diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0000-sync-to-master.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0000-sync-to-master.patch
new file mode 100644
index 0000000..44a01ec
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0000-sync-to-master.patch
@@ -0,0 +1,249 @@
+diff --git a/eeprom.c b/eeprom.c
+index 0a88048b..ea54b7af 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -138,6 +138,7 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
+ {
+ 	struct device_node *np = dev->dev->of_node;
+ 	const char *const region_names[] = {
++		[NL80211_DFS_UNSET] = "ww",
+ 		[NL80211_DFS_ETSI] = "etsi",
+ 		[NL80211_DFS_FCC] = "fcc",
+ 		[NL80211_DFS_JP] = "jp",
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index 614df85e..aed4ee95 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -823,7 +823,6 @@ void mt76_connac2_mac_decode_he_radiotap(struct mt76_dev *dev,
+ 			 HE_BITS(DATA2_TXOP_KNOWN),
+ 	};
+ 	u32 ltf_size = le32_get_bits(rxv[2], MT_CRXV_HE_LTF_SIZE) + 1;
+-	u32 txbf_mask = is_mt7996(dev) ? BIT(11) : BIT(10);
+ 	struct ieee80211_radiotap_he *he;
+ 
+ 	status->flag |= RX_FLAG_RADIOTAP_HE;
+@@ -837,7 +836,7 @@ void mt76_connac2_mac_decode_he_radiotap(struct mt76_dev *dev,
+ 	he->data5 = HE_PREP(DATA5_PE_DISAMBIG, PE_DISAMBIG, rxv[2]) |
+ 		    le16_encode_bits(ltf_size,
+ 				     IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE);
+-	if (le32_to_cpu(rxv[0]) & txbf_mask)
++	if (le32_to_cpu(rxv[0]) & MT_PRXV_TXBF)
+ 		he->data5 |= HE_BITS(DATA5_TXBF);
+ 	he->data6 = HE_PREP(DATA6_TXOP, TXOP_DUR, rxv[14]) |
+ 		    HE_PREP(DATA6_DOPPLER, DOPPLER, rxv[14]);
+diff --git a/mt76x0/usb_mcu.c b/mt76x0/usb_mcu.c
+index 45502fd4..6dc1f51f 100644
+--- a/mt76x0/usb_mcu.c
++++ b/mt76x0/usb_mcu.c
+@@ -148,6 +148,7 @@ static int mt76x0u_load_firmware(struct mt76x02_dev *dev)
+ 	mt76_wr(dev, MT_USB_DMA_CFG, val);
+ 
+ 	ret = mt76x0u_upload_firmware(dev, hdr);
++	mt76x02_set_ethtool_fwver(dev, hdr);
+ 	release_firmware(fw);
+ 
+ 	mt76_wr(dev, MT_FCE_PSE_CTRL, 1);
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 674cea1a..c9a9f0e3 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -12,6 +12,10 @@
+ 
+ #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
+ 
++#define HE_BITS(f)		cpu_to_le16(IEEE80211_RADIOTAP_HE_##f)
++#define HE_PREP(f, m, v)	le16_encode_bits(le32_get_bits(v, MT_CRXV_HE_##m),\
++						 IEEE80211_RADIOTAP_HE_##f)
++
+ static const struct mt7996_dfs_radar_spec etsi_radar_specs = {
+ 	.pulse_th = { 110, -10, -80, 40, 5200, 128, 5200 },
+ 	.radar_pattern = {
+@@ -251,6 +255,178 @@ void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
+ 		mt76_clear(dev, addr, BIT(5));
+ }
+ 
++static void
++mt7996_mac_decode_he_radiotap_ru(struct mt76_rx_status *status,
++				 struct ieee80211_radiotap_he *he,
++				 __le32 *rxv)
++{
++	u32 ru_h, ru_l;
++	u8 ru, offs = 0;
++
++	ru_l = le32_get_bits(rxv[0], MT_PRXV_HE_RU_ALLOC_L);
++	ru_h = le32_get_bits(rxv[1], MT_PRXV_HE_RU_ALLOC_H);
++	ru = (u8)(ru_l | ru_h << 4);
++
++	status->bw = RATE_INFO_BW_HE_RU;
++
++	switch (ru) {
++	case 0 ... 36:
++		status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_26;
++		offs = ru;
++		break;
++	case 37 ... 52:
++		status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_52;
++		offs = ru - 37;
++		break;
++	case 53 ... 60:
++		status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_106;
++		offs = ru - 53;
++		break;
++	case 61 ... 64:
++		status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_242;
++		offs = ru - 61;
++		break;
++	case 65 ... 66:
++		status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_484;
++		offs = ru - 65;
++		break;
++	case 67:
++		status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_996;
++		break;
++	case 68:
++		status->he_ru = NL80211_RATE_INFO_HE_RU_ALLOC_2x996;
++		break;
++	}
++
++	he->data1 |= HE_BITS(DATA1_BW_RU_ALLOC_KNOWN);
++	he->data2 |= HE_BITS(DATA2_RU_OFFSET_KNOWN) |
++		     le16_encode_bits(offs,
++				      IEEE80211_RADIOTAP_HE_DATA2_RU_OFFSET);
++}
++
++static void
++mt7996_mac_decode_he_mu_radiotap(struct sk_buff *skb, __le32 *rxv)
++{
++	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
++	static const struct ieee80211_radiotap_he_mu mu_known = {
++		.flags1 = HE_BITS(MU_FLAGS1_SIG_B_MCS_KNOWN) |
++			  HE_BITS(MU_FLAGS1_SIG_B_DCM_KNOWN) |
++			  HE_BITS(MU_FLAGS1_CH1_RU_KNOWN) |
++			  HE_BITS(MU_FLAGS1_SIG_B_SYMS_USERS_KNOWN),
++		.flags2 = HE_BITS(MU_FLAGS2_BW_FROM_SIG_A_BW_KNOWN),
++	};
++	struct ieee80211_radiotap_he_mu *he_mu = NULL;
++
++	status->flag |= RX_FLAG_RADIOTAP_HE_MU;
++
++	he_mu = skb_push(skb, sizeof(mu_known));
++	memcpy(he_mu, &mu_known, sizeof(mu_known));
++
++#define MU_PREP(f, v)	le16_encode_bits(v, IEEE80211_RADIOTAP_HE_MU_##f)
++
++	he_mu->flags1 |= MU_PREP(FLAGS1_SIG_B_MCS, status->rate_idx);
++	if (status->he_dcm)
++		he_mu->flags1 |= MU_PREP(FLAGS1_SIG_B_DCM, status->he_dcm);
++
++	he_mu->flags2 |= MU_PREP(FLAGS2_BW_FROM_SIG_A_BW, status->bw) |
++			 MU_PREP(FLAGS2_SIG_B_SYMS_USERS,
++				 le32_get_bits(rxv[2], MT_CRXV_HE_NUM_USER));
++
++	he_mu->ru_ch1[0] = le32_get_bits(rxv[3], MT_CRXV_HE_RU0);
++
++	if (status->bw >= RATE_INFO_BW_40) {
++		he_mu->flags1 |= HE_BITS(MU_FLAGS1_CH2_RU_KNOWN);
++		he_mu->ru_ch2[0] = le32_get_bits(rxv[3], MT_CRXV_HE_RU1);
++	}
++
++	if (status->bw >= RATE_INFO_BW_80) {
++		he_mu->ru_ch1[1] = le32_get_bits(rxv[3], MT_CRXV_HE_RU2);
++		he_mu->ru_ch2[1] = le32_get_bits(rxv[3], MT_CRXV_HE_RU3);
++	}
++}
++
++static void
++mt7996_mac_decode_he_radiotap(struct sk_buff *skb, __le32 *rxv, u8 mode)
++{
++	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
++	static const struct ieee80211_radiotap_he known = {
++		.data1 = HE_BITS(DATA1_DATA_MCS_KNOWN) |
++			 HE_BITS(DATA1_DATA_DCM_KNOWN) |
++			 HE_BITS(DATA1_STBC_KNOWN) |
++			 HE_BITS(DATA1_CODING_KNOWN) |
++			 HE_BITS(DATA1_LDPC_XSYMSEG_KNOWN) |
++			 HE_BITS(DATA1_DOPPLER_KNOWN) |
++			 HE_BITS(DATA1_SPTL_REUSE_KNOWN) |
++			 HE_BITS(DATA1_BSS_COLOR_KNOWN),
++		.data2 = HE_BITS(DATA2_GI_KNOWN) |
++			 HE_BITS(DATA2_TXBF_KNOWN) |
++			 HE_BITS(DATA2_PE_DISAMBIG_KNOWN) |
++			 HE_BITS(DATA2_TXOP_KNOWN),
++	};
++	struct ieee80211_radiotap_he *he = NULL;
++	u32 ltf_size = le32_get_bits(rxv[2], MT_CRXV_HE_LTF_SIZE) + 1;
++
++	status->flag |= RX_FLAG_RADIOTAP_HE;
++
++	he = skb_push(skb, sizeof(known));
++	memcpy(he, &known, sizeof(known));
++
++	he->data3 = HE_PREP(DATA3_BSS_COLOR, BSS_COLOR, rxv[14]) |
++		    HE_PREP(DATA3_LDPC_XSYMSEG, LDPC_EXT_SYM, rxv[2]);
++	he->data4 = HE_PREP(DATA4_SU_MU_SPTL_REUSE, SR_MASK, rxv[11]);
++	he->data5 = HE_PREP(DATA5_PE_DISAMBIG, PE_DISAMBIG, rxv[2]) |
++		    le16_encode_bits(ltf_size,
++				     IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE);
++	if (le32_to_cpu(rxv[0]) & MT_PRXV_TXBF)
++		he->data5 |= HE_BITS(DATA5_TXBF);
++	he->data6 = HE_PREP(DATA6_TXOP, TXOP_DUR, rxv[14]) |
++		    HE_PREP(DATA6_DOPPLER, DOPPLER, rxv[14]);
++
++	switch (mode) {
++	case MT_PHY_TYPE_HE_SU:
++		he->data1 |= HE_BITS(DATA1_FORMAT_SU) |
++			     HE_BITS(DATA1_UL_DL_KNOWN) |
++			     HE_BITS(DATA1_BEAM_CHANGE_KNOWN) |
++			     HE_BITS(DATA1_BW_RU_ALLOC_KNOWN);
++
++		he->data3 |= HE_PREP(DATA3_BEAM_CHANGE, BEAM_CHNG, rxv[14]) |
++			     HE_PREP(DATA3_UL_DL, UPLINK, rxv[2]);
++		break;
++	case MT_PHY_TYPE_HE_EXT_SU:
++		he->data1 |= HE_BITS(DATA1_FORMAT_EXT_SU) |
++			     HE_BITS(DATA1_UL_DL_KNOWN) |
++			     HE_BITS(DATA1_BW_RU_ALLOC_KNOWN);
++
++		he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[2]);
++		break;
++	case MT_PHY_TYPE_HE_MU:
++		he->data1 |= HE_BITS(DATA1_FORMAT_MU) |
++			     HE_BITS(DATA1_UL_DL_KNOWN);
++
++		he->data3 |= HE_PREP(DATA3_UL_DL, UPLINK, rxv[2]);
++		he->data4 |= HE_PREP(DATA4_MU_STA_ID, MU_AID, rxv[7]);
++
++		mt7996_mac_decode_he_radiotap_ru(status, he, rxv);
++		mt7996_mac_decode_he_mu_radiotap(skb, rxv);
++		break;
++	case MT_PHY_TYPE_HE_TB:
++		he->data1 |= HE_BITS(DATA1_FORMAT_TRIG) |
++			     HE_BITS(DATA1_SPTL_REUSE2_KNOWN) |
++			     HE_BITS(DATA1_SPTL_REUSE3_KNOWN) |
++			     HE_BITS(DATA1_SPTL_REUSE4_KNOWN);
++
++		he->data4 |= HE_PREP(DATA4_TB_SPTL_REUSE1, SR_MASK, rxv[11]) |
++			     HE_PREP(DATA4_TB_SPTL_REUSE2, SR1_MASK, rxv[11]) |
++			     HE_PREP(DATA4_TB_SPTL_REUSE3, SR2_MASK, rxv[11]) |
++			     HE_PREP(DATA4_TB_SPTL_REUSE4, SR3_MASK, rxv[11]);
++
++		mt7996_mac_decode_he_radiotap_ru(status, he, rxv);
++		break;
++	default:
++		break;
++	}
++}
++
+ /* The HW does not translate the mac header to 802.3 for mesh point */
+ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
+ {
+@@ -686,8 +862,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	}
+ 
+ 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
+-		mt76_connac2_mac_decode_he_radiotap(&dev->mt76, skb, rxv,
+-						    mode);
++		mt7996_mac_decode_he_radiotap(skb, rxv, mode);
+ 
+ 	if (!status->wcid || !ieee80211_is_data_qos(fc))
+ 		return 0;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_tx_compl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_tx_compl.patch
new file mode 100644
index 0000000..1022535
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0001-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_tx_compl.patch
@@ -0,0 +1,96 @@
+From 6767bcfec5f48f14fdf63c9699c63e6bc741ad74 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 3 Feb 2023 11:00:59 +0800
+Subject: [PATCH 1/7] Revert "wifi: mt76: mt7996: rely on
+ mt76_connac_tx_complete_skb"
+
+This reverts commit 8688756305c643b8a296c16d0626732aaae1d02a.
+---
+ mt7996/mac.c    | 21 +++++++++++++++++++++
+ mt7996/mac.h    | 13 +++++++++++++
+ mt7996/mmio.c   |  2 +-
+ mt7996/mt7996.h |  1 +
+ 4 files changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index c9a9f0e3..0d718598 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1565,6 +1565,27 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+ 	}
+ }
+ 
++void mt7996_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e)
++{
++	if (!e->txwi) {
++		dev_kfree_skb_any(e->skb);
++		return;
++	}
++
++	/* error path */
++	if (e->skb == DMA_DUMMY_DATA) {
++		struct mt76_connac_txp_common *txp;
++		struct mt76_txwi_cache *t;
++
++		txp = mt7996_txwi_to_txp(mdev, e->txwi);
++		t = mt76_token_put(mdev, le16_to_cpu(txp->fw.token));
++		e->skb = t ? t->skb : NULL;
++	}
++
++	if (e->skb)
++		mt76_tx_complete_skb(mdev, e->wcid, e->skb);
++}
++
+ void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy)
+ {
+ 	struct mt7996_dev *dev = phy->dev;
+diff --git a/mt7996/mac.h b/mt7996/mac.h
+index 27184cba..10e08d66 100644
+--- a/mt7996/mac.h
++++ b/mt7996/mac.h
+@@ -371,4 +371,17 @@ struct mt7996_dfs_radar_spec {
+ 	struct mt7996_dfs_pattern radar_pattern[16];
+ };
+ 
++static inline struct mt76_connac_txp_common *
++mt7996_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
++{
++	u8 *txwi;
++
++	if (!t)
++		return NULL;
++
++	txwi = mt76_get_txwi_ptr(dev, t);
++
++	return (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
++}
++
+ #endif
+diff --git a/mt7996/mmio.c b/mt7996/mmio.c
+index 902370a2..2237f50a 100644
+--- a/mt7996/mmio.c
++++ b/mt7996/mmio.c
+@@ -326,7 +326,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+ 				SURVEY_INFO_TIME_BSS_RX,
+ 		.token_size = MT7996_TOKEN_SIZE,
+ 		.tx_prepare_skb = mt7996_tx_prepare_skb,
+-		.tx_complete_skb = mt76_connac_tx_complete_skb,
++		.tx_complete_skb = mt7996_tx_complete_skb,
+ 		.rx_skb = mt7996_queue_rx_skb,
+ 		.rx_check = mt7996_rx_check,
+ 		.rx_poll_complete = mt7996_rx_poll_complete,
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 018dfd2b..13f22432 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -508,6 +508,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 			  enum mt76_txq_id qid, struct mt76_wcid *wcid,
+ 			  struct ieee80211_sta *sta,
+ 			  struct mt76_tx_info *tx_info);
++void mt7996_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e);
+ void mt7996_tx_token_put(struct mt7996_dev *dev);
+ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+ 			 struct sk_buff *skb, u32 *info);
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-fix-chainmask-calculation-in-mt7996.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-fix-chainmask-calculation-in-mt7996.patch
deleted file mode 100644
index dfc04e5..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-fix-chainmask-calculation-in-mt7996.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 36dcb418d47fb74f7a5a6fb276ff2fee63f4533a Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Wed, 30 Nov 2022 23:18:03 +0800
-Subject: [PATCH 1/7] wifi: mt76: mt7996: fix chainmask calculation in
- mt7996_set_antenna()
-
-Fix per-band chainmask when restoring from the dev chainmask.
-
-Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: Idf607cfdfb342fd283d2911231262f0f74994360
----
- mt7996/main.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 4421cd5..c423b05 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -880,7 +880,10 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
- 	phy->mt76->antenna_mask = tx_ant;
- 
- 	/* restore to the origin chainmask which might have auxiliary path */
--	if (hweight8(tx_ant) == max_nss)
-+	if (hweight8(tx_ant) == max_nss && band_idx < MT_BAND2)
-+		phy->mt76->chainmask = ((dev->chainmask >> shift) &
-+					(BIT(dev->chainshift[band_idx + 1] - shift) - 1)) << shift;
-+	else if (hweight8(tx_ant) == max_nss)
- 		phy->mt76->chainmask = (dev->chainmask >> shift) << shift;
- 	else
- 		phy->mt76->chainmask = tx_ant << shift;
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_txp_skb_.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_txp_skb_.patch
new file mode 100644
index 0000000..fb6581a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0002-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_txp_skb_.patch
@@ -0,0 +1,46 @@
+From 9c2313ddded0179ae1a9e6112e2762a1a3e958d7 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 3 Feb 2023 11:01:11 +0800
+Subject: [PATCH 2/7] Revert "wifi: mt76: mt7996: rely on
+ mt76_connac_txp_skb_unmap"
+
+This reverts commit bdb7dc38a6d150b5aa4b09b82a8954c6bb49ba4a.
+---
+ mt7996/mac.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 0d718598..df97d7cf 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1187,6 +1187,18 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+ 		ieee80211_start_tx_ba_session(sta, tid, 0);
+ }
+ 
++static void
++mt7996_txp_skb_unmap(struct mt76_dev *dev, struct mt76_txwi_cache *t)
++{
++	struct mt76_connac_txp_common *txp;
++	int i;
++
++	txp = mt7996_txwi_to_txp(dev, t);
++	for (i = 0; i < txp->fw.nbuf; i++)
++		dma_unmap_single(dev->dev, le32_to_cpu(txp->fw.buf[i]),
++				 le16_to_cpu(txp->fw.len[i]), DMA_TO_DEVICE);
++}
++
+ static void
+ mt7996_txwi_free(struct mt7996_dev *dev, struct mt76_txwi_cache *t,
+ 		 struct ieee80211_sta *sta, struct list_head *free_list)
+@@ -1196,7 +1208,7 @@ mt7996_txwi_free(struct mt7996_dev *dev, struct mt76_txwi_cache *t,
+ 	__le32 *txwi;
+ 	u16 wcid_idx;
+ 
+-	mt76_connac_txp_skb_unmap(mdev, t);
++	mt7996_txp_skb_unmap(mdev, t);
+ 	if (!t->skb)
+ 		goto out;
+ 
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch
deleted file mode 100644
index 927bbe6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 6098317d391c07b301bede6002c03ea0eed72103 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 1 Dec 2022 14:23:35 +0800
-Subject: [PATCH 2/7] wifi: mt76: mt7996: update register for CFEND_RATE
-
-In newer chipsets, CFEND_RATE setting has been moved to different hw
-module.
-
-Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I41dd443010ede910d934f38f4d86aaa3e7f31032
----
- mt7996/mac.c  |  2 +-
- mt7996/mmio.c |  1 +
- mt7996/regs.h | 15 ++++++++-------
- 3 files changed, 10 insertions(+), 8 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0b3e287..ce4242f 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -1690,7 +1690,7 @@ void mt7996_mac_set_timing(struct mt7996_phy *phy)
- 	else
- 		val = MT7996_CFEND_RATE_11B;
- 
--	mt76_rmw_field(dev, MT_AGG_ACR0(band_idx), MT_AGG_ACR_CFEND_RATE, val);
-+	mt76_rmw_field(dev, MT_RATE_HRCR0(band_idx), MT_RATE_HRCR0_CFEND_RATE, val);
- 	mt76_clear(dev, MT_ARB_SCR(band_idx),
- 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
- }
-diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 60781d0..d8a2c1a 100644
---- a/mt7996/mmio.c
-+++ b/mt7996/mmio.c
-@@ -21,6 +21,7 @@ static const struct __base mt7996_reg_base[] = {
- 	[WF_ETBF_BASE]		= { { 0x820ea000, 0x820fa000, 0x830ea000 } },
- 	[WF_LPON_BASE]		= { { 0x820eb000, 0x820fb000, 0x830eb000 } },
- 	[WF_MIB_BASE]		= { { 0x820ed000, 0x820fd000, 0x830ed000 } },
-+	[WF_RATE_BASE]		= { { 0x820ee000, 0x820fe000, 0x830ee000 } },
- };
- 
- static const struct __map mt7996_reg_map[] = {
-diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 42980b9..7a28cae 100644
---- a/mt7996/regs.h
-+++ b/mt7996/regs.h
-@@ -33,6 +33,7 @@ enum base_rev {
- 	WF_ETBF_BASE,
- 	WF_LPON_BASE,
- 	WF_MIB_BASE,
-+	WF_RATE_BASE,
- 	__MT_REG_BASE_MAX,
- };
- 
-@@ -235,13 +236,6 @@ enum base_rev {
- 						 FIELD_PREP(MT_WTBL_LMAC_ID, _id) | \
- 						 FIELD_PREP(MT_WTBL_LMAC_DW, _dw))
- 
--/* AGG: band 0(0x820e2000), band 1(0x820f2000), band 2(0x830e2000) */
--#define MT_WF_AGG_BASE(_band)			__BASE(WF_AGG_BASE, (_band))
--#define MT_WF_AGG(_band, ofs)			(MT_WF_AGG_BASE(_band) + (ofs))
--
--#define MT_AGG_ACR0(_band)			MT_WF_AGG(_band, 0x054)
--#define MT_AGG_ACR_CFEND_RATE			GENMASK(13, 0)
--
- /* ARB: band 0(0x820e3000), band 1(0x820f3000), band 2(0x830e3000) */
- #define MT_WF_ARB_BASE(_band)			__BASE(WF_ARB_BASE, (_band))
- #define MT_WF_ARB(_band, ofs)			(MT_WF_ARB_BASE(_band) + (ofs))
-@@ -300,6 +294,13 @@ enum base_rev {
- #define MT_WF_RMAC_RSVD0(_band)			MT_WF_RMAC(_band, 0x03e0)
- #define MT_WF_RMAC_RSVD0_EIFS_CLR		BIT(21)
- 
-+/* RATE: band 0(0x820ee000), band 1(0x820fe000), band 2(0x830ee000) */
-+#define MT_WF_RATE_BASE(_band)			__BASE(WF_RATE_BASE, (_band))
-+#define MT_WF_RATE(_band, ofs)			(MT_WF_RATE_BASE(_band) + (ofs))
-+
-+#define MT_RATE_HRCR0(_band)			MT_WF_RATE(_band, 0x050)
-+#define MT_RATE_HRCR0_CFEND_RATE		GENMASK(14, 0)
-+
- /* WFDMA0 */
- #define MT_WFDMA0_BASE				0xd4000
- #define MT_WFDMA0(ofs)				(MT_WFDMA0_BASE + (ofs))
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_txp_comm.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_txp_comm.patch
new file mode 100644
index 0000000..43ea6c9
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0003-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_txp_comm.patch
@@ -0,0 +1,163 @@
+From 8ba17e7cdbb5e921edd03102476cd8fb4f4e1b31 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 3 Feb 2023 11:12:46 +0800
+Subject: [PATCH 3/7] Revert "wifi: mt76: mt7996: rely on
+ mt76_connac_txp_common structure"
+
+This reverts commit 321edbb414dcc03d349bddd08916b7cc531802e8.
+---
+ mt7996/mac.c  | 38 +++++++++++++++++++-------------------
+ mt7996/mac.h  | 15 +++++++++++++--
+ mt7996/mmio.c |  2 +-
+ 3 files changed, 33 insertions(+), 22 deletions(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index df97d7cf..e5b5fed6 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1088,8 +1088,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
+ 	struct ieee80211_key_conf *key = info->control.hw_key;
+ 	struct ieee80211_vif *vif = info->control.vif;
+-	struct mt76_connac_txp_common *txp;
+ 	struct mt76_txwi_cache *t;
++	struct mt7996_txp *txp;
+ 	int id, i, pid, nbuf = tx_info->nbuf - 1;
+ 	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
+ 	u8 *txwi = (u8 *)txwi_ptr;
+@@ -1123,35 +1123,35 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid,
+ 				      key, 0);
+ 
+-	txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
++	txp = (struct mt7996_txp *)(txwi + MT_TXD_SIZE);
+ 	for (i = 0; i < nbuf; i++) {
+-		txp->fw.buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr);
+-		txp->fw.len[i] = cpu_to_le16(tx_info->buf[i + 1].len);
++		txp->buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr);
++		txp->len[i] = cpu_to_le16(tx_info->buf[i + 1].len);
+ 	}
+-	txp->fw.nbuf = nbuf;
++	txp->nbuf = nbuf;
+ 
+-	txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
++	txp->flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
+ 
+ 	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
+-		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
++		txp->flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
+ 
+ 	if (!key)
+-		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
++		txp->flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
+ 
+ 	if (!is_8023 && ieee80211_is_mgmt(hdr->frame_control))
+-		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_MGMT_FRAME);
++		txp->flags |= cpu_to_le16(MT_CT_INFO_MGMT_FRAME);
+ 
+ 	if (vif) {
+ 		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 
+-		txp->fw.bss_idx = mvif->mt76.idx;
++		txp->bss_idx = mvif->mt76.idx;
+ 	}
+ 
+-	txp->fw.token = cpu_to_le16(id);
++	txp->token = cpu_to_le16(id);
+ 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags))
+-		txp->fw.rept_wds_wcid = cpu_to_le16(wcid->idx);
++		txp->rept_wds_wcid = cpu_to_le16(wcid->idx);
+ 	else
+-		txp->fw.rept_wds_wcid = cpu_to_le16(0xfff);
++		txp->rept_wds_wcid = cpu_to_le16(0xfff);
+ 	tx_info->skb = DMA_DUMMY_DATA;
+ 
+ 	/* pass partial skb header to fw */
+@@ -1190,13 +1190,13 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+ static void
+ mt7996_txp_skb_unmap(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+ {
+-	struct mt76_connac_txp_common *txp;
++	struct mt7996_txp *txp;
+ 	int i;
+ 
+ 	txp = mt7996_txwi_to_txp(dev, t);
+-	for (i = 0; i < txp->fw.nbuf; i++)
+-		dma_unmap_single(dev->dev, le32_to_cpu(txp->fw.buf[i]),
+-				 le16_to_cpu(txp->fw.len[i]), DMA_TO_DEVICE);
++	for (i = 0; i < txp->nbuf; i++)
++		dma_unmap_single(dev->dev, le32_to_cpu(txp->buf[i]),
++				 le16_to_cpu(txp->len[i]), DMA_TO_DEVICE);
+ }
+ 
+ static void
+@@ -1586,11 +1586,11 @@ void mt7996_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e)
+ 
+ 	/* error path */
+ 	if (e->skb == DMA_DUMMY_DATA) {
+-		struct mt76_connac_txp_common *txp;
+ 		struct mt76_txwi_cache *t;
++		struct mt7996_txp *txp;
+ 
+ 		txp = mt7996_txwi_to_txp(mdev, e->txwi);
+-		t = mt76_token_put(mdev, le16_to_cpu(txp->fw.token));
++		t = mt76_token_put(mdev, le16_to_cpu(txp->token));
+ 		e->skb = t ? t->skb : NULL;
+ 	}
+ 
+diff --git a/mt7996/mac.h b/mt7996/mac.h
+index 10e08d66..9f688520 100644
+--- a/mt7996/mac.h
++++ b/mt7996/mac.h
+@@ -268,6 +268,17 @@ enum tx_mgnt_type {
+ /* VHT/HE only use bits 0-3 */
+ #define MT_TX_RATE_IDX			GENMASK(5, 0)
+ 
++struct mt7996_txp {
++	__le16 flags;
++	__le16 token;
++	u8 bss_idx;
++	__le16 rept_wds_wcid;
++	u8 nbuf;
++#define MT_TXP_MAX_BUF_NUM	6
++	__le32 buf[MT_TXP_MAX_BUF_NUM];
++	__le16 len[MT_TXP_MAX_BUF_NUM];
++} __packed __aligned(4);
++
+ #define MT_TXFREE0_PKT_TYPE		GENMASK(31, 27)
+ #define MT_TXFREE0_MSDU_CNT		GENMASK(25, 16)
+ #define MT_TXFREE0_RX_BYTE		GENMASK(15, 0)
+@@ -371,7 +382,7 @@ struct mt7996_dfs_radar_spec {
+ 	struct mt7996_dfs_pattern radar_pattern[16];
+ };
+ 
+-static inline struct mt76_connac_txp_common *
++static inline struct mt7996_txp *
+ mt7996_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+ {
+ 	u8 *txwi;
+@@ -381,7 +392,7 @@ mt7996_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+ 
+ 	txwi = mt76_get_txwi_ptr(dev, t);
+ 
+-	return (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
++	return (struct mt7996_txp *)(txwi + MT_TXD_SIZE);
+ }
+ 
+ #endif
+diff --git a/mt7996/mmio.c b/mt7996/mmio.c
+index 2237f50a..d8a2c1a7 100644
+--- a/mt7996/mmio.c
++++ b/mt7996/mmio.c
+@@ -318,7 +318,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+ {
+ 	static const struct mt76_driver_ops drv_ops = {
+ 		/* txwi_size = txd size + txp size */
+-		.txwi_size = MT_TXD_SIZE + sizeof(struct mt76_connac_fw_txp),
++		.txwi_size = MT_TXD_SIZE + sizeof(struct mt7996_txp),
+ 		.drv_flags = MT_DRV_TXWI_NO_FREE |
+ 			     MT_DRV_HW_MGMT_TXQ,
+ 		.survey_flags = SURVEY_INFO_TIME_TX |
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-do-not-hardcode-vht-beamform-cap.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-do-not-hardcode-vht-beamform-cap.patch
deleted file mode 100644
index 4d9142b..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-do-not-hardcode-vht-beamform-cap.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From bc54af3f8657ee2633a1c976247fb8d2f07ad568 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Fri, 9 Dec 2022 16:38:03 +0800
-Subject: [PATCH 3/7] wifi: mt76: mt7996: do not hardcode vht beamform cap
-
-Use the sts variable when setting vht beamform sts cap.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: Idbc52c144220ee855251d4a316e475510cfdadad
----
- mt7996/init.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 64e8dfd..7a9692a 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -465,7 +465,7 @@ void mt7996_set_stream_vht_txbf_caps(struct mt7996_phy *phy)
- 
- 	*cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
- 		IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE |
--		(3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
-+		FIELD_PREP(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK, sts - 1);
- 
- 	*cap &= ~(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK |
- 		  IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-connac-fix-POWER_CTRL-command-name-typo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-connac-fix-POWER_CTRL-command-name-typo.patch
deleted file mode 100644
index 55c75e5..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-connac-fix-POWER_CTRL-command-name-typo.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 5842d6dc7b6644545dac3444a522910a87df7e2b Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Fri, 9 Dec 2022 16:22:16 +0800
-Subject: [PATCH 4/7] wifi: mt76: connac: fix POWER_CTRL command name typo
-
-Fix typo MCU_UNI_CMD_POWER_CREL to MCU_UNI_CMD_POWER_CTRL.
-
-Fixes: 779d34de055e ("wifi: mt76: connac: add more unified command IDs")
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I89f9e930be97acb91b456c6361b8fb818fe6cbda
----
- mt76_connac_mcu.h | 2 +-
- mt7996/mcu.c      | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f1e942b..82fdf6d 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1198,7 +1198,7 @@ enum {
- 	MCU_UNI_CMD_REPT_MUAR = 0x09,
- 	MCU_UNI_CMD_WSYS_CONFIG = 0x0b,
- 	MCU_UNI_CMD_REG_ACCESS = 0x0d,
--	MCU_UNI_CMD_POWER_CREL = 0x0f,
-+	MCU_UNI_CMD_POWER_CTRL = 0x0f,
- 	MCU_UNI_CMD_RX_HDR_TRANS = 0x12,
- 	MCU_UNI_CMD_SER = 0x13,
- 	MCU_UNI_CMD_TWT = 0x14,
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a88fc76..d781c6e 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -2399,7 +2399,7 @@ mt7996_mcu_restart(struct mt76_dev *dev)
- 		.power_mode = 1,
- 	};
- 
--	return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CREL), &req,
-+	return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CTRL), &req,
- 				 sizeof(req), false);
- }
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-add-muru-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-add-muru-support.patch
new file mode 100644
index 0000000..dab5182
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-add-muru-support.patch
@@ -0,0 +1,141 @@
+From 7c8b8c77489ef907f2122c5d0edb7ff5e0fed177 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Date: Mon, 28 Nov 2022 14:36:09 +0800
+Subject: [PATCH 4/7] wifi: mt76: mt7996: add muru support
+
+Add sta_rec_muru() and related phy cap for MU and RU support.
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Change-Id: I2206a9bb6fd6e50f4bf1380a8bea19920f1b7bfd
+---
+ mt76_connac_mcu.h |  3 ++-
+ mt7996/mcu.c      | 69 ++++++++++++++++++++++++++++++++++++++++++++++-
+ mt7996/mt7996.h   |  3 +++
+ 3 files changed, 73 insertions(+), 2 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index a5e6ee4d..39667840 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -518,7 +518,8 @@ struct sta_rec_muru {
+ 		u8 uo_ra;
+ 		u8 he_2x996_tone;
+ 		u8 rx_t_frame_11ac;
+-		u8 rsv[3];
++		u8 rx_ctrl_frame_to_mbss;
++		u8 rsv[2];
+ 	} ofdma_ul;
+ 
+ 	struct {
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index dbe30832..394dd15c 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -1049,6 +1049,63 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	}
+ }
+ 
++static void
++mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
++			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++{
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
++	struct sta_rec_muru *muru;
++	struct tlv *tlv;
++
++	if (vif->type != NL80211_IFTYPE_STATION &&
++	    vif->type != NL80211_IFTYPE_AP)
++		return;
++
++	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
++
++	muru = (struct sta_rec_muru *)tlv;
++
++	muru->cfg.mimo_dl_en = mvif->cap.eht_mu_ebfer_bw80 ||
++			       mvif->cap.eht_mu_ebfer_bw160 ||
++			       mvif->cap.eht_mu_ebfer_bw320 ||
++			       mvif->cap.he_mu_ebfer ||
++			       mvif->cap.vht_mu_ebfer ||
++			       mvif->cap.vht_mu_ebfee;
++	muru->cfg.ofdma_dl_en = true;
++
++	if (sta->deflink.vht_cap.vht_supported)
++		muru->mimo_dl.vht_mu_bfee =
++			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
++
++	if (!sta->deflink.he_cap.has_he)
++		return;
++
++	muru->mimo_dl.partial_bw_dl_mimo =
++		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
++
++	muru->mimo_ul.full_ul_mimo =
++		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
++	muru->mimo_ul.partial_ul_mimo =
++		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
++
++	muru->ofdma_dl.punc_pream_rx =
++		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
++	muru->ofdma_dl.he_20m_in_40m_2g =
++		HE_PHY(CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G, elem->phy_cap_info[8]);
++	muru->ofdma_dl.he_20m_in_160m =
++		HE_PHY(CAP8_20MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
++	muru->ofdma_dl.he_80m_in_160m =
++		HE_PHY(CAP8_80MHZ_IN_160MHZ_HE_PPDU, elem->phy_cap_info[8]);
++
++	muru->ofdma_ul.t_frame_dur =
++		HE_MAC(CAP1_TF_MAC_PAD_DUR_MASK, elem->mac_cap_info[1]);
++	muru->ofdma_ul.mu_cascading =
++		HE_MAC(CAP2_MU_CASCADING, elem->mac_cap_info[2]);
++	muru->ofdma_ul.uo_ra =
++		HE_MAC(CAP3_OFDMA_RA, elem->mac_cap_info[3]);
++}
++
+ static inline bool
+ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 			struct ieee80211_sta *sta, bool bfee)
+@@ -1721,7 +1778,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 		mt7996_mcu_sta_he_6g_tlv(skb, sta);
+ 		/* starec eht */
+ 		mt7996_mcu_sta_eht_tlv(skb, sta);
+-		/* TODO: starec muru */
++		/* starec muru */
++		mt7996_mcu_sta_muru_tlv(dev, skb, vif, sta);
+ 		/* starec bfee */
+ 		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
+ 		/* starec hdr trans */
+@@ -2004,6 +2062,15 @@ mt7996_mcu_beacon_check_caps(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 		vc->eht_su_ebfee =
+ 			EHT_PHY(CAP0_SU_BEAMFORMEE, eht->phy_cap_info[0]) &&
+ 			EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
++		vc->eht_mu_ebfer_bw80 =
++			EHT_PHY(CAP7_MU_BEAMFORMER_80MHZ, eht->phy_cap_info[7]) &&
++			EHT_PHY(CAP7_MU_BEAMFORMER_80MHZ, pe->phy_cap_info[7]);
++		vc->eht_mu_ebfer_bw160 =
++			EHT_PHY(CAP7_MU_BEAMFORMER_160MHZ, eht->phy_cap_info[7]) &&
++			EHT_PHY(CAP7_MU_BEAMFORMER_160MHZ, pe->phy_cap_info[7]);
++		vc->eht_mu_ebfer_bw320 =
++			EHT_PHY(CAP7_MU_BEAMFORMER_320MHZ, eht->phy_cap_info[7]) &&
++			EHT_PHY(CAP7_MU_BEAMFORMER_320MHZ, pe->phy_cap_info[7]);
+ 	}
+ }
+ 
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 13f22432..64a804a4 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -125,6 +125,9 @@ struct mt7996_vif_cap {
+ 	bool he_mu_ebfer:1;
+ 	bool eht_su_ebfer:1;
+ 	bool eht_su_ebfee:1;
++	bool eht_mu_ebfer_bw80:1;
++	bool eht_mu_ebfer_bw160:1;
++	bool eht_mu_ebfer_bw320:1;
+ };
+ 
+ struct mt7996_vif {
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-set-txd-v1.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-set-txd-v1.patch
new file mode 100644
index 0000000..8fddb93
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-set-txd-v1.patch
@@ -0,0 +1,48 @@
+From d8bef73f22f88bf857698f4018db3aed6a2fca2d Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 29 Nov 2022 09:13:32 +0800
+Subject: [PATCH 5/7] wifi: mt76: mt7996: set txd v1
+
+---
+ mt7996/mac.c | 3 +++
+ mt7996/mac.h | 3 ++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index e5b5fed6..51337dde 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1092,6 +1092,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	struct mt7996_txp *txp;
+ 	int id, i, pid, nbuf = tx_info->nbuf - 1;
+ 	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
++	__le32 *txd = (__le32 *)txwi_ptr;
+ 	u8 *txwi = (u8 *)txwi_ptr;
+ 
+ 	if (unlikely(tx_info->skb->len <= ETH_HLEN))
+@@ -1123,6 +1124,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid,
+ 				      key, 0);
+ 
++	txd[0] |= le32_encode_bits(1, MT_TXD0_VER);
++
+ 	txp = (struct mt7996_txp *)(txwi + MT_TXD_SIZE);
+ 	for (i = 0; i < nbuf; i++) {
+ 		txp->buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr);
+diff --git a/mt7996/mac.h b/mt7996/mac.h
+index 9f688520..470b701a 100644
+--- a/mt7996/mac.h
++++ b/mt7996/mac.h
+@@ -186,7 +186,8 @@ enum tx_mgnt_type {
+ 
+ #define MT_TXD0_Q_IDX			GENMASK(31, 25)
+ #define MT_TXD0_PKT_FMT			GENMASK(24, 23)
+-#define MT_TXD0_ETH_TYPE_OFFSET		GENMASK(22, 16)
++#define MT_TXD0_VER			GENMASK(22, 19)
++#define MT_TXD0_ETH_TYPE_OFFSET		GENMASK(18, 16)
+ #define MT_TXD0_TX_BYTES		GENMASK(15, 0)
+ 
+ #define MT_TXD1_FIXED_RATE		BIT(31)
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
new file mode 100644
index 0000000..70867df
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
@@ -0,0 +1,132 @@
+From 6298046de15b190139552d74aeb668e8cb873b1d Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Thu, 15 Dec 2022 18:22:37 +0800
+Subject: [PATCH 6/7] wifi: mt76: mt7996: add 802.11s mesh amsdu/de-amsdu
+ support
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ mt7996/mac.c  | 15 ++++++++++++++-
+ mt7996/mac.h  |  2 ++
+ mt7996/mcu.c  |  9 ++++++++-
+ mt7996/mcu.h  |  2 +-
+ mt7996/mmio.c |  3 ++-
+ 5 files changed, 27 insertions(+), 4 deletions(-)
+ mode change 100644 => 100755 mt7996/mac.c
+ mode change 100644 => 100755 mt7996/mmio.c
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+old mode 100644
+new mode 100755
+index 51337dde..d17b5478
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -630,6 +630,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	u32 rxd4 = le32_to_cpu(rxd[4]);
+ 	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
+ 	u32 csum_status = *(u32 *)skb->cb;
++	u32 mesh_mask = MT_RXD0_MESH | MT_RXD0_MHCP;
+ 	bool unicast, insert_ccmp_hdr = false;
+ 	u8 remove_pad, amsdu_info, band_idx;
+ 	u8 mode = 0, qos_ctl = 0;
+@@ -822,6 +823,9 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
+ 
+ 		skb_pull(skb, hdr_gap);
+ 		if (!hdr_trans && status->amsdu) {
++		    if(ieee80211_has_a4(fc) && ((rxd0 & mesh_mask) == mesh_mask))
++			pad_start = 0;
++		    else
+ 			pad_start = ieee80211_get_hdrlen_from_skb(skb);
+ 		} else if (hdr_trans && (rxd2 & MT_RXD2_NORMAL_HDR_TRANS_ERROR)) {
+ 			/* When header translation failure is indicated,
+@@ -854,8 +858,17 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
+ 		hdr = mt76_skb_get_hdr(skb);
+ 		fc = hdr->frame_control;
+ 		if (ieee80211_is_data_qos(fc)) {
++			u8 *p = ieee80211_get_qos_ctl(hdr);
++
+ 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
+-			qos_ctl = *ieee80211_get_qos_ctl(hdr);
++			qos_ctl = *p;
++
++			/* the hardware support mesh de-amsdu by default,
++			 * so, clear amsdu present bit in the Qos Control field.
++			 */
++			if (ieee80211_has_a4(fc) && status->amsdu &&
++			    ((rxd0 & mesh_mask) == mesh_mask))
++				*p &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
+ 		}
+ 	} else {
+ 		status->flag |= RX_FLAG_8023;
+diff --git a/mt7996/mac.h b/mt7996/mac.h
+index 470b701a..fd0e5d1c 100644
+--- a/mt7996/mac.h
++++ b/mt7996/mac.h
+@@ -12,6 +12,8 @@
+ #define MT_RXD0_LENGTH			GENMASK(15, 0)
+ #define MT_RXD0_PKT_TYPE		GENMASK(31, 27)
+ 
++#define MT_RXD0_MESH			BIT(18)
++#define MT_RXD0_MHCP			BIT(19)
+ #define MT_RXD0_NORMAL_ETH_TYPE_OFS	GENMASK(22, 16)
+ #define MT_RXD0_NORMAL_IP_SUM		BIT(23)
+ #define MT_RXD0_NORMAL_UDP_TCP_SUM	BIT(24)
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 394dd15c..1e47b0ae 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -1022,7 +1022,8 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	struct tlv *tlv;
+ 
+ 	if (vif->type != NL80211_IFTYPE_STATION &&
+-	    vif->type != NL80211_IFTYPE_AP)
++	    vif->type != NL80211_IFTYPE_AP &&
++	    vif->type != NL80211_IFTYPE_MESH_POINT)
+ 		return;
+ 
+ 	if (!sta->deflink.agg.max_amsdu_len)
+@@ -1528,6 +1529,12 @@ mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 		hdr_trans->to_ds = true;
+ 		hdr_trans->from_ds = true;
+ 	}
++
++	if (vif->type == NL80211_IFTYPE_MESH_POINT) {
++		hdr_trans->to_ds = true;
++		hdr_trans->from_ds = true;
++		hdr_trans->mesh = true;
++	}
+ }
+ 
+ static enum mcu_mmps_mode
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index dd0c5ac5..009f5f06 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -396,7 +396,7 @@ struct sta_rec_hdr_trans {
+ 	u8 from_ds;
+ 	u8 to_ds;
+ 	u8 dis_rx_hdr_tran;
+-	u8 rsv;
++	u8 mesh;
+ } __packed;
+ 
+ struct hdr_trans_en {
+diff --git a/mt7996/mmio.c b/mt7996/mmio.c
+old mode 100644
+new mode 100755
+index d8a2c1a7..08164b1a
+--- a/mt7996/mmio.c
++++ b/mt7996/mmio.c
+@@ -320,7 +320,8 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+ 		/* txwi_size = txd size + txp size */
+ 		.txwi_size = MT_TXD_SIZE + sizeof(struct mt7996_txp),
+ 		.drv_flags = MT_DRV_TXWI_NO_FREE |
+-			     MT_DRV_HW_MGMT_TXQ,
++			     MT_DRV_HW_MGMT_TXQ |
++			     MT_DRV_AMSDU_OFFLOAD,
+ 		.survey_flags = SURVEY_INFO_TIME_TX |
+ 				SURVEY_INFO_TIME_RX |
+ 				SURVEY_INFO_TIME_BSS_RX,
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-mt76-revert-page-pool-changes.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mt76-revert-page-pool-changes.patch
new file mode 100644
index 0000000..ab1161f
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mt76-revert-page-pool-changes.patch
@@ -0,0 +1,708 @@
+From 60c4e64c0198c828fafd5e7b96027ad5fd633213 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 6 Feb 2023 15:34:43 +0800
+Subject: [PATCH 7/7] mt76: revert page pool changes
+
+---
+ dma.c         | 72 ++++++++++++++++++++++++++-------------------------
+ mac80211.c    | 57 ----------------------------------------
+ mt76.h        | 22 +---------------
+ mt7915/main.c | 26 +++++++------------
+ mt7915/mmio.c | 55 ++++++++++++++++++++++++---------------
+ mt7921/main.c | 31 +++-------------------
+ usb.c         | 42 ++++++++++++++++--------------
+ 7 files changed, 108 insertions(+), 197 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index e3fa4f39..50a7a689 100644
+--- a/dma.c
++++ b/dma.c
+@@ -173,7 +173,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
+ 	local_bh_disable();
+ 	while ((t = __mt76_get_rxwi(dev)) != NULL) {
+ 		if (t->ptr)
+-			mt76_put_page_pool_buf(t->ptr, false);
++			skb_free_frag(t->ptr);
+ 		kfree(t);
+ 	}
+ 	local_bh_enable();
+@@ -409,9 +409,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 		if (!t)
+ 			return NULL;
+ 
+-		dma_sync_single_for_cpu(dev->dma_dev, t->dma_addr,
+-				SKB_WITH_OVERHEAD(q->buf_size),
+-				page_pool_get_dma_dir(q->page_pool));
++		dma_unmap_single(dev->dma_dev, t->dma_addr,
++				 SKB_WITH_OVERHEAD(q->buf_size),
++				 DMA_FROM_DEVICE);
+ 
+ 		buf = t->ptr;
+ 		t->dma_addr = 0;
+@@ -428,9 +428,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 	} else {
+ 		buf = e->buf;
+ 		e->buf = NULL;
+-		dma_sync_single_for_cpu(dev->dma_dev, e->dma_addr[0],
+-				SKB_WITH_OVERHEAD(q->buf_size),
+-				page_pool_get_dma_dir(q->page_pool));
++		dma_unmap_single(dev->dma_dev, e->dma_addr[0],
++				 SKB_WITH_OVERHEAD(q->buf_size),
++				 DMA_FROM_DEVICE);
+ 	}
+ 
+ 	return buf;
+@@ -582,11 +582,11 @@ free_skb:
+ }
+ 
+ static int
+-mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+-		 bool allow_direct)
++mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ {
+ 	int len = SKB_WITH_OVERHEAD(q->buf_size);
+-	int frames = 0;
++	int frames = 0, offset = q->buf_offset;
++	dma_addr_t addr;
+ 
+ 	if (!q->ndesc)
+ 		return 0;
+@@ -594,25 +594,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+ 	spin_lock_bh(&q->lock);
+ 
+ 	while (q->queued < q->ndesc - 1) {
+-		enum dma_data_direction dir;
+ 		struct mt76_queue_buf qbuf;
+-		dma_addr_t addr;
+-		int offset;
+-		void *buf;
++		void *buf = NULL;
+ 
+-		buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
++		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
+ 		if (!buf)
+ 			break;
+ 
+-		addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
+-		dir = page_pool_get_dma_dir(q->page_pool);
+-		dma_sync_single_for_device(dev->dma_dev, addr, len, dir);
++		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
++		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
++			skb_free_frag(buf);
++			break;
++		}
+ 
+-		qbuf.addr = addr + q->buf_offset;
+-		qbuf.len = len - q->buf_offset;
++		qbuf.addr = addr + offset;
++		qbuf.len = len - offset;
+ 		qbuf.skip_unmap = false;
+ 		if (mt76_dma_add_rx_buf(dev, q, &qbuf, buf) < 0) {
+-			mt76_put_page_pool_buf(buf, allow_direct);
++			dma_unmap_single(dev->dma_dev, addr, len,
++					 DMA_FROM_DEVICE);
++			skb_free_frag(buf);
+ 			break;
+ 		}
+ 		frames++;
+@@ -656,7 +657,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+ 		/* WED txfree queue needs ring to be initialized before setup */
+ 		q->flags = 0;
+ 		mt76_dma_queue_reset(dev, q);
+-		mt76_dma_rx_fill(dev, q, false);
++		mt76_dma_rx_fill(dev, q);
+ 		q->flags = flags;
+ 
+ 		ret = mtk_wed_device_txfree_ring_setup(wed, q->regs);
+@@ -704,10 +705,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+ 	if (!q->entry)
+ 		return -ENOMEM;
+ 
+-	ret = mt76_create_page_pool(dev, q);
+-	if (ret)
+-		return ret;
+-
+ 	ret = mt76_dma_wed_setup(dev, q, false);
+ 	if (ret)
+ 		return ret;
+@@ -721,6 +718,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+ static void
+ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ {
++	struct page *page;
+ 	void *buf;
+ 	bool more;
+ 
+@@ -734,7 +732,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ 		if (!buf)
+ 			break;
+ 
+-		mt76_put_page_pool_buf(buf, false);
++		skb_free_frag(buf);
+ 	} while (1);
+ 
+ 	if (q->rx_head) {
+@@ -743,6 +741,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ 	}
+ 
+ 	spin_unlock_bh(&q->lock);
++
++	if (!q->rx_page.va)
++		return;
++
++	page = virt_to_page(q->rx_page.va);
++	__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++	memset(&q->rx_page, 0, sizeof(q->rx_page));
+ }
+ 
+ static void
+@@ -763,7 +768,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+ 	mt76_dma_wed_setup(dev, q, true);
+ 	if (q->flags != MT_WED_Q_TXFREE) {
+ 		mt76_dma_sync_idx(dev, q);
+-		mt76_dma_rx_fill(dev, q, false);
++		mt76_dma_rx_fill(dev, q);
+ 	}
+ }
+ 
+@@ -781,7 +786,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+ 
+ 		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
+ 	} else {
+-		mt76_put_page_pool_buf(data, true);
++		skb_free_frag(data);
+ 	}
+ 
+ 	if (more)
+@@ -854,7 +859,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 			goto free_frag;
+ 
+ 		skb_reserve(skb, q->buf_offset);
+-		skb_mark_for_recycle(skb);
+ 
+ 		*(u32 *)skb->cb = info;
+ 
+@@ -870,10 +874,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 		continue;
+ 
+ free_frag:
+-		mt76_put_page_pool_buf(data, true);
++		skb_free_frag(data);
+ 	}
+ 
+-	mt76_dma_rx_fill(dev, q, true);
++	mt76_dma_rx_fill(dev, q);
+ 	return done;
+ }
+ 
+@@ -918,7 +922,7 @@ mt76_dma_init(struct mt76_dev *dev,
+ 
+ 	mt76_for_each_q_rx(dev, i) {
+ 		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
+-		mt76_dma_rx_fill(dev, &dev->q_rx[i], false);
++		mt76_dma_rx_fill(dev, &dev->q_rx[i]);
+ 		napi_enable(&dev->napi[i]);
+ 	}
+ 
+@@ -969,8 +973,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+ 
+ 		netif_napi_del(&dev->napi[i]);
+ 		mt76_dma_rx_cleanup(dev, q);
+-
+-		page_pool_destroy(q->page_pool);
+ 	}
+ 
+ 	mt76_free_pending_txwi(dev);
+diff --git a/mac80211.c b/mac80211.c
+index b117e446..8a5f21e8 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -4,7 +4,6 @@
+  */
+ #include <linux/sched.h>
+ #include <linux/of.h>
+-#include <net/page_pool.h>
+ #include "mt76.h"
+ 
+ #define CHAN2G(_idx, _freq) {			\
+@@ -557,47 +556,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
+ }
+ EXPORT_SYMBOL_GPL(mt76_unregister_phy);
+ 
+-int mt76_create_page_pool(struct mt76_dev *dev, struct mt76_queue *q)
+-{
+-	struct page_pool_params pp_params = {
+-		.order = 0,
+-		.flags = PP_FLAG_PAGE_FRAG,
+-		.nid = NUMA_NO_NODE,
+-		.dev = dev->dma_dev,
+-	};
+-	int idx = q - dev->q_rx;
+-
+-	switch (idx) {
+-	case MT_RXQ_MAIN:
+-	case MT_RXQ_BAND1:
+-	case MT_RXQ_BAND2:
+-		pp_params.pool_size = 256;
+-		break;
+-	default:
+-		pp_params.pool_size = 16;
+-		break;
+-	}
+-
+-	if (mt76_is_mmio(dev)) {
+-		/* rely on page_pool for DMA mapping */
+-		pp_params.flags |= PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV;
+-		pp_params.dma_dir = DMA_FROM_DEVICE;
+-		pp_params.max_len = PAGE_SIZE;
+-		pp_params.offset = 0;
+-	}
+-
+-	q->page_pool = page_pool_create(&pp_params);
+-	if (IS_ERR(q->page_pool)) {
+-		int err = PTR_ERR(q->page_pool);
+-
+-		q->page_pool = NULL;
+-		return err;
+-	}
+-
+-	return 0;
+-}
+-EXPORT_SYMBOL_GPL(mt76_create_page_pool);
+-
+ struct mt76_dev *
+ mt76_alloc_device(struct device *pdev, unsigned int size,
+ 		  const struct ieee80211_ops *ops,
+@@ -1732,21 +1690,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+ }
+ EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
+ 
+-void mt76_ethtool_page_pool_stats(struct mt76_dev *dev, u64 *data, int *index)
+-{
+-#ifdef CONFIG_PAGE_POOL_STATS
+-	struct page_pool_stats stats = {};
+-	int i;
+-
+-	mt76_for_each_q_rx(dev, i)
+-		page_pool_get_stats(dev->q_rx[i].page_pool, &stats);
+-
+-	page_pool_ethtool_stats_get(data, &stats);
+-	*index += page_pool_ethtool_stats_get_count();
+-#endif
+-}
+-EXPORT_SYMBOL_GPL(mt76_ethtool_page_pool_stats);
+-
+ enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
+ {
+ 	struct ieee80211_hw *hw = phy->hw;
+diff --git a/mt76.h b/mt76.h
+index ccca0162..f6a32fe3 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -202,7 +202,7 @@ struct mt76_queue {
+ 
+ 	dma_addr_t desc_dma;
+ 	struct sk_buff *rx_head;
+-	struct page_pool *page_pool;
++	struct page_frag_cache rx_page;
+ };
+ 
+ struct mt76_mcu_ops {
+@@ -1318,7 +1318,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+ 	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
+ }
+ 
+-void mt76_ethtool_page_pool_stats(struct mt76_dev *dev, u64 *data, int *index);
+ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+ 			 struct mt76_sta_stats *stats, bool eht);
+ int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
+@@ -1430,25 +1429,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+ struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
+ int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
+ 			  struct mt76_txwi_cache *r, dma_addr_t phys);
+-int mt76_create_page_pool(struct mt76_dev *dev, struct mt76_queue *q);
+-static inline void mt76_put_page_pool_buf(void *buf, bool allow_direct)
+-{
+-	struct page *page = virt_to_head_page(buf);
+-
+-	page_pool_put_full_page(page->pp, page, allow_direct);
+-}
+-
+-static inline void *
+-mt76_get_page_pool_buf(struct mt76_queue *q, u32 *offset, u32 size)
+-{
+-	struct page *page;
+-
+-	page = page_pool_dev_alloc_frag(q->page_pool, offset, size);
+-	if (!page)
+-		return NULL;
+-
+-	return page_address(page) + *offset;
+-}
+ 
+ static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
+ {
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 3bbccbdf..161a2d1e 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1291,22 +1291,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+ 			   struct ieee80211_vif *vif,
+ 			   u32 sset, u8 *data)
+ {
+-	if (sset != ETH_SS_STATS)
+-		return;
+-
+-	memcpy(data, *mt7915_gstrings_stats, sizeof(mt7915_gstrings_stats));
+-	data += sizeof(mt7915_gstrings_stats);
+-	page_pool_ethtool_stats_get_strings(data);
++	if (sset == ETH_SS_STATS)
++		memcpy(data, *mt7915_gstrings_stats,
++		       sizeof(mt7915_gstrings_stats));
+ }
+ 
+ static
+ int mt7915_get_et_sset_count(struct ieee80211_hw *hw,
+ 			     struct ieee80211_vif *vif, int sset)
+ {
+-	if (sset != ETH_SS_STATS)
+-		return 0;
++	if (sset == ETH_SS_STATS)
++		return MT7915_SSTATS_LEN;
+ 
+-	return MT7915_SSTATS_LEN + page_pool_ethtool_stats_get_count();
++	return 0;
+ }
+ 
+ static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+@@ -1334,7 +1331,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+ 	};
+ 	struct mib_stats *mib = &phy->mib;
+ 	/* See mt7915_ampdu_stat_read_phy, etc */
+-	int i, ei = 0, stats_size;
++	int i, ei = 0;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
+@@ -1415,12 +1412,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+ 		return;
+ 
+ 	ei += wi.worker_stat_count;
+-
+-	mt76_ethtool_page_pool_stats(&dev->mt76, &data[ei], &ei);
+-
+-	stats_size = MT7915_SSTATS_LEN + page_pool_ethtool_stats_get_count();
+-	if (ei != stats_size)
+-		dev_err(dev->mt76.dev, "ei: %d size: %d", ei, stats_size);
++	if (ei != MT7915_SSTATS_LEN)
++		dev_err(dev->mt76.dev, "ei: %d  MT7915_SSTATS_LEN: %d",
++			ei, (int)MT7915_SSTATS_LEN);
+ }
+ 
+ static void
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 225a1960..cbe6e2cd 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -596,9 +596,13 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+ {
+ 	struct mt7915_dev *dev;
++	u32 length;
+ 	int i;
+ 
+ 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
++	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
++				sizeof(struct skb_shared_info));
++
+ 	for (i = 0; i < dev->mt76.rx_token_size; i++) {
+ 		struct mt76_txwi_cache *t;
+ 
+@@ -606,7 +610,9 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+ 		if (!t || !t->ptr)
+ 			continue;
+ 
+-		mt76_put_page_pool_buf(t->ptr, false);
++		dma_unmap_single(dev->mt76.dma_dev, t->dma_addr,
++				 wed->wlan.rx_size, DMA_FROM_DEVICE);
++		__free_pages(virt_to_page(t->ptr), get_order(length));
+ 		t->ptr = NULL;
+ 
+ 		mt76_put_rxwi(&dev->mt76, t);
+@@ -618,38 +624,47 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ {
+ 	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
+-	struct mt76_txwi_cache *t = NULL;
+ 	struct mt7915_dev *dev;
+-	struct mt76_queue *q;
+-	int i, len;
++	u32 length;
++	int i;
+ 
+ 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
+-	q = &dev->mt76.q_rx[MT_RXQ_MAIN];
+-	len = SKB_WITH_OVERHEAD(q->buf_size);
++	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
++				sizeof(struct skb_shared_info));
+ 
+ 	for (i = 0; i < size; i++) {
+-		enum dma_data_direction dir;
+-		dma_addr_t addr;
+-		u32 offset;
++		struct mt76_txwi_cache *t = mt76_get_rxwi(&dev->mt76);
++		dma_addr_t phy_addr;
++		struct page *page;
+ 		int token;
+-		void *buf;
++		void *ptr;
+ 
+-		t = mt76_get_rxwi(&dev->mt76);
+ 		if (!t)
+ 			goto unmap;
+ 
+-		buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
+-		if (!buf)
++		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
++		if (!page) {
++			mt76_put_rxwi(&dev->mt76, t);
+ 			goto unmap;
++		}
+ 
+-		addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
+-		dir = page_pool_get_dma_dir(q->page_pool);
+-		dma_sync_single_for_device(dev->mt76.dma_dev, addr, len, dir);
++		ptr = page_address(page);
++		phy_addr = dma_map_single(dev->mt76.dma_dev, ptr,
++					  wed->wlan.rx_size,
++					  DMA_TO_DEVICE);
++		if (unlikely(dma_mapping_error(dev->mt76.dev, phy_addr))) {
++			__free_pages(page, get_order(length));
++			mt76_put_rxwi(&dev->mt76, t);
++			goto unmap;
++		}
+ 
+-		desc->buf0 = cpu_to_le32(addr);
+-		token = mt76_rx_token_consume(&dev->mt76, buf, t, addr);
++		desc->buf0 = cpu_to_le32(phy_addr);
++		token = mt76_rx_token_consume(&dev->mt76, ptr, t, phy_addr);
+ 		if (token < 0) {
+-			mt76_put_page_pool_buf(buf, false);
++			dma_unmap_single(dev->mt76.dma_dev, phy_addr,
++					 wed->wlan.rx_size, DMA_TO_DEVICE);
++			__free_pages(page, get_order(length));
++			mt76_put_rxwi(&dev->mt76, t);
+ 			goto unmap;
+ 		}
+ 
+@@ -661,8 +676,6 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 	return 0;
+ 
+ unmap:
+-	if (t)
+-		mt76_put_rxwi(&dev->mt76, t);
+ 	mt7915_mmio_wed_release_rx_buf(wed);
+ 	return -ENOMEM;
+ }
+diff --git a/mt7921/main.c b/mt7921/main.c
+index 75eaf86c..1434ca79 100644
+--- a/mt7921/main.c
++++ b/mt7921/main.c
+@@ -1090,34 +1090,17 @@ static void
+ mt7921_get_et_strings(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      u32 sset, u8 *data)
+ {
+-	struct mt7921_dev *dev = mt7921_hw_dev(hw);
+-
+ 	if (sset != ETH_SS_STATS)
+ 		return;
+ 
+ 	memcpy(data, *mt7921_gstrings_stats, sizeof(mt7921_gstrings_stats));
+-
+-	if (mt76_is_sdio(&dev->mt76))
+-		return;
+-
+-	data += sizeof(mt7921_gstrings_stats);
+-	page_pool_ethtool_stats_get_strings(data);
+ }
+ 
+ static int
+ mt7921_get_et_sset_count(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			 int sset)
+ {
+-	struct mt7921_dev *dev = mt7921_hw_dev(hw);
+-
+-	if (sset != ETH_SS_STATS)
+-		return 0;
+-
+-	if (mt76_is_sdio(&dev->mt76))
+-		return ARRAY_SIZE(mt7921_gstrings_stats);
+-
+-	return ARRAY_SIZE(mt7921_gstrings_stats) +
+-	       page_pool_ethtool_stats_get_count();
++	return sset == ETH_SS_STATS ? ARRAY_SIZE(mt7921_gstrings_stats) : 0;
+ }
+ 
+ static void
+@@ -1137,7 +1120,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			 struct ethtool_stats *stats, u64 *data)
+ {
+ 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
+-	int stats_size = ARRAY_SIZE(mt7921_gstrings_stats);
+ 	struct mt7921_phy *phy = mt7921_hw_phy(hw);
+ 	struct mt7921_dev *dev = phy->dev;
+ 	struct mib_stats *mib = &phy->mib;
+@@ -1193,14 +1175,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		return;
+ 
+ 	ei += wi.worker_stat_count;
+-
+-	if (!mt76_is_sdio(&dev->mt76)) {
+-		mt76_ethtool_page_pool_stats(&dev->mt76, &data[ei], &ei);
+-		stats_size += page_pool_ethtool_stats_get_count();
+-	}
+-
+-	if (ei != stats_size)
+-		dev_err(dev->mt76.dev, "ei: %d  SSTATS_LEN: %d", ei, stats_size);
++	if (ei != ARRAY_SIZE(mt7921_gstrings_stats))
++		dev_err(dev->mt76.dev, "ei: %d  SSTATS_LEN: %zu",
++			ei, ARRAY_SIZE(mt7921_gstrings_stats));
+ }
+ 
+ static u64
+diff --git a/usb.c b/usb.c
+index b88959ef..3e281715 100644
+--- a/usb.c
++++ b/usb.c
+@@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
+ 
+ static int
+ mt76u_fill_rx_sg(struct mt76_dev *dev, struct mt76_queue *q, struct urb *urb,
+-		 int nsgs)
++		 int nsgs, gfp_t gfp)
+ {
+ 	int i;
+ 
+ 	for (i = 0; i < nsgs; i++) {
++		struct page *page;
+ 		void *data;
+ 		int offset;
+ 
+-		data = mt76_get_page_pool_buf(q, &offset, q->buf_size);
++		data = page_frag_alloc(&q->rx_page, q->buf_size, gfp);
+ 		if (!data)
+ 			break;
+ 
+-		sg_set_page(&urb->sg[i], virt_to_head_page(data), q->buf_size,
+-			    offset);
++		page = virt_to_head_page(data);
++		offset = data - page_address(page);
++		sg_set_page(&urb->sg[i], page, q->buf_size, offset);
+ 	}
+ 
+ 	if (i < nsgs) {
+ 		int j;
+ 
+ 		for (j = nsgs; j < urb->num_sgs; j++)
+-			mt76_put_page_pool_buf(sg_virt(&urb->sg[j]), false);
++			skb_free_frag(sg_virt(&urb->sg[j]));
+ 		urb->num_sgs = i;
+ 	}
+ 
+@@ -352,16 +354,15 @@ mt76u_fill_rx_sg(struct mt76_dev *dev, struct mt76_queue *q, struct urb *urb,
+ 
+ static int
+ mt76u_refill_rx(struct mt76_dev *dev, struct mt76_queue *q,
+-		struct urb *urb, int nsgs)
++		struct urb *urb, int nsgs, gfp_t gfp)
+ {
+ 	enum mt76_rxq_id qid = q - &dev->q_rx[MT_RXQ_MAIN];
+-	int offset;
+ 
+ 	if (qid == MT_RXQ_MAIN && dev->usb.sg_en)
+-		return mt76u_fill_rx_sg(dev, q, urb, nsgs);
++		return mt76u_fill_rx_sg(dev, q, urb, nsgs, gfp);
+ 
+ 	urb->transfer_buffer_length = q->buf_size;
+-	urb->transfer_buffer = mt76_get_page_pool_buf(q, &offset, q->buf_size);
++	urb->transfer_buffer = page_frag_alloc(&q->rx_page, q->buf_size, gfp);
+ 
+ 	return urb->transfer_buffer ? 0 : -ENOMEM;
+ }
+@@ -399,7 +400,7 @@ mt76u_rx_urb_alloc(struct mt76_dev *dev, struct mt76_queue *q,
+ 	if (err)
+ 		return err;
+ 
+-	return mt76u_refill_rx(dev, q, e->urb, sg_size);
++	return mt76u_refill_rx(dev, q, e->urb, sg_size, GFP_KERNEL);
+ }
+ 
+ static void mt76u_urb_free(struct urb *urb)
+@@ -407,10 +408,10 @@ static void mt76u_urb_free(struct urb *urb)
+ 	int i;
+ 
+ 	for (i = 0; i < urb->num_sgs; i++)
+-		mt76_put_page_pool_buf(sg_virt(&urb->sg[i]), false);
++		skb_free_frag(sg_virt(&urb->sg[i]));
+ 
+ 	if (urb->transfer_buffer)
+-		mt76_put_page_pool_buf(urb->transfer_buffer, false);
++		skb_free_frag(urb->transfer_buffer);
+ 
+ 	usb_free_urb(urb);
+ }
+@@ -546,8 +547,6 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb,
+ 		len -= data_len;
+ 		nsgs++;
+ 	}
+-
+-	skb_mark_for_recycle(skb);
+ 	dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb, NULL);
+ 
+ 	return nsgs;
+@@ -613,7 +612,7 @@ mt76u_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ 
+ 		count = mt76u_process_rx_entry(dev, urb, q->buf_size);
+ 		if (count > 0) {
+-			err = mt76u_refill_rx(dev, q, urb, count);
++			err = mt76u_refill_rx(dev, q, urb, count, GFP_ATOMIC);
+ 			if (err < 0)
+ 				break;
+ 		}
+@@ -664,10 +663,6 @@ mt76u_alloc_rx_queue(struct mt76_dev *dev, enum mt76_rxq_id qid)
+ 	struct mt76_queue *q = &dev->q_rx[qid];
+ 	int i, err;
+ 
+-	err = mt76_create_page_pool(dev, q);
+-	if (err)
+-		return err;
+-
+ 	spin_lock_init(&q->lock);
+ 	q->entry = devm_kcalloc(dev->dev,
+ 				MT_NUM_RX_ENTRIES, sizeof(*q->entry),
+@@ -696,6 +691,7 @@ EXPORT_SYMBOL_GPL(mt76u_alloc_mcu_queue);
+ static void
+ mt76u_free_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ {
++	struct page *page;
+ 	int i;
+ 
+ 	for (i = 0; i < q->ndesc; i++) {
+@@ -705,7 +701,13 @@ mt76u_free_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ 		mt76u_urb_free(q->entry[i].urb);
+ 		q->entry[i].urb = NULL;
+ 	}
+-	page_pool_destroy(q->page_pool);
++
++	if (!q->rx_page.va)
++		return;
++
++	page = virt_to_page(q->rx_page.va);
++	__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++	memset(&q->rx_page, 0, sizeof(q->rx_page));
+ }
+ 
+ static void mt76u_free_rx(struct mt76_dev *dev)
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch
new file mode 100644
index 0000000..dd28dc9
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch
@@ -0,0 +1,159 @@
+From e66fbcb72e09e9e6a88fcedc84f4eda0d53ef65d Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 3 Nov 2022 00:27:17 +0800
+Subject: [PATCH] mt76: mt7996: for build pass
+
+Change-Id: Ieb44c33ee6e6a2e6058c1ef528404c1a1cbcfdaf
+---
+ debugfs.c         | 3 +++
+ dma.c             | 2 +-
+ eeprom.c          | 8 +++++++-
+ mcu.c             | 1 +
+ mt7615/mcu.c      | 1 +
+ mt76_connac_mcu.c | 1 +
+ mt7915/mcu.c      | 1 +
+ mt7996/dma.c      | 4 ++--
+ mt7996/eeprom.c   | 1 +
+ mt7996/mcu.c      | 1 +
+ 10 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/debugfs.c b/debugfs.c
+index 79064a4d..e10d4cbc 100644
+--- a/debugfs.c
++++ b/debugfs.c
+@@ -33,8 +33,11 @@ mt76_napi_threaded_set(void *data, u64 val)
+ 	if (!mt76_is_mmio(dev))
+ 		return -EOPNOTSUPP;
+ 
++#if 0
++	/* need to backport patch from networking stack */
+ 	if (dev->napi_dev.threaded != val)
+ 		return dev_set_threaded(&dev->napi_dev, val);
++#endif
+ 
+ 	return 0;
+ }
+diff --git a/dma.c b/dma.c
+index 50a7a689..beb9f4a4 100644
+--- a/dma.c
++++ b/dma.c
+@@ -854,7 +854,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 		    !(dev->drv->rx_check(dev, data, len)))
+ 			goto free_frag;
+ 
+-		skb = napi_build_skb(data, q->buf_size);
++		skb = build_skb(data, q->buf_size);
+ 		if (!skb)
+ 			goto free_frag;
+ 
+diff --git a/eeprom.c b/eeprom.c
+index ea54b7af..90d36c8d 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -106,9 +106,15 @@ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+ 	struct mt76_dev *dev = phy->dev;
++#ifdef CONFIG_OF
+ 	struct device_node *np = dev->dev->of_node;
++	const u8 *mac = NULL;
+ 
+-	of_get_mac_address(np, phy->macaddr);
++	if (np)
++		mac = of_get_mac_address(np);
++	if (!IS_ERR_OR_NULL(mac))
++		ether_addr_copy(phy->macaddr, mac);
++#endif
+ 
+ 	if (!is_valid_ether_addr(phy->macaddr)) {
+ 		eth_random_addr(phy->macaddr);
+diff --git a/mcu.c b/mcu.c
+index a8cafa39..fa4b0544 100644
+--- a/mcu.c
++++ b/mcu.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include "mt76.h"
++#include <linux/moduleparam.h>
+ 
+ struct sk_buff *
+ __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
+diff --git a/mt7615/mcu.c b/mt7615/mcu.c
+index eea398c7..4593b2e1 100644
+--- a/mt7615/mcu.c
++++ b/mt7615/mcu.c
+@@ -10,6 +10,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ static bool prefer_offload_fw = true;
+ module_param(prefer_offload_fw, bool, 0644);
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index efb9bfaa..4a650721 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -4,6 +4,7 @@
+ #include <linux/firmware.h>
+ #include "mt76_connac2_mac.h"
+ #include "mt76_connac_mcu.h"
++#include <linux/module.h>
+ 
+ int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
+ {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index f151ce86..20d81f05 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -6,6 +6,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ #define fw_name(_dev, name, ...)	({			\
+ 	char *_fw;						\
+diff --git a/mt7996/dma.c b/mt7996/dma.c
+index c09fe427..8c2e060d 100644
+--- a/mt7996/dma.c
++++ b/mt7996/dma.c
+@@ -343,8 +343,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	netif_napi_add_tx(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
+-			  mt7996_poll_tx);
++	netif_tx_napi_add(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
++			  mt7996_poll_tx, NAPI_POLL_WEIGHT);
+ 	napi_enable(&dev->mt76.tx_napi);
+ 
+ 	mt7996_dma_enable(dev);
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index 2e48c5a4..dd322f62 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -98,6 +98,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	cap = 0x4b249248;	/* internal hardcode */
+ 	if (cap) {
+ 		dev->has_eht = !(cap & MODE_HE_ONLY);
+ 		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 1e47b0ae..db715195 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -5,6 +5,7 @@
+ 
+ #include <linux/firmware.h>
+ #include <linux/fs.h>
++#include <linux/moduleparam.h>
+ #include "mt7996.h"
+ #include "mcu.h"
+ #include "mac.h"
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-mt7996-for-build-pass.patch
deleted file mode 100644
index 3f327fc..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-mt7996-for-build-pass.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From c7c415e89ab0e47caa0d0a8d6b62bc179a16c35a Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 23 Dec 2022 17:28:03 +0800
-Subject: [PATCH 4001/4003] mt76: mt7996: for build pass
-
----
- debugfs.c    | 3 +++
- dma.c        | 4 ++--
- mt7996/dma.c | 4 ++--
- 3 files changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/debugfs.c b/debugfs.c
-index 79064a4..e10d4cb 100644
---- a/debugfs.c
-+++ b/debugfs.c
-@@ -33,8 +33,11 @@ mt76_napi_threaded_set(void *data, u64 val)
- 	if (!mt76_is_mmio(dev))
- 		return -EOPNOTSUPP;
- 
-+#if 0
-+	/* need to backport patch from networking stack */
- 	if (dev->napi_dev.threaded != val)
- 		return dev_set_threaded(&dev->napi_dev, val);
-+#endif
- 
- 	return 0;
- }
-diff --git a/dma.c b/dma.c
-index fc24b35..beb03cd 100644
---- a/dma.c
-+++ b/dma.c
-@@ -627,7 +627,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 
- 	switch (type) {
- 	case MT76_WED_Q_TX:
--		ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs);
-+		ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs, 0);
- 		if (!ret)
- 			q->wed_regs = wed->tx_ring[ring].reg_base;
- 		break;
-@@ -643,7 +643,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 			q->wed_regs = wed->txfree_ring.reg_base;
- 		break;
- 	case MT76_WED_Q_RX:
--		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
-+		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs, 0);
- 		if (!ret)
- 			q->wed_regs = wed->rx_ring[ring].reg_base;
- 		break;
-diff --git a/mt7996/dma.c b/mt7996/dma.c
-index c09fe42..8c2e060 100644
---- a/mt7996/dma.c
-+++ b/mt7996/dma.c
-@@ -343,8 +343,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
- 	if (ret < 0)
- 		return ret;
- 
--	netif_napi_add_tx(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
--			  mt7996_poll_tx);
-+	netif_tx_napi_add(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
-+			  mt7996_poll_tx, NAPI_POLL_WEIGHT);
- 	napi_enable(&dev->mt76.tx_napi);
- 
- 	mt7996_dma_enable(dev);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-revert-get_of_mac_addr.patch
deleted file mode 100644
index ad2ac2e..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-revert-get_of_mac_addr.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 4b50024ac0c221561d57a947fa6e76faf613c1a6 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 13 Dec 2022 10:51:46 +0800
-Subject: [PATCH 4002/4003] mt76: revert get_of_mac_addr
-
----
- eeprom.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/eeprom.c b/eeprom.c
-index 0a88048..680f76f 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -106,9 +106,15 @@ void
- mt76_eeprom_override(struct mt76_phy *phy)
- {
- 	struct mt76_dev *dev = phy->dev;
-+#ifdef CONFIG_OF
- 	struct device_node *np = dev->dev->of_node;
-+	const u8 *mac = NULL;
- 
--	of_get_mac_address(np, phy->macaddr);
-+	if (np)
-+		mac = of_get_mac_address(np);
-+	if (!IS_ERR_OR_NULL(mac))
-+		ether_addr_copy(phy->macaddr, mac);
-+#endif
- 
- 	if (!is_valid_ether_addr(phy->macaddr)) {
- 		eth_random_addr(phy->macaddr);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4003-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4003-mt76-include-header-files-for-module-param.patch
deleted file mode 100644
index 6fc5e0b..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4003-mt76-include-header-files-for-module-param.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 6ca19bb406e52edaed41d8ea84f67e872df113a4 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 23 Dec 2022 17:06:03 +0800
-Subject: [PATCH 4003/4003] mt76: include header files for module param
-
----
- mcu.c             | 1 +
- mt7615/mcu.c      | 1 +
- mt76_connac_mcu.c | 1 +
- mt7915/mcu.c      | 1 +
- mt7996/mcu.c      | 1 +
- 5 files changed, 5 insertions(+)
-
-diff --git a/mcu.c b/mcu.c
-index a8cafa3..fa4b054 100644
---- a/mcu.c
-+++ b/mcu.c
-@@ -4,6 +4,7 @@
-  */
- 
- #include "mt76.h"
-+#include <linux/moduleparam.h>
- 
- struct sk_buff *
- __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
-diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index 83f3030..e917d02 100644
---- a/mt7615/mcu.c
-+++ b/mt7615/mcu.c
-@@ -10,6 +10,7 @@
- #include "mcu.h"
- #include "mac.h"
- #include "eeprom.h"
-+#include <linux/moduleparam.h>
- 
- static bool prefer_offload_fw = true;
- module_param(prefer_offload_fw, bool, 0644);
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 5a047e6..b0dcc5a 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -4,6 +4,7 @@
- #include <linux/firmware.h>
- #include "mt76_connac2_mac.h"
- #include "mt76_connac_mcu.h"
-+#include <linux/module.h>
- 
- int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
- {
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 35441dc..56b5a24 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -6,6 +6,7 @@
- #include "mcu.h"
- #include "mac.h"
- #include "eeprom.h"
-+#include <linux/moduleparam.h>
- 
- #define fw_name(_dev, name, ...)	({			\
- 	char *_fw;						\
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index d781c6e..37cf269 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -8,6 +8,7 @@
- #include "mt7996.h"
- #include "mcu.h"
- #include "mac.h"
-+#include <linux/moduleparam.h>
- #include "eeprom.h"
- 
- struct mt7996_patch_hdr {
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index cc889fc..cf59945 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -1,10 +1,12 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
-    file://0001-wifi-mt76-mt7996-fix-chainmask-calculation-in-mt7996.patch \
-    file://0002-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch \
-    file://0003-wifi-mt76-mt7996-do-not-hardcode-vht-beamform-cap.patch \
-    file://0004-wifi-mt76-connac-fix-POWER_CTRL-command-name-typo.patch \
-    file://4001-mt76-mt7996-for-build-pass.patch \
-    file://4002-mt76-revert-get_of_mac_addr.patch \
-    file://4003-mt76-include-header-files-for-module-param.patch \
+    file://0000-sync-to-master.patch \
+    file://0001-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_tx_compl.patch \
+    file://0002-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_txp_skb_.patch \
+    file://0003-Revert-wifi-mt76-mt7996-rely-on-mt76_connac_txp_comm.patch \
+    file://0004-wifi-mt76-mt7996-add-muru-support.patch \
+    file://0005-wifi-mt76-mt7996-set-txd-v1.patch \
+    file://0006-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch \
+    file://0007-mt76-revert-page-pool-changes.patch \
+    file://0999-mt76-mt7996-for-build-pass.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
deleted file mode 100644
index 9ac96f3..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 3126ebf7886276a5a1da781a539da0fa3603f673 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Fri, 2 Dec 2022 10:16:49 +0800
-Subject: [PATCH 1/6] wifi: mt76: mt7915: call
- mt7915_mcu_set_thermal_throttling() only after init_work
-
-Enable thermal management by default shall not be executed during mcu
-init. This causes thermal configuration being reset to the firmware
-default settings.
-
-Fixes: 0063b86c9120 ("mt76: mt7915e: Enable thermal management by default")
-Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7915/init.c | 3 +--
- mt7915/main.c | 6 ++++++
- 2 files changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 6fd5c63..a03d0b3 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -201,8 +201,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
- 	phy->throttle_temp[0] = 110;
- 	phy->throttle_temp[1] = 120;
- 
--	return mt7915_mcu_set_thermal_throttling(phy,
--						 MT7915_THERMAL_THROTTLE_MAX);
-+	return 0;
- }
- 
- static void mt7915_led_set_config(struct led_classdev *led_cdev,
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 0511d6a..98af032 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -57,6 +57,12 @@ int mt7915_run(struct ieee80211_hw *hw)
- 		mt7915_mac_enable_nf(dev, phy->mt76->band_idx);
- 	}
- 
-+	ret = mt7915_mcu_set_thermal_throttling(phy,
-+						MT7915_THERMAL_THROTTLE_MAX);
-+
-+	if (ret)
-+		goto out;
-+
- 	ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, 0x92b,
- 					     phy->mt76->band_idx);
- 	if (ret)
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-rework-mt7915_thermal_init.patch b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-rework-mt7915_thermal_init.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-rework-mt7915_thermal_init.patch
rename to recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-rework-mt7915_thermal_init.patch
index f5c250a..0494b40 100644
--- a/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-rework-mt7915_thermal_init.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-rework-mt7915_thermal_init.patch
@@ -1,4 +1,4 @@
-From 6e2b8db65902a9ed9d0bb323b915657f14f9c740 Mon Sep 17 00:00:00 2001
+From e4a095d551a5d2252887b88d064dee43fcb4149d Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 19 Jan 2023 11:03:44 +0800
 Subject: [PATCH] wifi: mt76: mt7915: rework mt7915_thermal_init()
@@ -11,10 +11,10 @@
  1 file changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index b23a2fb8..476c1238 100644
+index ec297e04..8485a154 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -203,6 +203,10 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
+@@ -202,6 +202,10 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
  			phy->cdev = cdev;
  	}
  
@@ -25,7 +25,7 @@
  	if (!IS_REACHABLE(CONFIG_HWMON))
  		return 0;
  
-@@ -211,10 +215,6 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
+@@ -210,10 +214,6 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
  	if (IS_ERR(hwmon))
  		return PTR_ERR(hwmon);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
deleted file mode 100644
index 5878df6..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
+++ /dev/null
@@ -1,151 +0,0 @@
-From 40d952371aa09e9c979a0fa198825bee104acbe0 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 5 Dec 2022 14:09:18 +0800
-Subject: [PATCH 2/6] wifi: mt76: mt7915: rework
- mt7915_mcu_set_thermal_throttling
-
-This patch includes 2 changes:
-1. Firmware expects to disable thermal protect first before
-reconfiguring.
-2. Separate setting thermal_protect and setting thermal_tx_duty into
-different functions. These two firmware commands do not need to send
-together.
-
-Fixes: 34b877d972be ("mt76: mt7915: add thermal cooling device support")
-Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7915/init.c   |  3 ---
- mt7915/main.c   |  5 +++++
- mt7915/mcu.c    | 54 ++++++++++++++++++++++++++++---------------------
- mt7915/mt7915.h |  1 +
- 4 files changed, 37 insertions(+), 26 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index a03d0b3..df3a35d 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -134,9 +134,6 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,
- 	if (state > MT7915_CDEV_THROTTLE_MAX)
- 		return -EINVAL;
- 
--	if (phy->throttle_temp[0] > phy->throttle_temp[1])
--		return 0;
--
- 	if (state == phy->cdev_state)
- 		return 0;
- 
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 98af032..7589af4 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -60,6 +60,11 @@ int mt7915_run(struct ieee80211_hw *hw)
- 	ret = mt7915_mcu_set_thermal_throttling(phy,
- 						MT7915_THERMAL_THROTTLE_MAX);
- 
-+	if (ret)
-+		goto out;
-+
-+	ret = mt7915_mcu_set_thermal_protect(phy);
-+
- 	if (ret)
- 		goto out;
- 
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 35441dc..7c14a18 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3077,6 +3077,29 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
- }
- 
- int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_mcu_thermal_ctrl req = {
-+		.band_idx = phy->mt76->band_idx,
-+		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
-+	};
-+	int level, ret;
-+
-+	/* set duty cycle and level */
-+	for (level = 0; level < 4; level++) {
-+		req.duty.duty_level = level;
-+		req.duty.duty_cycle = state;
-+		state /= 2;
-+
-+		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
-+					&req, sizeof(req), false);
-+		if (ret)
-+			return ret;
-+	}
-+	return 0;
-+}
-+
-+int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
- 	struct {
-@@ -3089,29 +3112,18 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
- 	} __packed req = {
- 		.ctrl = {
- 			.band_idx = phy->mt76->band_idx,
-+			.type.protect_type = 1,
-+			.type.trigger_type = 1,
- 		},
- 	};
--	int level;
--
--	if (!state) {
--		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
--		goto out;
--	}
--
--	/* set duty cycle and level */
--	for (level = 0; level < 4; level++) {
--		int ret;
-+	int ret;
- 
--		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
--		req.ctrl.duty.duty_level = level;
--		req.ctrl.duty.duty_cycle = state;
--		state /= 2;
-+	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
-+	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
-+				&req, sizeof(req.ctrl), false);
- 
--		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
--					&req, sizeof(req.ctrl), false);
--		if (ret)
--			return ret;
--	}
-+	if (ret)
-+		return ret;
- 
- 	/* set high-temperature trigger threshold */
- 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
-@@ -3120,10 +3132,6 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
- 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
- 	req.sustain_time = cpu_to_le16(10);
- 
--out:
--	req.ctrl.type.protect_type = 1;
--	req.ctrl.type.trigger_type = 1;
--
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
- 				 &req, sizeof(req), false);
- }
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6351feb..855779f 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -543,6 +543,7 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy);
- int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
- int mt7915_mcu_get_temperature(struct mt7915_phy *phy);
- int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state);
-+int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
- int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 			   struct ieee80211_sta *sta, struct rate_info *rate);
- int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
deleted file mode 100644
index 49239f7..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 797d4335d5399b79cdd99668760658f780f951cf Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 12 Dec 2022 11:30:37 +0800
-Subject: [PATCH 3/6] wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
-
-Call mt7915_mcu_set_thermal_protect() through
-mt7915_thermal_temp_store() to update firmware trigger/restore temp
-directly.
-
-Fixes: 02ee68b95d81 ("mt76: mt7915: add control knobs for thermal throttling")
-Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7915/init.c   | 18 ++++++++++++++++--
- mt7915/mt7915.h |  3 +++
- 2 files changed, 19 insertions(+), 2 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index df3a35d..98655e4 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -83,9 +83,23 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev,
- 
- 	mutex_lock(&phy->dev->mt76.mutex);
- 	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 60, 130);
-+
-+	if ((i - 1 == MT7915_CRIT_TEMP_IDX &&
-+	     val > phy->throttle_temp[MT7915_MAX_TEMP_IDX]) ||
-+	    (i - 1 == MT7915_MAX_TEMP_IDX &&
-+	     val < phy->throttle_temp[MT7915_CRIT_TEMP_IDX])) {
-+		dev_err(phy->dev->mt76.dev,
-+			"temp1_max shall be greater than temp1_crit.");
-+		return -EINVAL;
-+	}
-+
- 	phy->throttle_temp[i - 1] = val;
- 	mutex_unlock(&phy->dev->mt76.mutex);
- 
-+	ret = mt7915_mcu_set_thermal_protect(phy);
-+	if (ret)
-+		return ret;
-+
- 	return count;
- }
- 
-@@ -195,8 +209,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
- 		return PTR_ERR(hwmon);
- 
- 	/* initialize critical/maximum high temperature */
--	phy->throttle_temp[0] = 110;
--	phy->throttle_temp[1] = 120;
-+	phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = 110;
-+	phy->throttle_temp[MT7915_MAX_TEMP_IDX] = 120;
- 
- 	return 0;
- }
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 855779f..e58650b 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -70,6 +70,9 @@
- 
- #define MT7915_WED_RX_TOKEN_SIZE	12288
- 
-+#define MT7915_CRIT_TEMP_IDX		0
-+#define MT7915_MAX_TEMP_IDX		1
-+
- struct mt7915_vif;
- struct mt7915_sta;
- struct mt7915_dfs_pulse;
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
deleted file mode 100644
index 04b211e..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From a0db278ac3f340b894e98e8672a36d428ed92dee Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 12 Dec 2022 13:18:49 +0800
-Subject: [PATCH 4/6] wifi: mt76: mt7915: add error message in
- mt7915_thermal_set_cur_throttle_state()
-
-Add dev_err so that it is easier to see invalid setting while looking at
-dmesg.
-
-Co-developed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7915/init.c   | 12 +++++++-----
- mt7915/mt7915.h |  2 ++
- 2 files changed, 9 insertions(+), 5 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 98655e4..b23a2fb 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -145,8 +145,11 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,
- 	u8 throttling = MT7915_THERMAL_THROTTLE_MAX - state;
- 	int ret;
- 
--	if (state > MT7915_CDEV_THROTTLE_MAX)
-+	if (state > MT7915_CDEV_THROTTLE_MAX) {
-+		dev_err(phy->dev->mt76.dev,
-+			"please specify a valid throttling state\n");
- 		return -EINVAL;
-+	}
- 
- 	if (state == phy->cdev_state)
- 		return 0;
-@@ -175,7 +178,7 @@ static void mt7915_unregister_thermal(struct mt7915_phy *phy)
- 	struct wiphy *wiphy = phy->mt76->hw->wiphy;
- 
- 	if (!phy->cdev)
--	    return;
-+		return;
- 
- 	sysfs_remove_link(&wiphy->dev.kobj, "cooling_device");
- 	thermal_cooling_device_unregister(phy->cdev);
-@@ -209,8 +212,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
- 		return PTR_ERR(hwmon);
- 
- 	/* initialize critical/maximum high temperature */
--	phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = 110;
--	phy->throttle_temp[MT7915_MAX_TEMP_IDX] = 120;
-+	phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = MT7915_CRIT_TEMP;
-+	phy->throttle_temp[MT7915_MAX_TEMP_IDX] = MT7915_MAX_TEMP;
- 
- 	return 0;
- }
-@@ -1185,7 +1188,6 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
- 		mt7986_wmac_disable(dev);
- }
- 
--
- int mt7915_register_device(struct mt7915_dev *dev)
- {
- 	struct mt7915_phy *phy2;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e58650b..942d70c 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -72,6 +72,8 @@
- 
- #define MT7915_CRIT_TEMP_IDX		0
- #define MT7915_MAX_TEMP_IDX		1
-+#define MT7915_CRIT_TEMP		110
-+#define MT7915_MAX_TEMP			120
- 
- struct mt7915_vif;
- struct mt7915_sta;
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch
deleted file mode 100644
index 13bcbdc..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 88bb62ee65721e2591f989e2bda3e1ab08efdf2b Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Thu, 15 Dec 2022 17:15:49 +0800
-Subject: [PATCH 5/6] wifi: mt76: mt7915: set sku initial value to zero
-
-Set sku initial value to prevent mcu get an invalid value before mcu starts
-to run.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/soc.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/mt7915/soc.c b/mt7915/soc.c
-index 686c9bb..2ac0a0f 100644
---- a/mt7915/soc.c
-+++ b/mt7915/soc.c
-@@ -883,6 +883,8 @@ static int mt7986_wmac_wm_enable(struct mt7915_dev *dev, bool enable)
- {
- 	u32 cur;
- 
-+	mt76_wr(dev, MT_CONNINFRA_SKU_DEC_ADDR, 0);
-+
- 	mt76_rmw_field(dev, MT7986_TOP_WM_RESET,
- 		       MT7986_TOP_WM_RESET_MASK, enable);
- 	if (!enable)
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch
deleted file mode 100644
index 7bbd01d..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 6d47538ac0b3e34f8cda287e9666fc15842f1d0b Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 8 Dec 2022 15:54:19 +0800
-Subject: [PATCH 6/6] wifi: mt76: mt7915: add chip id condition in
- mt7915_check_eeprom()
-
-When flash mode is enabled, and the eeprom data in the flash is not for
-the current chipset, it'll still be checked valid, and the default
-eeprom bin won't be loaded.
-(e.g., mt7915 NIC inserted with mt7916 eeprom data in the flash.)
-
-Fix this kind of case by adding chip id into consideration in
-mt7915_check_eeprom().
-
-Reported-by: Cheng-Ji Li <cheng-ji.li@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt7915/eeprom.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 24efa28..a796289 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -33,11 +33,14 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
- 	u8 *eeprom = dev->mt76.eeprom.data;
- 	u16 val = get_unaligned_le16(eeprom);
- 
-+#define CHECK_EEPROM_ERR(match)	(match ? 0 : -EINVAL)
- 	switch (val) {
- 	case 0x7915:
-+		return CHECK_EEPROM_ERR(is_mt7915(&dev->mt76));
- 	case 0x7916:
-+		return CHECK_EEPROM_ERR(is_mt7916(&dev->mt76));
- 	case 0x7986:
--		return 0;
-+		return CHECK_EEPROM_ERR(is_mt7986(&dev->mt76));
- 	default:
- 		return -EINVAL;
- 	}
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-remove-BW160-and-BW80-80-support.patch b/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-remove-BW160-and-BW80-80-support.patch
deleted file mode 100644
index af2ed13..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-remove-BW160-and-BW80-80-support.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From 98aa346042bd21fe8c0b1594736edca16be436db Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
-Date: Wed, 4 Jan 2023 17:03:52 +0800
-Subject: [PATCH] wifi: mt76: mt7915: remove BW160 and BW80+80 support
-
-Remove BW160 and BW80+80 capability in mt7915.
-
-Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
-Reviewed-by: Shayne Chen <shayne.chen@mediatek.com>
-Signed-off-by: Money Wang<Money.Wang@mediatek.com>
-Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
- mt7915/init.c | 38 +++++++++-----------------------------
- 1 file changed, 9 insertions(+), 29 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index b23a2fb8..ec297e04 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -38,8 +38,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
- 				       BIT(NL80211_CHAN_WIDTH_20) |
- 				       BIT(NL80211_CHAN_WIDTH_40) |
- 				       BIT(NL80211_CHAN_WIDTH_80) |
--				       BIT(NL80211_CHAN_WIDTH_160) |
--				       BIT(NL80211_CHAN_WIDTH_80P80),
-+				       BIT(NL80211_CHAN_WIDTH_160),
- 	}
- };
- 
-@@ -410,11 +409,6 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
- 			phy->mt76->sband_5g.sband.vht_cap.cap |=
- 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 |
- 				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
--
--			if (!dev->dbdc_support)
--				phy->mt76->sband_5g.sband.vht_cap.cap |=
--					IEEE80211_VHT_CAP_SHORT_GI_160 |
--					IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
- 		} else {
- 			phy->mt76->sband_5g.sband.vht_cap.cap |=
- 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
-@@ -850,13 +844,9 @@ mt7915_set_stream_he_txbf_caps(struct mt7915_phy *phy,
- 	int sts = hweight8(phy->mt76->chainmask);
- 	u8 c, sts_160 = sts;
- 
--	/* Can do 1/2 of STS in 160Mhz mode for mt7915 */
--	if (is_mt7915(&dev->mt76)) {
--		if (!dev->dbdc_support)
--			sts_160 /= 2;
--		else
--			sts_160 = 0;
--	}
-+	/* mt7915 doesn't support bw160 */
-+	if (is_mt7915(&dev->mt76))
-+		sts_160 = 0;
- 
- #ifdef CONFIG_MAC80211_MESH
- 	if (vif == NL80211_IFTYPE_MESH_POINT)
-@@ -910,9 +900,6 @@ mt7915_set_stream_he_txbf_caps(struct mt7915_phy *phy,
- 	elem->phy_cap_info[3] |= IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
- 	elem->phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
- 
--	/* num_snd_dim
--	 * for mt7915, max supported sts is 2 for bw > 80MHz and 0 if dbdc
--	 */
- 	c = FIELD_PREP(IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
- 		       sts - 1);
- 	if (sts_160)
-@@ -960,15 +947,10 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
- 	int i, idx = 0, nss = hweight8(phy->mt76->antenna_mask);
- 	u16 mcs_map = 0;
- 	u16 mcs_map_160 = 0;
--	u8 nss_160;
-+	u8 nss_160 = nss;
- 
--	if (!is_mt7915(&dev->mt76))
--		nss_160 = nss;
--	else if (!dev->dbdc_support)
--		/* Can do 1/2 of NSS streams in 160Mhz mode for mt7915 */
--		nss_160 = nss / 2;
--	else
--		/* Can't do 160MHz with mt7915 dbdc */
-+	/* Can't do 160MHz with mt7915 */
-+	if (is_mt7915(&dev->mt76))
- 		nss_160 = 0;
- 
- 	for (i = 0; i < 8; i++) {
-@@ -1018,8 +1000,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
- 		else if (nss_160)
- 			he_cap_elem->phy_cap_info[0] =
- 				IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
--				IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
--				IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
-+				IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
- 		else
- 			he_cap_elem->phy_cap_info[0] =
- 				IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G;
-@@ -1091,12 +1072,11 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
- 			break;
- 		}
- 
-+		memset(he_mcs, 0, sizeof(*he_mcs));
- 		he_mcs->rx_mcs_80 = cpu_to_le16(mcs_map);
- 		he_mcs->tx_mcs_80 = cpu_to_le16(mcs_map);
- 		he_mcs->rx_mcs_160 = cpu_to_le16(mcs_map_160);
- 		he_mcs->tx_mcs_160 = cpu_to_le16(mcs_map_160);
--		he_mcs->rx_mcs_80p80 = cpu_to_le16(mcs_map_160);
--		he_mcs->tx_mcs_80p80 = cpu_to_le16(mcs_map_160);
- 
- 		mt7915_set_stream_he_txbf_caps(phy, he_cap, i);
- 
--- 
-2.39.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index c48737b..2ebf984 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,31 +1,31 @@
-From 3b83a541b0c997b09518d85069a2ec3fb2c08f33 Mon Sep 17 00:00:00 2001
+From c1c5febad5b40bba3026976061a2d6c234f8ad25 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
 Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
- mt76_connac_mcu.h     |    7 +
+ mt76_connac_mcu.h     |    6 +
  mt7915/Makefile       |    2 +-
  mt7915/debugfs.c      |   73 +-
  mt7915/mac.c          |   14 +
  mt7915/main.c         |    4 +
- mt7915/mcu.c          |   63 +
+ mt7915/mcu.c          |   48 +-
  mt7915/mcu.h          |    4 +
  mt7915/mt7915.h       |   44 +
  mt7915/mt7915_debug.h | 1363 +++++++++++++++++++
  mt7915/mtk_debugfs.c  | 3003 +++++++++++++++++++++++++++++++++++++++++
  mt7915/mtk_mcu.c      |   51 +
  tools/fwlog.c         |   44 +-
- 12 files changed, 4659 insertions(+), 13 deletions(-)
+ 12 files changed, 4642 insertions(+), 14 deletions(-)
  create mode 100644 mt7915/mt7915_debug.h
  create mode 100644 mt7915/mtk_debugfs.c
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f1e942b..9d0d613 100644
+index a5e6ee4d..cbe0c52a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1146,6 +1146,7 @@ enum {
+@@ -1151,6 +1151,7 @@ enum {
  	MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
  	MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_CMD_TXBF_ACTION = 0x1e,
@@ -33,24 +33,23 @@
  	MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
  	MCU_EXT_CMD_THERMAL_PROT = 0x23,
  	MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
-@@ -1169,6 +1170,12 @@ enum {
+@@ -1174,6 +1175,11 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
 +#ifdef MTK_DEBUG
-+	MCU_EXT_CMD_RED_ENABLE = 0x68,
 +	MCU_EXT_CMD_RED_SHOW_STA = 0x69,
 +	MCU_EXT_CMD_RED_TARGET_DELAY = 0x6A,
 +	MCU_EXT_CMD_RED_TX_RPT = 0x6B,
 +#endif
  	MCU_EXT_CMD_TXDPD_CAL = 0x60,
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
- 	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
+ 	MCU_EXT_CMD_RED_ENABLE = 0x68,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index 797ae49..a42866e 100644
+index f033116c..cbcb64be 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
-@@ -3,7 +3,7 @@
+@@ -4,7 +4,7 @@ EXTRA_CFLAGS += -DCONFIG_MT76_LEDS
  obj-$(CONFIG_MT7915E) += mt7915e.o
  
  mt7915e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
@@ -60,7 +59,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 5a46813..f1f3f2f 100644
+index 5a46813a..f1f3f2f3 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -204,10 +203,10 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f0d5a36..149527d 100644
+index 97ca55d2..1ba4096d 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -300,6 +300,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -299,6 +299,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	__le16 fc = 0;
  	int idx;
  
@@ -218,7 +217,7 @@
  	memset(status, 0, sizeof(*status));
  
  	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->mt76->band_idx) {
-@@ -483,6 +487,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -482,6 +486,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	}
  
  	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
@@ -229,7 +228,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		struct ieee80211_vif *vif;
  		int err;
-@@ -820,6 +828,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -819,6 +827,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -243,7 +242,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7589af4..f6edab6 100644
+index 3bbccbdf..94ecded5 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -259,7 +258,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7c14a18..644e6a8 100644
+index f151ce86..ff718f78 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -274,7 +273,19 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3331,6 +3336,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -2315,7 +2320,10 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
+ 				 sizeof(req), false);
+ }
+ 
+-static int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
++#ifndef MTK_DEBUG
++static
++#endif
++int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+ {
+ #define RED_DISABLE		0
+ #define RED_BY_WA_ENABLE	2
+@@ -3377,6 +3385,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -283,7 +294,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3768,6 +3775,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3814,6 +3824,23 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -302,32 +313,12 @@
 +
 +	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
 +}
-+
-+int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
-+{
-+#define RED_DISABLE		0
-+#define RED_BY_HOST_ENABLE	1
-+#define RED_BY_WA_ENABLE	2
-+	int ret;
-+	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
-+	__le32 req = cpu_to_le32(red_type);
-+
-+	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
-+				 sizeof(req), false);
-+	if (ret < 0)
-+		return ret;
-+
-+	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
-+			  MCU_WA_PARAM_RED, enabled, 0, true);
-+
-+	return 0;
-+}
 +#endif
 +
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -3796,3 +3840,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3842,3 +3869,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -351,7 +342,7 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 29b5434..aa89106 100644
+index b9ea297f..da863601 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -278,6 +278,10 @@ enum {
@@ -362,11 +353,11 @@
 +	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
 +	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 +#endif
+ 	MCU_WA_PARAM_RED_SETTING = 0x40,
  };
  
- enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 942d70c..afe2ec7 100644
+index 3cbfb9b6..19880099 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -377,7 +368,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -372,6 +373,29 @@ struct mt7915_dev {
+@@ -373,6 +374,29 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -407,7 +398,7 @@
  };
  
  enum {
-@@ -650,4 +674,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -651,4 +675,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -434,7 +425,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 0000000..ca553dc
+index 00000000..ca553dca
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1363 @@
@@ -1803,7 +1794,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..761263e
+index 00000000..4fb845b0
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,3003 @@
@@ -4812,7 +4803,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 0000000..143dae2
+index 00000000..143dae26
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4868,7 +4859,7 @@
 +				 sizeof(req), true);
 +}
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a10..3d51d9e 100644
+index e5d4a105..3d51d9ec 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
diff --git a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index ce4f6ae..bde66c3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,4 +1,4 @@
-From 26caea08dc572c3d938aeb8c9471e857f865f103 Mon Sep 17 00:00:00 2001
+From f7a36f2ff5ca5cdf4a5fca215b14622da6257016 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
 Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
@@ -17,10 +17,10 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9d0d613..26e7cf6 100644
+index cbe0c52a..32156d35 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -998,6 +998,7 @@ enum {
+@@ -1003,6 +1003,7 @@ enum {
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
@@ -28,7 +28,7 @@
  };
  
  /* unified event table */
-@@ -1191,6 +1192,7 @@ enum {
+@@ -1196,6 +1197,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -37,13 +37,14 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index a42866e..14ce98a 100644
+index cbcb64be..6a922a9f 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
-@@ -1,9 +1,9 @@
+@@ -1,10 +1,10 @@
  # SPDX-License-Identifier: ISC
--
-+EXTRA_CFLAGS += -DCONFIG_MTK_VENDOR
+ 
+-EXTRA_CFLAGS += -DCONFIG_MT76_LEDS
++EXTRA_CFLAGS += -DCONFIG_MT76_LEDS -DCONFIG_MTK_VENDOR
  obj-$(CONFIG_MT7915E) += mt7915e.o
  
  mt7915e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
@@ -53,10 +54,10 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index b23a2fb..844a92f 100644
+index 8485a154..06ac261f 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -658,6 +658,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -652,6 +652,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
  	mt7915_init_wiphy(phy);
  
@@ -69,7 +70,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1164,6 +1170,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1144,6 +1150,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -95,7 +96,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1172,6 +1197,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1152,6 +1177,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -106,7 +107,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1184,6 +1213,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1164,6 +1193,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -117,7 +118,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1224,6 +1257,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1204,6 +1237,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -131,7 +132,7 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 644e6a8..788f3fb 100644
+index ff718f78..59cce553 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
@@ -157,7 +158,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3775,6 +3784,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3824,6 +3833,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -267,10 +268,10 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aa89106..f3dedd5 100644
+index da863601..c776417b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -532,4 +532,80 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
+@@ -533,4 +533,80 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
  	return txpower;
  }
  
@@ -352,10 +353,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index afe2ec7..53e1315 100644
+index 19880099..bd2ca6cc 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -293,6 +293,20 @@ struct mt7915_phy {
+@@ -294,6 +294,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -376,7 +377,7 @@
  };
  
  struct mt7915_dev {
-@@ -674,6 +688,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -675,6 +689,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -391,7 +392,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
 new file mode 100644
-index 0000000..98fd9c2
+index 00000000..98fd9c2d
 --- /dev/null
 +++ b/mt7915/vendor.c
 @@ -0,0 +1,452 @@
@@ -849,7 +850,7 @@
 +}
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
 new file mode 100644
-index 0000000..9d3db2a
+index 00000000..9d3db2a7
 --- /dev/null
 +++ b/mt7915/vendor.h
 @@ -0,0 +1,60 @@
@@ -914,5 +915,5 @@
 +
 +#endif
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index ede5ef3..c59c63d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From c831c0051618899509eb479fe3c07033b906bb56 Mon Sep 17 00:00:00 2001
+From a97766c58f1dc2a25421f1bc527a06b59cd5f0dc Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 26e7cf6..841fcde 100644
+index 32156d35..60161c9e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1192,6 +1192,8 @@ enum {
+@@ -1197,6 +1197,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,10 +26,10 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 149527d..015f270 100644
+index 1ba4096d..547519cc 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -548,6 +548,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -547,6 +547,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
  			qos_ctl = *ieee80211_get_qos_ctl(hdr);
  		}
@@ -41,7 +41,7 @@
  		status->flag |= RX_FLAG_8023;
  		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f6edab6..04f248f 100644
+index 94ecded5..3ded65de 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -702,6 +702,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 53e1315..29082b6 100644
+index bd2ca6cc..9a9d7f55 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -249,6 +249,35 @@ struct mt7915_hif {
+@@ -250,6 +250,35 @@ struct mt7915_hif {
  	int irq;
  };
  
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -306,6 +335,8 @@ struct mt7915_phy {
+@@ -307,6 +336,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -692,6 +723,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -693,6 +724,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2..b94d787 100644
+index 98fd9c2d..b94d787e 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,353 @@ out:
@@ -491,7 +491,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a..976817f 100644
+index 9d3db2a7..976817f3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -4,6 +4,7 @@
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 8d02ba5..08c1be9 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From 5aa5ed9a84420d0dc9310bae0f2ddbbe0a0a0247 Mon Sep 17 00:00:00 2001
+From b2fbeb0f208704fa5e6bb2a5e6a32e5f77be4e96 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
@@ -12,10 +12,10 @@
  4 files changed, 48 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 844a92f..00ddab7 100644
+index 06ac261f..f73d34a9 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -693,6 +693,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -687,6 +687,7 @@ static void mt7915_init_work(struct work_struct *work)
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
  	mt7915_txbf_init(dev);
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 788f3fb..ce07eee 100644
+index 59cce553..a46b714d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -876,13 +876,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -50,10 +50,10 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f3dedd5..b6840b2 100644
+index c776417b..275a0ece 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -608,4 +608,10 @@ struct csi_data {
+@@ -609,4 +609,10 @@ struct csi_data {
  };
  #endif
  
@@ -65,7 +65,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 761263e..3bf59ee 100644
+index 4fb845b0..1aafe040 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2558,6 +2558,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
index 13a328e..483bfab 100644
--- a/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
@@ -1,4 +1,4 @@
-From 8b3bb58a14f4419cf9842c96115107faf46e30bb Mon Sep 17 00:00:00 2001
+From d3944b59509bc65831997e973cf800f1e3f2b205 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
 Subject: [PATCH 1005/1009] mt76: mt7915: certification patches
@@ -16,10 +16,10 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 841fcde..18ae3ac 100644
+index 60161c9e..ff114cb9 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1194,6 +1194,7 @@ enum {
+@@ -1199,6 +1199,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 015f270..229e68c 100644
+index 547519cc..599d328d 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -2021,6 +2022,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2023,6 +2024,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2043,6 +2059,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -2045,6 +2061,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,7 +76,7 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 04f248f..2c4e392 100644
+index 3ded65de..e4d1c27b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -678,6 +678,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -109,10 +109,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ce07eee..c459258 100644
+index a46b714d..40b17b5f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3889,6 +3889,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3938,6 +3938,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -586,10 +586,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b6840b2..d7322fe 100644
+index 275a0ece..714bc44d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -415,10 +415,14 @@ enum {
+@@ -416,10 +416,14 @@ enum {
  	RATE_PARAM_FIXED = 3,
  	RATE_PARAM_MMPS_UPDATE = 5,
  	RATE_PARAM_FIXED_HE_LTF = 7,
@@ -605,7 +605,7 @@
  };
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -430,6 +434,9 @@ enum {
+@@ -431,6 +435,9 @@ enum {
  #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
  #define RATE_CFG_HE_LTF			GENMASK(31, 28)
  
@@ -615,7 +615,7 @@
  enum {
  	TX_POWER_LIMIT_ENABLE,
  	TX_POWER_LIMIT_TABLE = 0x4,
-@@ -613,5 +620,203 @@ struct csi_data {
+@@ -614,5 +621,203 @@ struct csi_data {
  #define OFDMA_UL                       BIT(1)
  #define MUMIMO_DL                      BIT(2)
  #define MUMIMO_UL                      BIT(3)
@@ -820,10 +820,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 29082b6..9fdb80b 100644
+index 9a9d7f55..018fd23e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -720,6 +720,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -721,6 +721,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -844,10 +844,10 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 2719a8d..b03ae39 100644
+index 1aafe040..f8d2cbbb 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2487,7 +2487,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+@@ -2564,7 +2564,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
  
         *val = dev->dbg.muru_onoff;
  
@@ -857,7 +857,7 @@
                 !!(dev->dbg.muru_onoff & MUMIMO_UL),
                 !!(dev->dbg.muru_onoff & MUMIMO_DL),
                 !!(dev->dbg.muru_onoff & OFDMA_UL),
-@@ -2500,8 +2501,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+@@ -2577,8 +2578,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
  {
         struct mt7915_dev *dev = data;
  
@@ -869,7 +869,7 @@
         }
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787..7456c57 100644
+index b94d787e..7456c577 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1081,7 +1081,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f..1b08321 100644
+index 976817f3..1b08321c 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -6,6 +6,48 @@
@@ -1134,5 +1134,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 3eb0db6..8ed42b3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From 74d79b063e48e2756c635d388c9cea3ca50d4239 Mon Sep 17 00:00:00 2001
+From 1a60e2ba1ae97e6109e1e27dc48ae074b46043ff Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1006/1009] mt76: mt7915: add support for runtime set in-band
@@ -10,7 +10,7 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index c459258..3baed2c 100644
+index 40b17b5f..f7ed1049 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1993,8 +1993,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
@@ -33,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index f55a73a..2df0a9c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From dd853ac02efd5973f494c700e2a668446c66c9a7 Mon Sep 17 00:00:00 2001
+From dede9889b01c531a5e71c4b1beffaef33b799a0b Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1007/1009] mt76: mt7915: add mt76 vendor muru onoff command
@@ -11,10 +11,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3baed2c..7728e82 100644
+index f7ed1049..6ec12fd2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3908,6 +3908,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3957,6 +3957,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,10 +29,10 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d7322fe..eaadd33 100644
+index 714bc44d..aaea3230 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -422,6 +422,7 @@ enum {
+@@ -423,6 +423,7 @@ enum {
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
  	RATE_PARAM_FIXED_OFDMA = 31,
@@ -41,7 +41,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7456c57..c755184 100644
+index 7456c577..c7551848 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321..a8e4ebf 100644
+index 1b08321c..a8e4ebf9 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch
index 04b4fd0..eea5003 100644
--- a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,4 +1,4 @@
-From 7ac624cb503877d455453ce736ce1abd42cbd218 Mon Sep 17 00:00:00 2001
+From d23718033b7a128a1bcffc203b38609116428374 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
 Subject: [PATCH 1008/1009] mt76: mt7915: drop undefined action frame
@@ -8,10 +8,10 @@
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 229e68c..fc7b790 100644
+index 599d328d..de2bdba5 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -761,6 +761,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -760,6 +760,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info)
  {
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
@@ -20,7 +20,7 @@
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -791,6 +793,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -790,6 +792,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
@@ -32,5 +32,5 @@
  	if (id < 0)
  		return id;
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
index c50fef0..89c073a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,4 +1,4 @@
-From 301531f8ae836dd93d9b61a2435acd27ba6eb738 Mon Sep 17 00:00:00 2001
+From e64af60e5c5642dec30e8605967b74dff53ada80 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
 Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 1037d23..beea57d 100644
+index ccca0162..00f1cd0d 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -837,6 +837,10 @@ struct mt76_dev {
+@@ -843,6 +843,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,10 +25,10 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 5a047e6..cf6ec55 100644
+index efb9bfaa..2fefac68 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2968,6 +2968,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -3014,6 +3014,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
  
@@ -38,7 +38,7 @@
  	release_firmware(fw);
  
  	if (!fw_wa)
-@@ -2993,6 +2996,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -3039,6 +3042,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -48,7 +48,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -3063,6 +3069,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -3109,6 +3115,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
@@ -59,10 +59,10 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index b03ae39..583bc19 100644
+index f8d2cbbb..cba38513 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2722,6 +2722,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
+@@ -2799,6 +2799,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -85,7 +85,7 @@
  /*usage: <en> <num> <len>
  	en: BIT(16) 0: sw amsdu  1: hw amsdu
  	num: GENMASK(15, 8) range 1-8
-@@ -2955,6 +2971,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3032,6 +3048,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
@@ -96,5 +96,5 @@
  }
  #endif
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-rework-testmode-init-registers.patch
index 2a37f4b..54c27fb 100644
--- a/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From d6067c8dc5b9e8264efb1c1f8ac27d416364dee0 Mon Sep 17 00:00:00 2001
+From 6517389a3eb0ee290151240c1639a94405fdfbd8 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1111/1131] mt76: testmode: rework testmode init registers
+Subject: [PATCH 1111/1133] mt76: testmode: rework testmode init registers
 
 ---
  mac80211.c        |   3 +-
@@ -17,10 +17,10 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 7fe7f68..19d9efb 100644
+index b117e446..00e7b4f3 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -775,7 +775,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -817,7 +817,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -31,10 +31,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index beea57d..4822ffb 100644
+index 00f1cd0d..25ad0f6b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -637,6 +637,8 @@ struct mt76_testmode_ops {
+@@ -643,6 +643,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -43,7 +43,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -668,6 +670,8 @@ struct mt76_testmode_data {
+@@ -674,6 +676,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -52,7 +52,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -675,6 +679,7 @@ struct mt76_testmode_data {
+@@ -681,6 +685,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -61,10 +61,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18ae3ac..18d6c66 100644
+index ff114cb9..1a146563 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1188,6 +1188,7 @@ enum {
+@@ -1193,6 +1193,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -73,7 +73,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index eaadd33..2e97db7 100644
+index aaea3230..a4b7ef82 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -85,10 +85,10 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index afa558c..07de3cb 100644
+index 225a1960..6d8455d5 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
+@@ -120,6 +120,7 @@ static const u32 mt7986_reg[] = {
  };
  
  static const u32 mt7915_offs[] = {
@@ -96,7 +96,7 @@
  	[TMAC_CDTR]		= 0x090,
  	[TMAC_ODTR]		= 0x094,
  	[TMAC_ATCR]		= 0x098,
-@@ -192,6 +193,7 @@ static const u32 mt7915_offs[] = {
+@@ -194,6 +195,7 @@ static const u32 mt7915_offs[] = {
  };
  
  static const u32 mt7916_offs[] = {
@@ -105,7 +105,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index c8e478a..d6a05f1 100644
+index c8e478a5..d6a05f13 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -48,6 +48,7 @@ enum reg_rev {
@@ -153,7 +153,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0d76ae3..4693919 100644
+index 0d76ae31..46939191 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -378,7 +378,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac3..a1c54c8 100644
+index 5573ac30..a1c54c89 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -429,7 +429,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 0accc71..1d0d5d3 100644
+index 0accc71a..1d0d5d30 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -453,7 +453,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d..8961326 100644
+index 5e2792d8..89613266 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
@@ -474,5 +474,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch
index 1d9a4de..1430ef9 100644
--- a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 852090bdc691d094e9ede04ea1e8b5931e35cdd9 Mon Sep 17 00:00:00 2001
+From 947b0a84d32ca9fbdfc5befc133da50c1349694e Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH] mt76: testmode: additional supports
+Subject: [PATCH 1112/1133] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -27,10 +27,10 @@
  19 files changed, 1964 insertions(+), 148 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 9d1b928..f977b7f 100644
+index e3fa4f39..a6bb3730 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -567,8 +567,7 @@ free:
+@@ -566,8 +566,7 @@ free:
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -41,10 +41,10 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index 19d9efb..2e0e011 100644
+index 00e7b4f3..2a66b1dd 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
+@@ -56,6 +56,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
  	CHAN5G(60, 5300),
  	CHAN5G(64, 5320),
  
@@ -58,7 +58,7 @@
  	CHAN5G(100, 5500),
  	CHAN5G(104, 5520),
  	CHAN5G(108, 5540),
-@@ -75,6 +82,11 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
+@@ -76,6 +83,11 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
  	CHAN5G(165, 5825),
  	CHAN5G(169, 5845),
  	CHAN5G(173, 5865),
@@ -71,10 +71,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 4822ffb..58258e1 100644
+index 25ad0f6b..cde52268 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -635,6 +635,21 @@ struct mt76_testmode_ops {
+@@ -641,6 +641,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -96,7 +96,7 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -643,16 +658,11 @@ struct mt76_testmode_data {
+@@ -649,16 +664,11 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
@@ -113,7 +113,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -668,10 +678,37 @@ struct mt76_testmode_data {
+@@ -674,10 +684,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -152,7 +152,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1135,6 +1172,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1141,6 +1178,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -212,7 +212,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1145,7 +1235,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1151,7 +1241,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -222,7 +222,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1247,7 +1338,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1253,7 +1344,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -233,7 +233,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index cf6ec55..291a7c1 100644
+index 2fefac68..b6c2ccf0 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
@@ -255,10 +255,10 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18d6c66..a8ce98c 100644
+index 1a146563..f616bcea 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -994,6 +994,7 @@ enum {
+@@ -999,6 +999,7 @@ enum {
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
@@ -266,7 +266,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1195,6 +1196,7 @@ enum {
+@@ -1200,6 +1201,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -275,10 +275,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 00ddab7..e044f50 100644
+index f73d34a9..19447ad1 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -687,7 +687,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -681,7 +681,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -288,10 +288,10 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index fc7b790..6ed6eb7 100644
+index de2bdba5..1460a32b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -628,16 +628,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -627,16 +627,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  {
  #ifdef CONFIG_NL80211_TESTMODE
  	struct mt76_testmode_data *td = &phy->mt76->test;
@@ -333,7 +333,7 @@
  
  	switch (td->tx_rate_mode) {
  	case MT76_TM_TX_MODE_HT:
-@@ -668,7 +690,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -667,7 +689,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  			rate_idx += 4;
  
  		r = &phy->mt76->hw->wiphy->bands[band]->bitrates[rate_idx];
@@ -342,7 +342,7 @@
  
  		mode = val >> 8;
  		rate_idx = val & 0xff;
-@@ -727,13 +749,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -726,13 +748,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  	if (mode >= MT_PHY_TYPE_HE_SU)
  		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
  
@@ -360,7 +360,7 @@
  #endif
  }
  
-@@ -1483,7 +1506,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+@@ -1479,7 +1502,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
  		goto out;
  
  	/* set the necessary init items */
@@ -370,7 +370,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2c4e392..4c3d822 100644
+index e4d1c27b..ea0d22fe 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -383,7 +383,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7728e82..85450ea 100644
+index 6ec12fd2..4d878665 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -383,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -406,7 +406,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2798,14 +2804,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2847,14 +2853,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -424,7 +424,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 2e97db7..4d86c7f 100644
+index a4b7ef82..1671d563 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -443,7 +443,7 @@
  };
  
  struct mt7915_mcu_thermal_ctrl {
-@@ -471,6 +476,12 @@ enum {
+@@ -472,6 +477,12 @@ enum {
  
  enum {
  	MT_BF_SOUNDING_ON = 1,
@@ -456,7 +456,7 @@
  	MT_BF_TYPE_UPDATE = 20,
  	MT_BF_MODULE_UPDATE = 25
  };
-@@ -717,10 +728,19 @@ struct mt7915_muru {
+@@ -718,10 +729,19 @@ struct mt7915_muru {
  #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
  
  /* Common Config */
@@ -481,10 +481,10 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 07de3cb..26881fd 100644
+index 6d8455d5..9a666d0f 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
+@@ -134,6 +134,7 @@ static const u32 mt7915_offs[] = {
  	[ARB_DRNGR0]		= 0x194,
  	[ARB_SCR]		= 0x080,
  	[RMAC_MIB_AIRTIME14]	= 0x3b8,
@@ -492,7 +492,7 @@
  	[AGG_AWSCR0]		= 0x05c,
  	[AGG_PCR0]		= 0x06c,
  	[AGG_ACR0]		= 0x084,
-@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
+@@ -209,6 +210,7 @@ static const u32 mt7916_offs[] = {
  	[ARB_DRNGR0]		= 0x1e0,
  	[ARB_SCR]		= 0x000,
  	[RMAC_MIB_AIRTIME14]	= 0x0398,
@@ -501,10 +501,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9fdb80b..4336f20 100644
+index 018fd23e..c45e42c5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -320,6 +320,9 @@ struct mt7915_phy {
+@@ -321,6 +321,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -514,7 +514,7 @@
  	} test;
  #endif
  
-@@ -419,6 +422,14 @@ struct mt7915_dev {
+@@ -420,6 +423,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -529,7 +529,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -590,7 +601,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -591,7 +602,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -538,7 +538,7 @@
  int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -628,6 +639,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -629,6 +640,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -547,7 +547,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index d6a05f1..e876848 100644
+index d6a05f13..e8768488 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -568,7 +568,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4693919..e0ba088 100644
+index 46939191..e0ba088f 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1907,7 +1907,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c8..01b08e9 100644
+index a1c54c89..01b08e9e 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2222,7 +2222,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1d0d5d3..7a9ed54 100644
+index 1d0d5d30..7a9ed543 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2689,7 +2689,7 @@
  		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
  		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 8961326..57949f2 100644
+index 89613266..57949f2b 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2794,7 +2794,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f6908..6e36ab2 100644
+index e3f69089..6e36ab27 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2920,7 +2920,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 1f309d0..6d55566 100644
+index 1f309d05..6d55566f 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -250,8 +250,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
diff --git a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch
index d0487c4..496d3a6 100644
--- a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 5a9a2fb84939e81c67a1508b56b2d59a5d7c5937 Mon Sep 17 00:00:00 2001
+From 7e220c97e2010f5a36f5d86928bb0bb7f3f5aa16 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH] mt76: testmode: add pre-cal support
+Subject: [PATCH 1113/1133] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 0a88048..cb6ff17 100644
+index 0a88048b..cb6ff17a 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,10 +37,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 58258e1..89c8570 100644
+index cde52268..e22f82c7 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -636,6 +636,7 @@ struct mt76_testmode_ops {
+@@ -642,6 +642,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -49,10 +49,10 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a8ce98c..f42946e 100644
+index f616bcea..89411ba6 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -990,6 +990,7 @@ enum {
+@@ -995,6 +995,7 @@ enum {
  
  /* ext event table */
  enum {
@@ -61,7 +61,7 @@
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index f3e5681..88aaa16 100644
+index f3e56817..88aaa16a 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
@@ -114,7 +114,7 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 85450ea..8e3217b 100644
+index 4d878665..fb89686b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -387,6 +387,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -127,7 +127,7 @@
  #endif
  	default:
  		break;
-@@ -2901,7 +2904,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2950,7 +2953,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -136,7 +136,7 @@
  		return 0;
  
  	/*
-@@ -2981,11 +2984,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3030,11 +3033,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4336f20..b6c9fc5 100644
+index c45e42c5..5d12cbbc 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -406,6 +406,10 @@ struct mt7915_dev {
+@@ -407,6 +407,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -640,6 +644,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -641,6 +645,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index e0ba088..a9e57e4 100644
+index e0ba088f..a9e57e4b 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -667,7 +667,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9..d500987 100644
+index 01b08e9e..d500987d 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -735,7 +735,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index 7a9ed54..42da6f0 100644
+index 7a9ed543..42da6f08 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -768,7 +768,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 57949f2..34936e5 100644
+index 57949f2b..34936e5f 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -824,7 +824,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 6e36ab2..1be1ffd 100644
+index 6e36ab27..1be1ffd6 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
index 5f69e9e..8f8b4dc 100644
--- a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 66bc9f6b11a2d1bb5da592400984337bb0d077b9 Mon Sep 17 00:00:00 2001
+From 0f8a11a93fd25593e5e778e0d0abda8d61127117 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1114/1131] mt76: testmode: add iBF command mode support
+Subject: [PATCH 1114/1133] mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index a9e57e4..99582d9 100644
+index a9e57e4b..99582d9c 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -105,7 +105,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index 82b8e98..aa874a8 100644
+index 42da6f08..b605a4bc 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -530,6 +530,42 @@ out:
@@ -164,7 +164,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index e2190e7..5d1fe79 100644
+index 34936e5f..bbfb313f 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
@@ -179,7 +179,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 1be1ffd..47fc69f 100644
+index 1be1ffd6..47fc69f9 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
@@ -239,5 +239,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 1fb13e1..10a8119 100644
--- a/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From fbce4b7e9c52454e930544224e586002fb77eb67 Mon Sep 17 00:00:00 2001
+From b269297b9cb95ea651d363ba49fff3d25d06f99b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1115/1131] mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1115/1133] mt76: testmode: add ZWDFS test mode support
 
 Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -19,10 +19,10 @@
  10 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 89c8570..2bacc1b 100644
+index e22f82c7..d5f5054f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -719,6 +719,15 @@ struct mt76_testmode_data {
+@@ -725,6 +725,15 @@ struct mt76_testmode_data {
  		u64 fcs_error[__MT_RXQ_MAX];
  		u64 len_mismatch;
  	} rx_stats;
@@ -39,10 +39,10 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f42946e..7853e07 100644
+index 89411ba6..5cef308a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1190,6 +1190,7 @@ enum {
+@@ -1195,6 +1195,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -50,7 +50,7 @@
  	MCU_EXT_CMD_RX_STAT = 0xa4,
  	MCU_EXT_CMD_SET_SPR = 0xa8,
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
-@@ -1200,6 +1201,7 @@ enum {
+@@ -1205,6 +1206,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
@@ -59,10 +59,10 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8e3217b..b8243e1 100644
+index fb89686b..988c55c6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2636,6 +2636,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+@@ -2685,6 +2685,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
  		req.monitor_chan = chandef->chan->hw_value;
  		req.monitor_central_chan =
  			ieee80211_frequency_to_channel(chandef->center_freq1);
@@ -70,7 +70,7 @@
  		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4474,3 +4475,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4503,3 +4504,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -140,10 +140,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 4d86c7f..9a48524 100644
+index 1671d563..d780415c 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -628,6 +628,52 @@ struct csi_data {
+@@ -629,6 +629,52 @@ struct csi_data {
  };
  #endif
  
@@ -197,10 +197,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b6c9fc5..d845206 100644
+index 5d12cbbc..2b42fb11 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -308,6 +308,7 @@ struct mt7915_phy {
+@@ -309,6 +309,7 @@ struct mt7915_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -208,7 +208,7 @@
  
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
-@@ -758,6 +759,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -759,6 +760,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -219,7 +219,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e876848..f4b5709 100644
+index e8768488..f4b57099 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -1194,6 +1194,8 @@ enum offs_rev {
@@ -232,7 +232,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 99582d9..2ae6c07 100644
+index 99582d9c..2ae6c07f 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -503,7 +503,7 @@
  
  static int
 diff --git a/testmode.c b/testmode.c
-index aa874a8..b19b872 100644
+index b605a4bc..58280a40 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -24,6 +24,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -567,7 +567,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index 5d1fe79..27a0095 100644
+index bbfb313f..e03fa6df 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -63,6 +63,20 @@
@@ -635,7 +635,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index 47fc69f..6f07eed 100644
+index 47fc69f9..6f07eed0 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -46,6 +46,14 @@ static const char * const testmode_txbf_act[] = {
@@ -682,5 +682,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch b/recipes-wifi/linux-mt76/files/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
index 1969783..8e9b2aa 100644
--- a/recipes-wifi/linux-mt76/files/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
@@ -1,7 +1,7 @@
-From 2e2057e91913f8992053753b80120a84b5174607 Mon Sep 17 00:00:00 2001
+From e6da252b1895b1aebdfe737dcd57572d877cd1f1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH 1116/1131] mt76: testmode: add iBF/eBF cal and cert commands
+Subject: [PATCH 1116/1133] mt76: testmode: add iBF/eBF cal and cert commands
  with golden
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -25,10 +25,10 @@
  16 files changed, 856 insertions(+), 324 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 2bacc1b..c6aefbf 100644
+index d5f5054f..6ab689af 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -681,6 +681,7 @@ struct mt76_testmode_data {
+@@ -687,6 +687,7 @@ struct mt76_testmode_data {
  
  	struct list_head tm_entry_list;
  	struct mt76_wcid *cur_entry;
@@ -36,7 +36,7 @@
  	u8 entry_num;
  	union {
  		struct mt76_testmode_entry_data ed;
-@@ -709,6 +710,9 @@ struct mt76_testmode_data {
+@@ -715,6 +716,9 @@ struct mt76_testmode_data {
  
  	u8 txbf_act;
  	u16 txbf_param[8];
@@ -47,10 +47,10 @@
  	u32 tx_pending;
  	u32 tx_queued;
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 291a7c1..14ce09e 100644
+index b6c2ccf0..6f5c81ce 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2756,6 +2756,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -2802,6 +2802,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
  	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
  	struct bss_info_basic *bss;
  	struct tlv *tlv;
@@ -58,7 +58,7 @@
  
  	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
  	bss = (struct bss_info_basic *)tlv;
-@@ -2815,6 +2816,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -2861,6 +2862,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
  		bss->dtim_period = vif->bss_conf.dtim_period;
  		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
  							 chandef->chan->band, NULL);
@@ -68,10 +68,10 @@
  		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0746e4b..013dfbd 100644
+index 1460a32b..35b85843 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -753,8 +753,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -752,8 +752,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  		val |= MT_TXD6_LDPC;
  
  	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
@@ -84,7 +84,7 @@
  	txwi[6] |= cpu_to_le32(val);
  #endif
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4c3d822..a347e77 100644
+index ea0d22fe..ecd023f6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
@@ -175,7 +175,7 @@
  
  	return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b8243e1..5d41ebf 100644
+index 988c55c6..e82b7e14 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -193,6 +193,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -227,7 +227,7 @@
  
  	if (enable) {
  		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
-@@ -3403,6 +3417,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3452,6 +3466,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  
  int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  {
@@ -235,7 +235,7 @@
  	struct {
  		u8 action;
  		union {
-@@ -3429,7 +3444,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+@@ -3478,7 +3493,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  		.action = action,
  	};
  
@@ -243,7 +243,7 @@
  	switch (action) {
  	case MT_BF_SOUNDING_ON:
  		req.snd.snd_mode = MT_BF_PROCESSING;
-@@ -4347,6 +4361,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
+@@ -4396,6 +4410,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
  		req.he_opt = v2;
  		req.glo_opt = v3;
  		break;
@@ -254,10 +254,10 @@
  		return -EINVAL;
  	}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9a48524..a30f52d 100644
+index d780415c..5c5c92fc 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -475,10 +475,12 @@ enum {
+@@ -476,10 +476,12 @@ enum {
  };
  
  enum {
@@ -270,7 +270,7 @@
  	MT_BF_PHASE_CAL = 14,
  	MT_BF_IBF_PHASE_COMP = 15,
  	MT_BF_PROFILE_WRITE_ALL = 17,
-@@ -486,6 +488,176 @@ enum {
+@@ -487,6 +489,176 @@ enum {
  	MT_BF_MODULE_UPDATE = 25
  };
  
@@ -448,10 +448,10 @@
  	MURU_SET_ARB_OP_MODE = 14,
  	MURU_SET_PLATFORM_TYPE = 25,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 26881fd..c1b421d 100644
+index 9a666d0f..95ded131 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -131,6 +131,7 @@ static const u32 mt7915_offs[] = {
+@@ -133,6 +133,7 @@ static const u32 mt7915_offs[] = {
  	[MDP_BNRCFR1]		= 0x074,
  	[ARB_DRNGR0]		= 0x194,
  	[ARB_SCR]		= 0x080,
@@ -459,7 +459,7 @@
  	[RMAC_MIB_AIRTIME14]	= 0x3b8,
  	[AGG_AALCR0]		= 0x048,
  	[AGG_AWSCR0]		= 0x05c,
-@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
+@@ -209,6 +210,7 @@ static const u32 mt7916_offs[] = {
  	[MDP_BNRCFR1]		= 0x094,
  	[ARB_DRNGR0]		= 0x1e0,
  	[ARB_SCR]		= 0x000,
@@ -468,10 +468,10 @@
  	[AGG_AALCR0]		= 0x028,
  	[AGG_AWSCR0]		= 0x030,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d845206..ab1efe6 100644
+index 2b42fb11..ae06a7c6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -322,7 +322,6 @@ struct mt7915_phy {
+@@ -323,7 +323,6 @@ struct mt7915_phy {
  
  		u8 spe_idx;
  
@@ -479,7 +479,7 @@
  		bool bf_ever_en;
  	} test;
  #endif
-@@ -427,7 +426,7 @@ struct mt7915_dev {
+@@ -428,7 +427,7 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -488,7 +488,7 @@
  	struct {
  		void *txbf_phase_cal;
  		void *txbf_pfmu_data;
-@@ -566,6 +565,7 @@ void mt7915_dma_prefetch(struct mt7915_dev *dev);
+@@ -567,6 +566,7 @@ void mt7915_dma_prefetch(struct mt7915_dev *dev);
  void mt7915_dma_cleanup(struct mt7915_dev *dev);
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int mt7915_txbf_init(struct mt7915_dev *dev);
@@ -496,7 +496,7 @@
  void mt7915_init_txpower(struct mt7915_dev *dev,
  			 struct ieee80211_supported_band *sband);
  void mt7915_reset(struct mt7915_dev *dev);
-@@ -644,8 +644,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -645,8 +645,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -508,7 +508,7 @@
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
-@@ -782,4 +784,10 @@ enum {
+@@ -783,4 +785,10 @@ enum {
  
  #endif
  
@@ -520,7 +520,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 6cb1018..f366869 100644
+index cba38513..867d52d1 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2908,6 +2908,36 @@ mt7915_txpower_level_set(void *data, u64 val)
@@ -573,7 +573,7 @@
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
-index 143dae2..906c872 100644
+index 143dae26..906c8725 100644
 --- a/mt7915/mtk_mcu.c
 +++ b/mt7915/mtk_mcu.c
 @@ -1,9 +1,10 @@
@@ -836,7 +836,7 @@
 +}
 +#endif
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index f4b5709..007fd4d 100644
+index f4b57099..007fd4d2 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -61,6 +61,7 @@ enum offs_rev {
@@ -858,7 +858,7 @@
  #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
  #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 2ae6c07..e4af5e1 100644
+index 2ae6c07f..e4af5e1c 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -53,6 +53,8 @@ struct reg_band {
@@ -1701,7 +1701,7 @@
  	rateval =  mode << 6 | rate_idx;
  	tx_cont->rateval = cpu_to_le16(rateval);
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index d500987..1982369 100644
+index d500987d..19823694 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -311,137 +311,7 @@ struct mt7915_tm_muru {
@@ -1845,7 +1845,7 @@
  
  #endif
 diff --git a/testmode.c b/testmode.c
-index b19b872..ed5ceee 100644
+index 58280a40..a6b0c160 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -191,6 +191,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
@@ -1857,7 +1857,7 @@
  	memcpy(hdr->addr2, addr[1], ETH_ALEN);
  	memcpy(hdr->addr3, addr[2], ETH_ALEN);
 diff --git a/testmode.h b/testmode.h
-index 27a0095..e1ebbd5 100644
+index e03fa6df..0e96173b 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -299,7 +299,10 @@ enum mt76_testmode_cfg {
@@ -1885,7 +1885,7 @@
  	/* keep last */
  	NUM_MT76_TM_TXBF_ACT,
 diff --git a/tools/fields.c b/tools/fields.c
-index 6f07eed..7211ec5 100644
+index 6f07eed0..7211ec52 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -33,7 +33,10 @@ static const char * const testmode_tx_mode[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 5fc9548..f79abb9 100644
--- a/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,14 +1,14 @@
-From c7815914fe507bf9781b064efb6ba7ca33b6f5d1 Mon Sep 17 00:00:00 2001
+From 57e604539560994584444115d893df77a24fafe0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1117/1131] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1117/1133] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index a347e77..eae1377 100644
+index ecd023f6..c32df9b1 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -692,6 +692,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
similarity index 69%
rename from recipes-wifi/linux-mt76/files/patches/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
rename to recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
index 9e83ecf..a7990a2 100644
--- a/recipes-wifi/linux-mt76/files/patches/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,7 +1,7 @@
-From 6aa3a1fd535b382c7b5af1b811d0ead0d4b74509 Mon Sep 17 00:00:00 2001
+From 1372e9f58ca9e818746afdd4f4693ef175dc1af5 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1119/1131] mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1118/1133] mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 2e0e011..de9ef23 100644
+index 2a66b1dd..e79568d1 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -435,7 +435,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
+@@ -436,7 +436,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
  			WIPHY_FLAG_AP_UAPSD;
  
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
@@ -21,5 +21,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
rename to recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index 7184f67..e1e65a1 100644
--- a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From e57722d4c3513b72957e6bb61bb67a4feb70c80f Mon Sep 17 00:00:00 2001
+From fd1a769323cb64ed9d21d0f291beb3dfcb9adb35 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1120/1131] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1119/1133] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index a796289..55ba90a 100644
+index a7962893..55ba90ac 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 88aaa16..fdae347 100644
+index 88aaa16a..fdae347e 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2d363c4..4c64655 100644
+index e82b7e14..28698d37 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2917,7 +2917,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2966,7 +2966,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2955,9 +2956,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -3004,9 +3005,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2965,34 +2966,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -3014,34 +3015,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3024,24 +3060,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3073,24 +3109,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
rename to recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
index 46f6a3e..b5eb864 100644
--- a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From e7f4f1cdee8c63f7e43a81e4ee538aada45c3b9b Mon Sep 17 00:00:00 2001
+From fff425467fb14ecb03f48ab95802d49412b15fe6 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1121/1131] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1120/1133] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ab1efe6..e977e5c 100644
+index ae06a7c6..9d98633c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c755184..77d71e4 100644
+index c7551848..77d71e48 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf..719b851 100644
+index a8e4ebf9..719b851f 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
rename to recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
index ef77644..e58ee25 100644
--- a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
@@ -1,7 +1,7 @@
-From 470a35f89bc43925f3ff9113a6541dcad2a6863e Mon Sep 17 00:00:00 2001
+From b9f5dab1bd609a933fab9d7e962a3db1d6e91c29 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1122/1131] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1121/1133] mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
@@ -16,10 +16,10 @@
  7 files changed, 264 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 7853e07..88bfd09 100644
+index 5cef308a..65863a0d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1200,6 +1200,7 @@ enum {
+@@ -1205,6 +1205,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -28,7 +28,7 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index eae1377..09cf35c 100644
+index c32df9b1..96236f4c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -479,6 +479,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 4c64655..dddab7d 100644
+index 28698d37..46f29021 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4593,3 +4593,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4622,3 +4622,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -122,10 +122,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a30f52d..391aed9 100644
+index 5c5c92fc..c87fe8e8 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -1057,6 +1057,27 @@ enum {
+@@ -1058,6 +1058,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -154,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e977e5c..4c370bb 100644
+index 9d98633c..8418c7dc 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -761,7 +761,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -762,7 +762,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -168,7 +168,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e4..2484e25 100644
+index 77d71e48..2484e25f 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -325,7 +325,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851..7231971 100644
+index 719b851f..72319717 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -2,6 +2,7 @@
@@ -376,5 +376,5 @@
  
  enum mtk_capi_control_changed {
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-implement-bin-file-mode.patch
rename to recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
index 3ba1ab7..2a2dcaf 100644
--- a/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From 57fecb7bb0f51f52b23727811f4d2a0612435911 Mon Sep 17 00:00:00 2001
+From 7e48b460bf9584a3ad9e03cad8ee7344fa8b8a82 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1123/1131] mt76: mt7915: implement bin file mode
+Subject: [PATCH 1122/1133] mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 110 insertions(+), 6 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index cb6ff17..05b6dfa 100644
+index cb6ff17a..05b6dfaa 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,26 @@ out_put_node:
@@ -46,10 +46,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index c6aefbf..9b6e806 100644
+index 6ab689af..1638ef63 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -894,9 +894,11 @@ struct mt76_dev {
+@@ -900,9 +900,11 @@ struct mt76_dev {
  		struct mt76_sdio sdio;
  	};
  
@@ -61,7 +61,7 @@
  };
  
  struct mt76_power_limits {
-@@ -1033,6 +1035,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1039,6 +1041,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -70,7 +70,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 55ba90a..54803e8 100644
+index 55ba90ac..54803e8e 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -45,8 +45,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
@@ -151,7 +151,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index fdae347..9056d78 100644
+index fdae347e..9056d786 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
@@ -169,7 +169,7 @@
  mt7915_get_channel_group_5g(int channel, bool is_7976)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4c370bb..e5cfc77 100644
+index 8418c7dc..db7e42db 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -42,9 +42,9 @@
@@ -185,7 +185,7 @@
  #define MT7986_EEPROM_MT7975_DEFAULT		"mediatek/mt7986_eeprom_mt7975.bin"
  #define MT7986_EEPROM_MT7975_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7975_dual.bin"
  #define MT7986_EEPROM_MT7976_DEFAULT		"mediatek/mt7986_eeprom_mt7976.bin"
-@@ -400,6 +400,8 @@ struct mt7915_dev {
+@@ -401,6 +401,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -194,7 +194,7 @@
  	bool muru_debug;
  	bool ibf;
  
-@@ -774,6 +776,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
+@@ -775,6 +777,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
  int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
@@ -203,7 +203,7 @@
  #define PKT_BIN_DEBUG_MAGIC	0xc8763123
  enum {
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index a2ceb6f..7567666 100644
+index 867d52d1..0f2795d5 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
@@ -214,7 +214,7 @@
  
  #ifdef MTK_DEBUG
  #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
-@@ -2924,6 +2925,44 @@ mt7915_wa_debug(void *data, u64 val)
+@@ -3001,6 +3002,44 @@ mt7915_wa_debug(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
  			 "0x%llx\n");
  
@@ -259,7 +259,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3009,6 +3048,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3086,6 +3125,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
  				    mt7915_dump_version);
  
@@ -269,5 +269,5 @@
  }
  #endif
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-initialize-wcid.patch
rename to recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch
index 2001d10..820ec00 100644
--- a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 380d2c824b4cd4792a33c9fff30f5f7a55fbce43 Mon Sep 17 00:00:00 2001
+From 93e76d8cf97dfe08679e24c4db3e0630fdfceb73 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1124/1131] mt76: mt7915: initialize wcid
+Subject: [PATCH 1123/1133] mt76: mt7915: initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 013dfbd..9d4cfa1 100644
+index 35b85843..623bf2d4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1032,7 +1032,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1031,7 +1031,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-Add-hemu-dump-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
index 11d6764..7ccc7d8 100644
--- a/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-Add-hemu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
@@ -1,7 +1,7 @@
-From 5b7b1ad75275431f2a3981445ecb122296e6033c Mon Sep 17 00:00:00 2001
+From 12952f6d361dd09ed3e7c27ef54d0c2acd00ad6f Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1125/1131] mt76: mt7915: Add hemu dump support
+Subject: [PATCH 1124/1133] mt76: mt7915: Add hemu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 26 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 2484e25..f7becce 100644
+index 2484e25f..f7becce9 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -60,7 +60,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 7231971..c19ffe7 100644
+index 72319717..c19ffe72 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
@@ -72,5 +72,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
rename to recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 2a83b0d..804084b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,7 +1,7 @@
-From da5f1ee9d19099b72b349a259e553db74954db59 Mon Sep 17 00:00:00 2001
+From f1fcf78c95d186f5ee4c52d3e3509eee0ba53e05 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1126/1131] mt76: mt7915: add vendor subcmd three wire (PTA)
+Subject: [PATCH 1125/1133] mt76: mt7915: add vendor subcmd three wire (PTA)
  ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
@@ -16,10 +16,10 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 88bfd09..5cff1a4 100644
+index 65863a0d..41859dc3 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1199,7 +1199,7 @@ enum {
+@@ -1204,7 +1204,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -29,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index dddab7d..36a33f6 100644
+index 46f29021..9cd51d95 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4272,37 +4272,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4321,37 +4321,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,10 +94,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 391aed9..025a03b 100644
+index c87fe8e8..16517099 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -846,6 +846,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -847,6 +847,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -134,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e5cfc77..b9b86b8 100644
+index db7e42db..e4422d94 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -755,6 +755,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -756,6 +756,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index f7becce..fb760e1 100644
+index f7becce9..fb760e17 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -229,7 +229,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index c19ffe7..d96e5c2 100644
+index c19ffe72..d96e5c23 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,6 +12,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -268,5 +268,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
rename to recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index f5a487e..2276d62 100644
--- a/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 1c77eafd5da4591caf20235cf716734e2319cd1c Mon Sep 17 00:00:00 2001
+From 7a747cdaec4b7093433fe2e3894c545874c3e0c1 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1127/1131] mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1126/1133] mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index fb760e1..22af66d 100644
+index fb760e17..22af66d5 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
@@ -100,7 +100,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index d96e5c2..949c885 100644
+index d96e5c23..949c8853 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,7 +12,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -141,5 +141,5 @@
 +
  #endif
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
rename to recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index b5c2d81..22b9452 100644
--- a/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,7 +1,7 @@
-From e7ed3dabb5b29e6a8d8d244d2fb9bd4a7a36a562 Mon Sep 17 00:00:00 2001
+From bc8e0a4dfa04ec0bf2cec39241329bca4c4f2b6d Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1128/1131] mt76: mt7915: add E3 re-bonding for low yield rate
+Subject: [PATCH 1127/1133] mt76: mt7915: add E3 re-bonding for low yield rate
  issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,7 +12,7 @@
  3 files changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 54803e8..849275e 100644
+index 54803e8e..849275e1 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -132,7 +132,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
@@ -64,10 +64,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 36a33f6..cb47ae6 100644
+index 9cd51d95..e8b8bc8d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2836,7 +2836,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+@@ -2885,7 +2885,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
  				 &req, sizeof(req), true);
  }
  
@@ -76,7 +76,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2854,8 +2854,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2903,8 +2903,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -95,10 +95,10 @@
  
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b9b86b8..ab81d41 100644
+index e4422d94..538896e5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -556,6 +556,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -557,6 +557,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
@@ -106,7 +106,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev);
  void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  				struct mt7915_phy *phy);
-@@ -610,7 +611,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -611,7 +612,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
  int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
@@ -116,5 +116,5 @@
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
rename to recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
index 0839730..fb10c3a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,7 +1,7 @@
-From 3243e04725e87c5036b440f26c52e6e274e35bb0 Mon Sep 17 00:00:00 2001
+From 3cc965c29077d7631327bf60f75cc23808a025e4 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1129/1131] mt76: mt7915: support on off SW ACI through debugfs
+Subject: [PATCH 1128/1133] mt76: mt7915: support on off SW ACI through debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
@@ -11,10 +11,10 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5cff1a4..98b0074 100644
+index 41859dc3..73a5509a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1201,6 +1201,7 @@ enum {
+@@ -1206,6 +1206,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_SET_CFG = 0xb7,
  	MCU_EXT_CMD_EDCCA = 0xba,
@@ -23,7 +23,7 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index d0f6a07..f223871 100644
+index 0f2795d5..576995dc 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3040,6 +3040,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index 2b7daf1..b65f733 100644
--- a/recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,7 +1,7 @@
-From cc6ed7205f43ca7da22cf2dba1697f4cae0780b1 Mon Sep 17 00:00:00 2001
+From 5cfacdb63a2c3b8105b0e8a131f306073085ce59 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1130/1131] mt76: mt7915: add bf backoff limit table support
+Subject: [PATCH 1129/1133] mt76: mt7915: add bf backoff limit table support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -14,7 +14,7 @@
  6 files changed, 203 insertions(+), 37 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 05b6dfa..d161264 100644
+index 05b6dfaa..d1612641 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -310,7 +310,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
@@ -57,10 +57,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
 diff --git a/mt76.h b/mt76.h
-index 9b6e806..c81ece0 100644
+index 1638ef63..5e24d03c 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -906,6 +906,14 @@ struct mt76_power_limits {
+@@ -912,6 +912,14 @@ struct mt76_power_limits {
  	s8 ofdm[8];
  	s8 mcs[4][10];
  	s8 ru[7][12];
@@ -76,7 +76,7 @@
  
  struct mt76_ethtool_worker_info {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f1f3f2f..3ef2148 100644
+index f1f3f2f3..3ef2148b 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1024,7 +1024,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -188,10 +188,10 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index cb47ae6..d380811 100644
+index e8b8bc8d..e3686f88 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3281,7 +3281,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3330,7 +3330,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	int ret;
  	s8 txpower_sku[MT7915_SKU_RATE_NUM];
  
@@ -201,7 +201,7 @@
  	if (ret)
  		return ret;
  
-@@ -3323,51 +3324,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3372,51 +3373,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  {
@@ -325,7 +325,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3376,10 +3424,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3425,10 +3473,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -337,7 +337,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3389,9 +3436,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3438,9 +3485,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -356,7 +356,7 @@
  
  	dev_kfree_skb(skb);
  
-@@ -3433,9 +3486,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3482,9 +3535,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.band_idx = phy->mt76->band_idx,
  		.sku_enable = enable,
  	};
@@ -376,10 +376,10 @@
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 025a03b..b33e671 100644
+index 16517099..e869a9f5 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -446,12 +446,18 @@ enum {
+@@ -447,12 +447,18 @@ enum {
  
  enum {
  	TX_POWER_LIMIT_ENABLE,
@@ -399,10 +399,10 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ab81d41..f5ac92e 100644
+index 538896e5..85c88bdd 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -64,6 +64,7 @@
+@@ -65,6 +65,7 @@
  #define MT7915_CDEV_THROTTLE_MAX	99
  
  #define MT7915_SKU_RATE_NUM		161
@@ -410,7 +410,7 @@
  
  #define MT7915_MAX_TWT_AGRT		16
  #define MT7915_MAX_STA_TWT_AGRT		8
-@@ -620,7 +621,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+@@ -621,7 +622,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
  int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
@@ -421,5 +421,5 @@
  int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  				 struct ieee80211_vif *vif,
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1131-mt76-mt7915-amsdu-set-and-get-control.patch b/recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-amsdu-set-and-get-control.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1131-mt76-mt7915-amsdu-set-and-get-control.patch
rename to recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-amsdu-set-and-get-control.patch
index a430000..2548262 100644
--- a/recipes-wifi/linux-mt76/files/patches/1131-mt76-mt7915-amsdu-set-and-get-control.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-amsdu-set-and-get-control.patch
@@ -1,7 +1,7 @@
-From 5d409ad69898ac9ca36176b2289b6fe7f61af618 Mon Sep 17 00:00:00 2001
+From 6f923c7b8315b6ca8c2308970f8c1e0794421116 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH 1131/1131] mt76: mt7915: amsdu set and get control
+Subject: [PATCH 1130/1133] mt76: mt7915: amsdu set and get control
 
 ---
  mt7915/mac.c    | 10 ++++++++++
@@ -11,10 +11,10 @@
  4 files changed, 54 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9d4cfa1..a0df785 100644
+index 623bf2d4..6fe5cac6 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -2053,6 +2053,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2055,6 +2055,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -32,10 +32,10 @@
  void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f5ac92e..5cc1924 100644
+index 85c88bdd..eb24b45f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -746,6 +746,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -747,6 +747,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -44,7 +44,7 @@
  void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 22af66d..a1f526c 100644
+index 22af66d5..a1f526c9 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -30,10 +30,16 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 949c885..cbff910 100644
+index 949c8853..cbff910b 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -74,6 +74,7 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
  
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1132-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch b/recipes-wifi/linux-mt76/files/patches/1131-wifi-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch
similarity index 66%
rename from recipes-wifi/linux-mt76/files/patches/1132-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch
rename to recipes-wifi/linux-mt76/files/patches/1131-wifi-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch
index 087907f..a1495be 100644
--- a/recipes-wifi/linux-mt76/files/patches/1132-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1131-wifi-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch
@@ -1,17 +1,18 @@
-From 1a2d1f83920eb159138ea226150f2e90398337a1 Mon Sep 17 00:00:00 2001
+From 49134453f2edb6f7724f6cc047db7e963909f1f4 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 12 Jan 2023 15:15:42 +0800
-Subject: [PATCH] wifi: mt76: mt7915: add support for he ldpc control from hostapd
+Subject: [PATCH 1131/1133] wifi: mt76: mt7915: add support for he ldpc control
+ from hostapd
 
 ---
  mt7915/mcu.c | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8fab4c7..7954745 100644
+index e3686f88..ad5ac120 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1983,6 +1983,7 @@ mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1982,6 +1982,7 @@ mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  		he = (void *)(ie + 3);
  
  		vc->he_ldpc =
@@ -20,5 +21,5 @@
  		vc->he_su_ebfer =
  			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
 -- 
-2.39.0
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1133-mt76-mt7915-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/linux-mt76/files/patches/1132-mt76-mt7915-Add-vendor-command-attribute-for-RTS-BW-.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches/1133-mt76-mt7915-Add-vendor-command-attribute-for-RTS-BW-.patch
rename to recipes-wifi/linux-mt76/files/patches/1132-mt76-mt7915-Add-vendor-command-attribute-for-RTS-BW-.patch
index 4f92ace..40b6813 100644
--- a/recipes-wifi/linux-mt76/files/patches/1133-mt76-mt7915-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1132-mt76-mt7915-Add-vendor-command-attribute-for-RTS-BW-.patch
@@ -1,8 +1,8 @@
-From 3c943d4668b64ee1540e70707db0021b012d13da Mon Sep 17 00:00:00 2001
+From 7932d63acfca9abe1b7e27c25e7e23015e0f39f7 Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 14:32:08 +0800
-Subject: [PATCH] mt76: mt7915: Add vendor command attribute for RTS BW
- signaling.
+Subject: [PATCH 1132/1133] mt76: mt7915: Add vendor command attribute for RTS
+ BW signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
 ---
@@ -13,10 +13,10 @@
  4 files changed, 20 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7954745..da3c004 100644
+index ad5ac120..fc5bf5b7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4534,6 +4534,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
+@@ -4407,6 +4407,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
  		req.cert.length = cpu_to_le16(tlv_len);
  		req.cert.cert_program = type;
  		break;
@@ -30,10 +30,10 @@
  		tlv_len = sizeof(struct three_wire_cfg);
  		req.three_wire.tag = cpu_to_le16(cfg_info);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 572cc16..b045578 100644
+index e869a9f5..03ee600a 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -868,6 +868,13 @@ struct three_wire_cfg {
+@@ -867,6 +867,13 @@ struct three_wire_cfg {
  	u8 rsv[3];
  } __packed;
  
@@ -47,7 +47,7 @@
  struct cfg_basic_info {
  	u8 dbdc_idx;
  	u8 rsv[3];
-@@ -875,11 +882,13 @@ struct cfg_basic_info {
+@@ -874,11 +881,13 @@ struct cfg_basic_info {
  	union {
  		struct cert_cfg cert;
  		struct three_wire_cfg three_wire;
@@ -62,7 +62,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index a1f526c..b54fee7 100644
+index a1f526c9..b54fee72 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -33,6 +33,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -84,7 +84,7 @@
  
  	return 0;
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index cbff910..41d6ff2 100644
+index cbff910b..41d6ff26 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -76,6 +76,7 @@ enum mtk_vendor_attr_wireless_ctrl {
diff --git a/recipes-wifi/linux-mt76/files/patches/1134-mt76-mt7915-Allow-AP-to-change-channel-width-for-40M.patch b/recipes-wifi/linux-mt76/files/patches/1133-mt76-mt7915-Allow-AP-to-change-channel-width-for-40M.patch
similarity index 74%
rename from recipes-wifi/linux-mt76/files/patches/1134-mt76-mt7915-Allow-AP-to-change-channel-width-for-40M.patch
rename to recipes-wifi/linux-mt76/files/patches/1133-mt76-mt7915-Allow-AP-to-change-channel-width-for-40M.patch
index 362d53e..c2d6298 100644
--- a/recipes-wifi/linux-mt76/files/patches/1134-mt76-mt7915-Allow-AP-to-change-channel-width-for-40M.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1133-mt76-mt7915-Allow-AP-to-change-channel-width-for-40M.patch
@@ -1,8 +1,8 @@
-From 59bae873f7663ccff9f601bcb638793a961265dd Mon Sep 17 00:00:00 2001
+From 657b01e6ed24b9b7f6fd0d52768e9674c0382828 Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Mon, 30 Jan 2023 17:47:06 +0800
-Subject: [PATCH] mt76: mt7915: Allow AP to change channel width for 40Mhz
- Intolerant STA
+Subject: [PATCH 1133/1133] mt76: mt7915: Allow AP to change channel width for
+ 40Mhz Intolerant STA
 
 Ref: WFA 11n Test Case: 4.2.41 AP 20/40 MHz Coexistence
 
@@ -12,10 +12,10 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 909ab25..4724c62 100644
+index e79568d1..35fd0347 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -429,7 +429,8 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
+@@ -430,7 +430,8 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
  	SET_IEEE80211_DEV(hw, dev->dev);
  	SET_IEEE80211_PERM_ADDR(hw, phy->macaddr);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
index 3ec16f5..f35915c 100644
--- a/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From 2d217a2c6ffc6069b76956213a60e055e55d59df Mon Sep 17 00:00:00 2001
+From 2a80e06e9d9e76ecb7c3d8de983a692bb58e8f62 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 3001/3014] mt76: mt7915: wed: add wed tx support
+Subject: [PATCH 3001/3010] mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -12,10 +12,10 @@
  4 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 8ba883b0..f70987dd 100644
+index b339c50b..323203df 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
-@@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
+@@ -117,6 +117,7 @@ struct mt76_connac_sta_key_conf {
  };
  
  #define MT_TXP_MAX_BUF_NUM		6
@@ -24,10 +24,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a0df7853..0984357a 100644
+index 6fe5cac6..175498b1 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -891,9 +891,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -890,9 +890,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -39,7 +39,7 @@
  }
  
  static void
-@@ -1009,6 +1009,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1008,6 +1008,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -47,7 +47,7 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1064,12 +1065,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1063,12 +1064,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -65,10 +65,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 09cf35c1..2dd78ca2 100644
+index 96236f4c..06a72197 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1533,14 +1533,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1539,14 +1539,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -86,10 +86,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c1b421d1..04411e77 100644
+index 95ded131..6ebb969f 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -11,7 +11,7 @@
+@@ -13,7 +13,7 @@
  #include "../trace.h"
  #include "../dma.h"
  
@@ -98,7 +98,7 @@
  module_param(wed_enable, bool, 0644);
  MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
  
-@@ -582,7 +582,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -584,7 +584,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  
  	spin_lock_bh(&dev->mt76.token_lock);
@@ -107,7 +107,7 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  
  	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-@@ -792,6 +792,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -825,6 +825,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
diff --git a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
index 5a6cc6c..5d1cd12 100644
--- a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
@@ -1,7 +1,7 @@
-From 87fc706b27c4947f51ea0ed1045c841c54af2700 Mon Sep 17 00:00:00 2001
+From cbc0a7e53a836bb19b4eb407143a86400c78c814 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 17:51:26 +0800
-Subject: [PATCH 3002/3014] mt76: mt7915: wed: add wds support when wed is
+Subject: [PATCH 3002/3010] mt76: mt7915: wed: add wds support when wed is
  enabled
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 81 insertions(+), 8 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index c81ece06..cba11f6c 100644
+index 5e24d03c..cb34391a 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -60,6 +60,12 @@ enum mt76_wed_type {
@@ -32,7 +32,7 @@
  	u32 (*rr)(struct mt76_dev *dev, u32 offset);
  	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2dd78ca2..eef4c3b4 100644
+index 06a72197..9ae8694a 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -696,8 +696,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -66,7 +66,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1540,8 +1554,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1546,8 +1560,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -81,10 +81,10 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d3808116..f494d9f6 100644
+index fc5bf5b7..64789b80 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2364,8 +2364,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2415,8 +2415,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -105,7 +105,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b33e671d..f2f88cc4 100644
+index 03ee600a..24d0efd3 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -284,6 +284,7 @@ enum {
@@ -117,12 +117,12 @@
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 diff --git a/util.c b/util.c
-index 58196442..5cd5ede0 100644
+index fc76c66f..61b2d30a 100644
 --- a/util.c
 +++ b/util.c
-@@ -42,9 +42,14 @@ bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
+@@ -42,9 +42,14 @@ bool ____mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
  }
- EXPORT_SYMBOL_GPL(__mt76_poll_msec);
+ EXPORT_SYMBOL_GPL(____mt76_poll_msec);
  
 -int mt76_wcid_alloc(u32 *mask, int size)
 +int __mt76_wcid_alloc(u32 *mask, int size, u8 flag)
diff --git a/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
deleted file mode 100644
index f6cca71..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From cf9c84fbe7863a9af60e00bbb18ebdc6a4f29020 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Thu, 5 Jan 2023 16:43:57 +0800
-Subject: [PATCH 3003/3014] mt76: connac: wed: add wed rx copy skb
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- dma.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++-------------
- 1 file changed, 52 insertions(+), 15 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index e05b7ca1..74e2169e 100644
---- a/dma.c
-+++ b/dma.c
-@@ -207,11 +207,11 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
- 
- static int
- mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
--		    struct mt76_queue_buf *buf, void *data)
-+		    struct mt76_queue_buf *buf, void *data,
-+		    struct mt76_txwi_cache *txwi)
- {
- 	struct mt76_desc *desc = &q->desc[q->head];
- 	struct mt76_queue_entry *entry = &q->entry[q->head];
--	struct mt76_txwi_cache *txwi = NULL;
- 	u32 buf1 = 0, ctrl;
- 	int idx = q->head;
- 	int rx_token;
-@@ -220,9 +220,11 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 
- 	if ((q->flags & MT_QFLAG_WED) &&
- 	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
--		txwi = mt76_get_rxwi(dev);
--		if (!txwi)
--			return -ENOMEM;
-+		if(!txwi) {
-+			txwi = mt76_get_rxwi(dev);
-+			if (!txwi)
-+				return -ENOMEM;
-+		}
- 
- 		rx_token = mt76_rx_token_consume(dev, data, txwi, buf->addr);
- 		if (rx_token < 0) {
-@@ -386,7 +388,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
- 
- static void *
- mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
--		 int *len, u32 *info, bool *more, bool *drop)
-+		 int *len, u32 *info, bool *more, bool *drop, bool flush)
- {
- 	struct mt76_queue_entry *e = &q->entry[idx];
- 	struct mt76_desc *desc = &q->desc[idx];
-@@ -413,12 +415,43 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 		dma_unmap_single(dev->dma_dev, t->dma_addr,
- 				 SKB_WITH_OVERHEAD(q->buf_size),
- 				 DMA_FROM_DEVICE);
--
--		buf = t->ptr;
--		t->dma_addr = 0;
--		t->ptr = NULL;
--
--		mt76_put_rxwi(dev, t);
-+		if (flush) {
-+			buf = t->ptr;
-+			t->dma_addr = 0;
-+			t->ptr = NULL;
-+
-+			mt76_put_rxwi(dev, t);
-+		} else {
-+			struct mt76_queue_buf qbuf;
-+
-+			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+			if (!buf)
-+				return NULL;
-+
-+			memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
-+
-+			t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
-+						     SKB_WITH_OVERHEAD(q->buf_size),
-+						     DMA_FROM_DEVICE);
-+			if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
-+				skb_free_frag(t->ptr);
-+				mt76_put_rxwi(dev, t);
-+				return NULL;
-+			}
-+
-+			qbuf.addr = t->dma_addr;
-+			qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
-+			qbuf.skip_unmap = false;
-+
-+			if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
-+				dma_unmap_single(dev->dma_dev, t->dma_addr,
-+						 SKB_WITH_OVERHEAD(q->buf_size),
-+						 DMA_FROM_DEVICE);
-+				skb_free_frag(t->ptr);
-+				mt76_put_rxwi(dev, t);
-+				return NULL;
-+			}
-+		}
- 
- 		if (drop) {
- 			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-@@ -455,7 +488,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
- 	q->tail = (q->tail + 1) % q->ndesc;
- 	q->queued--;
- 
--	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
-+	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop, flush);
- }
- 
- static int
-@@ -587,6 +620,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	int len = SKB_WITH_OVERHEAD(q->buf_size);
- 	int frames = 0, offset = q->buf_offset;
- 	dma_addr_t addr;
-+	bool flags = false;
- 
- 	if (!q->ndesc)
- 		return 0;
-@@ -610,7 +644,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		qbuf.addr = addr + offset;
- 		qbuf.len = len - offset;
- 		qbuf.skip_unmap = false;
--		if (mt76_dma_add_rx_buf(dev, q, &qbuf, buf) < 0) {
-+		if (mt76_dma_add_rx_buf(dev, q, &qbuf, buf, NULL) < 0) {
- 			dma_unmap_single(dev->dma_dev, addr, len,
- 					 DMA_FROM_DEVICE);
- 			skb_free_frag(buf);
-@@ -619,7 +653,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		frames++;
- 	}
- 
--	if (frames)
-+	flags = (q->flags & MT_QFLAG_WED) &&
-+		FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX;
-+
-+	if (frames || flags)
- 		mt76_dma_kick_queue(dev, q);
- 
- 	spin_unlock_bh(&q->lock);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/recipes-wifi/linux-mt76/files/patches/3003-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
rename to recipes-wifi/linux-mt76/files/patches/3003-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
index be492fc..4910330 100644
--- a/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3003-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -1,7 +1,7 @@
-From b750e9f13c700e0b9f60c1d29b0493a539fd8c2f Mon Sep 17 00:00:00 2001
+From 51ef6c501ddd6262d00daaaf95015db71fe90de2 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3014] mt76: mt7915: wed: add fill receive path to report
+Subject: [PATCH 3003/3010] mt76: mt7915: wed: add fill receive path to report
  wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index eef4c3b4..7dd3973f 100644
+index 9ae8694a..9a5dac91 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1565,6 +1565,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1571,6 +1571,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -38,7 +38,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1617,5 +1635,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1623,5 +1641,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
diff --git a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
similarity index 63%
rename from recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
rename to recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
index bcdd37a..ea151cb 100644
--- a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -1,7 +1,7 @@
-From 7c2e0d8a456963e4d5df268b7b28ae8a5d0d94d9 Mon Sep 17 00:00:00 2001
+From e27abd8471cfe265afd0061cc86f85cce5b37773 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 3007/3014] mt76: mt7915: wed: find rx token by physical
+Subject: [PATCH 3004/3010] mt76: mt7915: wed: find rx token by physical
  address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -9,17 +9,18 @@
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
- dma.c | 21 ++++++++++++++++++++-
- 1 file changed, 20 insertions(+), 1 deletion(-)
+ dma.c | 27 ++++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index 5163a8e9..0dce97fb 100644
+index a6bb3730..b58579c5 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -406,10 +406,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -402,10 +402,35 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 		*info = le32_to_cpu(desc->info);
  
- 	if ((q->flags & MT_QFLAG_WED) &&
- 	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
+ 	if (mt76_queue_is_wed_rx(q)) {
++		__le32 buf1;
 +		u32 id, find = 0;
  		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
  				      le32_to_cpu(desc->buf1));
@@ -32,8 +33,13 @@
 +			idr_for_each_entry(&dev->rx_token, t, id) {
 +				if (t->dma_addr == le32_to_cpu(desc->buf0)) {
 +					find = 1;
-+					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
 +					token = id;
++
++					/* Write correct id back to DMA*/
++					buf1 = desc->buf1;
++					buf1 = le32_replace_bits(buf1, id,
++							MT_DMA_CTL_TOKEN);
++					WRITE_ONCE(desc->buf1, buf1);
 +					break;
 +				}
 +			}
diff --git a/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
deleted file mode 100644
index d5fca9a..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ /dev/null
@@ -1,284 +0,0 @@
-From f8d9b46c86122218ee1c60d813cf371b25401780 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 25 Nov 2022 14:07:46 +0800
-Subject: [PATCH 3005/3014] mt76: mt7915: wed: add ser support when wed on
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- dma.c           | 29 ++++++++++++++++++++---------
- dma.h           |  1 +
- mt76.h          |  1 +
- mt7915/dma.c    | 37 ++++++++++++++++++++++++++++++++-----
- mt7915/mac.c    | 18 ++++++++++++++++++
- mt7915/mmio.c   |  3 +++
- mt7915/mt7915.h |  1 +
- 7 files changed, 76 insertions(+), 14 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 1082d6f1..5163a8e9 100644
---- a/dma.c
-+++ b/dma.c
-@@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
- 	local_bh_enable();
- }
- 
--static void
-+void
- mt76_free_pending_rxwi(struct mt76_dev *dev)
- {
- 	struct mt76_txwi_cache *t;
-@@ -178,6 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
- 	}
- 	local_bh_enable();
- }
-+EXPORT_SYMBOL_GPL(mt76_free_pending_rxwi);
- 
- static void
- mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
-@@ -656,14 +657,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	return frames;
- }
- 
--static int
--mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
-+int
-+mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
- {
- #ifdef CONFIG_NET_MEDIATEK_SOC_WED
- 	struct mtk_wed_device *wed = &dev->mmio.wed;
- 	int ret, type, ring;
--	u8 flags = q->flags;
-+	u8 flags;
- 
-+	if (!q || !q->ndesc)
-+		return -EINVAL;
-+
-+	flags = q->flags;
- 	if (!mtk_wed_device_active(wed))
- 		q->flags &= ~MT_QFLAG_WED;
- 
-@@ -683,7 +688,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 
- 	switch (type) {
- 	case MT76_WED_Q_TX:
--		ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs);
-+		ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs, reset);
- 		if (!ret)
- 			q->wed_regs = wed->tx_ring[ring].reg_base;
- 		break;
-@@ -699,7 +704,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 			q->wed_regs = wed->txfree_ring.reg_base;
- 		break;
- 	case MT76_WED_Q_RX:
--		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
-+		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs, reset);
- 		if (!ret)
- 			q->wed_regs = wed->rx_ring[ring].reg_base;
- 		break;
-@@ -712,6 +717,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 	return 0;
- #endif
- }
-+EXPORT_SYMBOL_GPL(mt76_dma_wed_setup);
- 
- static int
- mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
-@@ -738,7 +744,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
- 	if (!q->entry)
- 		return -ENOMEM;
- 
--	ret = mt76_dma_wed_setup(dev, q);
-+	ret = mt76_dma_wed_setup(dev, q, false);
- 	if (ret)
- 		return ret;
- 
-@@ -789,8 +795,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
- 		q->desc[i].ctrl = cpu_to_le32(MT_DMA_CTL_DMA_DONE);
- 
- 	mt76_dma_rx_cleanup(dev, q);
--	mt76_dma_sync_idx(dev, q);
--	mt76_dma_rx_fill(dev, q);
-+
-+	mt76_dma_wed_setup(dev, q, true);
-+
-+	if (q->flags != MT_WED_Q_TXFREE) {
-+		mt76_dma_sync_idx(dev, q);
-+		mt76_dma_rx_fill(dev, q);
-+	}
- 
- 	if (!q->rx_head)
- 		return;
-diff --git a/dma.h b/dma.h
-index 53c6ce25..4b9bc7f4 100644
---- a/dma.h
-+++ b/dma.h
-@@ -56,5 +56,6 @@ enum mt76_mcu_evt_type {
- int mt76_dma_rx_poll(struct napi_struct *napi, int budget);
- void mt76_dma_attach(struct mt76_dev *dev);
- void mt76_dma_cleanup(struct mt76_dev *dev);
-+int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
- 
- #endif
-diff --git a/mt76.h b/mt76.h
-index cba11f6c..369e1e4b 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -1401,6 +1401,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
- void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
- void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
- struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
-+void mt76_free_pending_rxwi(struct mt76_dev *dev);
- void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
- 		      struct napi_struct *napi);
- void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index e3fa0649..1ae6c339 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -4,6 +4,7 @@
- #include "mt7915.h"
- #include "../dma.h"
- #include "mac.h"
-+#include <linux/rtnetlink.h>
- 
- static int
- mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc, int ring_base)
-@@ -562,6 +563,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
- {
- 	struct mt76_phy *mphy_ext = dev->mt76.phys[MT_BAND1];
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
- 	int i;
- 
- 	/* clean up hw queues */
-@@ -581,28 +583,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
- 	if (force)
- 		mt7915_wfsys_reset(dev);
- 
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
-+		mtk_wed_device_dma_reset(&dev->mt76.mmio.wed);
- 	mt7915_dma_disable(dev, force);
- 
-+	/* set wifi reset done, wait FE reset */
-+	if (mtk_wed_device_active(wed) && atomic_read(&wed->fe_reset)) {
-+		atomic_set(&wed->fe_reset, 0);
-+		rtnl_lock();
-+		complete(&wed->wlan_reset_done);
-+		rtnl_unlock();
-+		wait_for_completion(&wed->fe_reset_done);
-+	}
-+
- 	/* reset hw queues */
- 	for (i = 0; i < __MT_TXQ_MAX; i++) {
- 		mt76_queue_reset(dev, dev->mphy.q_tx[i]);
--		if (mphy_ext)
-+		if (mphy_ext) {
- 			mt76_queue_reset(dev, mphy_ext->q_tx[i]);
-+			if (mtk_wed_device_active(wed))
-+				mt76_dma_wed_setup(&dev->mt76,
-+						   mphy_ext->q_tx[i],
-+						   true);
-+		}
-+		if (mtk_wed_device_active(wed))
-+			mt76_dma_wed_setup(&dev->mt76, dev->mphy.q_tx[i],
-+					   true);
- 	}
- 
- 	for (i = 0; i < __MT_MCUQ_MAX; i++)
- 		mt76_queue_reset(dev, dev->mt76.q_mcu[i]);
- 
--	mt76_for_each_q_rx(&dev->mt76, i)
--		mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
-+	mt76_for_each_q_rx(&dev->mt76, i) {
-+		if (dev->mt76.q_rx[i].flags != MT_WED_Q_TXFREE)
-+			mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
-+	}
- 
- 	mt76_tx_status_check(&dev->mt76, true);
- 
--	mt7915_dma_enable(dev);
--
- 	mt76_for_each_q_rx(&dev->mt76, i)
- 		mt76_queue_rx_reset(dev, i);
- 
-+	if(mtk_wed_device_active(wed) && is_mt7915(&dev->mt76))
-+		mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
-+			 MT_WFDMA0_EXT0_RXWB_KEEP);
-+
-+	mt7915_dma_enable(dev);
-+
- 	return 0;
- }
- 
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0984357a..0d0ae7ab 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -896,6 +896,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
- 	return MT_TXD_TXP_BUF_SIZE;
- }
- 
-+void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
-+{
-+	struct mt7915_dev *dev;
-+	u8 band_idx;
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	band_idx = dev->phy.mt76->band_idx;
-+
-+	mt7915_mcu_set_ser(dev, SER_RECOVER, 1, band_idx);
-+
-+	return;
-+}
-+
- static void
- mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
- {
-@@ -1635,6 +1647,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
- 	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
- 		return;
- 
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+		mtk_wed_device_stop(&dev->mt76.mmio.wed, true);
-+		if (!is_mt7986(&dev->mt76))
-+			mt76_wr(dev, MT_INT_WED_MASK_CSR, 0);
-+	}
-+
- 	ieee80211_stop_queues(mt76_hw(dev));
- 	if (ext_phy)
- 		ieee80211_stop_queues(ext_phy->hw);
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 04411e77..e0761e89 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -619,6 +619,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- 		mt76_put_rxwi(&dev->mt76, t);
- 	}
- 
-+	mt76_free_pending_rxwi(&dev->mt76);
-+
- 	if (!wed->rx_buf_ring.rx_page.va)
- 		return;
- 
-@@ -784,6 +786,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	wed->wlan.init_rx_buf = mt7915_mmio_wed_init_rx_buf;
- 	wed->wlan.release_rx_buf = mt7915_mmio_wed_release_rx_buf;
- 	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
-+	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
- 
- 	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
- 
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5cc19240..89c13dbe 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -554,6 +554,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
- irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
- u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
- u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
-+void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
- 
- int mt7915_register_device(struct mt7915_dev *dev);
- void mt7915_unregister_device(struct mt7915_dev *dev);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
rename to recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
index a1c51c0..8e62cd5 100644
--- a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -1,7 +1,7 @@
-From 66908ed646059fd3dd40a6430ba8337cfc69fbb7 Mon Sep 17 00:00:00 2001
+From aa7dfb5e157381545a798a7333a0332858bb9cbf Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 25 Nov 2022 14:37:58 +0800
-Subject: [PATCH 3008/3014] mt76: mt7915: wed: drop scatter and gather frame
+Subject: [PATCH 3005/3010] mt76: mt7915: wed: drop scatter and gather frame
 
 The scatter and gather frame may be incorrect because WED and WO may
 send frames to host driver interleaved.
@@ -14,10 +14,10 @@
  3 files changed, 11 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index 0dce97fb..98d2a29a 100644
+index b58579c5..86b0bf84 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -478,6 +478,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -449,6 +449,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
  					   MT_DMA_CTL_DROP));
@@ -46,7 +46,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index 369e1e4b..b10a16f8 100644
+index cb34391a..982d0bbf 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -30,6 +30,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
similarity index 97%
rename from recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
rename to recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 777a5a8..2dffdc4 100644
--- a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 2610d420e26e59804355c34498acd79cf3c8336e Mon Sep 17 00:00:00 2001
+From b2b4b6a891b1c9e4232addc929a0dac8cd548a06 Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3009/3014] mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 3006/3010] mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
@@ -13,13 +13,12 @@
  mt7915/mt7915.h      |  68 ++++++++
  mt7915/mtk_debugfs.c | 133 +++++++++++++-
  7 files changed, 826 insertions(+), 1 deletion(-)
- mode change 100644 => 100755 mt7915/init.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 21ea55d1..86ce55d1 100644
+index 73a5509a..130a8d25 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1159,6 +1159,7 @@ enum {
+@@ -1164,6 +1164,7 @@ enum {
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
  	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
@@ -27,7 +26,7 @@
  	MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
  	MCU_EXT_CMD_ATE_CTRL = 0x3d,
  	MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
-@@ -1168,6 +1169,7 @@ enum {
+@@ -1173,6 +1174,7 @@ enum {
  	MCU_EXT_CMD_MUAR_UPDATE = 0x48,
  	MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
  	MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
@@ -466,12 +465,10 @@
  	if (!dev->dbdc_support || phy->mt76->band_idx) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7915/init.c b/mt7915/init.c
-old mode 100644
-new mode 100755
-index e044f503..ef752e10
+index 19447ad1..92977b98 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -563,10 +563,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -557,10 +557,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  	}
  }
  
@@ -518,7 +515,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -588,6 +624,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -582,6 +618,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		mt7915_mac_init_band(dev, i);
  
  	mt7915_init_led_mux(dev);
@@ -529,7 +526,7 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7dd3973f..c87f04b1 100644
+index 9a5dac91..a9980e70 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -209,6 +209,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
@@ -576,10 +573,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 116a5cc9..15f20add 100644
+index 64789b80..e3b7d824 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3530,6 +3530,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3579,6 +3579,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -752,7 +749,7 @@
  {
  #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2335f78f..c3a0b326 100644
+index eb24b45f..a1ef8359 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -127,6 +127,58 @@ struct mt7915_twt_flow {
@@ -847,7 +844,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -621,6 +685,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -620,6 +684,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
diff --git a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
deleted file mode 100644
index 3798866..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-From 4a7d3194f24e390b37bd9b1349ee25a4ca5e17aa Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3006/3014] mt76: mt7915: wed: enable red per-band token drop
- for HW Path
-
-Limit the number of token used by each band. If a band uses too many token,
-it may hurt the throughput of the other band. The SW path can solve this
-problem by AQL.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt76_connac_mcu.h |  2 +-
- mt7915/mcu.c      | 45 ++++++++++++++++++++++++++++++++++++++-------
- mt7915/mcu.h      |  1 +
- mt7915/mmio.c     |  2 +-
- mt7915/mt7915.h   |  4 +++-
- 5 files changed, 44 insertions(+), 10 deletions(-)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 98b00747..21ea55d1 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1174,13 +1174,13 @@ enum {
- 	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
- 	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
- #ifdef MTK_DEBUG
--	MCU_EXT_CMD_RED_ENABLE = 0x68,
- 	MCU_EXT_CMD_RED_SHOW_STA = 0x69,
- 	MCU_EXT_CMD_RED_TARGET_DELAY = 0x6A,
- 	MCU_EXT_CMD_RED_TX_RPT = 0x6B,
- #endif
- 	MCU_EXT_CMD_TXDPD_CAL = 0x60,
- 	MCU_EXT_CMD_CAL_CACHE = 0x67,
-+	MCU_EXT_CMD_RED_ENABLE = 0x68,
- 	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
- 	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
- 	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f494d9f6..116a5cc9 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2377,6 +2377,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
- 			return ret;
- 	}
- 
-+
- 	ret = mt7915_mcu_set_mwds(dev, 1);
- 	if (ret)
- 		return ret;
-@@ -2390,8 +2391,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
- 	if (ret)
- 		return ret;
- 
--	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
--				 MCU_WA_PARAM_RED, 0, 0);
-+	return mt7915_mcu_set_red(dev, mtk_wed_device_active(&dev->mt76.mmio.wed));
- }
- 
- int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4534,27 +4534,58 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
- 
- 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
- }
-+#endif
-+
-+static int mt7915_red_set_watermark(struct mt7915_dev *dev)
-+{
-+#define RED_GLOBAL_TOKEN_WATERMARK 2
-+	struct {
-+		__le32 args[3];
-+
-+		u8 cmd;
-+		u8 version;
-+		u8 __rsv1[4];
-+		u16 len;
-+
-+		__le16 high_mark;
-+		__le16 low_mark;
-+		u8 __rsv2[12];
-+	} __packed req = {
-+		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
-+		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
-+		.len = cpu_to_le16(sizeof(req) - 12),
-+
-+		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
-+		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
-+				 sizeof(req), false);
-+}
- 
- int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
- {
- #define RED_DISABLE		0
--#define RED_BY_HOST_ENABLE	1
- #define RED_BY_WA_ENABLE	2
- 	int ret;
- 	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
- 	__le32 req = cpu_to_le32(red_type);
- 
-+	if (enabled) {
-+		ret = mt7915_red_set_watermark(dev);
-+		if (ret < 0)
-+			return ret;
-+	}
-+
- 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
- 				 sizeof(req), false);
- 	if (ret < 0)
- 		return ret;
- 
--	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
--			  MCU_WA_PARAM_RED, enabled, 0, true);
-+	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
-+				 MCU_WA_PARAM_RED, enabled, 0);
- 
--	return 0;
- }
--#endif
- 
- int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
- {
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f2f88cc4..572cc16a 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -285,6 +285,7 @@ enum {
- 	MCU_WA_PARAM_CPU_UTIL = 0x0b,
- 	MCU_WA_PARAM_RED = 0x0e,
- 	MCU_WA_PARAM_WED_VERSION = 0x32,
-+	MCU_WA_PARAM_RED_SETTING = 0x40,
- #ifdef MTK_DEBUG
- 	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
- 	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index e0761e89..b29fe7a4 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -759,7 +759,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
- 		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
- 	}
--	wed->wlan.nbuf = 4096;
-+	wed->wlan.nbuf = MT7915_HW_TOKEN_SIZE;
- 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
- 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
- 	wed->wlan.txfree_tbit = is_mt7986(&dev->mt76) ? 2 : 1;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 89c13dbe..2335f78f 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -56,6 +56,7 @@
- 
- #define MT7915_EEPROM_BLOCK_SIZE	16
- #define MT7915_TOKEN_SIZE		8192
-+#define MT7915_HW_TOKEN_SIZE		7168
- 
- #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
- #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
-@@ -771,13 +772,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
- #endif
- int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
- int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
-+int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
-+
- int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
- int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
- 
- #ifdef MTK_DEBUG
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
- int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
--int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
- void mt7915_dump_tmac_info(u8 *tmac_info);
- int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
- void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
similarity index 83%
rename from recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
rename to recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
index 7eb7d96..92760dc 100644
--- a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
@@ -1,7 +1,7 @@
-From 60ddcc5d8263f9bd6c62697adb479e5b00b8b514 Mon Sep 17 00:00:00 2001
+From b4091a26e5e6ac5b80a587afdbfd8a54251d050f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 2 Dec 2022 17:17:06 +0800
-Subject: [PATCH 3010/3014] mt76: mt7915: wed: add mt7916 2 pcie support when
+Subject: [PATCH 3007/3010] mt76: mt7915: wed: add mt7916 2 pcie support when
  wed on
 
 It should use bit 23 in interrupt mask for wfdma band1 data
@@ -15,10 +15,10 @@
  3 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 1ae6c339..36260085 100644
+index abe17dac..52fabde0 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -88,8 +88,12 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
+@@ -87,8 +87,12 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
  				   MT7916_RXQ_BAND0);
  			RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MT7916,
  				   MT7916_RXQ_MCU_WA);
@@ -34,10 +34,10 @@
  				   MT7916_RXQ_MCU_WA_MAIN);
  			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 15f20add..a2687346 100644
+index e3b7d824..b5a0967b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2365,7 +2365,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2416,7 +2416,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  		return ret;
  
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
@@ -48,10 +48,10 @@
  						0, 0, 0);
  		else
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b29fe7a4..4bc8e8cd 100644
+index 6ebb969f..890af388 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -966,13 +966,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
+@@ -996,13 +996,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
  	struct mt7915_dev *dev = dev_instance;
  	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro.patch
similarity index 66%
rename from recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
rename to recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro.patch
index 8f063a0..0e6a4bf 100644
--- a/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro.patch
@@ -1,21 +1,21 @@
-From 0ed439e39989e3bd470c2aac9e07ab23853d76ed Mon Sep 17 00:00:00 2001
+From 664c9ad764c5ec77923ec6a70623e7b294a4bf60 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 6 Jan 2023 18:18:50 +0800
-Subject: [PATCH 3011/3014] mt76: mt7915: wed: add rxwi for further in chip rro
+Subject: [PATCH 3008/3010] mt76: mt7915: wed: add rxwi for further in chip rro
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c           | 115 ++++++++++++++++++++++++------------------------
- mac80211.c      |   2 +-
- mt76.h          |  24 ++++++----
- mt7915/dma.c    |   2 -
- mt7915/mmio.c   |  21 ++++-----
- mt7915/mt7915.h |   1 +
- tx.c            |  16 +++----
- 7 files changed, 94 insertions(+), 87 deletions(-)
+ dma.c           | 93 +++++++++++++++++++++++++------------------------
+ mac80211.c      |  2 +-
+ mt76.h          | 24 ++++++++-----
+ mt7915/dma.c    |  2 --
+ mt7915/mmio.c   | 27 +++++++-------
+ mt7915/mt7915.h |  1 +
+ tx.c            | 16 ++++-----
+ 7 files changed, 86 insertions(+), 79 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index f898cef0..d4fc091e 100644
+index 86b0bf84..76af6506 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -118,36 +118,33 @@
  	local_bh_disable();
 -	while ((t = __mt76_get_rxwi(dev)) != NULL) {
 -		if (t->ptr)
--			skb_free_frag(t->ptr);
+-			mt76_put_page_pool_buf(t->ptr, false);
 -		kfree(t);
 +	while ((r = __mt76_get_rxwi(dev)) != NULL) {
 +		if (r->ptr)
-+			skb_free_frag(r->ptr);
++			mt76_put_page_pool_buf(r->ptr, false);
 +		kfree(r);
  	}
  	local_bh_enable();
  }
-@@ -209,7 +209,7 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
- static int
- mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 		    struct mt76_queue_buf *buf, void *data,
--		    struct mt76_txwi_cache *txwi)
-+		    struct mt76_rxwi_cache *rxwi)
+@@ -212,7 +212,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  {
  	struct mt76_desc *desc = &q->desc[q->head];
  	struct mt76_queue_entry *entry = &q->entry[q->head];
-@@ -221,15 +221,15 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+-	struct mt76_txwi_cache *txwi = NULL;
++	struct mt76_rxwi_cache *rxwi = NULL;
+ 	u32 buf1 = 0, ctrl;
+ 	int idx = q->head;
+ 	int rx_token;
+@@ -220,13 +220,13 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ 	ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
  
- 	if ((q->flags & MT_QFLAG_WED) &&
- 	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
--		if(!txwi) {
--			txwi = mt76_get_rxwi(dev);
--			if (!txwi)
-+		if(!rxwi) {
-+			rxwi = mt76_get_rxwi(dev);
-+			if (!rxwi)
- 				return -ENOMEM;
- 		}
+ 	if (mt76_queue_is_wed_rx(q)) {
+-		txwi = mt76_get_rxwi(dev);
+-		if (!txwi)
++		rxwi = mt76_get_rxwi(dev);
++		if (!rxwi)
+ 			return -ENOMEM;
  
 -		rx_token = mt76_rx_token_consume(dev, data, txwi, buf->addr);
 +		rx_token = mt76_rx_token_consume(dev, data, rxwi, buf->addr);
@@ -157,7 +154,7 @@
  			return -ENOMEM;
  		}
  
-@@ -244,7 +244,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -241,7 +241,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  
  	entry->dma_addr[0] = buf->addr;
  	entry->dma_len[0] = buf->len;
@@ -166,7 +163,7 @@
  	entry->buf = data;
  	entry->wcid = 0xffff;
  	entry->skip_buf1 = true;
-@@ -257,7 +257,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -254,7 +254,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  static int
  mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
  		 struct mt76_queue_buf *buf, int nbufs, u32 info,
@@ -175,7 +172,7 @@
  {
  	struct mt76_queue_entry *entry;
  	struct mt76_desc *desc;
-@@ -310,6 +310,7 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -307,6 +307,7 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
  	}
  
  	q->entry[idx].txwi = txwi;
@@ -183,7 +180,7 @@
  	q->entry[idx].skb = skb;
  	q->entry[idx].wcid = 0xffff;
  
-@@ -409,13 +410,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -406,13 +407,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		u32 id, find = 0;
  		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
  				      le32_to_cpu(desc->buf1));
@@ -198,9 +195,9 @@
 +			idr_for_each_entry(&dev->rx_token, r, id) {
 +				if (r->dma_addr == le32_to_cpu(desc->buf0)) {
  					find = 1;
- 					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
  					token = id;
-@@ -428,19 +429,19 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 
+@@ -430,19 +431,19 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				return NULL;
  		}
  
@@ -210,62 +207,24 @@
 +		if (!r)
  			return NULL;
  
--		dma_unmap_single(dev->dma_dev, t->dma_addr,
-+		dma_unmap_single(dev->dma_dev, r->dma_addr,
- 				 SKB_WITH_OVERHEAD(q->buf_size),
- 				 DMA_FROM_DEVICE);
- 		if (flush) {
--			buf = t->ptr;
--			t->dma_addr = 0;
--			t->ptr = NULL;
-+			buf = r->ptr;
-+			r->dma_addr = 0;
-+			r->ptr = NULL;
+-		dma_sync_single_for_cpu(dev->dma_dev, t->dma_addr,
++		dma_sync_single_for_cpu(dev->dma_dev, r->dma_addr,
+ 				SKB_WITH_OVERHEAD(q->buf_size),
+ 				page_pool_get_dma_dir(q->page_pool));
  
--			mt76_put_rxwi(dev, t);
-+			mt76_put_rxwi(dev, r);
- 		} else {
- 			struct mt76_queue_buf qbuf;
- 
-@@ -448,27 +449,27 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 			if (!buf)
- 				return NULL;
- 
--			memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
-+			memcpy(buf, r->ptr, SKB_WITH_OVERHEAD(q->buf_size));
- 
--			t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
-+			r->dma_addr = dma_map_single(dev->dma_dev, r->ptr,
- 						     SKB_WITH_OVERHEAD(q->buf_size),
- 						     DMA_FROM_DEVICE);
--			if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
--				skb_free_frag(t->ptr);
--				mt76_put_rxwi(dev, t);
-+			if (unlikely(dma_mapping_error(dev->dma_dev, r->dma_addr))) {
-+				skb_free_frag(r->ptr);
-+				mt76_put_rxwi(dev, r);
- 				return NULL;
- 			}
+-		buf = t->ptr;
+-		t->dma_addr = 0;
+-		t->ptr = NULL;
++		buf = r->ptr;
++		r->dma_addr = 0;
++		r->ptr = NULL;
  
--			qbuf.addr = t->dma_addr;
-+			qbuf.addr = r->dma_addr;
- 			qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
- 			qbuf.skip_unmap = false;
+-		mt76_put_rxwi(dev, t);
++		mt76_put_rxwi(dev, r);
  
--			if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
--				dma_unmap_single(dev->dma_dev, t->dma_addr,
-+			if (mt76_dma_add_rx_buf(dev, q, &qbuf, r->ptr, r) < 0) {
-+				dma_unmap_single(dev->dma_dev, r->dma_addr,
- 						 SKB_WITH_OVERHEAD(q->buf_size),
- 						 DMA_FROM_DEVICE);
--				skb_free_frag(t->ptr);
--				mt76_put_rxwi(dev, t);
-+				skb_free_frag(r->ptr);
-+				mt76_put_rxwi(dev, r);
- 				return NULL;
- 			}
- 		}
-@@ -539,7 +540,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+ 		if (drop) {
+ 			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
+@@ -510,7 +511,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
  	buf.len = skb->len;
  
  	spin_lock_bh(&q->lock);
@@ -274,7 +233,7 @@
  	mt76_dma_kick_queue(dev, q);
  	spin_unlock_bh(&q->lock);
  
-@@ -616,7 +617,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -587,7 +588,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
  		goto unmap;
  
  	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
@@ -284,10 +243,10 @@
  unmap:
  	for (n--; n > 0; n--)
 diff --git a/mac80211.c b/mac80211.c
-index de9ef237..818f4f0c 100644
+index 35fd0347..95861d47 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -597,7 +597,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -640,7 +640,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	spin_lock_init(&dev->lock);
  	spin_lock_init(&dev->cc_lock);
  	spin_lock_init(&dev->status_lock);
@@ -295,7 +254,7 @@
  	mutex_init(&dev->mutex);
  	init_waitqueue_head(&dev->tx_wait);
  
-@@ -628,6 +627,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -671,6 +670,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	INIT_LIST_HEAD(&dev->txwi_cache);
  	INIT_LIST_HEAD(&dev->rxwi_cache);
  	dev->token_size = dev->drv->token_size;
@@ -304,7 +263,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index b10a16f8..631c4ccd 100644
+index 982d0bbf..a36a978b 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -166,6 +166,7 @@ struct mt76_queue_entry {
@@ -315,7 +274,7 @@
  		struct urb *urb;
  		int buf_sz;
  	};
-@@ -354,10 +355,15 @@ struct mt76_txwi_cache {
+@@ -357,10 +358,15 @@ struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
  
@@ -335,7 +294,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -441,6 +447,7 @@ struct mt76_driver_ops {
+@@ -445,6 +451,7 @@ struct mt76_driver_ops {
  	u16 txwi_size;
  	u16 token_size;
  	u8 mcs_rates;
@@ -343,7 +302,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  
-@@ -809,7 +816,6 @@ struct mt76_dev {
+@@ -815,7 +822,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -351,7 +310,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1400,8 +1406,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1406,8 +1412,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -362,7 +321,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1547,9 +1553,9 @@ struct mt76_txwi_cache *
+@@ -1560,9 +1566,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -371,14 +330,14 @@
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
 -			  struct mt76_txwi_cache *r, dma_addr_t phys);
 +			  struct mt76_rxwi_cache *r, dma_addr_t phys);
- 
- static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
+ int mt76_create_page_pool(struct mt76_dev *dev, struct mt76_queue *q);
+ static inline void mt76_put_page_pool_buf(void *buf, bool allow_direct)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 36260085..9cbd3625 100644
+index 52fabde0..4dd321ee 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -492,7 +492,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -491,7 +491,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
  			dev->mt76.q_rx[MT_RXQ_MAIN].flags =
  				MT_WED_Q_RX(MT7915_RXQ_BAND0);
@@ -386,7 +345,7 @@
  		}
  
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
-@@ -529,7 +528,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -528,7 +527,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
  			dev->mt76.q_rx[MT_RXQ_BAND1].flags =
  				MT_WED_Q_RX(MT7915_RXQ_BAND1);
@@ -395,10 +354,10 @@
  
  		/* rx data queue for band1 */
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 4bc8e8cd..09b39730 100644
+index 890af388..6dec9d60 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -605,18 +605,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -606,16 +606,16 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  	for (i = 0; i < dev->mt76.rx_token_size; i++) {
@@ -411,12 +370,9 @@
 +		if (!r || !r->ptr)
  			continue;
  
--		dma_unmap_single(dev->mt76.dma_dev, t->dma_addr,
-+		dma_unmap_single(dev->mt76.dma_dev, r->dma_addr,
- 				 wed->wlan.rx_size, DMA_FROM_DEVICE);
--		skb_free_frag(t->ptr);
+-		mt76_put_page_pool_buf(t->ptr, false);
 -		t->ptr = NULL;
-+		skb_free_frag(r->ptr);
++		mt76_put_page_pool_buf(r->ptr, false);
 +		r->ptr = NULL;
  
 -		mt76_put_rxwi(&dev->mt76, t);
@@ -424,34 +380,56 @@
  	}
  
  	mt76_free_pending_rxwi(&dev->mt76);
-@@ -641,7 +641,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 				sizeof(struct skb_shared_info));
- 
- 	for (i = 0; i < size; i++) {
--		struct mt76_txwi_cache *t = mt76_get_rxwi(&dev->mt76);
-+		struct mt76_rxwi_cache *r = mt76_get_rxwi(&dev->mt76);
- 		dma_addr_t phy_addr;
+@@ -624,7 +624,7 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ {
+ 	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
+-	struct mt76_txwi_cache *t = NULL;
++	struct mt76_rxwi_cache *r = NULL;
+ 	struct mt7915_dev *dev;
+ 	struct mt76_queue *q;
+ 	int i, len;
+@@ -640,8 +640,8 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  		int token;
- 		void *ptr;
-@@ -660,7 +660,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 		}
+ 		void *buf;
  
- 		desc->buf0 = cpu_to_le32(phy_addr);
--		token = mt76_rx_token_consume(&dev->mt76, ptr, t, phy_addr);
-+		token = mt76_rx_token_consume(&dev->mt76, ptr, r, phy_addr);
+-		t = mt76_get_rxwi(&dev->mt76);
+-		if (!t)
++		r = mt76_get_rxwi(&dev->mt76);
++		if (!r)
+ 			goto unmap;
+ 
+ 		buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
+@@ -653,7 +653,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 		dma_sync_single_for_device(dev->mt76.dma_dev, addr, len, dir);
+ 
+ 		desc->buf0 = cpu_to_le32(addr);
+-		token = mt76_rx_token_consume(&dev->mt76, buf, t, addr);
++		token = mt76_rx_token_consume(&dev->mt76, buf, r, addr);
  		if (token < 0) {
- 			dma_unmap_single(dev->mt76.dma_dev, phy_addr,
- 					 wed->wlan.rx_size, DMA_TO_DEVICE);
-@@ -788,7 +788,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
- 	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
+ 			mt76_put_page_pool_buf(buf, false);
+ 			goto unmap;
+@@ -667,8 +667,8 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 	return 0;
+ 
+ unmap:
+-	if (t)
+-		mt76_put_rxwi(&dev->mt76, t);
++	if (r)
++		mt76_put_rxwi(&dev->mt76, r);
+ 	mt7915_mmio_wed_release_rx_buf(wed);
+ 	return -ENOMEM;
+ }
+@@ -818,7 +818,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 	wed->wlan.reset = mt7915_mmio_wed_reset;
+ 	wed->wlan.reset_complete = mt7915_mmio_wed_reset_complete;
  
 -	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
 +	dev->mt76.rx_token_size += wed->wlan.rx_npkt;
  
  	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -994,6 +994,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -1024,6 +1024,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  				SURVEY_INFO_TIME_RX |
  				SURVEY_INFO_TIME_BSS_RX,
  		.token_size = MT7915_TOKEN_SIZE,
@@ -460,13 +438,13 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c3a0b326..91b98ede 100644
+index a1ef8359..594dfcd5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -57,6 +57,7 @@
  #define MT7915_EEPROM_BLOCK_SIZE	16
+ #define MT7915_HW_TOKEN_SIZE		4096
  #define MT7915_TOKEN_SIZE		8192
- #define MT7915_HW_TOKEN_SIZE		7168
 +#define MT7915_RX_TOKEN_SIZE		4096
  
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
diff --git a/recipes-wifi/linux-mt76/files/patches/3013-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches/3013-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch
rename to recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch
index 6c8e2ee..d672e1b 100644
--- a/recipes-wifi/linux-mt76/files/patches/3013-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch
@@ -1,7 +1,7 @@
-From 7786c799b9c6dfc3d09079e65e896467a62724c7 Mon Sep 17 00:00:00 2001
+From 8084e069b66a729e756e8bf4d8b283043990aa44 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 27 Dec 2022 09:45:14 +0800
-Subject: [PATCH 3013/3014] mt76: mt7915: add mt7915_net_setup_tc to support
+Subject: [PATCH 3009/3010] mt76: mt7915: add mt7915_net_setup_tc to support
  wifi2wifi offload
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 16 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c87f04b..c281b47 100644
+index a9980e70..8ebea612 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1598,6 +1598,21 @@ mt7915_net_fill_receive_path(struct ieee80211_hw *hw,
+@@ -1604,6 +1604,21 @@ mt7915_net_fill_receive_path(struct ieee80211_hw *hw,
  	return 0;
  }
  
@@ -35,7 +35,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1651,5 +1666,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1657,5 +1672,6 @@ const struct ieee80211_ops mt7915_ops = {
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
  	.net_fill_receive_path = mt7915_net_fill_receive_path,
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch b/recipes-wifi/linux-mt76/files/patches/3010-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch
new file mode 100644
index 0000000..9bce03a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3010-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch
@@ -0,0 +1,839 @@
+From 27b1ad3b825b3208c599330f944fc11c120f3d2e Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Thu, 5 Jan 2023 16:43:57 +0800
+Subject: [PATCH 3010/3010] mt76: connac: wed: add wed rx copy skb and revert
+ page_pool
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c         | 138 ++++++++++++++++++++++++++++++++------------------
+ mac80211.c    |  57 ---------------------
+ mt76.h        |  22 +-------
+ mt7915/main.c |  26 ++++------
+ mt7915/mmio.c |  77 ++++++++++++++++++++--------
+ mt7921/main.c |  31 ++----------
+ usb.c         |  42 +++++++--------
+ 7 files changed, 183 insertions(+), 210 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index 76af6506..79da538c 100644
+--- a/dma.c
++++ b/dma.c
+@@ -173,7 +173,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
+ 	local_bh_disable();
+ 	while ((r = __mt76_get_rxwi(dev)) != NULL) {
+ 		if (r->ptr)
+-			mt76_put_page_pool_buf(r->ptr, false);
++			skb_free_frag(r->ptr);
+ 		kfree(r);
+ 	}
+ 	local_bh_enable();
+@@ -208,11 +208,11 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
+ 
+ static int
+ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+-		    struct mt76_queue_buf *buf, void *data)
++		    struct mt76_queue_buf *buf, void *data,
++		    struct mt76_rxwi_cache *rxwi)
+ {
+ 	struct mt76_desc *desc = &q->desc[q->head];
+ 	struct mt76_queue_entry *entry = &q->entry[q->head];
+-	struct mt76_rxwi_cache *rxwi = NULL;
+ 	u32 buf1 = 0, ctrl;
+ 	int idx = q->head;
+ 	int rx_token;
+@@ -220,9 +220,11 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ 	ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
+ 
+ 	if (mt76_queue_is_wed_rx(q)) {
+-		rxwi = mt76_get_rxwi(dev);
+-		if (!rxwi)
+-			return -ENOMEM;
++		if (!rxwi) {
++			rxwi = mt76_get_rxwi(dev);
++			if (!rxwi)
++				return -ENOMEM;
++		}
+ 
+ 		rx_token = mt76_rx_token_consume(dev, data, rxwi, buf->addr);
+ 		if (rx_token < 0) {
+@@ -387,7 +389,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
+ 
+ static void *
+ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+-		 int *len, u32 *info, bool *more, bool *drop)
++		 int *len, u32 *info, bool *more, bool *drop, bool flush)
+ {
+ 	struct mt76_queue_entry *e = &q->entry[idx];
+ 	struct mt76_desc *desc = &q->desc[idx];
+@@ -435,15 +437,47 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 		if (!r)
+ 			return NULL;
+ 
+-		dma_sync_single_for_cpu(dev->dma_dev, r->dma_addr,
+-				SKB_WITH_OVERHEAD(q->buf_size),
+-				page_pool_get_dma_dir(q->page_pool));
++		dma_unmap_single(dev->dma_dev, r->dma_addr,
++				 SKB_WITH_OVERHEAD(q->buf_size),
++				 DMA_FROM_DEVICE);
+ 
+-		buf = r->ptr;
+-		r->dma_addr = 0;
+-		r->ptr = NULL;
++		if (flush) {
++			buf = r->ptr;
++			r->dma_addr = 0;
++			r->ptr = NULL;
+ 
+-		mt76_put_rxwi(dev, r);
++			mt76_put_rxwi(dev, r);
++		} else {
++			struct mt76_queue_buf qbuf;
++
++			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
++			if (!buf)
++				return NULL;
++
++			memcpy(buf, r->ptr, SKB_WITH_OVERHEAD(q->buf_size));
++
++			r->dma_addr = dma_map_single(dev->dma_dev, r->ptr,
++						     SKB_WITH_OVERHEAD(q->buf_size),
++						     DMA_FROM_DEVICE);
++			if (unlikely(dma_mapping_error(dev->dma_dev, r->dma_addr))) {
++				skb_free_frag(r->ptr);
++				mt76_put_rxwi(dev, r);
++				return NULL;
++			}
++
++			qbuf.addr = r->dma_addr;
++			qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
++			qbuf.skip_unmap = false;
++
++			if (mt76_dma_add_rx_buf(dev, q, &qbuf, r->ptr, r) < 0) {
++				dma_unmap_single(dev->dma_dev, r->dma_addr,
++						 SKB_WITH_OVERHEAD(q->buf_size),
++						 DMA_FROM_DEVICE);
++				skb_free_frag(r->ptr);
++				mt76_put_rxwi(dev, r);
++				return NULL;
++			}
++		}
+ 
+ 		if (drop) {
+ 			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
+@@ -463,9 +497,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 	} else {
+ 		buf = e->buf;
+ 		e->buf = NULL;
+-		dma_sync_single_for_cpu(dev->dma_dev, e->dma_addr[0],
+-				SKB_WITH_OVERHEAD(q->buf_size),
+-				page_pool_get_dma_dir(q->page_pool));
++		dma_unmap_single(dev->dma_dev, e->dma_addr[0],
++				 SKB_WITH_OVERHEAD(q->buf_size),
++				 DMA_FROM_DEVICE);
+ 	}
+ 
+ 	return buf;
+@@ -489,7 +523,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+ 	q->tail = (q->tail + 1) % q->ndesc;
+ 	q->queued--;
+ 
+-	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
++	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop, flush);
+ }
+ 
+ static int
+@@ -616,11 +650,12 @@ free_skb:
+ }
+ 
+ static int
+-mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+-		 bool allow_direct)
++mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ {
+ 	int len = SKB_WITH_OVERHEAD(q->buf_size);
+-	int frames = 0;
++	int frames = 0, offset = q->buf_offset;
++	dma_addr_t addr;
++	bool flags = false;
+ 
+ 	if (!q->ndesc)
+ 		return 0;
+@@ -628,31 +663,35 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+ 	spin_lock_bh(&q->lock);
+ 
+ 	while (q->queued < q->ndesc - 1) {
+-		enum dma_data_direction dir;
+ 		struct mt76_queue_buf qbuf;
+-		dma_addr_t addr;
+-		int offset;
+-		void *buf;
++		void *buf = NULL;
+ 
+-		buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
++		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
+ 		if (!buf)
+ 			break;
+ 
+-		addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
+-		dir = page_pool_get_dma_dir(q->page_pool);
+-		dma_sync_single_for_device(dev->dma_dev, addr, len, dir);
++		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
++		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
++			skb_free_frag(buf);
++			break;
++		}
+ 
+-		qbuf.addr = addr + q->buf_offset;
+-		qbuf.len = len - q->buf_offset;
++		qbuf.addr = addr + offset;
++		qbuf.len = len - offset;
+ 		qbuf.skip_unmap = false;
+-		if (mt76_dma_add_rx_buf(dev, q, &qbuf, buf) < 0) {
+-			mt76_put_page_pool_buf(buf, allow_direct);
++		if (mt76_dma_add_rx_buf(dev, q, &qbuf, buf, NULL) < 0) {
++			dma_unmap_single(dev->dma_dev, addr, len,
++					 DMA_FROM_DEVICE);
++			skb_free_frag(buf);
+ 			break;
+ 		}
+ 		frames++;
+ 	}
+ 
+-	if (frames)
++	flags = (q->flags & MT_QFLAG_WED) &&
++		FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX;
++
++	if (frames || flags)
+ 		mt76_dma_kick_queue(dev, q);
+ 
+ 	spin_unlock_bh(&q->lock);
+@@ -690,7 +729,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+ 		/* WED txfree queue needs ring to be initialized before setup */
+ 		q->flags = 0;
+ 		mt76_dma_queue_reset(dev, q);
+-		mt76_dma_rx_fill(dev, q, false);
++		mt76_dma_rx_fill(dev, q);
+ 		q->flags = flags;
+ 
+ 		ret = mtk_wed_device_txfree_ring_setup(wed, q->regs);
+@@ -738,10 +777,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+ 	if (!q->entry)
+ 		return -ENOMEM;
+ 
+-	ret = mt76_create_page_pool(dev, q);
+-	if (ret)
+-		return ret;
+-
+ 	ret = mt76_dma_wed_setup(dev, q, false);
+ 	if (ret)
+ 		return ret;
+@@ -755,6 +790,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+ static void
+ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ {
++	struct page *page;
+ 	void *buf;
+ 	bool more;
+ 
+@@ -768,7 +804,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ 		if (!buf)
+ 			break;
+ 
+-		mt76_put_page_pool_buf(buf, false);
++		skb_free_frag(buf);
+ 	} while (1);
+ 
+ 	if (q->rx_head) {
+@@ -777,6 +813,15 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ 	}
+ 
+ 	spin_unlock_bh(&q->lock);
++
++	if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) != MT76_WED_Q_RX) {
++		if (!q->rx_page.va)
++			return;
++
++		page = virt_to_page(q->rx_page.va);
++		__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++		memset(&q->rx_page, 0, sizeof(q->rx_page));
++	}
+ }
+ 
+ static void
+@@ -797,7 +842,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+ 	mt76_dma_wed_setup(dev, q, true);
+ 	if (q->flags != MT_WED_Q_TXFREE) {
+ 		mt76_dma_sync_idx(dev, q);
+-		mt76_dma_rx_fill(dev, q, false);
++		mt76_dma_rx_fill(dev, q);
+ 	}
+ }
+ 
+@@ -815,7 +860,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+ 
+ 		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
+ 	} else {
+-		mt76_put_page_pool_buf(data, true);
++		skb_free_frag(data);
+ 	}
+ 
+ 	if (more)
+@@ -888,7 +933,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 			goto free_frag;
+ 
+ 		skb_reserve(skb, q->buf_offset);
+-		skb_mark_for_recycle(skb);
+ 
+ 		*(u32 *)skb->cb = info;
+ 
+@@ -904,10 +948,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 		continue;
+ 
+ free_frag:
+-		mt76_put_page_pool_buf(data, true);
++		skb_free_frag(data);
+ 	}
+ 
+-	mt76_dma_rx_fill(dev, q, true);
++	mt76_dma_rx_fill(dev, q);
+ 	return done;
+ }
+ 
+@@ -952,7 +996,7 @@ mt76_dma_init(struct mt76_dev *dev,
+ 
+ 	mt76_for_each_q_rx(dev, i) {
+ 		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
+-		mt76_dma_rx_fill(dev, &dev->q_rx[i], false);
++		mt76_dma_rx_fill(dev, &dev->q_rx[i]);
+ 		napi_enable(&dev->napi[i]);
+ 	}
+ 
+@@ -1003,8 +1047,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+ 
+ 		netif_napi_del(&dev->napi[i]);
+ 		mt76_dma_rx_cleanup(dev, q);
+-
+-		page_pool_destroy(q->page_pool);
+ 	}
+ 
+ 	mt76_free_pending_txwi(dev);
+diff --git a/mac80211.c b/mac80211.c
+index 95861d47..90447472 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -4,7 +4,6 @@
+  */
+ #include <linux/sched.h>
+ #include <linux/of.h>
+-#include <net/page_pool.h>
+ #include "mt76.h"
+ 
+ #define CHAN2G(_idx, _freq) {			\
+@@ -569,47 +568,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
+ }
+ EXPORT_SYMBOL_GPL(mt76_unregister_phy);
+ 
+-int mt76_create_page_pool(struct mt76_dev *dev, struct mt76_queue *q)
+-{
+-	struct page_pool_params pp_params = {
+-		.order = 0,
+-		.flags = PP_FLAG_PAGE_FRAG,
+-		.nid = NUMA_NO_NODE,
+-		.dev = dev->dma_dev,
+-	};
+-	int idx = q - dev->q_rx;
+-
+-	switch (idx) {
+-	case MT_RXQ_MAIN:
+-	case MT_RXQ_BAND1:
+-	case MT_RXQ_BAND2:
+-		pp_params.pool_size = 256;
+-		break;
+-	default:
+-		pp_params.pool_size = 16;
+-		break;
+-	}
+-
+-	if (mt76_is_mmio(dev)) {
+-		/* rely on page_pool for DMA mapping */
+-		pp_params.flags |= PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV;
+-		pp_params.dma_dir = DMA_FROM_DEVICE;
+-		pp_params.max_len = PAGE_SIZE;
+-		pp_params.offset = 0;
+-	}
+-
+-	q->page_pool = page_pool_create(&pp_params);
+-	if (IS_ERR(q->page_pool)) {
+-		int err = PTR_ERR(q->page_pool);
+-
+-		q->page_pool = NULL;
+-		return err;
+-	}
+-
+-	return 0;
+-}
+-EXPORT_SYMBOL_GPL(mt76_create_page_pool);
+-
+ struct mt76_dev *
+ mt76_alloc_device(struct device *pdev, unsigned int size,
+ 		  const struct ieee80211_ops *ops,
+@@ -1745,21 +1703,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+ }
+ EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
+ 
+-void mt76_ethtool_page_pool_stats(struct mt76_dev *dev, u64 *data, int *index)
+-{
+-#ifdef CONFIG_PAGE_POOL_STATS
+-	struct page_pool_stats stats = {};
+-	int i;
+-
+-	mt76_for_each_q_rx(dev, i)
+-		page_pool_get_stats(dev->q_rx[i].page_pool, &stats);
+-
+-	page_pool_ethtool_stats_get(data, &stats);
+-	*index += page_pool_ethtool_stats_get_count();
+-#endif
+-}
+-EXPORT_SYMBOL_GPL(mt76_ethtool_page_pool_stats);
+-
+ enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
+ {
+ 	struct ieee80211_hw *hw = phy->hw;
+diff --git a/mt76.h b/mt76.h
+index a36a978b..3911d013 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -210,7 +210,7 @@ struct mt76_queue {
+ 
+ 	dma_addr_t desc_dma;
+ 	struct sk_buff *rx_head;
+-	struct page_pool *page_pool;
++	struct page_frag_cache rx_page;
+ };
+ 
+ struct mt76_mcu_ops {
+@@ -1457,7 +1457,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+ 	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
+ }
+ 
+-void mt76_ethtool_page_pool_stats(struct mt76_dev *dev, u64 *data, int *index);
+ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+ 			 struct mt76_sta_stats *stats, bool eht);
+ int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
+@@ -1569,25 +1568,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+ struct mt76_rxwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
+ int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
+ 			  struct mt76_rxwi_cache *r, dma_addr_t phys);
+-int mt76_create_page_pool(struct mt76_dev *dev, struct mt76_queue *q);
+-static inline void mt76_put_page_pool_buf(void *buf, bool allow_direct)
+-{
+-	struct page *page = virt_to_head_page(buf);
+-
+-	page_pool_put_full_page(page->pp, page, allow_direct);
+-}
+-
+-static inline void *
+-mt76_get_page_pool_buf(struct mt76_queue *q, u32 *offset, u32 size)
+-{
+-	struct page *page;
+-
+-	page = page_pool_dev_alloc_frag(q->page_pool, offset, size);
+-	if (!page)
+-		return NULL;
+-
+-	return page_address(page) + *offset;
+-}
+ 
+ static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
+ {
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 8ebea612..5307e15d 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1357,22 +1357,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+ 			   struct ieee80211_vif *vif,
+ 			   u32 sset, u8 *data)
+ {
+-	if (sset != ETH_SS_STATS)
+-		return;
+-
+-	memcpy(data, *mt7915_gstrings_stats, sizeof(mt7915_gstrings_stats));
+-	data += sizeof(mt7915_gstrings_stats);
+-	page_pool_ethtool_stats_get_strings(data);
++	if (sset == ETH_SS_STATS)
++		memcpy(data, *mt7915_gstrings_stats,
++		       sizeof(mt7915_gstrings_stats));
+ }
+ 
+ static
+ int mt7915_get_et_sset_count(struct ieee80211_hw *hw,
+ 			     struct ieee80211_vif *vif, int sset)
+ {
+-	if (sset != ETH_SS_STATS)
+-		return 0;
++	if (sset == ETH_SS_STATS)
++		return MT7915_SSTATS_LEN;
+ 
+-	return MT7915_SSTATS_LEN + page_pool_ethtool_stats_get_count();
++	return 0;
+ }
+ 
+ static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+@@ -1400,7 +1397,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+ 	};
+ 	struct mib_stats *mib = &phy->mib;
+ 	/* See mt7915_ampdu_stat_read_phy, etc */
+-	int i, ei = 0, stats_size;
++	int i, ei = 0;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
+@@ -1481,12 +1478,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+ 		return;
+ 
+ 	ei += wi.worker_stat_count;
+-
+-	mt76_ethtool_page_pool_stats(&dev->mt76, &data[ei], &ei);
+-
+-	stats_size = MT7915_SSTATS_LEN + page_pool_ethtool_stats_get_count();
+-	if (ei != stats_size)
+-		dev_err(dev->mt76.dev, "ei: %d size: %d", ei, stats_size);
++	if (ei != MT7915_SSTATS_LEN)
++		dev_err(dev->mt76.dev, "ei: %d  MT7915_SSTATS_LEN: %d",
++			ei, (int)MT7915_SSTATS_LEN);
+ }
+ 
+ static void
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 6dec9d60..6b9752b2 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -602,9 +602,14 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+ {
+ 	struct mt7915_dev *dev;
++	struct page *page;
++	u32 length;
+ 	int i;
+ 
+ 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
++	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
++				sizeof(struct skb_shared_info));
++
+ 	for (i = 0; i < dev->mt76.rx_token_size; i++) {
+ 		struct mt76_rxwi_cache *r;
+ 
+@@ -612,50 +617,82 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+ 		if (!r || !r->ptr)
+ 			continue;
+ 
+-		mt76_put_page_pool_buf(r->ptr, false);
++		dma_unmap_single(dev->mt76.dma_dev, r->dma_addr,
++				 wed->wlan.rx_size, DMA_FROM_DEVICE);
++		__free_pages(virt_to_page(r->ptr), get_order(length));
+ 		r->ptr = NULL;
+ 
+ 		mt76_put_rxwi(&dev->mt76, r);
+ 	}
+ 
+ 	mt76_free_pending_rxwi(&dev->mt76);
++
++	mt76_for_each_q_rx(&dev->mt76, i) {
++		if (FIELD_GET(MT_QFLAG_WED_TYPE,
++			      dev->mt76.q_rx[i].flags) == MT76_WED_Q_RX) {
++			struct mt76_queue *q = &dev->mt76.q_rx[i];
++
++			if (!q->rx_page.va)
++				continue;
++
++			page = virt_to_page(q->rx_page.va);
++			__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++			memset(&q->rx_page, 0, sizeof(q->rx_page));
++		}
++	}
++
++	if (!wed->rx_buf_ring.rx_page.va)
++		return;
++
++	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
++	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
++	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
+ }
+ 
+ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ {
+ 	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
+-	struct mt76_rxwi_cache *r = NULL;
+ 	struct mt7915_dev *dev;
+-	struct mt76_queue *q;
+-	int i, len;
++	u32 length;
++	int i;
+ 
+ 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
+-	q = &dev->mt76.q_rx[MT_RXQ_MAIN];
+-	len = SKB_WITH_OVERHEAD(q->buf_size);
++	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
++				sizeof(struct skb_shared_info));
+ 
+ 	for (i = 0; i < size; i++) {
+-		enum dma_data_direction dir;
+-		dma_addr_t addr;
+-		u32 offset;
++		struct mt76_rxwi_cache *r = mt76_get_rxwi(&dev->mt76);
++		dma_addr_t phy_addr;
++		struct page *page;
+ 		int token;
+-		void *buf;
++		void *ptr;
+ 
+-		r = mt76_get_rxwi(&dev->mt76);
+ 		if (!r)
+ 			goto unmap;
+ 
+-		buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
+-		if (!buf)
++		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
++		if (!page) {
++			mt76_put_rxwi(&dev->mt76, r);
+ 			goto unmap;
++		}
+ 
+-		addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
+-		dir = page_pool_get_dma_dir(q->page_pool);
+-		dma_sync_single_for_device(dev->mt76.dma_dev, addr, len, dir);
+ 
+-		desc->buf0 = cpu_to_le32(addr);
+-		token = mt76_rx_token_consume(&dev->mt76, buf, r, addr);
++		ptr = page_address(page);
++		phy_addr = dma_map_single(dev->mt76.dma_dev, ptr,
++					wed->wlan.rx_size,
++					DMA_TO_DEVICE);
++		if (unlikely(dma_mapping_error(dev->mt76.dev, phy_addr))) {
++			__free_pages(page, get_order(length));
++			mt76_put_rxwi(&dev->mt76, r);
++			goto unmap;
++		}
++		desc->buf0 = cpu_to_le32(phy_addr);
++		token = mt76_rx_token_consume(&dev->mt76, ptr, r, phy_addr);
+ 		if (token < 0) {
+-			mt76_put_page_pool_buf(buf, false);
++			dma_unmap_single(dev->mt76.dma_dev, phy_addr,
++					 wed->wlan.rx_size, DMA_TO_DEVICE);
++			__free_pages(page, get_order(length));
++			mt76_put_rxwi(&dev->mt76, r);
+ 			goto unmap;
+ 		}
+ 
+@@ -667,8 +704,6 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 	return 0;
+ 
+ unmap:
+-	if (r)
+-		mt76_put_rxwi(&dev->mt76, r);
+ 	mt7915_mmio_wed_release_rx_buf(wed);
+ 	return -ENOMEM;
+ }
+diff --git a/mt7921/main.c b/mt7921/main.c
+index 75eaf86c..1434ca79 100644
+--- a/mt7921/main.c
++++ b/mt7921/main.c
+@@ -1090,34 +1090,17 @@ static void
+ mt7921_get_et_strings(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      u32 sset, u8 *data)
+ {
+-	struct mt7921_dev *dev = mt7921_hw_dev(hw);
+-
+ 	if (sset != ETH_SS_STATS)
+ 		return;
+ 
+ 	memcpy(data, *mt7921_gstrings_stats, sizeof(mt7921_gstrings_stats));
+-
+-	if (mt76_is_sdio(&dev->mt76))
+-		return;
+-
+-	data += sizeof(mt7921_gstrings_stats);
+-	page_pool_ethtool_stats_get_strings(data);
+ }
+ 
+ static int
+ mt7921_get_et_sset_count(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			 int sset)
+ {
+-	struct mt7921_dev *dev = mt7921_hw_dev(hw);
+-
+-	if (sset != ETH_SS_STATS)
+-		return 0;
+-
+-	if (mt76_is_sdio(&dev->mt76))
+-		return ARRAY_SIZE(mt7921_gstrings_stats);
+-
+-	return ARRAY_SIZE(mt7921_gstrings_stats) +
+-	       page_pool_ethtool_stats_get_count();
++	return sset == ETH_SS_STATS ? ARRAY_SIZE(mt7921_gstrings_stats) : 0;
+ }
+ 
+ static void
+@@ -1137,7 +1120,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			 struct ethtool_stats *stats, u64 *data)
+ {
+ 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
+-	int stats_size = ARRAY_SIZE(mt7921_gstrings_stats);
+ 	struct mt7921_phy *phy = mt7921_hw_phy(hw);
+ 	struct mt7921_dev *dev = phy->dev;
+ 	struct mib_stats *mib = &phy->mib;
+@@ -1193,14 +1175,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		return;
+ 
+ 	ei += wi.worker_stat_count;
+-
+-	if (!mt76_is_sdio(&dev->mt76)) {
+-		mt76_ethtool_page_pool_stats(&dev->mt76, &data[ei], &ei);
+-		stats_size += page_pool_ethtool_stats_get_count();
+-	}
+-
+-	if (ei != stats_size)
+-		dev_err(dev->mt76.dev, "ei: %d  SSTATS_LEN: %d", ei, stats_size);
++	if (ei != ARRAY_SIZE(mt7921_gstrings_stats))
++		dev_err(dev->mt76.dev, "ei: %d  SSTATS_LEN: %zu",
++			ei, ARRAY_SIZE(mt7921_gstrings_stats));
+ }
+ 
+ static u64
+diff --git a/usb.c b/usb.c
+index b88959ef..3e281715 100644
+--- a/usb.c
++++ b/usb.c
+@@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
+ 
+ static int
+ mt76u_fill_rx_sg(struct mt76_dev *dev, struct mt76_queue *q, struct urb *urb,
+-		 int nsgs)
++		 int nsgs, gfp_t gfp)
+ {
+ 	int i;
+ 
+ 	for (i = 0; i < nsgs; i++) {
++		struct page *page;
+ 		void *data;
+ 		int offset;
+ 
+-		data = mt76_get_page_pool_buf(q, &offset, q->buf_size);
++		data = page_frag_alloc(&q->rx_page, q->buf_size, gfp);
+ 		if (!data)
+ 			break;
+ 
+-		sg_set_page(&urb->sg[i], virt_to_head_page(data), q->buf_size,
+-			    offset);
++		page = virt_to_head_page(data);
++		offset = data - page_address(page);
++		sg_set_page(&urb->sg[i], page, q->buf_size, offset);
+ 	}
+ 
+ 	if (i < nsgs) {
+ 		int j;
+ 
+ 		for (j = nsgs; j < urb->num_sgs; j++)
+-			mt76_put_page_pool_buf(sg_virt(&urb->sg[j]), false);
++			skb_free_frag(sg_virt(&urb->sg[j]));
+ 		urb->num_sgs = i;
+ 	}
+ 
+@@ -352,16 +354,15 @@ mt76u_fill_rx_sg(struct mt76_dev *dev, struct mt76_queue *q, struct urb *urb,
+ 
+ static int
+ mt76u_refill_rx(struct mt76_dev *dev, struct mt76_queue *q,
+-		struct urb *urb, int nsgs)
++		struct urb *urb, int nsgs, gfp_t gfp)
+ {
+ 	enum mt76_rxq_id qid = q - &dev->q_rx[MT_RXQ_MAIN];
+-	int offset;
+ 
+ 	if (qid == MT_RXQ_MAIN && dev->usb.sg_en)
+-		return mt76u_fill_rx_sg(dev, q, urb, nsgs);
++		return mt76u_fill_rx_sg(dev, q, urb, nsgs, gfp);
+ 
+ 	urb->transfer_buffer_length = q->buf_size;
+-	urb->transfer_buffer = mt76_get_page_pool_buf(q, &offset, q->buf_size);
++	urb->transfer_buffer = page_frag_alloc(&q->rx_page, q->buf_size, gfp);
+ 
+ 	return urb->transfer_buffer ? 0 : -ENOMEM;
+ }
+@@ -399,7 +400,7 @@ mt76u_rx_urb_alloc(struct mt76_dev *dev, struct mt76_queue *q,
+ 	if (err)
+ 		return err;
+ 
+-	return mt76u_refill_rx(dev, q, e->urb, sg_size);
++	return mt76u_refill_rx(dev, q, e->urb, sg_size, GFP_KERNEL);
+ }
+ 
+ static void mt76u_urb_free(struct urb *urb)
+@@ -407,10 +408,10 @@ static void mt76u_urb_free(struct urb *urb)
+ 	int i;
+ 
+ 	for (i = 0; i < urb->num_sgs; i++)
+-		mt76_put_page_pool_buf(sg_virt(&urb->sg[i]), false);
++		skb_free_frag(sg_virt(&urb->sg[i]));
+ 
+ 	if (urb->transfer_buffer)
+-		mt76_put_page_pool_buf(urb->transfer_buffer, false);
++		skb_free_frag(urb->transfer_buffer);
+ 
+ 	usb_free_urb(urb);
+ }
+@@ -546,8 +547,6 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb,
+ 		len -= data_len;
+ 		nsgs++;
+ 	}
+-
+-	skb_mark_for_recycle(skb);
+ 	dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb, NULL);
+ 
+ 	return nsgs;
+@@ -613,7 +612,7 @@ mt76u_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ 
+ 		count = mt76u_process_rx_entry(dev, urb, q->buf_size);
+ 		if (count > 0) {
+-			err = mt76u_refill_rx(dev, q, urb, count);
++			err = mt76u_refill_rx(dev, q, urb, count, GFP_ATOMIC);
+ 			if (err < 0)
+ 				break;
+ 		}
+@@ -664,10 +663,6 @@ mt76u_alloc_rx_queue(struct mt76_dev *dev, enum mt76_rxq_id qid)
+ 	struct mt76_queue *q = &dev->q_rx[qid];
+ 	int i, err;
+ 
+-	err = mt76_create_page_pool(dev, q);
+-	if (err)
+-		return err;
+-
+ 	spin_lock_init(&q->lock);
+ 	q->entry = devm_kcalloc(dev->dev,
+ 				MT_NUM_RX_ENTRIES, sizeof(*q->entry),
+@@ -696,6 +691,7 @@ EXPORT_SYMBOL_GPL(mt76u_alloc_mcu_queue);
+ static void
+ mt76u_free_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ {
++	struct page *page;
+ 	int i;
+ 
+ 	for (i = 0; i < q->ndesc; i++) {
+@@ -705,7 +701,13 @@ mt76u_free_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
+ 		mt76u_urb_free(q->entry[i].urb);
+ 		q->entry[i].urb = NULL;
+ 	}
+-	page_pool_destroy(q->page_pool);
++
++	if (!q->rx_page.va)
++		return;
++
++	page = virt_to_page(q->rx_page.va);
++	__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++	memset(&q->rx_page, 0, sizeof(q->rx_page));
+ }
+ 
+ static void mt76u_free_rx(struct mt76_dev *dev)
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch b/recipes-wifi/linux-mt76/files/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch
deleted file mode 100644
index 840f878..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 5f7175246f6a734b63ecd336f1b3ad0bc4f37048 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 6 Jan 2023 18:25:51 +0800
-Subject: [PATCH 3012/3014] mt76: mt7915: wed: fix potential memory leakage
-
-release rx queue pages in mt7915_mmio_wed_release_rx_buf.
-recycle rxwi when mt76_dma_add_buf() call fails.
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- dma.c         | 12 +++++++-----
- mt7915/mmio.c | 15 +++++++++++++++
- 2 files changed, 22 insertions(+), 5 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 21f26df7..cb1fd9c6 100644
---- a/dma.c
-+++ b/dma.c
-@@ -803,12 +803,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
- 	} while (1);
- 	spin_unlock_bh(&q->lock);
- 
--	if (!q->rx_page.va)
--		return;
-+	if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) != MT76_WED_Q_RX) {
-+		if (!q->rx_page.va)
-+			return;
- 
--	page = virt_to_page(q->rx_page.va);
--	__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
--	memset(&q->rx_page, 0, sizeof(q->rx_page));
-+		page = virt_to_page(q->rx_page.va);
-+		__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
-+		memset(&q->rx_page, 0, sizeof(q->rx_page));
-+	}
- }
- 
- static void
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 09b39730..419338cc 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -621,12 +621,27 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- 
- 	mt76_free_pending_rxwi(&dev->mt76);
- 
-+	mt76_for_each_q_rx(&dev->mt76, i) {
-+		if (FIELD_GET(MT_QFLAG_WED_TYPE,
-+			      dev->mt76.q_rx[i].flags) == MT76_WED_Q_RX) {
-+			struct mt76_queue *q = &dev->mt76.q_rx[i];
-+
-+			if (!q->rx_page.va)
-+				continue;
-+
-+			page = virt_to_page(q->rx_page.va);
-+			__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
-+			memset(&q->rx_page, 0, sizeof(q->rx_page));
-+		}
-+	}
-+
- 	if (!wed->rx_buf_ring.rx_page.va)
- 		return;
- 
- 	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
- 	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
- 	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
-+
- }
- 
- static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3014-mt76-mt7915-drop-the-wrong-judgment-condition-to-sup.patch b/recipes-wifi/linux-mt76/files/patches/3014-mt76-mt7915-drop-the-wrong-judgment-condition-to-sup.patch
deleted file mode 100644
index aced902..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3014-mt76-mt7915-drop-the-wrong-judgment-condition-to-sup.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 47277f4e21c57fb04aa0d31c24a50a5a42ec8d78 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 6 Jan 2023 18:29:08 +0800
-Subject: [PATCH 3014/3014] mt76: mt7915: drop the wrong judgment condition to
- support ppdu txs
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- mt7915/mac.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0d0ae7ab..41c117f3 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -1126,9 +1126,6 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
- 	u16 wcidx;
- 	u8 pid;
- 
--	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
--		return;
--
- 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
- 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/4001-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches/4001-mt76-revert-get_of_mac_addr.patch
index 5fcce4a..6aba23f 100644
--- a/recipes-wifi/linux-mt76/files/patches/4001-mt76-revert-get_of_mac_addr.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4001-mt76-revert-get_of_mac_addr.patch
@@ -1,14 +1,14 @@
-From 1b370c429b7193202f6b3df50bd72500b4ec4581 Mon Sep 17 00:00:00 2001
+From d5719b44dcc2f6ef728a63f523dbbe9f089a2eaf Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:51:46 +0800
-Subject: [PATCH 4001/4003] mt76: revert get_of_mac_addr
+Subject: [PATCH 4001/4006] mt76: revert get_of_mac_addr
 
 ---
  eeprom.c | 8 +++++++-
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index d161264..1f29cf9 100644
+index d1612641..1f29cf99 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -128,9 +128,15 @@ void
@@ -29,5 +29,5 @@
  	if (!is_valid_ether_addr(phy->macaddr)) {
  		eth_random_addr(phy->macaddr);
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/4002-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches/4002-mt76-include-header-files-for-module-param.patch
index 096a54f..d1611f9 100644
--- a/recipes-wifi/linux-mt76/files/patches/4002-mt76-include-header-files-for-module-param.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4002-mt76-include-header-files-for-module-param.patch
@@ -1,7 +1,7 @@
-From c38e6c0b746781a43faa8a7391f45f8f1110117d Mon Sep 17 00:00:00 2001
+From 83be679b14eb071b0eb1cedac9d004901322b2f3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:38:13 +0800
-Subject: [PATCH 4002/4003] mt76: include header files for module param
+Subject: [PATCH 4002/4006] mt76: include header files for module param
 
 ---
  mcu.c             | 1 +
@@ -11,7 +11,7 @@
  4 files changed, 4 insertions(+)
 
 diff --git a/mcu.c b/mcu.c
-index a8cafa3..fa4b054 100644
+index a8cafa39..fa4b0544 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -23,7 +23,7 @@
  struct sk_buff *
  __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index 83f3030..e917d02 100644
+index eea398c7..4593b2e1 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -10,6 +10,7 @@
@@ -35,7 +35,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 14ce09e..d406013 100644
+index 6f5c81ce..1baa4a03 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -47,7 +47,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 387967d..88ce44f 100644
+index b5a0967b..f4867ea7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -59,5 +59,5 @@
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/4003-mt76-revert-kernel-api-for-kernel-5.4.patch b/recipes-wifi/linux-mt76/files/patches/4003-mt76-revert-kernel-api-for-kernel-5.4.patch
index 092258d..6845b0f 100644
--- a/recipes-wifi/linux-mt76/files/patches/4003-mt76-revert-kernel-api-for-kernel-5.4.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4003-mt76-revert-kernel-api-for-kernel-5.4.patch
@@ -1,11 +1,12 @@
-From be3ce3c8e5cf171cca1a6e7c3f5ec0536fae0f81 Mon Sep 17 00:00:00 2001
+From 1796376cd4aedff17a93f6a28c5b321d678ebf95 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 30 Dec 2022 11:11:59 +0800
-Subject: [PATCH 4003/4004] mt76: revert kernel api for kernel 5.4
+Subject: [PATCH 4003/4006] mt76: revert kernel api for kernel 5.4
 
 ---
  debugfs.c | 2 ++
- 1 file changed, 2 insertions(+)
+ dma.c     | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/debugfs.c b/debugfs.c
 index 79064a4d..4a8e1864 100644
@@ -22,6 +23,19 @@
  
  	return 0;
  }
+diff --git a/dma.c b/dma.c
+index 79da538c..e6021369 100644
+--- a/dma.c
++++ b/dma.c
+@@ -928,7 +928,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 		    !(dev->drv->rx_check(dev, data, len)))
+ 			goto free_frag;
+ 
+-		skb = napi_build_skb(data, q->buf_size);
++		skb = build_skb(data, q->buf_size);
+ 		if (!skb)
+ 			goto free_frag;
+ 
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch
index 6c1df10..1977b98 100644
--- a/recipes-wifi/linux-mt76/files/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,7 +1,7 @@
-From 24e0b09a440cc5f581f01f495a76d6180bc44faf Mon Sep 17 00:00:00 2001
+From fb3205686d76d409b1cdd4a25c2dd526fda4b2e4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 30 Dec 2022 11:12:07 +0800
-Subject: [PATCH 4004/4004] mt76: revert for backports-5.15 wireless stack
+Subject: [PATCH 4004/4006] mt76: revert for backports-5.15 wireless stack
 
 ---
  dma.c             |   2 +-
@@ -22,11 +22,11 @@
  15 files changed, 168 insertions(+), 178 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 0925daf4..08169bae 100644
+index e6021369..c2125106 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -980,7 +980,7 @@ mt76_dma_init(struct mt76_dev *dev,
- 	dev->napi_dev.threaded = 1;
+@@ -995,7 +995,7 @@ mt76_dma_init(struct mt76_dev *dev,
+ 	init_completion(&dev->mmio.wed_reset_complete);
  
  	mt76_for_each_q_rx(dev, i) {
 -		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
@@ -35,10 +35,10 @@
  		napi_enable(&dev->napi[i]);
  	}
 diff --git a/mac80211.c b/mac80211.c
-index 818f4f0c..909ab259 100644
+index 90447472..14a02c01 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1508,7 +1508,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
+@@ -1509,7 +1509,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
  static void
  __mt76_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -47,7 +47,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -1530,7 +1530,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1531,7 +1531,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct mt76_dev *dev = priv;
  
@@ -103,7 +103,7 @@
  	mt7615_mutex_release(dev);
  }
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index e917d025..b2e1f388 100644
+index 4593b2e1..39e81d26 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -353,7 +353,7 @@ out:
@@ -133,7 +133,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -2526,7 +2526,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
+@@ -2525,7 +2525,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
  		u8 pad;
  	} req = {
  		.bss_idx = mvif->mt76.idx,
@@ -143,7 +143,7 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index d4060136..703ca736 100644
+index 1baa4a03..d7d85291 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -197,7 +197,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
@@ -446,7 +446,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -1616,7 +1616,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1662,7 +1662,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	for (i = 0; i < sreq->n_ssids; i++) {
  		if (!sreq->ssids[i].ssid_len)
  			continue;
@@ -454,7 +454,7 @@
  		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
  		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
  		       sreq->ssids[i].ssid_len);
-@@ -1749,7 +1748,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
+@@ -1795,7 +1794,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
  		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
  		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
  	}
@@ -462,7 +462,7 @@
  	req->match_num = sreq->n_match_sets;
  	for (i = 0; i < req->match_num; i++) {
  		match = &sreq->match_sets[i];
-@@ -2236,10 +2234,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2282,10 +2280,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  				      struct mt76_vif *vif,
  				      struct ieee80211_bss_conf *info)
  {
@@ -474,7 +474,7 @@
  			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
  	struct {
  		struct {
-@@ -2267,7 +2263,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2313,7 +2309,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  
  	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
  	for (i = 0; i < len; i++)
@@ -524,10 +524,10 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 9cbd3625..5743dc54 100644
+index 4dd321ee..354d1e0e 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -553,8 +553,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -552,8 +552,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  	if (ret < 0)
  		return ret;
  
@@ -539,10 +539,10 @@
  
  	mt7915_dma_enable(dev);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index ef752e10..9ccbc7bc 100755
+index 92977b98..25aa44f6 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1152,8 +1152,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -1132,8 +1132,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  			mt7915_gen_ppe_thresh(he_cap->ppe_thres, nss);
  		} else {
  			he_cap_elem->phy_cap_info[9] |=
@@ -553,10 +553,10 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0d0ae7ab..d759912c 100644
+index 175498b1..c2e3048c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -915,7 +915,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -902,7 +902,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  	u16 fc, tid;
  	u32 val;
  
@@ -566,7 +566,7 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c281b472..ad5cd002 100644
+index 5307e15d..ac62f0be 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -523,7 +523,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -610,7 +610,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 50cbda88..8fab4c76 100644
+index f4867ea7..9005ce2b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -64,7 +64,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
@@ -1099,7 +1099,7 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -2092,7 +2092,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2093,7 +2093,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (!en)
  		goto out;
  
@@ -1108,7 +1108,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -3304,17 +3304,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3354,17 +3354,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/4005-wifi-mt76-revert-EHT-definitions.patch b/recipes-wifi/linux-mt76/files/patches/4005-wifi-mt76-revert-EHT-definitions.patch
new file mode 100644
index 0000000..1b4049d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/4005-wifi-mt76-revert-EHT-definitions.patch
@@ -0,0 +1,120 @@
+From b655964b1f68678a665f30a68c13a73feeffaa73 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 3 Feb 2023 17:09:55 +0800
+Subject: [PATCH 4005/4006] wifi: mt76: revert EHT definitions
+
+Revert the following patches
+* 68b17a24 wifi: mt76: connac: add helpers for EHT capability
+* b375845a wifi: mt76: connac: add CMD_CBW_320MHZ
+
+This reverts commit b375845abc105904242d3c6d9da15c7a1ec5ffc4.
+---
+ mt76_connac.h     |  2 --
+ mt76_connac_mcu.c | 46 ----------------------------------------------
+ mt76_connac_mcu.h |  4 ----
+ 3 files changed, 52 deletions(-)
+
+diff --git a/mt76_connac.h b/mt76_connac.h
+index 323203df..5a0a3ce1 100644
+--- a/mt76_connac.h
++++ b/mt76_connac.h
+@@ -42,7 +42,6 @@ enum {
+ 	CMD_CBW_10MHZ,
+ 	CMD_CBW_5MHZ,
+ 	CMD_CBW_8080MHZ,
+-	CMD_CBW_320MHZ,
+ 
+ 	CMD_HE_MCS_BW80 = 0,
+ 	CMD_HE_MCS_BW160,
+@@ -241,7 +240,6 @@ static inline u8 mt76_connac_chan_bw(struct cfg80211_chan_def *chandef)
+ 		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
+ 		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
+ 		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
+-		[NL80211_CHAN_WIDTH_320] = CMD_CBW_320MHZ,
+ 	};
+ 
+ 	if (chandef->width >= ARRAY_SIZE(width_to_bw))
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index d7d85291..703ca736 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -1334,40 +1334,6 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
+ 
+-u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
+-				enum nl80211_band band)
+-{
+-	const struct ieee80211_sta_eht_cap *eht_cap;
+-	struct ieee80211_supported_band *sband;
+-	u8 mode = 0;
+-
+-	if (band == NL80211_BAND_6GHZ)
+-		mode |= PHY_MODE_AX_6G;
+-
+-	sband = phy->hw->wiphy->bands[band];
+-	eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
+-
+-	if (!eht_cap || !eht_cap->has_eht)
+-		return mode;
+-
+-	switch (band) {
+-	case NL80211_BAND_6GHZ:
+-		mode |= PHY_MODE_BE_6G;
+-		break;
+-	case NL80211_BAND_5GHZ:
+-		mode |= PHY_MODE_BE_5G;
+-		break;
+-	case NL80211_BAND_2GHZ:
+-		mode |= PHY_MODE_BE_24G;
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	return mode;
+-}
+-EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode_ext);
+-
+ const struct ieee80211_sta_he_cap *
+ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
+ {
+@@ -1380,18 +1346,6 @@ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_get_he_phy_cap);
+ 
+-const struct ieee80211_sta_eht_cap *
+-mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
+-{
+-	enum nl80211_band band = phy->chandef.chan->band;
+-	struct ieee80211_supported_band *sband;
+-
+-	sband = phy->hw->wiphy->bands[band];
+-
+-	return ieee80211_get_eht_iftype_cap(sband, vif->type);
+-}
+-EXPORT_SYMBOL_GPL(mt76_connac_get_eht_phy_cap);
+-
+ #define DEFAULT_HE_PE_DURATION		4
+ #define DEFAULT_HE_DURATION_RTS_THRES	1023
+ static void
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 130a8d25..2faef32b 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1895,12 +1895,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val);
+ 
+ const struct ieee80211_sta_he_cap *
+ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
+-const struct ieee80211_sta_eht_cap *
+-mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
+ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ 			    enum nl80211_band band, struct ieee80211_sta *sta);
+-u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
+-				enum nl80211_band band);
+ 
+ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ 			    struct mt76_connac_sta_key_conf *sta_key_conf,
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/4006-wifi-mt76-revert-ser-patches.patch b/recipes-wifi/linux-mt76/files/patches/4006-wifi-mt76-revert-ser-patches.patch
new file mode 100644
index 0000000..ac71e70
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/4006-wifi-mt76-revert-ser-patches.patch
@@ -0,0 +1,83 @@
+From 21960def41a69264aadbd66be033ac32820e1909 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 3 Feb 2023 15:41:59 +0800
+Subject: [PATCH 4006/4006] wifi: mt76: revert ser patches
+
+---
+ mt7915/mac.c  |  2 +-
+ mt7915/mmio.c | 30 +++---------------------------
+ 2 files changed, 4 insertions(+), 28 deletions(-)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index c2e3048c..f1a21422 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1632,7 +1632,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 		return;
+ 
+ 	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
+-		mtk_wed_device_stop(&dev->mt76.mmio.wed);
++		mtk_wed_device_stop(&dev->mt76.mmio.wed, true);
+ 		if (!is_mt7986(&dev->mt76))
+ 			mt76_wr(dev, MT_INT_WED_MASK_CSR, 0);
+ 	}
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 6b9752b2..33231599 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -733,40 +733,17 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
+ 	rcu_read_unlock();
+ }
+ 
+-static int mt7915_mmio_wed_reset(struct mtk_wed_device *wed)
++static void mt7915_mmio_wed_reset(struct mtk_wed_device *wed)
+ {
+ 	struct mt76_dev *mdev = container_of(wed, struct mt76_dev, mmio.wed);
+ 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
+ 	struct mt76_phy *mphy = &dev->mphy;
+ 	int ret;
+ 
+-	ASSERT_RTNL();
+-
+-	if (test_and_set_bit(MT76_STATE_WED_RESET, &mphy->state))
+-		return -EBUSY;
+-
+ 	ret = mt7915_mcu_set_ser(dev, SER_RECOVER, SER_SET_RECOVER_L1,
+ 				 mphy->band_idx);
+-	if (ret)
+-		goto out;
+-
+-	rtnl_unlock();
+-	if (!wait_for_completion_timeout(&mdev->mmio.wed_reset, 20 * HZ)) {
+-		dev_err(mdev->dev, "wed reset timeout\n");
+-		ret = -ETIMEDOUT;
+-	}
+-	rtnl_lock();
+-out:
+-	clear_bit(MT76_STATE_WED_RESET, &mphy->state);
+-
+-	return ret;
+-}
+-
+-static void mt7915_mmio_wed_reset_complete(struct mtk_wed_device *wed)
+-{
+-	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ 
+-	complete(&dev->mmio.wed_reset_complete);
++	return;
+ }
+ #endif
+ 
+@@ -850,8 +827,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 	wed->wlan.init_rx_buf = mt7915_mmio_wed_init_rx_buf;
+ 	wed->wlan.release_rx_buf = mt7915_mmio_wed_release_rx_buf;
+ 	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
+-	wed->wlan.reset = mt7915_mmio_wed_reset;
+-	wed->wlan.reset_complete = mt7915_mmio_wed_reset_complete;
++	wed->wlan.ser_trigger = mt7915_mmio_wed_reset;
+ 
+ 	dev->mt76.rx_token_size += wed->wlan.rx_npkt;
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index da1bf09..7a55f85 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -1,13 +1,6 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
-    file://0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch \
-    file://0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch \
-    file://0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch \
-    file://0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch \
-    file://0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch \
-    file://0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch \
-    file://0007-wifi-mt76-mt7915-rework-mt7915_thermal_init.patch \
-    file://0008-wifi-mt76-mt7915-remove-BW160-and-BW80-80-support.patch \
+    file://0001-wifi-mt76-mt7915-rework-mt7915_thermal_init.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
     file://1003-mt76-mt7915-air-monitor-support.patch \
@@ -24,38 +17,36 @@
     file://1115-mt76-testmode-add-ZWDFS-test-mode-support.patch \
     file://1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch \
     file://1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch \
-    file://1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
-    file://1121-mt76-mt7915-add-phy-capability-vendor-command.patch \
-    file://1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch \
-    file://1123-mt76-mt7915-implement-bin-file-mode.patch \
-    file://1124-mt76-mt7915-initialize-wcid.patch \
-    file://1125-mt76-mt7915-Add-hemu-dump-support.patch \
-    file://1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
-    file://1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
-    file://1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
-    file://1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
-    file://1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
-    file://1131-mt76-mt7915-amsdu-set-and-get-control.patch \
-    file://1132-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch \
-    file://1133-mt76-mt7915-Add-vendor-command-attribute-for-RTS-BW-.patch \
-    file://1134-mt76-mt7915-Allow-AP-to-change-channel-width-for-40M.patch \
+    file://1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch \
+    file://1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
+    file://1120-mt76-mt7915-add-phy-capability-vendor-command.patch \
+    file://1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch \
+    file://1122-mt76-mt7915-implement-bin-file-mode.patch \
+    file://1123-mt76-mt7915-initialize-wcid.patch \
+    file://1124-mt76-mt7915-Add-hemu-dump-support.patch \
+    file://1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
+    file://1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
+    file://1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
+    file://1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
+    file://1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
+    file://1130-mt76-mt7915-amsdu-set-and-get-control.patch \
+    file://1131-wifi-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch \
+    file://1132-mt76-mt7915-Add-vendor-command-attribute-for-RTS-BW-.patch \
+    file://1133-mt76-mt7915-Allow-AP-to-change-channel-width-for-40M.patch \
     file://3001-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch \
-    file://3003-mt76-connac-wed-add-wed-rx-copy-skb.patch \
-    file://3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch \
-    file://3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch \
-    file://3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch \
-    file://3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch \
-    file://3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch \
-    file://3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch \
-    file://3010-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
-    file://3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch \
-    file://3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch \
-    file://3013-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch \
-    file://3014-mt76-mt7915-drop-the-wrong-judgment-condition-to-sup.patch \
+    file://3003-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch \
+    file://3004-mt76-mt7915-wed-find-rx-token-by-physical-address.patch \
+    file://3005-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch \
+    file://3006-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch \
+    file://3007-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
+    file://3008-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro.patch \
+    file://3009-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch \
+    file://3010-mt76-connac-wed-add-wed-rx-copy-skb-and-revert-page_.patch \
     file://4001-mt76-revert-get_of_mac_addr.patch \
     file://4002-mt76-include-header-files-for-module-param.patch \
     file://4003-mt76-revert-kernel-api-for-kernel-5.4.patch \
     file://4004-mt76-revert-for-backports-5.15-wireless-stack.patch \
+    file://4005-wifi-mt76-revert-EHT-definitions.patch \
+    file://4006-wifi-mt76-revert-ser-patches.patch \
     "
diff --git a/recipes-wifi/linux-mt76/mt76.inc b/recipes-wifi/linux-mt76/mt76.inc
index e92cc83..4feb511 100644
--- a/recipes-wifi/linux-mt76/mt76.inc
+++ b/recipes-wifi/linux-mt76/mt76.inc
@@ -1 +1 @@
-SRCREV ?= "5b509e80384ab019ac11aa90c81ec0dbb5b0d7f2"
+SRCREV ?= "b2360d59747c6fed2b65bc1c3563c10593c83f3e"