ mt7915/init.c     |  6 ++++++
+ mt7915/mmio.c     | 21 ---------------------
+ tx.c              |  6 ++++++
+ 4 files changed, 12 insertions(+), 23 deletions(-)
+
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index 05a7a215..d7cca351 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -490,8 +490,6 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ 			mt76_connac_lmac_mapping(skb_get_queue_mapping(skb));
+ 
+ 		/* counting non-offloading skbs */
+-		wcid->stats.tx_bytes += skb->len;
+-
+ 		if (is_mt7915(dev))
+ 			wcid->stats.tx_packets++;
+ 	}
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 92977b98..f24c45f6 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -489,6 +489,12 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+ 	set = FIELD_PREP(MT_WTBLOFF_TOP_RSCR_RCPI_MODE, 0) |
+ 	      FIELD_PREP(MT_WTBLOFF_TOP_RSCR_RCPI_PARAM, 0x3);
+ 	mt76_rmw(dev, MT_WTBLOFF_TOP_RSCR(band), mask, set);
++
++	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
++	 * MT_AGG_ACR_PPDU_TXS2H (PPDU format) even though ACR bit is set.
++	 */
++	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
++		mt76_set(dev, MT_AGG_ACR4(band), MT_AGG_ACR_PPDU_TXS2H);
+ }
+ 
+ static void
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 6dec9d60..87cff5d4 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -551,7 +551,6 @@ static u32 mt7915_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
+ static int mt7915_mmio_wed_offload_enable(struct mtk_wed_device *wed)
+ {
+ 	struct mt7915_dev *dev;
+-	struct mt7915_phy *phy;
+ 	int ret;
+ 
+ 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
+@@ -565,38 +564,18 @@ static int mt7915_mmio_wed_offload_enable(struct mtk_wed_device *wed)
+ 	if (!ret)
+ 		return -EAGAIN;
+ 
+-	phy = &dev->phy;
+-	mt76_set(dev, MT_AGG_ACR4(phy->mt76->band_idx), MT_AGG_ACR_PPDU_TXS2H);
+-
+-	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
+-	if (phy)
+-		mt76_set(dev, MT_AGG_ACR4(phy->mt76->band_idx),
+-			 MT_AGG_ACR_PPDU_TXS2H);
+-
+ 	return 0;
+ }
+ 
+ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+ {
+ 	struct mt7915_dev *dev;
+-	struct mt7915_phy *phy;
+ 
+ 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
+ 
+ 	spin_lock_bh(&dev->mt76.token_lock);
+ 	dev->mt76.token_size = wed->wlan.token_start;//MT7915_TOKEN_SIZE
+ 	spin_unlock_bh(&dev->mt76.token_lock);
+-
+-	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
+-	 * MT_AGG_ACR_PPDU_TXS2H (PPDU format) even though ACR bit is set.
+-	 */
+-	phy = &dev->phy;
+-	mt76_clear(dev, MT_AGG_ACR4(phy->mt76->band_idx), MT_AGG_ACR_PPDU_TXS2H);
+-
+-	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
+-	if (phy)
+-		mt76_clear(dev, MT_AGG_ACR4(phy->mt76->band_idx),
+-			   MT_AGG_ACR_PPDU_TXS2H);
+ }
+ 
+ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+diff --git a/tx.c b/tx.c
+index a72b7779..36b0f486 100644
+--- a/tx.c
++++ b/tx.c
+@@ -120,6 +120,7 @@ mt76_tx_status_skb_add(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 		       struct sk_buff *skb)
+ {
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
+ 	int pid;
+ 
+@@ -131,6 +132,11 @@ mt76_tx_status_skb_add(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+ 		return MT_PACKET_ID_NO_ACK;
+ 
++	if (mtk_wed_device_active(&dev->mmio.wed) &&
++	    ((info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) ||
++	    ieee80211_is_data(hdr->frame_control)))
++		return MT_PACKET_ID_WED;
++
+ 	if (!(info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS |
+ 			     IEEE80211_TX_CTL_RATE_CTRL_PROBE)))
+ 		return MT_PACKET_ID_NO_SKB;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3013-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch b/recipes-wifi/linux-mt76/files/patches/3013-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch
new file mode 100644
index 0000000..3a1ba99
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3013-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch
@@ -0,0 +1,102 @@
+From 2d87b4aa84333ffdf4d42c16f5b13bc6c349285c Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 17 Jan 2023 21:15:00 +0800
+Subject: [PATCH 3013/3015] wifi: mt76: mt7915: get tx retries from tx free
+ done event for sw path
+
+---
+ mt7915/mac.c  | 14 +++++++++++---
+ mt7915/mac.h  |  5 ++++-
+ mt7915/main.c |  6 +++---
+ 3 files changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 175498b1..b7559182 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1005,6 +1005,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 	struct mt76_dev *mdev = &dev->mt76;
+ 	struct mt76_txwi_cache *txwi;
+ 	struct ieee80211_sta *sta = NULL;
++	struct mt76_wcid *wcid = NULL;
+ 	LIST_HEAD(free_list);
+ 	void *end = data + len;
+ 	bool v3, wake = false;
+@@ -1019,7 +1020,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 	v3 = (FIELD_GET(MT_TX_FREE_VER, txd) == 0x4);
+ 
+ 	for (cur_info = tx_info; count < total; cur_info++) {
+-		u32 msdu, info;
++		u32 msdu, info, retries = 0;
+ 		u8 i;
+ 
+ 		if (WARN_ON_ONCE((void *)cur_info >= end))
+@@ -1032,7 +1033,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 		info = le32_to_cpu(*cur_info);
+ 		if (info & MT_TX_FREE_PAIR) {
+ 			struct mt7915_sta *msta;
+-			struct mt76_wcid *wcid = NULL;
+ 			u16 idx;
+ 
+ 			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
+@@ -1049,7 +1049,15 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 			continue;
+ 		}
+ 
+-		if (v3 && (info & MT_TX_FREE_MPDU_HEADER))
++		if (v3 && (info & MT_TX_FREE_MPDU_HEADER_V3))
++			retries = u32_get_bits(info, MT_TX_FREE_TX_COUNT_V3) - 1;
++		else if (!v3 && (info & MT_TX_FREE_MPDU_HEADER))
++			retries = u32_get_bits(info, MT_TX_FREE_TX_COUNT) - 1;
++
++		if (!mtk_wed_device_active(&mdev->mmio.wed))
++			wcid->stats.tx_retries += retries;
++
++		if (v3 && (info & MT_TX_FREE_MPDU_HEADER_V3))
+ 			continue;
+ 
+ 		for (i = 0; i < 1 + v3; i++) {
+diff --git a/mt7915/mac.h b/mt7915/mac.h
+index 6fa9c79f..afadc512 100644
+--- a/mt7915/mac.h
++++ b/mt7915/mac.h
+@@ -36,8 +36,11 @@ enum rx_pkt_type {
+ #define MT_TX_FREE_LATENCY		GENMASK(12, 0)
+ /* 0: success, others: dropped */
+ #define MT_TX_FREE_MSDU_ID		GENMASK(30, 16)
++#define MT_TX_FREE_TX_COUNT		GENMASK(12, 0)
++#define MT_TX_FREE_TX_COUNT_V3		GENMASK(27, 24)
+ #define MT_TX_FREE_PAIR			BIT(31)
+-#define MT_TX_FREE_MPDU_HEADER		BIT(30)
++#define MT_TX_FREE_MPDU_HEADER		BIT(15)
++#define MT_TX_FREE_MPDU_HEADER_V3	BIT(30)
+ #define MT_TX_FREE_MSDU_ID_V3		GENMASK(14, 0)
+ 
+ /* will support this field in further revision */
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 51129341..ef1cf20c 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1103,9 +1103,6 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
+ 
+-		sinfo->tx_retries = msta->wcid.stats.tx_retries;
+-		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
+-
+ 		if (mtk_wed_get_rx_capa(&phy->dev->mt76.mmio.wed)) {
+ 			sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
+ 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
+@@ -1115,6 +1112,9 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 		}
+ 	}
+ 
++	sinfo->tx_retries = msta->wcid.stats.tx_retries;
++	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
++
+ 	if (!mt7915_mcu_get_tx_stat_wa(phy->dev, msta->wcid.idx)) {
+ 		sinfo->tx_packets = msta->wcid.stats.tx_packets;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3014-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch b/recipes-wifi/linux-mt76/files/patches/3014-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch
new file mode 100644
index 0000000..3707c51
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3014-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch
@@ -0,0 +1,93 @@
+From 5cdb0e4160589abdd04c2a5bdc3bad935e7dbf32 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 30 Jan 2023 11:36:32 +0800
+Subject: [PATCH 3014/3015] wifi: mt76: update debugfs knob for reset counter
+ and get tx packet error rate
+
+---
+ mt7915/mtk_debugfs.c | 62 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 62 insertions(+)
+
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 5e64fe91..dbbf7ecc 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -3190,6 +3190,66 @@ mt7915_sw_aci_set(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_sw_aci, NULL,
+ 			 mt7915_sw_aci_set, "%llx\n");
+ 
++static int mt7915_reset_counter(void *data, u64 val)
++{
++	struct mt7915_phy *phy = data;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_wcid *wcid;
++
++	/* Clear the firmware counters */
++	mt7915_mcu_get_tx_stat_wa(dev, dev->wlan_idx);
++	mt7915_get_tx_stat(phy, dev->wlan_idx);
++
++	rcu_read_lock();
++	wcid = rcu_dereference(dev->mt76.wcid[dev->wlan_idx]);
++	if (!wcid)
++		return -EINVAL;
++
++	memset(&wcid->stats, 0, sizeof(struct mt76_sta_stats));
++
++	rcu_read_unlock();
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_reset_counter, NULL,
++			 mt7915_reset_counter, "%lld\n");
++
++static int
++mt7915_per_read(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	struct mt76_sta_stats *stats;
++	struct mt76_wcid *wcid;
++	int ret;
++	u8 phy_idx;
++
++	if (!dev->mt76.wcid[dev->wlan_idx])
++		return -EINVAL;
++
++	phy_idx = dev->mt76.wcid[dev->wlan_idx]->phy_idx;
++
++	ret = mt7915_get_tx_stat(dev->mt76.phys[phy_idx]->priv, dev->wlan_idx);
++	if (ret)
++		return ret;
++
++	rcu_read_lock();
++	wcid = rcu_dereference(dev->mt76.wcid[dev->wlan_idx]);
++	if (!wcid)
++		return -EINVAL;
++
++	stats = &wcid->stats;
++
++	seq_printf(s, "sta %d, tx_mpdu_cnt = %u, tx_failed = %u,  PER = %u.%u%%\n", dev->wlan_idx,
++		   stats->tx_mpdu_cnt, stats->tx_failed,
++		   stats->tx_mpdu_cnt ? stats->tx_failed * 1000 / stats->tx_mpdu_cnt / 10 : 0,
++		   stats->tx_mpdu_cnt ? stats->tx_failed * 1000 / stats->tx_mpdu_cnt % 10 : 0);
++
++	rcu_read_unlock();
++
++	return 0;
++}
++
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+@@ -3279,6 +3339,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ 				    mt7915_show_eeprom_mode);
+ 	debugfs_create_file("sw_aci", 0600, dir, dev,
+ 			    &fops_sw_aci);
++	debugfs_create_file("reset_counter", 0200, dir, dev, &fops_reset_counter);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "per", dir, mt7915_per_read);
+ 	return 0;
+ }
+ #endif
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch b/recipes-wifi/linux-mt76/files/patches/3015-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches/3010-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch
rename to recipes-wifi/linux-mt76/files/patches/3015-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch
index 9bce03a..64743b6 100644
--- a/recipes-wifi/linux-mt76/files/patches/3010-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3015-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch
@@ -1,7 +1,7 @@
-From 27b1ad3b825b3208c599330f944fc11c120f3d2e Mon Sep 17 00:00:00 2001
+From 6c1940b9974057133ad6a27509d21547937d2ab6 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 5 Jan 2023 16:43:57 +0800
-Subject: [PATCH 3010/3010] mt76: connac: wed: add wed rx copy skb and revert
+Subject: [PATCH 3015/3015] mt76: connac: wed: add wed rx copy skb and revert
  page_pool
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -401,7 +401,7 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mt76.h b/mt76.h
-index a36a978b..3911d013 100644
+index 22c6531a..19100d62 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -210,7 +210,7 @@ struct mt76_queue {
@@ -413,7 +413,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1457,7 +1457,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1458,7 +1458,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -421,7 +421,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1569,25 +1568,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1570,25 +1569,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_rxwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_rxwi_cache *r, dma_addr_t phys);
@@ -448,10 +448,10 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8ebea612..5307e15d 100644
+index ef1cf20c..0a64ef01 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1357,22 +1357,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1361,22 +1361,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
@@ -480,7 +480,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1400,7 +1397,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1404,7 +1401,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  	};
  	struct mib_stats *mib = &phy->mib;
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -489,7 +489,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1481,12 +1478,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1485,12 +1482,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -506,10 +506,10 @@
  
  static void
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6dec9d60..6b9752b2 100644
+index 87cff5d4..0709f5bc 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -602,9 +602,14 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -581,9 +581,14 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  {
  	struct mt7915_dev *dev;
@@ -524,7 +524,7 @@
  	for (i = 0; i < dev->mt76.rx_token_size; i++) {
  		struct mt76_rxwi_cache *r;
  
-@@ -612,50 +617,82 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -591,50 +596,82 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  		if (!r || !r->ptr)
  			continue;
  
@@ -626,7 +626,7 @@
  			goto unmap;
  		}
  
-@@ -667,8 +704,6 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -646,8 +683,6 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  	return 0;
  
  unmap:
diff --git a/recipes-wifi/linux-mt76/files/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch
index 1977b98..20fc039 100644
--- a/recipes-wifi/linux-mt76/files/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -713,14 +713,14 @@
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+	struct mt7915_phy *phy = mvif->phy;
 -	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
 +	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
- 
 @@ -912,11 +912,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
- 	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
+ 	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
+ 	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
  
 -	if (sta->deflink.vht_cap.vht_supported)
 +	if (sta->vht_cap.vht_supported)
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 7a55f85..9484ae8 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -42,7 +42,12 @@
     file://3007-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
     file://3008-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro.patch \
     file://3009-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch \
-    file://3010-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch \
+    file://3010-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch \
+    file://3011-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch \
+    file://3012-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch \
+    file://3013-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch \
+    file://3014-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch \
+    file://3015-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch \
     file://4001-mt76-revert-get_of_mac_addr.patch \
     file://4002-mt76-include-header-files-for-module-param.patch \
     file://4003-mt76-revert-kernel-api-for-kernel-5.4.patch \
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin
index 9243dae..6a25364 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin
index 9541e61..3201bfc 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin
index 256dd41..4375155 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin
Binary files differ
diff --git a/recipes-wifi/wpa-supplicant/wpa-supplicant_2.10.3.bb b/recipes-wifi/wpa-supplicant/wpa-supplicant_2.10.3.bb
index d8ce220..9181a39 100644
--- a/recipes-wifi/wpa-supplicant/wpa-supplicant_2.10.3.bb
+++ b/recipes-wifi/wpa-supplicant/wpa-supplicant_2.10.3.bb
@@ -82,6 +82,7 @@
 	echo "CONFIG_WEP=y" >> wpa_supplicant/.config
 	echo "CONFIG_AP=y" >> wpa_supplicant/.config
 	echo "CONFIG_MESH=y" >> wpa_supplicant/.config
+	echo "CONFIG_IEEE80211BE=y" >> ${B}/.config
 }
 
 do_compile () {