diff --git a/recipes-connectivity/hostapd/files/hostapd-full.config b/recipes-connectivity/hostapd/files/hostapd-full.config
index 5d1b2f9..22a367f 100644
--- a/recipes-connectivity/hostapd/files/hostapd-full.config
+++ b/recipes-connectivity/hostapd/files/hostapd-full.config
@@ -316,7 +316,7 @@
 CONFIG_INTERWORKING=y
 
 # Hotspot 2.0
-#CONFIG_HS20=y
+CONFIG_HS20=y
 
 # Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file
 #CONFIG_SQLITE=y
diff --git a/recipes-connectivity/hostapd/files/patches/340-reload_freq_change.patch b/recipes-connectivity/hostapd/files/patches/340-reload_freq_change.patch
index 3d51a47..89259f2 100644
--- a/recipes-connectivity/hostapd/files/patches/340-reload_freq_change.patch
+++ b/recipes-connectivity/hostapd/files/patches/340-reload_freq_change.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -115,6 +115,28 @@ static void hostapd_reload_bss(struct ho
+@@ -115,6 +115,29 @@ static void hostapd_reload_bss(struct ho
  #endif /* CONFIG_NO_RADIUS */
  
  	ssid = &hapd->conf->ssid;
@@ -12,6 +12,7 @@
 +			 hapd->iconf->ieee80211n,
 +			 hapd->iconf->ieee80211ac,
 +			 hapd->iconf->ieee80211ax,
++			 hapd->iconf->ieee80211be,
 +			 hapd->iconf->secondary_channel,
 +			 hostapd_get_oper_chwidth(hapd->iconf),
 +			 hostapd_get_oper_centr_freq_seg0_idx(hapd->iconf),
diff --git a/recipes-connectivity/hostapd/files/patches/350-nl80211_del_beacon_bss.patch b/recipes-connectivity/hostapd/files/patches/350-nl80211_del_beacon_bss.patch
index 3556783..8a2beb3 100644
--- a/recipes-connectivity/hostapd/files/patches/350-nl80211_del_beacon_bss.patch
+++ b/recipes-connectivity/hostapd/files/patches/350-nl80211_del_beacon_bss.patch
@@ -1,24 +1,20 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -2931,10 +2931,15 @@ static int wpa_driver_nl80211_del_beacon
- 	struct nl_msg *msg;
+@@ -2932,11 +2932,11 @@ static int wpa_driver_nl80211_del_beacon
  	struct wpa_driver_nl80211_data *drv = bss->drv;
  
-+	if (!bss->beacon_set)
-+		return 0;
-+
-+	bss->beacon_set = 0;
-+
  	wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
 -		   drv->ifindex);
 +		   bss->ifindex);
+ 	bss->beacon_set = 0;
+ 	bss->freq = 0;
  	nl80211_put_wiphy_data_ap(bss);
 -	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
-+	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_BEACON);
++	msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
  	return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
  }
  
-@@ -5617,7 +5622,7 @@ static void nl80211_teardown_ap(struct i
+@@ -5650,7 +5650,7 @@ static void nl80211_teardown_ap(struct i
  		nl80211_mgmt_unsubscribe(bss, "AP teardown");
  
  	nl80211_put_wiphy_data_ap(bss);
@@ -27,7 +23,7 @@
  }
  
  
-@@ -8071,8 +8076,6 @@ static int wpa_driver_nl80211_if_remove(
+@@ -8104,8 +8104,6 @@ static int wpa_driver_nl80211_if_remove(
  	} else {
  		wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
  		nl80211_teardown_ap(bss);
@@ -36,19 +32,3 @@
  		nl80211_destroy_bss(bss);
  		if (!bss->added_if)
  			i802_set_iface_flags(bss, 0);
-@@ -8469,7 +8472,6 @@ static int wpa_driver_nl80211_deinit_ap(
- 	if (!is_ap_interface(drv->nlmode))
- 		return -1;
- 	wpa_driver_nl80211_del_beacon(bss);
--	bss->beacon_set = 0;
- 
- 	/*
- 	 * If the P2P GO interface was dynamically added, then it is
-@@ -8489,7 +8491,6 @@ static int wpa_driver_nl80211_stop_ap(vo
- 	if (!is_ap_interface(drv->nlmode))
- 		return -1;
- 	wpa_driver_nl80211_del_beacon(bss);
--	bss->beacon_set = 0;
- 	return 0;
- }
- 
diff --git a/recipes-connectivity/hostapd/files/patches/420-indicate-features.patch b/recipes-connectivity/hostapd/files/patches/420-indicate-features.patch
index f9dff66..12edb6b 100644
--- a/recipes-connectivity/hostapd/files/patches/420-indicate-features.patch
+++ b/recipes-connectivity/hostapd/files/patches/420-indicate-features.patch
@@ -1,23 +1,24 @@
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -15,6 +15,7 @@
- #include "utils/common.h"
- #include "utils/eloop.h"
- #include "utils/uuid.h"
-+#include "utils/build_features.h"
- #include "crypto/random.h"
- #include "crypto/tls.h"
- #include "common/version.h"
-@@ -691,7 +692,7 @@ int main(int argc, char *argv[])
+@@ -31,7 +31,7 @@
+ #include "config_file.h"
+ #include "eap_register.h"
+ #include "ctrl_iface.h"
+-
++#include "build_features.h"
+ 
+ struct hapd_global {
+ 	void **drv_priv;
+@@ -692,7 +692,7 @@ int main(int argc, char *argv[])
  	wpa_supplicant_event = hostapd_wpa_event;
  	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
--		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:");
-+		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:v::");
+-		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
++		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:qv::");
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -728,6 +729,8 @@ int main(int argc, char *argv[])
+@@ -729,6 +729,8 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_DEBUG_LINUX_TRACING */
  		case 'v':
@@ -25,7 +26,7 @@
 +				exit(!has_feature(optarg));
  			show_version();
  			exit(1);
- 			break;
+ 		case 'g':
 --- a/wpa_supplicant/main.c
 +++ b/wpa_supplicant/main.c
 @@ -12,6 +12,7 @@
@@ -33,10 +34,10 @@
  
  #include "common.h"
 +#include "build_features.h"
+ #include "crypto/crypto.h"
  #include "fst/fst.h"
  #include "wpa_supplicant_i.h"
- #include "driver_i.h"
-@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
+@@ -203,7 +204,7 @@ int main(int argc, char *argv[])
  
  	for (;;) {
  		c = getopt(argc, argv,
@@ -45,7 +46,7 @@
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -305,8 +306,12 @@ int main(int argc, char *argv[])
+@@ -306,8 +307,12 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
  		case 'v':
diff --git a/recipes-connectivity/hostapd/files/patches/465-hostapd-config-support-random-BSS-color.patch b/recipes-connectivity/hostapd/files/patches/465-hostapd-config-support-random-BSS-color.patch
new file mode 100644
index 0000000..c0b0119
--- /dev/null
+++ b/recipes-connectivity/hostapd/files/patches/465-hostapd-config-support-random-BSS-color.patch
@@ -0,0 +1,24 @@
+From c9304d3303d563ad6d2619f4e07864ed12f96889 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 14 May 2022 21:41:03 +0200
+Subject: [PATCH] hostapd: config: support random BSS color
+
+Configure the HE BSS color to a random value in case the config defines
+a BSS color which exceeds the max BSS color (63).
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ hostapd/config_file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3485,6 +3485,8 @@ static int hostapd_config_fill(struct ho
+ 	} else if (os_strcmp(buf, "he_bss_color") == 0) {
+ 		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ 		conf->he_op.he_bss_color_disabled = 0;
++		if (atoi(pos) > 63)
++			conf->he_op.he_bss_color = os_random() % 63 + 1;
+ 	} else if (os_strcmp(buf, "he_bss_color_partial") == 0) {
+ 		conf->he_op.he_bss_color_partial = atoi(pos);
+ 	} else if (os_strcmp(buf, "he_default_pe_duration") == 0) {
diff --git a/recipes-connectivity/hostapd/files/patches/750-qos_map_set_without_interworking.patch b/recipes-connectivity/hostapd/files/patches/750-qos_map_set_without_interworking.patch
index 43a4ea7..ff1d076 100644
--- a/recipes-connectivity/hostapd/files/patches/750-qos_map_set_without_interworking.patch
+++ b/recipes-connectivity/hostapd/files/patches/750-qos_map_set_without_interworking.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -1644,6 +1644,8 @@ static int parse_anqp_elem(struct hostap
+@@ -1598,6 +1598,8 @@ static int parse_anqp_elem(struct hostap
  	return 0;
  }
  
@@ -9,7 +9,7 @@
  
  static int parse_qos_map_set(struct hostapd_bss_config *bss,
  			     char *buf, int line)
-@@ -1685,8 +1687,6 @@ static int parse_qos_map_set(struct host
+@@ -1639,8 +1641,6 @@ static int parse_qos_map_set(struct host
  	return 0;
  }
  
@@ -18,7 +18,7 @@
  
  #ifdef CONFIG_HS20
  static int hs20_parse_conn_capab(struct hostapd_bss_config *bss, char *buf,
-@@ -4077,10 +4077,10 @@ static int hostapd_config_fill(struct ho
+@@ -4042,10 +4042,10 @@ static int hostapd_config_fill(struct ho
  		bss->gas_frag_limit = val;
  	} else if (os_strcmp(buf, "gas_comeback_delay") == 0) {
  		bss->gas_comeback_delay = atoi(pos);
@@ -32,7 +32,7 @@
  		os_free(bss->dump_msk_file);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -1415,6 +1415,7 @@ static int hostapd_setup_bss(struct host
+@@ -1423,6 +1423,7 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "GAS server initialization failed");
  		return -1;
  	}
@@ -40,7 +40,7 @@
  
  	if (conf->qos_map_set_len &&
  	    hostapd_drv_set_qos_map(hapd, conf->qos_map_set,
-@@ -1422,7 +1423,6 @@ static int hostapd_setup_bss(struct host
+@@ -1430,7 +1431,6 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "Failed to initialize QoS Map");
  		return -1;
  	}
@@ -48,40 +48,9 @@
  
  	if (conf->bss_load_update_period && bss_load_update_init(hapd)) {
  		wpa_printf(MSG_ERROR, "BSS Load initialization failed");
---- a/src/ap/drv_callbacks.c
-+++ b/src/ap/drv_callbacks.c
-@@ -271,12 +271,10 @@ int hostapd_notif_assoc(struct hostapd_d
- 	}
- #endif /* NEED_AP_MLME */
- 
--#ifdef CONFIG_INTERWORKING
- 	if (elems.ext_capab && elems.ext_capab_len > 4) {
- 		if (elems.ext_capab[4] & 0x01)
- 			sta->qos_map_enabled = 1;
- 	}
--#endif /* CONFIG_INTERWORKING */
- 
- #ifdef CONFIG_HS20
- 	wpabuf_free(sta->hs20_ie);
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -4129,13 +4129,11 @@ static u16 copy_supp_rates(struct hostap
- static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
- 			   const u8 *ext_capab_ie, size_t ext_capab_ie_len)
- {
--#ifdef CONFIG_INTERWORKING
- 	/* check for QoS Map support */
- 	if (ext_capab_ie_len >= 5) {
- 		if (ext_capab_ie[4] & 0x01)
- 			sta->qos_map_enabled = 1;
- 	}
--#endif /* CONFIG_INTERWORKING */
- 
- 	if (ext_capab_ie_len > 0) {
- 		sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -2540,8 +2540,6 @@ void wnm_bss_keep_alive_deinit(struct wp
+@@ -2586,8 +2586,6 @@ void wnm_bss_keep_alive_deinit(struct wp
  }
  
  
@@ -90,7 +59,7 @@
  static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
  			    size_t len)
  {
-@@ -2574,8 +2572,6 @@ static void interworking_process_assoc_r
+@@ -2620,8 +2618,6 @@ static void interworking_process_assoc_r
  	}
  }
  
@@ -99,7 +68,7 @@
  
  static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
  					const u8 *ies, size_t ies_len)
-@@ -2908,10 +2904,8 @@ static int wpa_supplicant_event_associnf
+@@ -2954,10 +2950,8 @@ static int wpa_supplicant_event_associnf
  		wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
  				       data->assoc_info.resp_ies_len);
  #endif /* CONFIG_WNM */
@@ -110,3 +79,19 @@
  		if (wpa_s->hw_capab == CAPAB_VHT &&
  		    get_ie(data->assoc_info.resp_ies,
  			   data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
+--- a/src/ap/ieee802_11_shared.c
++++ b/src/ap/ieee802_11_shared.c
+@@ -1098,13 +1098,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
+ u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
+ 		    const u8 *ext_capab_ie, size_t ext_capab_ie_len)
+ {
+-#ifdef CONFIG_INTERWORKING
+ 	/* check for QoS Map support */
+ 	if (ext_capab_ie_len >= 5) {
+ 		if (ext_capab_ie[4] & 0x01)
+ 			sta->qos_map_enabled = 1;
+ 	}
+-#endif /* CONFIG_INTERWORKING */
+ 
+ 	if (ext_capab_ie_len > 0) {
+ 		sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
diff --git a/recipes-connectivity/hostapd/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch b/recipes-connectivity/hostapd/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
new file mode 100644
index 0000000..68935df
--- /dev/null
+++ b/recipes-connectivity/hostapd/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
@@ -0,0 +1,44 @@
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 55b7188..6af0ef2 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1048,7 +1048,7 @@ static int hostapd_dfs_request_channel_switch(struct hostapd_iface *iface,
+ }
+ 
+ 
+-static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
++static int hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
+ {
+ 	int sec = 0;
+ 	enum dfs_channel_type channel_type = DFS_NO_CAC_YET;
+@@ -1084,7 +1084,7 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
+ 				  oper_centr_freq_seg1_idx, true)) {
+ 		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
+ 		iface->radar_background.channel = -1;
+-		return;
++		return -1;
+ 	}
+ 
+ 	iface->radar_background.channel = channel->chan;
+@@ -1096,6 +1096,8 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
+ 	wpa_printf(MSG_ERROR,
+ 		   "%s: setting background chain to chan %d (%d MHz)",
+ 		   __func__, channel->chan, channel->freq);
++
++	return 0;
+ }
+ 
+ 
+@@ -1320,8 +1322,7 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		 * Just select a new random channel according to the
+ 		 * regulations for monitoring.
+ 		 */
+-		hostpad_dfs_update_background_chain(iface);
+-		return 0;
++		return hostpad_dfs_update_background_chain(iface);
+ 	}
+ 
+ 	/*
+-- 
+2.29.2
+
diff --git a/recipes-connectivity/hostapd/files/patches/900-master-sync-include-uapi-linux-nl80211.patch b/recipes-connectivity/hostapd/files/patches/900-master-sync-include-uapi-linux-nl80211.patch
deleted file mode 100644
index fe47b57..0000000
--- a/recipes-connectivity/hostapd/files/patches/900-master-sync-include-uapi-linux-nl80211.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index f962c06..f7be755 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -2560,6 +2560,19 @@ enum nl80211_commands {
-  *	disassoc events to indicate that an immediate reconnect to the AP
-  *	is desired.
-  *
-+ * @NL80211_ATTR_OBSS_COLOR_BITMAP: bitmap of the u64 BSS colors for the
-+ *	%NL80211_CMD_OBSS_COLOR_COLLISION event.
-+ *
-+ * @NL80211_ATTR_COLOR_CHANGE_COUNT: u8 attribute specifying the number of TBTT's
-+ *	until the color switch event.
-+ * @NL80211_ATTR_COLOR_CHANGE_COLOR: u8 attribute specifying the color that we are
-+ *	switching to
-+ * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
-+ *	information for the time while performing a color switch.
-+ *
-+ * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
-+ *	transmit power to stay within regulatory limits. u32, dBi.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3057,6 +3070,14 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_DISABLE_HE,
- 
-+	NL80211_ATTR_OBSS_COLOR_BITMAP,
-+
-+	NL80211_ATTR_COLOR_CHANGE_COUNT,
-+	NL80211_ATTR_COLOR_CHANGE_COLOR,
-+	NL80211_ATTR_COLOR_CHANGE_ELEMS,
-+
-+	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5950,6 +5971,9 @@ enum nl80211_feature_flags {
-  *      frame protection for all management frames exchanged during the
-  *      negotiation and range measurement procedure.
-  *
-+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-+ *	detection and change announcemnts.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6014,6 +6038,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_LTF,
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
-+	NL80211_EXT_FEATURE_BSS_COLOR,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
diff --git a/recipes-connectivity/hostapd/files/patches/901-master-zero-wait_dfs.patch b/recipes-connectivity/hostapd/files/patches/901-master-zero-wait_dfs.patch
deleted file mode 100644
index cb11aee..0000000
--- a/recipes-connectivity/hostapd/files/patches/901-master-zero-wait_dfs.patch
+++ /dev/null
@@ -1,851 +0,0 @@
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 1e1b685..8f6281a 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -2476,6 +2476,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		conf->ieee80211d = atoi(pos);
- 	} else if (os_strcmp(buf, "ieee80211h") == 0) {
- 		conf->ieee80211h = atoi(pos);
-+	} else if (os_strcmp(buf, "radar_offchan") == 0) {
-+		conf->radar_offchan = atoi(pos);
- 	} else if (os_strcmp(buf, "ieee8021x") == 0) {
- 		bss->ieee802_1x = atoi(pos);
- 	} else if (os_strcmp(buf, "eapol_version") == 0) {
-diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index a89ce9b..0c951a9 100644
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -143,6 +143,13 @@ ssid=test
- # ieee80211d=1 and local_pwr_constraint configured.
- #spectrum_mgmt_required=1
- 
-+# Enable radar/CAC detection through a dedicated offchannel chain available on
-+# some hw. The chain can't be used to transmits or receives frames.
-+# This feature allows to avoid CAC downtime switching on a different channel
-+# during CAC detection on the selected radar channel.
-+# (default: 0 = disabled, 1 = enabled)
-+#radar_offchan=0
-+
- # Operation mode (a = IEEE 802.11a (5 GHz), b = IEEE 802.11b (2.4 GHz),
- # g = IEEE 802.11g (2.4 GHz), ad = IEEE 802.11ad (60 GHz); a/g options are used
- # with IEEE 802.11n (HT), too, to specify band). For IEEE 802.11ac (VHT), this
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 28b7efe..ffc3c2c 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -993,6 +993,7 @@ struct hostapd_config {
- 	int ieee80211d;
- 
- 	int ieee80211h; /* DFS */
-+	int radar_offchan;
- 
- 	/*
- 	 * Local power constraint is an octet encoded as an unsigned integer in
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index bc49079..c97ee39 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -810,7 +810,8 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
- 			  int channel, int ht_enabled, int vht_enabled,
- 			  int he_enabled,
- 			  int sec_channel_offset, int oper_chwidth,
--			  int center_segment0, int center_segment1)
-+			  int center_segment0, int center_segment1,
-+			  int radar_offchan)
- {
- 	struct hostapd_data *hapd = iface->bss[0];
- 	struct hostapd_freq_params data;
-@@ -836,10 +837,14 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
- 		wpa_printf(MSG_ERROR, "Can't set freq params");
- 		return -1;
- 	}
-+	data.radar_offchan = radar_offchan;
- 
- 	res = hapd->driver->start_dfs_cac(hapd->drv_priv, &data);
- 	if (!res) {
--		iface->cac_started = 1;
-+		if (radar_offchan)
-+			iface->radar_offchan.cac_started = 1;
-+		else
-+			iface->cac_started = 1;
- 		os_get_reltime(&iface->dfs_cac_start);
- 	}
- 
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 61c8f64..92842a1 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -130,7 +130,8 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
- 			  int channel, int ht_enabled, int vht_enabled,
- 			  int he_enabled,
- 			  int sec_channel_offset, int oper_chwidth,
--			  int center_segment0, int center_segment1);
-+			  int center_segment0, int center_segment1,
-+			  int radar_offchan);
- int hostapd_drv_do_acs(struct hostapd_data *hapd);
- int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
- 			     u16 reason_code, const u8 *ie, size_t ielen);
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index eccda1a..3b1276f 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -51,16 +51,31 @@ static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1)
- 	return n_chans;
- }
- 
--
-+/*
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-+ */
- static int dfs_channel_available(struct hostapd_channel_data *chan,
--				 int skip_radar)
-+				 int flags)
- {
-+	if (flags == 2) {
-+		/* Select only radar channel where CAC has not been
-+		 * performed yet
-+		 */
-+		if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
-+		    (chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
-+		     HOSTAPD_CHAN_DFS_USABLE)
-+			return 1;
-+		return 0;
-+	}
- 	/*
- 	 * When radar detection happens, CSA is performed. However, there's no
- 	 * time for CAC, so radar channels must be skipped when finding a new
- 	 * channel for CSA, unless they are available for immediate use.
- 	 */
--	if (skip_radar && (chan->flag & HOSTAPD_CHAN_RADAR) &&
-+	if (flags && (chan->flag & HOSTAPD_CHAN_RADAR) &&
- 	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) !=
- 	     HOSTAPD_CHAN_DFS_AVAILABLE))
- 		return 0;
-@@ -136,10 +151,15 @@ dfs_get_chan_data(struct hostapd_hw_modes *mode, int freq, int first_chan_idx)
- 	return NULL;
- }
- 
--
-+/*
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-+ */
- static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
- 				    int first_chan_idx, int num_chans,
--				    int skip_radar)
-+				    int flags)
- {
- 	struct hostapd_channel_data *first_chan, *chan;
- 	int i;
-@@ -178,7 +198,7 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
- 			return 0;
- 		}
- 
--		if (!dfs_channel_available(chan, skip_radar)) {
-+		if (!dfs_channel_available(chan, flags)) {
- 			wpa_printf(MSG_DEBUG, "DFS: channel not available %d",
- 				   first_chan->freq + i * 20);
- 			return 0;
-@@ -205,10 +225,15 @@ static int is_in_chanlist(struct hostapd_iface *iface,
-  *  - hapd->secondary_channel
-  *  - hapd->vht/he_oper_centr_freq_seg0_idx
-  *  - hapd->vht/he_oper_centr_freq_seg1_idx
-+ *
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-  */
- static int dfs_find_channel(struct hostapd_iface *iface,
- 			    struct hostapd_channel_data **ret_chan,
--			    int idx, int skip_radar)
-+			    int idx, int flags)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan;
-@@ -233,7 +258,7 @@ static int dfs_find_channel(struct hostapd_iface *iface,
- 		}
- 
- 		/* Skip incompatible chandefs */
--		if (!dfs_chan_range_available(mode, i, n_chans, skip_radar)) {
-+		if (!dfs_chan_range_available(mode, i, n_chans, flags)) {
- 			wpa_printf(MSG_DEBUG,
- 				   "DFS: range not available for %d (%d)",
- 				   chan->freq, chan->chan);
-@@ -467,13 +492,18 @@ static int dfs_check_chans_unavailable(struct hostapd_iface *iface,
- 	return res;
- }
- 
--
-+/*
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-+ */
- static struct hostapd_channel_data *
- dfs_get_valid_channel(struct hostapd_iface *iface,
- 		      int *secondary_channel,
- 		      u8 *oper_centr_freq_seg0_idx,
- 		      u8 *oper_centr_freq_seg1_idx,
--		      int skip_radar)
-+		      int flags)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan = NULL;
-@@ -502,7 +532,7 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 		return NULL;
- 
- 	/* Get the count first */
--	num_available_chandefs = dfs_find_channel(iface, NULL, 0, skip_radar);
-+	num_available_chandefs = dfs_find_channel(iface, NULL, 0, flags);
- 	wpa_printf(MSG_DEBUG, "DFS: num_available_chandefs=%d",
- 		   num_available_chandefs);
- 	if (num_available_chandefs == 0)
-@@ -523,7 +553,7 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 		return NULL;
- 
- 	chan_idx = _rand % num_available_chandefs;
--	dfs_find_channel(iface, &chan, chan_idx, skip_radar);
-+	dfs_find_channel(iface, &chan, chan_idx, flags);
- 	if (!chan) {
- 		wpa_printf(MSG_DEBUG, "DFS: no random channel found");
- 		return NULL;
-@@ -552,7 +582,7 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 		for (i = 0; i < num_available_chandefs - 1; i++) {
- 			/* start from chan_idx + 1, end when chan_idx - 1 */
- 			chan_idx2 = (chan_idx + 1 + i) % num_available_chandefs;
--			dfs_find_channel(iface, &chan2, chan_idx2, skip_radar);
-+			dfs_find_channel(iface, &chan2, chan_idx2, flags);
- 			if (chan2 && abs(chan2->chan - chan->chan) > 12) {
- 				/* two channels are not adjacent */
- 				sec_chan_idx_80p80 = chan2->chan;
-@@ -582,6 +612,27 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 	return chan;
- }
- 
-+static int dfs_set_valid_channel(struct hostapd_iface *iface, int skip_radar)
-+{
-+	struct hostapd_channel_data *channel;
-+	u8 cf1 = 0, cf2 = 0;
-+	int sec = 0;
-+
-+	channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2,
-+					skip_radar);
-+	if (!channel) {
-+		wpa_printf(MSG_ERROR, "could not get valid channel");
-+		return -1;
-+	}
-+
-+	iface->freq = channel->freq;
-+	iface->conf->channel = channel->chan;
-+	iface->conf->secondary_channel = sec;
-+	hostapd_set_oper_centr_freq_seg0_idx(iface->conf, cf1);
-+	hostapd_set_oper_centr_freq_seg1_idx(iface->conf, cf2);
-+
-+	return 0;
-+}
- 
- static int set_dfs_state_freq(struct hostapd_iface *iface, int freq, u32 state)
- {
-@@ -761,6 +812,11 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
- 	return cac_time_ms;
- }
- 
-+static int hostapd_is_radar_offchan_enabled(struct hostapd_iface *iface)
-+{
-+	return (iface->drv_flags2 & WPA_DRIVER_RADAR_OFFCHAN) &&
-+	       iface->conf->radar_offchan;
-+}
- 
- /*
-  * Main DFS handler
-@@ -770,9 +826,8 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
-  */
- int hostapd_handle_dfs(struct hostapd_iface *iface)
- {
--	struct hostapd_channel_data *channel;
- 	int res, n_chans, n_chans1, start_chan_idx, start_chan_idx1;
--	int skip_radar = 0;
-+	int skip_radar = 0, radar_offchan;
- 
- 	if (is_6ghz_freq(iface->freq))
- 		return 1;
-@@ -825,28 +880,18 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
- 		wpa_printf(MSG_DEBUG, "DFS %d chans unavailable - choose other channel: %s",
- 			   res, res ? "yes": "no");
- 		if (res) {
--			int sec = 0;
--			u8 cf1 = 0, cf2 = 0;
--
--			channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2,
--							skip_radar);
--			if (!channel) {
--				wpa_printf(MSG_ERROR, "could not get valid channel");
-+			if (dfs_set_valid_channel(iface, skip_radar) < 0) {
- 				hostapd_set_state(iface, HAPD_IFACE_DFS);
- 				return 0;
- 			}
--
--			iface->freq = channel->freq;
--			iface->conf->channel = channel->chan;
--			iface->conf->secondary_channel = sec;
--			hostapd_set_oper_centr_freq_seg0_idx(iface->conf, cf1);
--			hostapd_set_oper_centr_freq_seg1_idx(iface->conf, cf2);
- 		}
- 	} while (res);
- 
- 	/* Finally start CAC */
- 	hostapd_set_state(iface, HAPD_IFACE_DFS);
--	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz", iface->freq);
-+	radar_offchan = hostapd_is_radar_offchan_enabled(iface);
-+	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz offchan %d",
-+		   iface->freq, radar_offchan);
- 	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_START
- 		"freq=%d chan=%d sec_chan=%d, width=%d, seg0=%d, seg1=%d, cac_time=%ds",
- 		iface->freq,
-@@ -863,13 +908,37 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
- 		iface->conf->secondary_channel,
- 		hostapd_get_oper_chwidth(iface->conf),
- 		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
--		hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
-+		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
-+		radar_offchan);
- 
- 	if (res) {
- 		wpa_printf(MSG_ERROR, "DFS start_dfs_cac() failed, %d", res);
- 		return -1;
- 	}
- 
-+	if (radar_offchan) {
-+		/* Cache offchannel radar parameters */
-+		iface->radar_offchan.channel = iface->conf->channel;
-+		iface->radar_offchan.secondary_channel =
-+			iface->conf->secondary_channel;
-+		iface->radar_offchan.freq = iface->freq;
-+		iface->radar_offchan.centr_freq_seg0_idx =
-+			hostapd_get_oper_centr_freq_seg0_idx(iface->conf);
-+		iface->radar_offchan.centr_freq_seg1_idx =
-+			hostapd_get_oper_centr_freq_seg1_idx(iface->conf);
-+
-+		/*
-+		 * Let's select a random channel for the moment
-+		 * and perform CAC on dedicated radar chain
-+		 */
-+		res = dfs_set_valid_channel(iface, 1);
-+		if (res < 0)
-+			return res;
-+
-+		iface->radar_offchan.temp_ch = 1;
-+		return 1;
-+	}
-+
- 	return 0;
- }
- 
-@@ -890,6 +959,157 @@ int hostapd_is_dfs_chan_available(struct hostapd_iface *iface)
- 	return dfs_check_chans_available(iface, start_chan_idx, n_chans);
- }
- 
-+static int hostapd_dfs_request_channel_switch(struct hostapd_iface *iface,
-+					      int channel, int freq,
-+					      int secondary_channel,
-+					      u8 oper_centr_freq_seg0_idx,
-+					      u8 oper_centr_freq_seg1_idx)
-+{
-+	struct hostapd_hw_modes *cmode = iface->current_mode;
-+	int ieee80211_mode = IEEE80211_MODE_AP, err, i;
-+	struct csa_settings csa_settings;
-+	u8 new_vht_oper_chwidth;
-+
-+	wpa_printf(MSG_DEBUG, "DFS will switch to a new channel %d", channel);
-+	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_NEW_CHANNEL
-+		"freq=%d chan=%d sec_chan=%d", freq, channel,
-+		secondary_channel);
-+
-+	new_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
-+	hostapd_set_oper_chwidth(iface->conf,
-+				 hostapd_get_oper_chwidth(iface->conf));
-+
-+	/* Setup CSA request */
-+	os_memset(&csa_settings, 0, sizeof(csa_settings));
-+	csa_settings.cs_count = 5;
-+	csa_settings.block_tx = 1;
-+#ifdef CONFIG_MESH
-+	if (iface->mconf)
-+		ieee80211_mode = IEEE80211_MODE_MESH;
-+#endif /* CONFIG_MESH */
-+	err = hostapd_set_freq_params(&csa_settings.freq_params,
-+				      iface->conf->hw_mode,
-+				      freq, channel,
-+				      iface->conf->enable_edmg,
-+				      iface->conf->edmg_channel,
-+				      iface->conf->ieee80211n,
-+				      iface->conf->ieee80211ac,
-+				      iface->conf->ieee80211ax,
-+				      secondary_channel,
-+				      new_vht_oper_chwidth,
-+				      oper_centr_freq_seg0_idx,
-+				      oper_centr_freq_seg1_idx,
-+				      cmode->vht_capab,
-+				      &cmode->he_capab[ieee80211_mode]);
-+
-+	if (err) {
-+		wpa_printf(MSG_ERROR, "DFS failed to calculate CSA freq params");
-+		hostapd_disable_iface(iface);
-+		return err;
-+	}
-+
-+	for (i = 0; i < iface->num_bss; i++) {
-+		err = hostapd_switch_channel(iface->bss[i], &csa_settings);
-+		if (err)
-+			break;
-+	}
-+
-+	if (err) {
-+		wpa_printf(MSG_WARNING, "DFS failed to schedule CSA (%d) - trying fallback",
-+			   err);
-+		iface->freq = freq;
-+		iface->conf->channel = channel;
-+		iface->conf->secondary_channel = secondary_channel;
-+		hostapd_set_oper_chwidth(iface->conf, new_vht_oper_chwidth);
-+		hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
-+						     oper_centr_freq_seg0_idx);
-+		hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
-+						     oper_centr_freq_seg1_idx);
-+
-+		hostapd_disable_iface(iface);
-+		hostapd_enable_iface(iface);
-+
-+		return 0;
-+	}
-+
-+	/* Channel configuration will be updated once CSA completes and
-+	 * ch_switch_notify event is received */
-+	wpa_printf(MSG_DEBUG, "DFS waiting channel switch event");
-+
-+	return 0;
-+}
-+
-+static struct hostapd_channel_data *
-+dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
-+			u8 *oper_centr_freq_seg0_idx,
-+			u8 *oper_centr_freq_seg1_idx, int *skip_radar);
-+
-+static void
-+hostpad_dfs_update_offchannel_chain(struct hostapd_iface *iface)
-+{
-+	struct hostapd_channel_data *channel;
-+	int sec = 0, flags = 2;
-+	u8 cf1 = 0, cf2 = 0;
-+
-+	channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, 2);
-+	if (!channel || channel->chan == iface->conf->channel)
-+		channel = dfs_downgrade_bandwidth(iface, &sec, &cf1, &cf2,
-+						  &flags);
-+	if (!channel ||
-+	    hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
-+				  channel->freq, channel->chan,
-+				  iface->conf->ieee80211n,
-+				  iface->conf->ieee80211ac,
-+				  iface->conf->ieee80211ax,
-+				  sec, hostapd_get_oper_chwidth(iface->conf),
-+				  cf1, cf2, 1)) {
-+		/*
-+		 * Toggle interface state to enter DFS state
-+		 * until NOP is finished.
-+		 */
-+		wpa_printf(MSG_ERROR, "DFS failed start CAC offchannel");
-+		return;
-+	}
-+
-+	wpa_printf(MSG_DEBUG, "%s: setting offchannel chain to chan %d (%d MHz)",
-+		   __func__, channel->chan, channel->freq);
-+
-+	iface->radar_offchan.channel = channel->chan;
-+	iface->radar_offchan.freq = channel->freq;
-+	iface->radar_offchan.secondary_channel = sec;
-+	iface->radar_offchan.centr_freq_seg0_idx = cf1;
-+	iface->radar_offchan.centr_freq_seg1_idx = cf2;
-+}
-+
-+/* FIXME: check if all channel bandwith */
-+static int
-+hostapd_dfs_is_offchan_event(struct hostapd_iface *iface, int freq)
-+{
-+	if (iface->radar_offchan.freq != freq)
-+		return 0;
-+
-+	return 1;
-+}
-+
-+static int
-+hostapd_dfs_start_channel_switch_offchan(struct hostapd_iface *iface)
-+{
-+	iface->conf->channel = iface->radar_offchan.channel;
-+	iface->freq = iface->radar_offchan.freq;
-+	iface->conf->secondary_channel =
-+		iface->radar_offchan.secondary_channel;
-+	hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
-+			iface->radar_offchan.centr_freq_seg0_idx);
-+	hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
-+			iface->radar_offchan.centr_freq_seg1_idx);
-+
-+	hostpad_dfs_update_offchannel_chain(iface);
-+
-+	return hostapd_dfs_request_channel_switch(iface, iface->conf->channel,
-+						  iface->freq, iface->conf->secondary_channel,
-+						  hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
-+						  hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
-+}
- 
- int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
- 			     int ht_enabled, int chan_offset, int chan_width,
-@@ -911,6 +1131,23 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
- 			set_dfs_state(iface, freq, ht_enabled, chan_offset,
- 				      chan_width, cf1, cf2,
- 				      HOSTAPD_CHAN_DFS_AVAILABLE);
-+
-+			/*
-+			 * radar event from offchannel chain for selected
-+			 * channel. Perfrom CSA, move main chain to selected
-+			 * channel and configure offchannel chain to a new DFS
-+			 * channel
-+			 */
-+			if (hostapd_is_radar_offchan_enabled(iface) &&
-+			    hostapd_dfs_is_offchan_event(iface, freq)) {
-+				iface->radar_offchan.cac_started = 0;
-+				if (iface->radar_offchan.temp_ch) {
-+					iface->radar_offchan.temp_ch = 0;
-+					return hostapd_dfs_start_channel_switch_offchan(iface);
-+				}
-+				return 0;
-+			}
-+
- 			/*
- 			 * Just mark the channel available when CAC completion
- 			 * event is received in enabled state. CAC result could
-@@ -927,6 +1164,10 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
- 				iface->cac_started = 0;
- 			}
- 		}
-+	} else if (hostapd_is_radar_offchan_enabled(iface) &&
-+		   hostapd_dfs_is_offchan_event(iface, freq)) {
-+		iface->radar_offchan.cac_started = 0;
-+		hostpad_dfs_update_offchannel_chain(iface);
- 	}
- 
- 	return 0;
-@@ -1036,6 +1277,44 @@ static int hostapd_dfs_start_channel_switch_cac(struct hostapd_iface *iface)
- 	return err;
- }
- 
-+static int
-+hostapd_dfs_offchan_start_channel_switch(struct hostapd_iface *iface, int freq)
-+{
-+	if (!hostapd_is_radar_offchan_enabled(iface))
-+		return -1; /* Offchannel chain not supported */
-+
-+	wpa_printf(MSG_DEBUG,
-+		   "%s called (offchannel CAC active: %s, CSA active: %s)",
-+		   __func__, iface->radar_offchan.cac_started ? "yes" : "no",
-+		   hostapd_csa_in_progress(iface) ? "yes" : "no");
-+
-+	/* Check if CSA in progress */
-+	if (hostapd_csa_in_progress(iface))
-+		return 0;
-+
-+	/*
-+	 * If offchannel radar detation is supported and radar channel
-+	 * monitored by offchain is available switch to it without waiting
-+	 * for the CAC otherwise let's keep a random channel.
-+	 * If radar pattern is reported on offchannel chain, just switch to
-+	 * monitor another radar channel.
-+	 */
-+	if (hostapd_dfs_is_offchan_event(iface, freq)) {
-+		hostpad_dfs_update_offchannel_chain(iface);
-+		return 0;
-+	}
-+
-+	/* Offchannel not availanle yet. Perform CAC on main chain */
-+	if (iface->radar_offchan.cac_started) {
-+		/* We want to switch to monitored channel as soon as
-+		 * CAC is completed.
-+		 */
-+		iface->radar_offchan.temp_ch = 1;
-+		return -1;
-+	}
-+
-+	return hostapd_dfs_start_channel_switch_offchan(iface);
-+}
- 
- static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- {
-@@ -1043,13 +1322,7 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 	int secondary_channel;
- 	u8 oper_centr_freq_seg0_idx;
- 	u8 oper_centr_freq_seg1_idx;
--	u8 new_vht_oper_chwidth;
- 	int skip_radar = 1;
--	struct csa_settings csa_settings;
--	unsigned int i;
--	int err = 1;
--	struct hostapd_hw_modes *cmode = iface->current_mode;
--	u8 current_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
- 	int ieee80211_mode = IEEE80211_MODE_AP;
- 
- 	wpa_printf(MSG_DEBUG, "%s called (CAC active: %s, CSA active: %s)",
-@@ -1113,73 +1386,16 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 		}
- 	}
- 
--	wpa_printf(MSG_DEBUG, "DFS will switch to a new channel %d",
--		   channel->chan);
--	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_NEW_CHANNEL
--		"freq=%d chan=%d sec_chan=%d", channel->freq,
--		channel->chan, secondary_channel);
--
--	new_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
--	hostapd_set_oper_chwidth(iface->conf, current_vht_oper_chwidth);
--
--	/* Setup CSA request */
--	os_memset(&csa_settings, 0, sizeof(csa_settings));
--	csa_settings.cs_count = 5;
--	csa_settings.block_tx = 1;
- #ifdef CONFIG_MESH
- 	if (iface->mconf)
- 		ieee80211_mode = IEEE80211_MODE_MESH;
- #endif /* CONFIG_MESH */
--	err = hostapd_set_freq_params(&csa_settings.freq_params,
--				      iface->conf->hw_mode,
--				      channel->freq,
--				      channel->chan,
--				      iface->conf->enable_edmg,
--				      iface->conf->edmg_channel,
--				      iface->conf->ieee80211n,
--				      iface->conf->ieee80211ac,
--				      iface->conf->ieee80211ax,
--				      secondary_channel,
--				      new_vht_oper_chwidth,
--				      oper_centr_freq_seg0_idx,
--				      oper_centr_freq_seg1_idx,
--				      cmode->vht_capab,
--				      &cmode->he_capab[ieee80211_mode]);
--
--	if (err) {
--		wpa_printf(MSG_ERROR, "DFS failed to calculate CSA freq params");
--		hostapd_disable_iface(iface);
--		return err;
--	}
- 
--	for (i = 0; i < iface->num_bss; i++) {
--		err = hostapd_switch_channel(iface->bss[i], &csa_settings);
--		if (err)
--			break;
--	}
--
--	if (err) {
--		wpa_printf(MSG_WARNING, "DFS failed to schedule CSA (%d) - trying fallback",
--			   err);
--		iface->freq = channel->freq;
--		iface->conf->channel = channel->chan;
--		iface->conf->secondary_channel = secondary_channel;
--		hostapd_set_oper_chwidth(iface->conf, new_vht_oper_chwidth);
--		hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
--						     oper_centr_freq_seg0_idx);
--		hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
--						     oper_centr_freq_seg1_idx);
--
--		hostapd_disable_iface(iface);
--		hostapd_enable_iface(iface);
--		return 0;
--	}
--
--	/* Channel configuration will be updated once CSA completes and
--	 * ch_switch_notify event is received */
--
--	wpa_printf(MSG_DEBUG, "DFS waiting channel switch event");
--	return 0;
-+	return hostapd_dfs_request_channel_switch(iface, channel->chan,
-+						  channel->freq,
-+						  secondary_channel,
-+						  oper_centr_freq_seg0_idx,
-+						  oper_centr_freq_seg1_idx);
- }
- 
- 
-@@ -1208,15 +1424,19 @@ int hostapd_dfs_radar_detected(struct hostapd_iface *iface, int freq,
- 	if (!res)
- 		return 0;
- 
--	/* Skip if reported radar event not overlapped our channels */
--	res = dfs_are_channels_overlapped(iface, freq, chan_width, cf1, cf2);
--	if (!res)
--		return 0;
-+	if (!hostapd_dfs_is_offchan_event(iface, freq)) {
-+		/* Skip if reported radar event not overlapped our channels */
-+		res = dfs_are_channels_overlapped(iface, freq, chan_width,
-+						  cf1, cf2);
-+		if (!res)
-+			return 0;
-+	}
- 
--	/* radar detected while operating, switch the channel. */
--	res = hostapd_dfs_start_channel_switch(iface);
-+	if (hostapd_dfs_offchan_start_channel_switch(iface, freq))
-+		/* radar detected while operating, switch the channel. */
-+		return hostapd_dfs_start_channel_switch(iface);
- 
--	return res;
-+	return 0;
- }
- 
- 
-@@ -1284,7 +1504,11 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
- 		"seg1=%d cac_time=%ds",
- 		freq, (freq - 5000) / 5, chan_offset, chan_width, cf1, cf2,
- 		iface->dfs_cac_ms / 1000);
--	iface->cac_started = 1;
-+
-+	if (hostapd_dfs_is_offchan_event(iface, freq))
-+		iface->radar_offchan.cac_started = 1;
-+	else
-+		iface->cac_started = 1;
- 	os_get_reltime(&iface->dfs_cac_start);
- 	return 0;
- }
-diff --git a/src/ap/hostapd.h b/src/ap/hostapd.h
-index 27b985d..1c6c94e 100644
---- a/src/ap/hostapd.h
-+++ b/src/ap/hostapd.h
-@@ -521,6 +521,21 @@ struct hostapd_iface {
- 	int *basic_rates;
- 	int freq;
- 
-+	/* Offchanel chain configuration */
-+	struct {
-+		int channel;
-+		int secondary_channel;
-+		int freq;
-+		int centr_freq_seg0_idx;
-+		int centr_freq_seg1_idx;
-+		/* Main chain is on temporary channel during
-+		 * CAC detection on radar offchain
-+		 */
-+		unsigned int temp_ch:1;
-+		/* CAC started on radar offchain */
-+		unsigned int cac_started:1;
-+	} radar_offchan;
-+
- 	u16 hw_flags;
- 
- 	/* Number of associated Non-ERP stations (i.e., stations using 802.11b
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 6d9194f..7ed47c0 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -777,6 +777,11 @@ struct hostapd_freq_params {
- 	 * for IEEE 802.11ay EDMG configuration.
- 	 */
- 	struct ieee80211_edmg_config edmg;
-+
-+	/**
-+	 * radar_offchan - Whether radar/CAC offchannel is requested
-+	 */
-+	int radar_offchan;
- };
- 
- /**
-@@ -2026,6 +2031,8 @@ struct wpa_driver_capa {
- #define WPA_DRIVER_FLAGS2_OCV			0x0000000000000080ULL
- /** Driver expects user space implementation of SME in AP mode */
- #define WPA_DRIVER_FLAGS2_AP_SME		0x0000000000000100ULL
-+/** Driver supports offchannel radar/CAC detection */
-+#define WPA_DRIVER_RADAR_OFFCHAN		0x0000000000000200ULL
- 	u64 flags2;
- 
- #define FULL_AP_CLIENT_STATE_SUPP(drv_flags) \
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 4db8cce..62c3cd8 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -4885,6 +4885,7 @@ static int nl80211_put_freq_params(struct nl_msg *msg,
- 	wpa_printf(MSG_DEBUG, "  * he_enabled=%d", freq->he_enabled);
- 	wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", freq->vht_enabled);
- 	wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", freq->ht_enabled);
-+	wpa_printf(MSG_DEBUG, "  * radar_offchan=%d", freq->radar_offchan);
- 
- 	hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
- 	is_24ghz = hw_mode == HOSTAPD_MODE_IEEE80211G ||
-@@ -4962,6 +4963,9 @@ static int nl80211_put_freq_params(struct nl_msg *msg,
- 				NL80211_CHAN_NO_HT))
- 			return -ENOBUFS;
- 	}
-+	if (freq->radar_offchan)
-+		nla_put_flag(msg, NL80211_ATTR_RADAR_OFFCHAN);
-+
- 	return 0;
- }
- 
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index cd596e3..e370ef3 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -665,6 +665,10 @@ static void wiphy_info_ext_feature_flags(struct wiphy_info_data *info,
- 	if (ext_feature_isset(ext_features, len,
- 			      NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION))
- 		capa->flags2 |= WPA_DRIVER_FLAGS2_OCV;
-+
-+	if (ext_feature_isset(ext_features, len,
-+			      NL80211_EXT_FEATURE_RADAR_OFFCHAN))
-+		capa->flags2 |= WPA_DRIVER_RADAR_OFFCHAN;
- }
- 
- 
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index f7be755..736b483 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -2573,6 +2573,10 @@ enum nl80211_commands {
-  * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
-  *	transmit power to stay within regulatory limits. u32, dBi.
-  *
-+ * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated chain available for radar
-+ *	detection on some hw. The chain can't be used to transmits or receives
-+ *	frames. The driver is supposed to implement CAC management in sw or fw.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3078,6 +3082,8 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
- 
-+	NL80211_ATTR_RADAR_OFFCHAN,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5974,6 +5980,9 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-  *	detection and change announcemnts.
-  *
-+ * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
-+ *	detection.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6039,6 +6048,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
- 	NL80211_EXT_FEATURE_BSS_COLOR,
-+	NL80211_EXT_FEATURE_RADAR_OFFCHAN,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
diff --git a/recipes-connectivity/hostapd/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch b/recipes-connectivity/hostapd/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch
index f6832e3..ad9c926 100644
--- a/recipes-connectivity/hostapd/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch
+++ b/recipes-connectivity/hostapd/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch
@@ -1,31 +1,21 @@
-From 56613ad9b568a3ac7467105beaa162c68ffbbf70 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 20:20:03 +0800
-Subject: [PATCH 4/9] Support configuring BSS Termination TSF by using
+From 6a949f8644546d689b7271228d19b1b1ad80632f Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 19:56:18 +0800
+Subject: [PATCH 1/6] Support configuring BSS Termination TSF by using
  hostapd_cli command
 
 ---
- hostapd/ctrl_iface.c | 9 +++++++++
- src/ap/ap_config.c   | 1 +
- src/ap/ap_config.h   | 1 +
- 3 files changed, 11 insertions(+)
+ hostapd/ctrl_iface.c   | 5 +++++
+ src/ap/ap_config.c     | 1 +
+ src/ap/ap_config.h     | 1 +
+ src/ap/ctrl_iface_ap.c | 4 ++++
+ 4 files changed, 11 insertions(+)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index f50fafb..1b5a091 100644
+index 4718368..e0a7e4f 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -954,6 +954,10 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
- 			return -1;
- 		}
-+		if (hapd->conf->bss_termination_tsf) {
-+			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
-+		}
-+
- 		end++;
- 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
- 	}
-@@ -1589,6 +1593,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+@@ -1326,6 +1326,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
  #endif /* CONFIG_DPP */
  	} else if (os_strcasecmp(cmd, "setband") == 0) {
  		ret = hostapd_ctrl_iface_set_band(hapd, value);
@@ -38,7 +28,7 @@
  		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
  		if (ret)
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 1f04686..078a3fc 100644
+index 23b67e1..f248281 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
@@ -50,10 +40,10 @@
  
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index f3aff36..7301bbb 100644
+index f795ee9..5dab8be 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -549,6 +549,7 @@ struct hostapd_bss_config {
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
  	int wnm_sleep_mode;
  	int wnm_sleep_mode_no_keys;
  	int bss_transition;
@@ -61,6 +51,21 @@
  
  	/* IEEE 802.11u - Interworking */
  	int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index c496e4f..aad5180 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1202,6 +1202,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ 			return -1;
+ 		}
++		if (hapd->conf->bss_termination_tsf) {
++			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++		}
++
+ 		end++;
+ 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ 	}
 -- 
 2.18.0
 
diff --git a/recipes-connectivity/hostapd/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch b/recipes-connectivity/hostapd/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch
index 1bf102a..37f2d96 100644
--- a/recipes-connectivity/hostapd/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch
+++ b/recipes-connectivity/hostapd/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch
@@ -1,17 +1,17 @@
-From 9043eff145701c6324ae48966301681adacb89c4 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:16:45 +0800
-Subject: [PATCH 7/9] Support including neighbor report elements in BTM request
+From e6f1c893d375aa952e1f9c8c1eb4ecacf588e4e2 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 19:58:57 +0800
+Subject: [PATCH 4/6] Support including neighbor report elements in BTM request
 
 ---
- hostapd/ctrl_iface.c | 7 ++++++-
+ src/ap/ctrl_iface_ap.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)
 
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 1b5a091..5a82ae6 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -984,8 +984,13 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index aad5180..fccc5f9 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1232,8 +1232,13 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
  		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
  	}
  
diff --git a/recipes-connectivity/hostapd/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch b/recipes-connectivity/hostapd/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch
index 14571fe..f77deb2 100644
--- a/recipes-connectivity/hostapd/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch
+++ b/recipes-connectivity/hostapd/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch
@@ -1,21 +1,19 @@
-From 6fc069a54efb892e486dfde59cb97e0023dbbf5d Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:27:55 +0800
-Subject: [PATCH 8/9] Add hostapd_neighbor_set_own_report_pref()
+From 12b95b365372ca8167b8fdbfd192fcd4dcb11419 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 20:00:49 +0800
+Subject: [PATCH 5/6] Add hostapd_neighbor_set_own_report_pref()
 
-If my own BSS is going to terminate itself, the preference value of neighbor
-report must be set to 0.
 ---
- hostapd/ctrl_iface.c |  5 ++++-
- src/ap/neighbor_db.c | 36 ++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h |  2 ++
- 3 files changed, 42 insertions(+), 1 deletion(-)
+ src/ap/ctrl_iface_ap.c |  6 +++++-
+ src/ap/neighbor_db.c   | 36 ++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |  2 ++
+ 3 files changed, 43 insertions(+), 1 deletion(-)
 
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 5a82ae6..3146a25 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -993,8 +993,11 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index fccc5f9..d5d4e33 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1241,8 +1241,12 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
  	}
  	if (os_strstr(cmd, " abridged=1"))
  		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
@@ -25,14 +23,15 @@
 +		/* Set own BSS neighbor report preference value as 0 */
 +		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
 +	}
++
  
  #ifdef CONFIG_MBO
  	pos = os_strstr(cmd, "mbo=");
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index ce6865d..bc1b163 100644
+index fabe64d..20a4417 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
-@@ -352,3 +352,39 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+@@ -355,3 +355,39 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
  	wpabuf_free(nr);
  #endif /* NEED_AP_MLME */
  }
diff --git a/recipes-connectivity/hostapd/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch b/recipes-connectivity/hostapd/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
index 632475c..8a9e47e 100644
--- a/recipes-connectivity/hostapd/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
+++ b/recipes-connectivity/hostapd/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
@@ -1,22 +1,20 @@
-From 7aab6cf66cfb7dea480d16e312e0f0eb08e758ab Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:32:17 +0800
-Subject: [PATCH 9/9] Add hostapd_neighbor_set_pref_by_non_pref_chan()
+From be49aa855a83b3bb0c6a96380960b54cbdabcb56 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 20:02:06 +0800
+Subject: [PATCH 6/6] Add hostapd_neighbor_set_pref_by_non_pref_chan()
 
-The preference value of neighbor report shall be modified according to struct
-non_pref_chan_info.
 ---
- hostapd/ctrl_iface.c |  2 ++
- src/ap/neighbor_db.c | 51 ++++++++++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h |  4 ++++
+ src/ap/ctrl_iface_ap.c |  2 ++
+ src/ap/neighbor_db.c   | 51 ++++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |  4 ++++
  3 files changed, 57 insertions(+)
 
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 3146a25..974e5b9 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -1000,6 +1000,8 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 	}
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index d5d4e33..a888b76 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1249,6 +1249,8 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 
  
  #ifdef CONFIG_MBO
 +	hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
@@ -25,10 +23,10 @@
  	if (pos) {
  		unsigned int mbo_reason, cell_pref, reassoc_delay;
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index bc1b163..75b6fcc 100644
+index 20a4417..8c27da9 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
-@@ -388,3 +388,54 @@ void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_b
+@@ -391,3 +391,54 @@ void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_b
  		}
  	}
  }
diff --git a/recipes-connectivity/hostapd/files/patches/912-master-add-the-destination-address-of-unsolicited-Probe.patch b/recipes-connectivity/hostapd/files/patches/912-master-add-the-destination-address-of-unsolicited-Probe.patch
deleted file mode 100644
index e9b630f..0000000
--- a/recipes-connectivity/hostapd/files/patches/912-master-add-the-destination-address-of-unsolicited-Probe.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 96a7f383290f78e15f1e7a5bc33099c81f104c5b Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Fri, 6 May 2022 11:02:36 +0800
-Subject: hostapd: Add the destination address of unsolicited Probe Response
- frame
-
-Without this, hostapd generates Probe Response frames with the null
-destination address when hostapd enables unsolicited Probe Response
-frame transmission. Fix this to use the broadcast address instead.
-
-Fixes: 024b4b2a298f ("AP: Unsolicited broadcast Probe Response configuration")
-Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
----
- src/ap/beacon.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index eaa403326..58872bfda 100644
---- a/src/ap/beacon.c
-+++ b/src/ap/beacon.c
-@@ -464,7 +464,8 @@ static u8 * hostapd_eid_supported_op_classes(struct hostapd_data *hapd, u8 *eid)
- 
- static u8 * hostapd_gen_probe_resp(struct hostapd_data *hapd,
- 				   const struct ieee80211_mgmt *req,
--				   int is_p2p, size_t *resp_len)
-+				   int is_p2p, size_t *resp_len,
-+				   bool bcast_probe_resp)
- {
- 	struct ieee80211_mgmt *resp;
- 	u8 *pos, *epos, *csa_pos;
-@@ -531,6 +532,9 @@ static u8 * hostapd_gen_probe_resp(struct hostapd_data *hapd,
- 					   WLAN_FC_STYPE_PROBE_RESP);
- 	if (req)
- 		os_memcpy(resp->da, req->sa, ETH_ALEN);
-+	else if (bcast_probe_resp)
-+		os_memset(resp->da, 0xff, ETH_ALEN);
-+
- 	os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
- 
- 	os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
-@@ -1141,7 +1145,7 @@ void handle_probe_req(struct hostapd_data *hapd,
- 		     " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
- 
- 	resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
--				      &resp_len);
-+				      &resp_len, false);
- 	if (resp == NULL)
- 		return;
- 
-@@ -1210,7 +1214,7 @@ static u8 * hostapd_probe_resp_offloads(struct hostapd_data *hapd,
- 			   "this");
- 
- 	/* Generate a Probe Response template for the non-P2P case */
--	return hostapd_gen_probe_resp(hapd, NULL, 0, resp_len);
-+	return hostapd_gen_probe_resp(hapd, NULL, 0, resp_len, false);
- }
- 
- #endif /* NEED_AP_MLME */
-@@ -1228,7 +1232,8 @@ static u8 * hostapd_unsol_bcast_probe_resp(struct hostapd_data *hapd,
- 		hapd->conf->unsol_bcast_probe_resp_interval;
- 
- 	return hostapd_gen_probe_resp(hapd, NULL, 0,
--				      &params->unsol_bcast_probe_resp_tmpl_len);
-+				      &params->unsol_bcast_probe_resp_tmpl_len,
-+				      true);
- }
- #endif /* CONFIG_IEEE80211AX */
- 
--- 
-cgit v1.2.3-18-g5258
-
diff --git a/recipes-connectivity/hostapd/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch b/recipes-connectivity/hostapd/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch
index 306b221..d217f5d 100644
--- a/recipes-connectivity/hostapd/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch
+++ b/recipes-connectivity/hostapd/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch
@@ -1,7 +1,7 @@
-From 8c9d9f2b8da1b0e3e0832e7d7b02d75c4c0a4f3e Mon Sep 17 00:00:00 2001
+From 31ec868f23a1bae48fceab6f2fb5f8b1a3a909a1 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Thu, 24 May 2022 21:48:21 +0800
-Subject: [PATCH] hostapd:v2 add support for runtime set in-band discovery-v2
+Date: Tue, 31 May 2022 21:15:54 +0800
+Subject: [PATCH] hostapd: add support for runtime set in-band discovery
 
 Usage:
 hostapd_cli unsolic_probe_resp [tx_type] [interval]
@@ -12,18 +12,18 @@
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
- hostapd/ctrl_iface.c         | 62 ++++++++++++++++++++++++++++++++++++
- hostapd/hostapd_cli.c        | 20 ++++++++++++
+ hostapd/ctrl_iface.c         | 66 ++++++++++++++++++++++++++++++++++++
+ hostapd/hostapd_cli.c        | 20 +++++++++++
  src/ap/beacon.c              |  5 ++-
  src/drivers/driver_nl80211.c |  8 +++--
  src/drivers/nl80211_copy.h   |  1 +
- 5 files changed, 92 insertions(+), 4 deletions(-)
+ 5 files changed, 96 insertions(+), 4 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 86adf18e5..41740cfd5 100644
+index 86adf18e5..ce04cd641 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -769,6 +769,65 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
+@@ -769,6 +769,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
  
  #endif /* CONFIG_INTERWORKING */
  
@@ -57,8 +57,10 @@
 +#define UNSOL_PROBE_RESP 1
 +#define FILS_DISCOVERY 2
 +
++#ifdef CONFIG_FILS
 +	conf->fils_discovery_max_int = 0;
 +	conf->fils_discovery_min_int = 0;
++#endif /* CONFIG_FILS */
 +	conf->unsol_bcast_probe_resp_interval = 0;
 +
 +	switch (tx_type) {
@@ -70,11 +72,13 @@
 +		/* Enable Unsolicited probe response */
 +		conf->unsol_bcast_probe_resp_interval = interval;
 +		break;
++#ifdef CONFIG_FILS
 +	case FILS_DISCOVERY:
 +		/* Enable FILS discovery */
 +		conf->fils_discovery_min_int = interval;
 +		conf->fils_discovery_max_int = interval;
 +		break;
++#endif /* CONFIG_FILS */
 +	}
 +
 +	ret = ieee802_11_update_beacons(hapd->iface);
@@ -89,7 +93,7 @@
  
  #ifdef CONFIG_WNM_AP
  
-@@ -3673,6 +3732,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+@@ -3673,6 +3736,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  		if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
  			reply_len = -1;
  #endif /* CONFIG_WNM_AP */
@@ -138,10 +142,10 @@
  };
  
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 3c49653cc..367e32611 100644
+index a96155ada..68e847956 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -1406,6 +1406,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+@@ -1408,6 +1408,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
  				   struct wpa_driver_ap_params *params)
  {
  	params->fd_max_int = hapd->conf->fils_discovery_max_int;
@@ -150,7 +154,7 @@
  	if (is_6ghz_op_class(hapd->iconf->op_class) &&
  	    params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
  		params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
-@@ -1414,7 +1416,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+@@ -1416,7 +1418,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
  	if (params->fd_min_int > params->fd_max_int)
  		params->fd_min_int = params->fd_max_int;
  
diff --git a/recipes-connectivity/hostapd/files/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch b/recipes-connectivity/hostapd/files/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
new file mode 100644
index 0000000..3665c6c
--- /dev/null
+++ b/recipes-connectivity/hostapd/files/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
@@ -0,0 +1,38 @@
+From f0e9f5aab52b3eab85d28338cc996972ced4c39c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 17 May 2022 23:07:59 +0200
+Subject: [PATCH] ctrl: make WNM_AP functions dependant on CONFIG_AP
+
+This fixes linking errors found when compiling wpa_supplicant with
+CONFIG_WNM_AP enabled but CONFIG_AP disabled.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ wpa_supplicant/ctrl_iface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
+index ac337e0f5..6e23114e6 100644
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -12185,7 +12185,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+ 		if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
+ 			reply_len = -1;
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_WNM_AP
++#if defined(CONFIG_AP) && defined(CONFIG_WNM_AP)
+ 	} else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
+ 		if (ap_ctrl_iface_disassoc_imminent(wpa_s, buf + 18))
+ 			reply_len = -1;
+@@ -12195,7 +12195,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+ 	} else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
+ 		if (ap_ctrl_iface_bss_tm_req(wpa_s, buf + 11))
+ 			reply_len = -1;
+-#endif /* CONFIG_WNM_AP */
++#endif /* CONFIG_AP && CONFIG_WNM_AP */
+ 	} else if (os_strcmp(buf, "FLUSH") == 0) {
+ 		wpa_supplicant_ctrl_iface_flush(wpa_s);
+ 	} else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
+-- 
+2.35.1
+
diff --git a/recipes-connectivity/hostapd/files/patches/patches.inc b/recipes-connectivity/hostapd/files/patches/patches.inc
index 36ec650..af2e054 100644
--- a/recipes-connectivity/hostapd/files/patches/patches.inc
+++ b/recipes-connectivity/hostapd/files/patches/patches.inc
@@ -35,6 +35,7 @@
     file://461-driver_nl80211-use-new-parameters-during-ibss-join.patch \
     file://463-add-mcast_rate-to-11s.patch \
     file://464-fix-mesh-obss-check.patch \
+    file://465-hostapd-config-support-random-BSS-color.patch \
     file://470-survey_data_fallback.patch \
     file://500-lto-jobserver-support.patch \
     file://590-rrm-wnm-statistics.patch \
@@ -49,8 +50,7 @@
     file://740-snoop_iface.patch \
     file://750-qos_map_set_without_interworking.patch \
     file://751-qos_map_ignore_when_unsupported.patch \
-    file://900-master-sync-include-uapi-linux-nl80211.patch \
-    file://901-master-zero-wait_dfs.patch \
+    file://812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch \
     file://902-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_inse.patch \
     file://903-master-Support-including-neighbor-report-elements-in-ANQP-r.patch \
     file://904-master-Support-including-neignbor-report-elements-in-BTM-re.patch \
@@ -61,6 +61,6 @@
     file://909-master-Add-hostapd_neighbor_set_own_report_pref.patch \
     file://910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch \
     file://911-master-print-sae-groups-by-hostapd-ctrl.patch \
-    file://912-master-add-the-destination-address-of-unsolicited-Probe.patch \
     file://913-master-add-support-for-runtime-set-in-band-discover.patch \
+    file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     "
diff --git a/recipes-connectivity/hostapd/files/src/src/ap/ubus.c b/recipes-connectivity/hostapd/files/src/src/ap/ubus.c
index fa325ea..1199098 100644
--- a/recipes-connectivity/hostapd/files/src/src/ap/ubus.c
+++ b/recipes-connectivity/hostapd/files/src/src/ap/ubus.c
@@ -445,6 +445,12 @@
 	blobmsg_add_u32(&b, "channel", channel);
 	blobmsg_add_u32(&b, "op_class", op_class);
 	blobmsg_add_u32(&b, "beacon_interval", hapd->iconf->beacon_int);
+#ifdef CONFIG_IEEE80211AX
+	blobmsg_add_u32(&b, "bss_color", hapd->iface->conf->he_op.he_bss_color_disabled ? -1 :
+					 hapd->iface->conf->he_op.he_bss_color);
+#else
+	blobmsg_add_u32(&b, "bss_color", -1);
+#endif
 
 	snprintf(phy_name, 17, "%s", hapd->iface->phy);
 	blobmsg_add_string(&b, "phy", phy_name);
@@ -888,10 +894,13 @@
 				css.freq_params.ht_enabled,
 				css.freq_params.vht_enabled,
 				css.freq_params.he_enabled,
+				css.freq_params.eht_enabled,
 				css.freq_params.sec_channel_offset,
 				chwidth, seg0, seg1,
 				iconf->vht_capab,
 				mode ? &mode->he_capab[IEEE80211_MODE_AP] :
+				NULL,
+				mode ? &mode->eht_capab[IEEE80211_MODE_AP] :
 				NULL);
 
 	for (i = 0; i < hapd->iface->num_bss; i++) {
@@ -1570,50 +1579,6 @@
 	return hostapd_bss_tr_send(hapd, addr, da_imminent, abridged, da_timer, valid_period,
 				   dialog_token, tb[BSS_TR_NEIGHBORS]);
 }
-
-enum {
-	WNM_DISASSOC_ADDR,
-	WNM_DISASSOC_DURATION,
-	WNM_DISASSOC_NEIGHBORS,
-	WNM_DISASSOC_ABRIDGED,
-	__WNM_DISASSOC_MAX,
-};
-
-static const struct blobmsg_policy wnm_disassoc_policy[__WNM_DISASSOC_MAX] = {
-	[WNM_DISASSOC_ADDR] = { "addr", BLOBMSG_TYPE_STRING },
-	[WNM_DISASSOC_DURATION] { "duration", BLOBMSG_TYPE_INT32 },
-	[WNM_DISASSOC_NEIGHBORS] { "neighbors", BLOBMSG_TYPE_ARRAY },
-	[WNM_DISASSOC_ABRIDGED] { "abridged", BLOBMSG_TYPE_BOOL },
-};
-
-static int
-hostapd_wnm_disassoc_imminent(struct ubus_context *ctx, struct ubus_object *obj,
-			      struct ubus_request_data *ureq, const char *method,
-			      struct blob_attr *msg)
-{
-	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-	struct blob_attr *tb[__WNM_DISASSOC_MAX];
-	struct sta_info *sta;
-	int duration = 10;
-	u8 addr[ETH_ALEN];
-	bool abridged;
-
-	blobmsg_parse(wnm_disassoc_policy, __WNM_DISASSOC_MAX, tb, blob_data(msg), blob_len(msg));
-
-	if (!tb[WNM_DISASSOC_ADDR])
-		return UBUS_STATUS_INVALID_ARGUMENT;
-
-	if (hwaddr_aton(blobmsg_data(tb[WNM_DISASSOC_ADDR]), addr))
-		return UBUS_STATUS_INVALID_ARGUMENT;
-
-	if (tb[WNM_DISASSOC_DURATION])
-		duration = blobmsg_get_u32(tb[WNM_DISASSOC_DURATION]);
-
-	abridged = !!(tb[WNM_DISASSOC_ABRIDGED] && blobmsg_get_bool(tb[WNM_DISASSOC_ABRIDGED]));
-
-	return hostapd_bss_tr_send(hapd, addr, true, abridged, duration, duration,
-				   1, tb[WNM_DISASSOC_NEIGHBORS]);
-}
 #endif
 
 #ifdef CONFIG_AIRTIME_POLICY
@@ -1698,7 +1663,6 @@
 	UBUS_METHOD("rrm_beacon_req", hostapd_rrm_beacon_req, beacon_req_policy),
 	UBUS_METHOD("link_measurement_req", hostapd_rrm_lm_req, lm_req_policy),
 #ifdef CONFIG_WNM_AP
-	UBUS_METHOD("wnm_disassoc_imminent", hostapd_wnm_disassoc_imminent, wnm_disassoc_policy),
 	UBUS_METHOD("bss_transition_request", hostapd_bss_transition_request, bss_tr_policy),
 #endif
 };
diff --git a/recipes-connectivity/hostapd/hostapd_2.10.bb b/recipes-connectivity/hostapd/hostapd_2.10.bb
index 0a487db..c36cbe3 100644
--- a/recipes-connectivity/hostapd/hostapd_2.10.bb
+++ b/recipes-connectivity/hostapd/hostapd_2.10.bb
@@ -12,7 +12,7 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches:"
 
-SRCREV ?= "cff80b4f7d3c0a47c052e8187d671710f48939e4"
+SRCREV ?= "b859b9bceadccd882252ff0aa2fdba0d3b91764e"
 SRC_URI = " \
     git://w1.fi/hostap.git;protocol=https;branch=main \
     file://hostapd-full.config \
diff --git a/recipes-connectivity/iw/iw_5.19.bb b/recipes-connectivity/iw/iw_5.19.bb
index ae43225..8241477 100644
--- a/recipes-connectivity/iw/iw_5.19.bb
+++ b/recipes-connectivity/iw/iw_5.19.bb
@@ -9,12 +9,12 @@
 
 DEPENDS = "libnl"
 
-SRC_URI = "http://www.kernel.org/pub/software/network/iw/${BP}.tar.gz \
+SRC_URI = "http://www.kernel.org/pub/software/network/iw/${BP}.tar.xz \
            file://0001-iw-version.sh-don-t-use-git-describe-for-versioning.patch \
            file://separate-objdir.patch \
 "
 
-SRC_URI[sha256sum] = "2a44676d28a87bbc232903d5d573e7618e4fae0cea3a1aff067a26fa66652b75"
+SRC_URI[sha256sum] = "f167bbe947dd53bb9ebc0c1dcef5db6ad73ac1d6084f2c6f9376c5c360cc4d4e"
 
 FILESEXTRAPATHS_prepend := "${THISDIR}/patches:"
 require patches/patches.inc
diff --git a/recipes-connectivity/wpa-supplicant/files/0001-Install-wpa_passphrase-when-not-disabled.patch b/recipes-connectivity/wpa-supplicant/files/0001-Install-wpa_passphrase-when-not-disabled.patch
deleted file mode 100644
index c04c608..0000000
--- a/recipes-connectivity/wpa-supplicant/files/0001-Install-wpa_passphrase-when-not-disabled.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 57b12a1e43605f71239a21488cb9b541f0751dda Mon Sep 17 00:00:00 2001
-From: Alex Kiernan <alexk@zuma.ai>
-Date: Thu, 21 Apr 2022 10:15:29 +0100
-Subject: [PATCH] Install wpa_passphrase when not disabled
-
-As part of fixing CONFIG_NO_WPA_PASSPHRASE, whilst wpa_passphrase gets
-built, its not installed during `make install`.
-
-Fixes: cb41c214b78d ("build: Re-enable options for libwpa_client.so and wpa_passphrase")
-Signed-off-by: Alex Kiernan <alexk@zuma.ai>
-Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
-Upstream-Status: Submitted [http://lists.infradead.org/pipermail/hostap/2022-April/040448.html]
----
- wpa_supplicant/Makefile | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
-index 0bab313f2355..12787c0c7d0f 100644
---- a/wpa_supplicant/Makefile
-+++ b/wpa_supplicant/Makefile
-@@ -73,6 +73,9 @@ $(DESTDIR)$(BINDIR)/%: %
- 
- install: $(addprefix $(DESTDIR)$(BINDIR)/,$(BINALL))
- 	$(MAKE) -C ../src install
-+ifndef CONFIG_NO_WPA_PASSPHRASE
-+	install -D wpa_passphrase $(DESTDIR)/$(BINDIR)/wpa_passphrase
-+endif
- ifdef CONFIG_BUILD_WPA_CLIENT_SO
- 	install -m 0644 -D libwpa_client.so $(DESTDIR)/$(LIBDIR)/libwpa_client.so
- 	install -m 0644 -D ../src/common/wpa_ctrl.h $(DESTDIR)/$(INCDIR)/wpa_ctrl.h
--- 
-2.35.1
-
diff --git a/recipes-connectivity/wpa-supplicant/files/0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch b/recipes-connectivity/wpa-supplicant/files/0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch
deleted file mode 100644
index 6e930fc..0000000
--- a/recipes-connectivity/wpa-supplicant/files/0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From cb41c214b78d6df187a31950342e48a403dbd769 Mon Sep 17 00:00:00 2001
-From: Sergey Matyukevich <geomatsi@gmail.com>
-Date: Tue, 22 Feb 2022 11:52:19 +0300
-Subject: [PATCH 1/2] build: Re-enable options for libwpa_client.so and
- wpa_passphrase
-
-Commit a41a29192e5d ("build: Pull common fragments into a build.rules
-file") introduced a regression into wpa_supplicant build process. The
-build target libwpa_client.so is not built regardless of whether the
-option CONFIG_BUILD_WPA_CLIENT_SO is set or not. This happens because
-this config option is used before it is imported from the configuration
-file. Moving its use after including build.rules does not help: the
-variable ALL is processed by build.rules and further changes are not
-applied. Similarly, option CONFIG_NO_WPA_PASSPHRASE also does not work
-as expected: wpa_passphrase is always built regardless of whether the
-option is set or not.
-
-Re-enable these options by adding both build targets to _all
-dependencies.
-
-Fixes: a41a29192e5d ("build: Pull common fragments into a build.rules file")
-Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
-Upstream-Status: Backport
-Signed-off-by: Alex Kiernan <alexk@zuma.ai>
-Signed-off-by: Alex Kiernan <alexk@gmail.com>
----
- wpa_supplicant/Makefile | 19 ++++++++++++-------
- 1 file changed, 12 insertions(+), 7 deletions(-)
-
-diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
-index cb66defac7c8..c456825ae75f 100644
---- a/wpa_supplicant/Makefile
-+++ b/wpa_supplicant/Makefile
-@@ -1,24 +1,29 @@
- BINALL=wpa_supplicant wpa_cli
- 
--ifndef CONFIG_NO_WPA_PASSPHRASE
--BINALL += wpa_passphrase
--endif
--
- ALL = $(BINALL)
- ALL += systemd/wpa_supplicant.service
- ALL += systemd/wpa_supplicant@.service
- ALL += systemd/wpa_supplicant-nl80211@.service
- ALL += systemd/wpa_supplicant-wired@.service
- ALL += dbus/fi.w1.wpa_supplicant1.service
--ifdef CONFIG_BUILD_WPA_CLIENT_SO
--ALL += libwpa_client.so
--endif
- 
- EXTRA_TARGETS=dynamic_eap_methods
- 
- CONFIG_FILE=.config
- include ../src/build.rules
- 
-+ifdef CONFIG_BUILD_WPA_CLIENT_SO
-+# add the dependency this way to allow CONFIG_BUILD_WPA_CLIENT_SO
-+# being set in the config which is read by build.rules
-+_all: libwpa_client.so
-+endif
-+
-+ifndef CONFIG_NO_WPA_PASSPHRASE
-+# add the dependency this way to allow CONFIG_NO_WPA_PASSPHRASE
-+# being set in the config which is read by build.rules
-+_all: wpa_passphrase
-+endif
-+
- ifdef LIBS
- # If LIBS is set with some global build system defaults, clone those for
- # LIBS_c and LIBS_p to cover wpa_passphrase and wpa_cli as well.
--- 
-2.35.1
-
diff --git a/recipes-connectivity/wpa-supplicant/files/0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch b/recipes-connectivity/wpa-supplicant/files/0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch
deleted file mode 100644
index 53b0fcd..0000000
--- a/recipes-connectivity/wpa-supplicant/files/0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From d001b301ba7987f4b39453a211631b85c48f2ff8 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <quic_jouni@quicinc.com>
-Date: Thu, 3 Mar 2022 13:26:42 +0200
-Subject: [PATCH 2/2] Fix removal of wpa_passphrase on 'make clean'
-
-Fixes: 0430bc8267b4 ("build: Add a common-clean target")
-Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
-Upstream-Status: Backport
-Signed-off-by: Alex Kiernan <alexk@zuma.ai>
-Signed-off-by: Alex Kiernan <alexk@gmail.com>
----
- wpa_supplicant/Makefile | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
-index c456825ae75f..4b4688931b1d 100644
---- a/wpa_supplicant/Makefile
-+++ b/wpa_supplicant/Makefile
-@@ -2077,3 +2077,4 @@ clean: common-clean
- 	rm -f libwpa_client.a
- 	rm -f libwpa_client.so
- 	rm -f libwpa_test1 libwpa_test2
-+	rm -f wpa_passphrase
--- 
-2.35.1
-
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/340-reload_freq_change.patch b/recipes-connectivity/wpa-supplicant/files/patches/340-reload_freq_change.patch
index 3d51a47..89259f2 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/340-reload_freq_change.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/340-reload_freq_change.patch
@@ -1,6 +1,6 @@
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -115,6 +115,28 @@ static void hostapd_reload_bss(struct ho
+@@ -115,6 +115,29 @@ static void hostapd_reload_bss(struct ho
  #endif /* CONFIG_NO_RADIUS */
  
  	ssid = &hapd->conf->ssid;
@@ -12,6 +12,7 @@
 +			 hapd->iconf->ieee80211n,
 +			 hapd->iconf->ieee80211ac,
 +			 hapd->iconf->ieee80211ax,
++			 hapd->iconf->ieee80211be,
 +			 hapd->iconf->secondary_channel,
 +			 hostapd_get_oper_chwidth(hapd->iconf),
 +			 hostapd_get_oper_centr_freq_seg0_idx(hapd->iconf),
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/350-nl80211_del_beacon_bss.patch b/recipes-connectivity/wpa-supplicant/files/patches/350-nl80211_del_beacon_bss.patch
index 3556783..8a2beb3 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/350-nl80211_del_beacon_bss.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/350-nl80211_del_beacon_bss.patch
@@ -1,24 +1,20 @@
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -2931,10 +2931,15 @@ static int wpa_driver_nl80211_del_beacon
- 	struct nl_msg *msg;
+@@ -2932,11 +2932,11 @@ static int wpa_driver_nl80211_del_beacon
  	struct wpa_driver_nl80211_data *drv = bss->drv;
  
-+	if (!bss->beacon_set)
-+		return 0;
-+
-+	bss->beacon_set = 0;
-+
  	wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
 -		   drv->ifindex);
 +		   bss->ifindex);
+ 	bss->beacon_set = 0;
+ 	bss->freq = 0;
  	nl80211_put_wiphy_data_ap(bss);
 -	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
-+	msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_BEACON);
++	msg = nl80211_bss_msg(drv, 0, NL80211_CMD_DEL_BEACON);
  	return send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
  }
  
-@@ -5617,7 +5622,7 @@ static void nl80211_teardown_ap(struct i
+@@ -5650,7 +5650,7 @@ static void nl80211_teardown_ap(struct i
  		nl80211_mgmt_unsubscribe(bss, "AP teardown");
  
  	nl80211_put_wiphy_data_ap(bss);
@@ -27,7 +23,7 @@
  }
  
  
-@@ -8071,8 +8076,6 @@ static int wpa_driver_nl80211_if_remove(
+@@ -8104,8 +8104,6 @@ static int wpa_driver_nl80211_if_remove(
  	} else {
  		wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
  		nl80211_teardown_ap(bss);
@@ -36,19 +32,3 @@
  		nl80211_destroy_bss(bss);
  		if (!bss->added_if)
  			i802_set_iface_flags(bss, 0);
-@@ -8469,7 +8472,6 @@ static int wpa_driver_nl80211_deinit_ap(
- 	if (!is_ap_interface(drv->nlmode))
- 		return -1;
- 	wpa_driver_nl80211_del_beacon(bss);
--	bss->beacon_set = 0;
- 
- 	/*
- 	 * If the P2P GO interface was dynamically added, then it is
-@@ -8489,7 +8491,6 @@ static int wpa_driver_nl80211_stop_ap(vo
- 	if (!is_ap_interface(drv->nlmode))
- 		return -1;
- 	wpa_driver_nl80211_del_beacon(bss);
--	bss->beacon_set = 0;
- 	return 0;
- }
- 
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/420-indicate-features.patch b/recipes-connectivity/wpa-supplicant/files/patches/420-indicate-features.patch
index f9dff66..12edb6b 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/420-indicate-features.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/420-indicate-features.patch
@@ -1,23 +1,24 @@
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -15,6 +15,7 @@
- #include "utils/common.h"
- #include "utils/eloop.h"
- #include "utils/uuid.h"
-+#include "utils/build_features.h"
- #include "crypto/random.h"
- #include "crypto/tls.h"
- #include "common/version.h"
-@@ -691,7 +692,7 @@ int main(int argc, char *argv[])
+@@ -31,7 +31,7 @@
+ #include "config_file.h"
+ #include "eap_register.h"
+ #include "ctrl_iface.h"
+-
++#include "build_features.h"
+ 
+ struct hapd_global {
+ 	void **drv_priv;
+@@ -692,7 +692,7 @@ int main(int argc, char *argv[])
  	wpa_supplicant_event = hostapd_wpa_event;
  	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
--		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:");
-+		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:v::");
+-		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:q");
++		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:qv::");
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -728,6 +729,8 @@ int main(int argc, char *argv[])
+@@ -729,6 +729,8 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_DEBUG_LINUX_TRACING */
  		case 'v':
@@ -25,7 +26,7 @@
 +				exit(!has_feature(optarg));
  			show_version();
  			exit(1);
- 			break;
+ 		case 'g':
 --- a/wpa_supplicant/main.c
 +++ b/wpa_supplicant/main.c
 @@ -12,6 +12,7 @@
@@ -33,10 +34,10 @@
  
  #include "common.h"
 +#include "build_features.h"
+ #include "crypto/crypto.h"
  #include "fst/fst.h"
  #include "wpa_supplicant_i.h"
- #include "driver_i.h"
-@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
+@@ -203,7 +204,7 @@ int main(int argc, char *argv[])
  
  	for (;;) {
  		c = getopt(argc, argv,
@@ -45,7 +46,7 @@
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -305,8 +306,12 @@ int main(int argc, char *argv[])
+@@ -306,8 +307,12 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
  		case 'v':
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/465-hostapd-config-support-random-BSS-color.patch b/recipes-connectivity/wpa-supplicant/files/patches/465-hostapd-config-support-random-BSS-color.patch
new file mode 100644
index 0000000..c0b0119
--- /dev/null
+++ b/recipes-connectivity/wpa-supplicant/files/patches/465-hostapd-config-support-random-BSS-color.patch
@@ -0,0 +1,24 @@
+From c9304d3303d563ad6d2619f4e07864ed12f96889 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 14 May 2022 21:41:03 +0200
+Subject: [PATCH] hostapd: config: support random BSS color
+
+Configure the HE BSS color to a random value in case the config defines
+a BSS color which exceeds the max BSS color (63).
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ hostapd/config_file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -3485,6 +3485,8 @@ static int hostapd_config_fill(struct ho
+ 	} else if (os_strcmp(buf, "he_bss_color") == 0) {
+ 		conf->he_op.he_bss_color = atoi(pos) & 0x3f;
+ 		conf->he_op.he_bss_color_disabled = 0;
++		if (atoi(pos) > 63)
++			conf->he_op.he_bss_color = os_random() % 63 + 1;
+ 	} else if (os_strcmp(buf, "he_bss_color_partial") == 0) {
+ 		conf->he_op.he_bss_color_partial = atoi(pos);
+ 	} else if (os_strcmp(buf, "he_default_pe_duration") == 0) {
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/750-qos_map_set_without_interworking.patch b/recipes-connectivity/wpa-supplicant/files/patches/750-qos_map_set_without_interworking.patch
index 43a4ea7..ff1d076 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/750-qos_map_set_without_interworking.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/750-qos_map_set_without_interworking.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -1644,6 +1644,8 @@ static int parse_anqp_elem(struct hostap
+@@ -1598,6 +1598,8 @@ static int parse_anqp_elem(struct hostap
  	return 0;
  }
  
@@ -9,7 +9,7 @@
  
  static int parse_qos_map_set(struct hostapd_bss_config *bss,
  			     char *buf, int line)
-@@ -1685,8 +1687,6 @@ static int parse_qos_map_set(struct host
+@@ -1639,8 +1641,6 @@ static int parse_qos_map_set(struct host
  	return 0;
  }
  
@@ -18,7 +18,7 @@
  
  #ifdef CONFIG_HS20
  static int hs20_parse_conn_capab(struct hostapd_bss_config *bss, char *buf,
-@@ -4077,10 +4077,10 @@ static int hostapd_config_fill(struct ho
+@@ -4042,10 +4042,10 @@ static int hostapd_config_fill(struct ho
  		bss->gas_frag_limit = val;
  	} else if (os_strcmp(buf, "gas_comeback_delay") == 0) {
  		bss->gas_comeback_delay = atoi(pos);
@@ -32,7 +32,7 @@
  		os_free(bss->dump_msk_file);
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -1415,6 +1415,7 @@ static int hostapd_setup_bss(struct host
+@@ -1423,6 +1423,7 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "GAS server initialization failed");
  		return -1;
  	}
@@ -40,7 +40,7 @@
  
  	if (conf->qos_map_set_len &&
  	    hostapd_drv_set_qos_map(hapd, conf->qos_map_set,
-@@ -1422,7 +1423,6 @@ static int hostapd_setup_bss(struct host
+@@ -1430,7 +1431,6 @@ static int hostapd_setup_bss(struct host
  		wpa_printf(MSG_ERROR, "Failed to initialize QoS Map");
  		return -1;
  	}
@@ -48,40 +48,9 @@
  
  	if (conf->bss_load_update_period && bss_load_update_init(hapd)) {
  		wpa_printf(MSG_ERROR, "BSS Load initialization failed");
---- a/src/ap/drv_callbacks.c
-+++ b/src/ap/drv_callbacks.c
-@@ -271,12 +271,10 @@ int hostapd_notif_assoc(struct hostapd_d
- 	}
- #endif /* NEED_AP_MLME */
- 
--#ifdef CONFIG_INTERWORKING
- 	if (elems.ext_capab && elems.ext_capab_len > 4) {
- 		if (elems.ext_capab[4] & 0x01)
- 			sta->qos_map_enabled = 1;
- 	}
--#endif /* CONFIG_INTERWORKING */
- 
- #ifdef CONFIG_HS20
- 	wpabuf_free(sta->hs20_ie);
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -4129,13 +4129,11 @@ static u16 copy_supp_rates(struct hostap
- static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
- 			   const u8 *ext_capab_ie, size_t ext_capab_ie_len)
- {
--#ifdef CONFIG_INTERWORKING
- 	/* check for QoS Map support */
- 	if (ext_capab_ie_len >= 5) {
- 		if (ext_capab_ie[4] & 0x01)
- 			sta->qos_map_enabled = 1;
- 	}
--#endif /* CONFIG_INTERWORKING */
- 
- 	if (ext_capab_ie_len > 0) {
- 		sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -2540,8 +2540,6 @@ void wnm_bss_keep_alive_deinit(struct wp
+@@ -2586,8 +2586,6 @@ void wnm_bss_keep_alive_deinit(struct wp
  }
  
  
@@ -90,7 +59,7 @@
  static int wpas_qos_map_set(struct wpa_supplicant *wpa_s, const u8 *qos_map,
  			    size_t len)
  {
-@@ -2574,8 +2572,6 @@ static void interworking_process_assoc_r
+@@ -2620,8 +2618,6 @@ static void interworking_process_assoc_r
  	}
  }
  
@@ -99,7 +68,7 @@
  
  static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s,
  					const u8 *ies, size_t ies_len)
-@@ -2908,10 +2904,8 @@ static int wpa_supplicant_event_associnf
+@@ -2954,10 +2950,8 @@ static int wpa_supplicant_event_associnf
  		wnm_process_assoc_resp(wpa_s, data->assoc_info.resp_ies,
  				       data->assoc_info.resp_ies_len);
  #endif /* CONFIG_WNM */
@@ -110,3 +79,19 @@
  		if (wpa_s->hw_capab == CAPAB_VHT &&
  		    get_ie(data->assoc_info.resp_ies,
  			   data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP))
+--- a/src/ap/ieee802_11_shared.c
++++ b/src/ap/ieee802_11_shared.c
+@@ -1098,13 +1098,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_da
+ u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
+ 		    const u8 *ext_capab_ie, size_t ext_capab_ie_len)
+ {
+-#ifdef CONFIG_INTERWORKING
+ 	/* check for QoS Map support */
+ 	if (ext_capab_ie_len >= 5) {
+ 		if (ext_capab_ie[4] & 0x01)
+ 			sta->qos_map_enabled = 1;
+ 	}
+-#endif /* CONFIG_INTERWORKING */
+ 
+ 	if (ext_capab_ie_len > 0) {
+ 		sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch b/recipes-connectivity/wpa-supplicant/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
new file mode 100644
index 0000000..68935df
--- /dev/null
+++ b/recipes-connectivity/wpa-supplicant/files/patches/812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch
@@ -0,0 +1,44 @@
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index 55b7188..6af0ef2 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1048,7 +1048,7 @@ static int hostapd_dfs_request_channel_switch(struct hostapd_iface *iface,
+ }
+ 
+ 
+-static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
++static int hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
+ {
+ 	int sec = 0;
+ 	enum dfs_channel_type channel_type = DFS_NO_CAC_YET;
+@@ -1084,7 +1084,7 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
+ 				  oper_centr_freq_seg1_idx, true)) {
+ 		wpa_printf(MSG_ERROR, "DFS failed to start CAC offchannel");
+ 		iface->radar_background.channel = -1;
+-		return;
++		return -1;
+ 	}
+ 
+ 	iface->radar_background.channel = channel->chan;
+@@ -1096,6 +1096,8 @@ static void hostpad_dfs_update_background_chain(struct hostapd_iface *iface)
+ 	wpa_printf(MSG_ERROR,
+ 		   "%s: setting background chain to chan %d (%d MHz)",
+ 		   __func__, channel->chan, channel->freq);
++
++	return 0;
+ }
+ 
+ 
+@@ -1320,8 +1322,7 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		 * Just select a new random channel according to the
+ 		 * regulations for monitoring.
+ 		 */
+-		hostpad_dfs_update_background_chain(iface);
+-		return 0;
++		return hostpad_dfs_update_background_chain(iface);
+ 	}
+ 
+ 	/*
+-- 
+2.29.2
+
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/900-master-sync-include-uapi-linux-nl80211.patch b/recipes-connectivity/wpa-supplicant/files/patches/900-master-sync-include-uapi-linux-nl80211.patch
deleted file mode 100644
index fe47b57..0000000
--- a/recipes-connectivity/wpa-supplicant/files/patches/900-master-sync-include-uapi-linux-nl80211.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index f962c06..f7be755 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -2560,6 +2560,19 @@ enum nl80211_commands {
-  *	disassoc events to indicate that an immediate reconnect to the AP
-  *	is desired.
-  *
-+ * @NL80211_ATTR_OBSS_COLOR_BITMAP: bitmap of the u64 BSS colors for the
-+ *	%NL80211_CMD_OBSS_COLOR_COLLISION event.
-+ *
-+ * @NL80211_ATTR_COLOR_CHANGE_COUNT: u8 attribute specifying the number of TBTT's
-+ *	until the color switch event.
-+ * @NL80211_ATTR_COLOR_CHANGE_COLOR: u8 attribute specifying the color that we are
-+ *	switching to
-+ * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
-+ *	information for the time while performing a color switch.
-+ *
-+ * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
-+ *	transmit power to stay within regulatory limits. u32, dBi.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3057,6 +3070,14 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_DISABLE_HE,
- 
-+	NL80211_ATTR_OBSS_COLOR_BITMAP,
-+
-+	NL80211_ATTR_COLOR_CHANGE_COUNT,
-+	NL80211_ATTR_COLOR_CHANGE_COLOR,
-+	NL80211_ATTR_COLOR_CHANGE_ELEMS,
-+
-+	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5950,6 +5971,9 @@ enum nl80211_feature_flags {
-  *      frame protection for all management frames exchanged during the
-  *      negotiation and range measurement procedure.
-  *
-+ * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-+ *	detection and change announcemnts.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6014,6 +6038,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_LTF,
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
-+	NL80211_EXT_FEATURE_BSS_COLOR,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/901-master-zero-wait_dfs.patch b/recipes-connectivity/wpa-supplicant/files/patches/901-master-zero-wait_dfs.patch
deleted file mode 100644
index cb11aee..0000000
--- a/recipes-connectivity/wpa-supplicant/files/patches/901-master-zero-wait_dfs.patch
+++ /dev/null
@@ -1,851 +0,0 @@
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 1e1b685..8f6281a 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -2476,6 +2476,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- 		conf->ieee80211d = atoi(pos);
- 	} else if (os_strcmp(buf, "ieee80211h") == 0) {
- 		conf->ieee80211h = atoi(pos);
-+	} else if (os_strcmp(buf, "radar_offchan") == 0) {
-+		conf->radar_offchan = atoi(pos);
- 	} else if (os_strcmp(buf, "ieee8021x") == 0) {
- 		bss->ieee802_1x = atoi(pos);
- 	} else if (os_strcmp(buf, "eapol_version") == 0) {
-diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index a89ce9b..0c951a9 100644
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -143,6 +143,13 @@ ssid=test
- # ieee80211d=1 and local_pwr_constraint configured.
- #spectrum_mgmt_required=1
- 
-+# Enable radar/CAC detection through a dedicated offchannel chain available on
-+# some hw. The chain can't be used to transmits or receives frames.
-+# This feature allows to avoid CAC downtime switching on a different channel
-+# during CAC detection on the selected radar channel.
-+# (default: 0 = disabled, 1 = enabled)
-+#radar_offchan=0
-+
- # Operation mode (a = IEEE 802.11a (5 GHz), b = IEEE 802.11b (2.4 GHz),
- # g = IEEE 802.11g (2.4 GHz), ad = IEEE 802.11ad (60 GHz); a/g options are used
- # with IEEE 802.11n (HT), too, to specify band). For IEEE 802.11ac (VHT), this
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 28b7efe..ffc3c2c 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -993,6 +993,7 @@ struct hostapd_config {
- 	int ieee80211d;
- 
- 	int ieee80211h; /* DFS */
-+	int radar_offchan;
- 
- 	/*
- 	 * Local power constraint is an octet encoded as an unsigned integer in
-diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index bc49079..c97ee39 100644
---- a/src/ap/ap_drv_ops.c
-+++ b/src/ap/ap_drv_ops.c
-@@ -810,7 +810,8 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
- 			  int channel, int ht_enabled, int vht_enabled,
- 			  int he_enabled,
- 			  int sec_channel_offset, int oper_chwidth,
--			  int center_segment0, int center_segment1)
-+			  int center_segment0, int center_segment1,
-+			  int radar_offchan)
- {
- 	struct hostapd_data *hapd = iface->bss[0];
- 	struct hostapd_freq_params data;
-@@ -836,10 +837,14 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
- 		wpa_printf(MSG_ERROR, "Can't set freq params");
- 		return -1;
- 	}
-+	data.radar_offchan = radar_offchan;
- 
- 	res = hapd->driver->start_dfs_cac(hapd->drv_priv, &data);
- 	if (!res) {
--		iface->cac_started = 1;
-+		if (radar_offchan)
-+			iface->radar_offchan.cac_started = 1;
-+		else
-+			iface->cac_started = 1;
- 		os_get_reltime(&iface->dfs_cac_start);
- 	}
- 
-diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 61c8f64..92842a1 100644
---- a/src/ap/ap_drv_ops.h
-+++ b/src/ap/ap_drv_ops.h
-@@ -130,7 +130,8 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
- 			  int channel, int ht_enabled, int vht_enabled,
- 			  int he_enabled,
- 			  int sec_channel_offset, int oper_chwidth,
--			  int center_segment0, int center_segment1);
-+			  int center_segment0, int center_segment1,
-+			  int radar_offchan);
- int hostapd_drv_do_acs(struct hostapd_data *hapd);
- int hostapd_drv_update_dh_ie(struct hostapd_data *hapd, const u8 *peer,
- 			     u16 reason_code, const u8 *ie, size_t ielen);
-diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index eccda1a..3b1276f 100644
---- a/src/ap/dfs.c
-+++ b/src/ap/dfs.c
-@@ -51,16 +51,31 @@ static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1)
- 	return n_chans;
- }
- 
--
-+/*
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-+ */
- static int dfs_channel_available(struct hostapd_channel_data *chan,
--				 int skip_radar)
-+				 int flags)
- {
-+	if (flags == 2) {
-+		/* Select only radar channel where CAC has not been
-+		 * performed yet
-+		 */
-+		if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
-+		    (chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
-+		     HOSTAPD_CHAN_DFS_USABLE)
-+			return 1;
-+		return 0;
-+	}
- 	/*
- 	 * When radar detection happens, CSA is performed. However, there's no
- 	 * time for CAC, so radar channels must be skipped when finding a new
- 	 * channel for CSA, unless they are available for immediate use.
- 	 */
--	if (skip_radar && (chan->flag & HOSTAPD_CHAN_RADAR) &&
-+	if (flags && (chan->flag & HOSTAPD_CHAN_RADAR) &&
- 	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) !=
- 	     HOSTAPD_CHAN_DFS_AVAILABLE))
- 		return 0;
-@@ -136,10 +151,15 @@ dfs_get_chan_data(struct hostapd_hw_modes *mode, int freq, int first_chan_idx)
- 	return NULL;
- }
- 
--
-+/*
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-+ */
- static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
- 				    int first_chan_idx, int num_chans,
--				    int skip_radar)
-+				    int flags)
- {
- 	struct hostapd_channel_data *first_chan, *chan;
- 	int i;
-@@ -178,7 +198,7 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
- 			return 0;
- 		}
- 
--		if (!dfs_channel_available(chan, skip_radar)) {
-+		if (!dfs_channel_available(chan, flags)) {
- 			wpa_printf(MSG_DEBUG, "DFS: channel not available %d",
- 				   first_chan->freq + i * 20);
- 			return 0;
-@@ -205,10 +225,15 @@ static int is_in_chanlist(struct hostapd_iface *iface,
-  *  - hapd->secondary_channel
-  *  - hapd->vht/he_oper_centr_freq_seg0_idx
-  *  - hapd->vht/he_oper_centr_freq_seg1_idx
-+ *
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-  */
- static int dfs_find_channel(struct hostapd_iface *iface,
- 			    struct hostapd_channel_data **ret_chan,
--			    int idx, int skip_radar)
-+			    int idx, int flags)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan;
-@@ -233,7 +258,7 @@ static int dfs_find_channel(struct hostapd_iface *iface,
- 		}
- 
- 		/* Skip incompatible chandefs */
--		if (!dfs_chan_range_available(mode, i, n_chans, skip_radar)) {
-+		if (!dfs_chan_range_available(mode, i, n_chans, flags)) {
- 			wpa_printf(MSG_DEBUG,
- 				   "DFS: range not available for %d (%d)",
- 				   chan->freq, chan->chan);
-@@ -467,13 +492,18 @@ static int dfs_check_chans_unavailable(struct hostapd_iface *iface,
- 	return res;
- }
- 
--
-+/*
-+ * flags:
-+ * - 0: any channel
-+ * - 1: non-radar channel or radar available one
-+ * - 2: radar-only channel not yet available
-+ */
- static struct hostapd_channel_data *
- dfs_get_valid_channel(struct hostapd_iface *iface,
- 		      int *secondary_channel,
- 		      u8 *oper_centr_freq_seg0_idx,
- 		      u8 *oper_centr_freq_seg1_idx,
--		      int skip_radar)
-+		      int flags)
- {
- 	struct hostapd_hw_modes *mode;
- 	struct hostapd_channel_data *chan = NULL;
-@@ -502,7 +532,7 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 		return NULL;
- 
- 	/* Get the count first */
--	num_available_chandefs = dfs_find_channel(iface, NULL, 0, skip_radar);
-+	num_available_chandefs = dfs_find_channel(iface, NULL, 0, flags);
- 	wpa_printf(MSG_DEBUG, "DFS: num_available_chandefs=%d",
- 		   num_available_chandefs);
- 	if (num_available_chandefs == 0)
-@@ -523,7 +553,7 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 		return NULL;
- 
- 	chan_idx = _rand % num_available_chandefs;
--	dfs_find_channel(iface, &chan, chan_idx, skip_radar);
-+	dfs_find_channel(iface, &chan, chan_idx, flags);
- 	if (!chan) {
- 		wpa_printf(MSG_DEBUG, "DFS: no random channel found");
- 		return NULL;
-@@ -552,7 +582,7 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 		for (i = 0; i < num_available_chandefs - 1; i++) {
- 			/* start from chan_idx + 1, end when chan_idx - 1 */
- 			chan_idx2 = (chan_idx + 1 + i) % num_available_chandefs;
--			dfs_find_channel(iface, &chan2, chan_idx2, skip_radar);
-+			dfs_find_channel(iface, &chan2, chan_idx2, flags);
- 			if (chan2 && abs(chan2->chan - chan->chan) > 12) {
- 				/* two channels are not adjacent */
- 				sec_chan_idx_80p80 = chan2->chan;
-@@ -582,6 +612,27 @@ dfs_get_valid_channel(struct hostapd_iface *iface,
- 	return chan;
- }
- 
-+static int dfs_set_valid_channel(struct hostapd_iface *iface, int skip_radar)
-+{
-+	struct hostapd_channel_data *channel;
-+	u8 cf1 = 0, cf2 = 0;
-+	int sec = 0;
-+
-+	channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2,
-+					skip_radar);
-+	if (!channel) {
-+		wpa_printf(MSG_ERROR, "could not get valid channel");
-+		return -1;
-+	}
-+
-+	iface->freq = channel->freq;
-+	iface->conf->channel = channel->chan;
-+	iface->conf->secondary_channel = sec;
-+	hostapd_set_oper_centr_freq_seg0_idx(iface->conf, cf1);
-+	hostapd_set_oper_centr_freq_seg1_idx(iface->conf, cf2);
-+
-+	return 0;
-+}
- 
- static int set_dfs_state_freq(struct hostapd_iface *iface, int freq, u32 state)
- {
-@@ -761,6 +812,11 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
- 	return cac_time_ms;
- }
- 
-+static int hostapd_is_radar_offchan_enabled(struct hostapd_iface *iface)
-+{
-+	return (iface->drv_flags2 & WPA_DRIVER_RADAR_OFFCHAN) &&
-+	       iface->conf->radar_offchan;
-+}
- 
- /*
-  * Main DFS handler
-@@ -770,9 +826,8 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
-  */
- int hostapd_handle_dfs(struct hostapd_iface *iface)
- {
--	struct hostapd_channel_data *channel;
- 	int res, n_chans, n_chans1, start_chan_idx, start_chan_idx1;
--	int skip_radar = 0;
-+	int skip_radar = 0, radar_offchan;
- 
- 	if (is_6ghz_freq(iface->freq))
- 		return 1;
-@@ -825,28 +880,18 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
- 		wpa_printf(MSG_DEBUG, "DFS %d chans unavailable - choose other channel: %s",
- 			   res, res ? "yes": "no");
- 		if (res) {
--			int sec = 0;
--			u8 cf1 = 0, cf2 = 0;
--
--			channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2,
--							skip_radar);
--			if (!channel) {
--				wpa_printf(MSG_ERROR, "could not get valid channel");
-+			if (dfs_set_valid_channel(iface, skip_radar) < 0) {
- 				hostapd_set_state(iface, HAPD_IFACE_DFS);
- 				return 0;
- 			}
--
--			iface->freq = channel->freq;
--			iface->conf->channel = channel->chan;
--			iface->conf->secondary_channel = sec;
--			hostapd_set_oper_centr_freq_seg0_idx(iface->conf, cf1);
--			hostapd_set_oper_centr_freq_seg1_idx(iface->conf, cf2);
- 		}
- 	} while (res);
- 
- 	/* Finally start CAC */
- 	hostapd_set_state(iface, HAPD_IFACE_DFS);
--	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz", iface->freq);
-+	radar_offchan = hostapd_is_radar_offchan_enabled(iface);
-+	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz offchan %d",
-+		   iface->freq, radar_offchan);
- 	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_START
- 		"freq=%d chan=%d sec_chan=%d, width=%d, seg0=%d, seg1=%d, cac_time=%ds",
- 		iface->freq,
-@@ -863,13 +908,37 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
- 		iface->conf->secondary_channel,
- 		hostapd_get_oper_chwidth(iface->conf),
- 		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
--		hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
-+		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
-+		radar_offchan);
- 
- 	if (res) {
- 		wpa_printf(MSG_ERROR, "DFS start_dfs_cac() failed, %d", res);
- 		return -1;
- 	}
- 
-+	if (radar_offchan) {
-+		/* Cache offchannel radar parameters */
-+		iface->radar_offchan.channel = iface->conf->channel;
-+		iface->radar_offchan.secondary_channel =
-+			iface->conf->secondary_channel;
-+		iface->radar_offchan.freq = iface->freq;
-+		iface->radar_offchan.centr_freq_seg0_idx =
-+			hostapd_get_oper_centr_freq_seg0_idx(iface->conf);
-+		iface->radar_offchan.centr_freq_seg1_idx =
-+			hostapd_get_oper_centr_freq_seg1_idx(iface->conf);
-+
-+		/*
-+		 * Let's select a random channel for the moment
-+		 * and perform CAC on dedicated radar chain
-+		 */
-+		res = dfs_set_valid_channel(iface, 1);
-+		if (res < 0)
-+			return res;
-+
-+		iface->radar_offchan.temp_ch = 1;
-+		return 1;
-+	}
-+
- 	return 0;
- }
- 
-@@ -890,6 +959,157 @@ int hostapd_is_dfs_chan_available(struct hostapd_iface *iface)
- 	return dfs_check_chans_available(iface, start_chan_idx, n_chans);
- }
- 
-+static int hostapd_dfs_request_channel_switch(struct hostapd_iface *iface,
-+					      int channel, int freq,
-+					      int secondary_channel,
-+					      u8 oper_centr_freq_seg0_idx,
-+					      u8 oper_centr_freq_seg1_idx)
-+{
-+	struct hostapd_hw_modes *cmode = iface->current_mode;
-+	int ieee80211_mode = IEEE80211_MODE_AP, err, i;
-+	struct csa_settings csa_settings;
-+	u8 new_vht_oper_chwidth;
-+
-+	wpa_printf(MSG_DEBUG, "DFS will switch to a new channel %d", channel);
-+	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_NEW_CHANNEL
-+		"freq=%d chan=%d sec_chan=%d", freq, channel,
-+		secondary_channel);
-+
-+	new_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
-+	hostapd_set_oper_chwidth(iface->conf,
-+				 hostapd_get_oper_chwidth(iface->conf));
-+
-+	/* Setup CSA request */
-+	os_memset(&csa_settings, 0, sizeof(csa_settings));
-+	csa_settings.cs_count = 5;
-+	csa_settings.block_tx = 1;
-+#ifdef CONFIG_MESH
-+	if (iface->mconf)
-+		ieee80211_mode = IEEE80211_MODE_MESH;
-+#endif /* CONFIG_MESH */
-+	err = hostapd_set_freq_params(&csa_settings.freq_params,
-+				      iface->conf->hw_mode,
-+				      freq, channel,
-+				      iface->conf->enable_edmg,
-+				      iface->conf->edmg_channel,
-+				      iface->conf->ieee80211n,
-+				      iface->conf->ieee80211ac,
-+				      iface->conf->ieee80211ax,
-+				      secondary_channel,
-+				      new_vht_oper_chwidth,
-+				      oper_centr_freq_seg0_idx,
-+				      oper_centr_freq_seg1_idx,
-+				      cmode->vht_capab,
-+				      &cmode->he_capab[ieee80211_mode]);
-+
-+	if (err) {
-+		wpa_printf(MSG_ERROR, "DFS failed to calculate CSA freq params");
-+		hostapd_disable_iface(iface);
-+		return err;
-+	}
-+
-+	for (i = 0; i < iface->num_bss; i++) {
-+		err = hostapd_switch_channel(iface->bss[i], &csa_settings);
-+		if (err)
-+			break;
-+	}
-+
-+	if (err) {
-+		wpa_printf(MSG_WARNING, "DFS failed to schedule CSA (%d) - trying fallback",
-+			   err);
-+		iface->freq = freq;
-+		iface->conf->channel = channel;
-+		iface->conf->secondary_channel = secondary_channel;
-+		hostapd_set_oper_chwidth(iface->conf, new_vht_oper_chwidth);
-+		hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
-+						     oper_centr_freq_seg0_idx);
-+		hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
-+						     oper_centr_freq_seg1_idx);
-+
-+		hostapd_disable_iface(iface);
-+		hostapd_enable_iface(iface);
-+
-+		return 0;
-+	}
-+
-+	/* Channel configuration will be updated once CSA completes and
-+	 * ch_switch_notify event is received */
-+	wpa_printf(MSG_DEBUG, "DFS waiting channel switch event");
-+
-+	return 0;
-+}
-+
-+static struct hostapd_channel_data *
-+dfs_downgrade_bandwidth(struct hostapd_iface *iface, int *secondary_channel,
-+			u8 *oper_centr_freq_seg0_idx,
-+			u8 *oper_centr_freq_seg1_idx, int *skip_radar);
-+
-+static void
-+hostpad_dfs_update_offchannel_chain(struct hostapd_iface *iface)
-+{
-+	struct hostapd_channel_data *channel;
-+	int sec = 0, flags = 2;
-+	u8 cf1 = 0, cf2 = 0;
-+
-+	channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, 2);
-+	if (!channel || channel->chan == iface->conf->channel)
-+		channel = dfs_downgrade_bandwidth(iface, &sec, &cf1, &cf2,
-+						  &flags);
-+	if (!channel ||
-+	    hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
-+				  channel->freq, channel->chan,
-+				  iface->conf->ieee80211n,
-+				  iface->conf->ieee80211ac,
-+				  iface->conf->ieee80211ax,
-+				  sec, hostapd_get_oper_chwidth(iface->conf),
-+				  cf1, cf2, 1)) {
-+		/*
-+		 * Toggle interface state to enter DFS state
-+		 * until NOP is finished.
-+		 */
-+		wpa_printf(MSG_ERROR, "DFS failed start CAC offchannel");
-+		return;
-+	}
-+
-+	wpa_printf(MSG_DEBUG, "%s: setting offchannel chain to chan %d (%d MHz)",
-+		   __func__, channel->chan, channel->freq);
-+
-+	iface->radar_offchan.channel = channel->chan;
-+	iface->radar_offchan.freq = channel->freq;
-+	iface->radar_offchan.secondary_channel = sec;
-+	iface->radar_offchan.centr_freq_seg0_idx = cf1;
-+	iface->radar_offchan.centr_freq_seg1_idx = cf2;
-+}
-+
-+/* FIXME: check if all channel bandwith */
-+static int
-+hostapd_dfs_is_offchan_event(struct hostapd_iface *iface, int freq)
-+{
-+	if (iface->radar_offchan.freq != freq)
-+		return 0;
-+
-+	return 1;
-+}
-+
-+static int
-+hostapd_dfs_start_channel_switch_offchan(struct hostapd_iface *iface)
-+{
-+	iface->conf->channel = iface->radar_offchan.channel;
-+	iface->freq = iface->radar_offchan.freq;
-+	iface->conf->secondary_channel =
-+		iface->radar_offchan.secondary_channel;
-+	hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
-+			iface->radar_offchan.centr_freq_seg0_idx);
-+	hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
-+			iface->radar_offchan.centr_freq_seg1_idx);
-+
-+	hostpad_dfs_update_offchannel_chain(iface);
-+
-+	return hostapd_dfs_request_channel_switch(iface, iface->conf->channel,
-+						  iface->freq, iface->conf->secondary_channel,
-+						  hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
-+						  hostapd_get_oper_centr_freq_seg1_idx(iface->conf));
-+}
- 
- int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
- 			     int ht_enabled, int chan_offset, int chan_width,
-@@ -911,6 +1131,23 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
- 			set_dfs_state(iface, freq, ht_enabled, chan_offset,
- 				      chan_width, cf1, cf2,
- 				      HOSTAPD_CHAN_DFS_AVAILABLE);
-+
-+			/*
-+			 * radar event from offchannel chain for selected
-+			 * channel. Perfrom CSA, move main chain to selected
-+			 * channel and configure offchannel chain to a new DFS
-+			 * channel
-+			 */
-+			if (hostapd_is_radar_offchan_enabled(iface) &&
-+			    hostapd_dfs_is_offchan_event(iface, freq)) {
-+				iface->radar_offchan.cac_started = 0;
-+				if (iface->radar_offchan.temp_ch) {
-+					iface->radar_offchan.temp_ch = 0;
-+					return hostapd_dfs_start_channel_switch_offchan(iface);
-+				}
-+				return 0;
-+			}
-+
- 			/*
- 			 * Just mark the channel available when CAC completion
- 			 * event is received in enabled state. CAC result could
-@@ -927,6 +1164,10 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
- 				iface->cac_started = 0;
- 			}
- 		}
-+	} else if (hostapd_is_radar_offchan_enabled(iface) &&
-+		   hostapd_dfs_is_offchan_event(iface, freq)) {
-+		iface->radar_offchan.cac_started = 0;
-+		hostpad_dfs_update_offchannel_chain(iface);
- 	}
- 
- 	return 0;
-@@ -1036,6 +1277,44 @@ static int hostapd_dfs_start_channel_switch_cac(struct hostapd_iface *iface)
- 	return err;
- }
- 
-+static int
-+hostapd_dfs_offchan_start_channel_switch(struct hostapd_iface *iface, int freq)
-+{
-+	if (!hostapd_is_radar_offchan_enabled(iface))
-+		return -1; /* Offchannel chain not supported */
-+
-+	wpa_printf(MSG_DEBUG,
-+		   "%s called (offchannel CAC active: %s, CSA active: %s)",
-+		   __func__, iface->radar_offchan.cac_started ? "yes" : "no",
-+		   hostapd_csa_in_progress(iface) ? "yes" : "no");
-+
-+	/* Check if CSA in progress */
-+	if (hostapd_csa_in_progress(iface))
-+		return 0;
-+
-+	/*
-+	 * If offchannel radar detation is supported and radar channel
-+	 * monitored by offchain is available switch to it without waiting
-+	 * for the CAC otherwise let's keep a random channel.
-+	 * If radar pattern is reported on offchannel chain, just switch to
-+	 * monitor another radar channel.
-+	 */
-+	if (hostapd_dfs_is_offchan_event(iface, freq)) {
-+		hostpad_dfs_update_offchannel_chain(iface);
-+		return 0;
-+	}
-+
-+	/* Offchannel not availanle yet. Perform CAC on main chain */
-+	if (iface->radar_offchan.cac_started) {
-+		/* We want to switch to monitored channel as soon as
-+		 * CAC is completed.
-+		 */
-+		iface->radar_offchan.temp_ch = 1;
-+		return -1;
-+	}
-+
-+	return hostapd_dfs_start_channel_switch_offchan(iface);
-+}
- 
- static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- {
-@@ -1043,13 +1322,7 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 	int secondary_channel;
- 	u8 oper_centr_freq_seg0_idx;
- 	u8 oper_centr_freq_seg1_idx;
--	u8 new_vht_oper_chwidth;
- 	int skip_radar = 1;
--	struct csa_settings csa_settings;
--	unsigned int i;
--	int err = 1;
--	struct hostapd_hw_modes *cmode = iface->current_mode;
--	u8 current_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
- 	int ieee80211_mode = IEEE80211_MODE_AP;
- 
- 	wpa_printf(MSG_DEBUG, "%s called (CAC active: %s, CSA active: %s)",
-@@ -1113,73 +1386,16 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
- 		}
- 	}
- 
--	wpa_printf(MSG_DEBUG, "DFS will switch to a new channel %d",
--		   channel->chan);
--	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_NEW_CHANNEL
--		"freq=%d chan=%d sec_chan=%d", channel->freq,
--		channel->chan, secondary_channel);
--
--	new_vht_oper_chwidth = hostapd_get_oper_chwidth(iface->conf);
--	hostapd_set_oper_chwidth(iface->conf, current_vht_oper_chwidth);
--
--	/* Setup CSA request */
--	os_memset(&csa_settings, 0, sizeof(csa_settings));
--	csa_settings.cs_count = 5;
--	csa_settings.block_tx = 1;
- #ifdef CONFIG_MESH
- 	if (iface->mconf)
- 		ieee80211_mode = IEEE80211_MODE_MESH;
- #endif /* CONFIG_MESH */
--	err = hostapd_set_freq_params(&csa_settings.freq_params,
--				      iface->conf->hw_mode,
--				      channel->freq,
--				      channel->chan,
--				      iface->conf->enable_edmg,
--				      iface->conf->edmg_channel,
--				      iface->conf->ieee80211n,
--				      iface->conf->ieee80211ac,
--				      iface->conf->ieee80211ax,
--				      secondary_channel,
--				      new_vht_oper_chwidth,
--				      oper_centr_freq_seg0_idx,
--				      oper_centr_freq_seg1_idx,
--				      cmode->vht_capab,
--				      &cmode->he_capab[ieee80211_mode]);
--
--	if (err) {
--		wpa_printf(MSG_ERROR, "DFS failed to calculate CSA freq params");
--		hostapd_disable_iface(iface);
--		return err;
--	}
- 
--	for (i = 0; i < iface->num_bss; i++) {
--		err = hostapd_switch_channel(iface->bss[i], &csa_settings);
--		if (err)
--			break;
--	}
--
--	if (err) {
--		wpa_printf(MSG_WARNING, "DFS failed to schedule CSA (%d) - trying fallback",
--			   err);
--		iface->freq = channel->freq;
--		iface->conf->channel = channel->chan;
--		iface->conf->secondary_channel = secondary_channel;
--		hostapd_set_oper_chwidth(iface->conf, new_vht_oper_chwidth);
--		hostapd_set_oper_centr_freq_seg0_idx(iface->conf,
--						     oper_centr_freq_seg0_idx);
--		hostapd_set_oper_centr_freq_seg1_idx(iface->conf,
--						     oper_centr_freq_seg1_idx);
--
--		hostapd_disable_iface(iface);
--		hostapd_enable_iface(iface);
--		return 0;
--	}
--
--	/* Channel configuration will be updated once CSA completes and
--	 * ch_switch_notify event is received */
--
--	wpa_printf(MSG_DEBUG, "DFS waiting channel switch event");
--	return 0;
-+	return hostapd_dfs_request_channel_switch(iface, channel->chan,
-+						  channel->freq,
-+						  secondary_channel,
-+						  oper_centr_freq_seg0_idx,
-+						  oper_centr_freq_seg1_idx);
- }
- 
- 
-@@ -1208,15 +1424,19 @@ int hostapd_dfs_radar_detected(struct hostapd_iface *iface, int freq,
- 	if (!res)
- 		return 0;
- 
--	/* Skip if reported radar event not overlapped our channels */
--	res = dfs_are_channels_overlapped(iface, freq, chan_width, cf1, cf2);
--	if (!res)
--		return 0;
-+	if (!hostapd_dfs_is_offchan_event(iface, freq)) {
-+		/* Skip if reported radar event not overlapped our channels */
-+		res = dfs_are_channels_overlapped(iface, freq, chan_width,
-+						  cf1, cf2);
-+		if (!res)
-+			return 0;
-+	}
- 
--	/* radar detected while operating, switch the channel. */
--	res = hostapd_dfs_start_channel_switch(iface);
-+	if (hostapd_dfs_offchan_start_channel_switch(iface, freq))
-+		/* radar detected while operating, switch the channel. */
-+		return hostapd_dfs_start_channel_switch(iface);
- 
--	return res;
-+	return 0;
- }
- 
- 
-@@ -1284,7 +1504,11 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
- 		"seg1=%d cac_time=%ds",
- 		freq, (freq - 5000) / 5, chan_offset, chan_width, cf1, cf2,
- 		iface->dfs_cac_ms / 1000);
--	iface->cac_started = 1;
-+
-+	if (hostapd_dfs_is_offchan_event(iface, freq))
-+		iface->radar_offchan.cac_started = 1;
-+	else
-+		iface->cac_started = 1;
- 	os_get_reltime(&iface->dfs_cac_start);
- 	return 0;
- }
-diff --git a/src/ap/hostapd.h b/src/ap/hostapd.h
-index 27b985d..1c6c94e 100644
---- a/src/ap/hostapd.h
-+++ b/src/ap/hostapd.h
-@@ -521,6 +521,21 @@ struct hostapd_iface {
- 	int *basic_rates;
- 	int freq;
- 
-+	/* Offchanel chain configuration */
-+	struct {
-+		int channel;
-+		int secondary_channel;
-+		int freq;
-+		int centr_freq_seg0_idx;
-+		int centr_freq_seg1_idx;
-+		/* Main chain is on temporary channel during
-+		 * CAC detection on radar offchain
-+		 */
-+		unsigned int temp_ch:1;
-+		/* CAC started on radar offchain */
-+		unsigned int cac_started:1;
-+	} radar_offchan;
-+
- 	u16 hw_flags;
- 
- 	/* Number of associated Non-ERP stations (i.e., stations using 802.11b
-diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 6d9194f..7ed47c0 100644
---- a/src/drivers/driver.h
-+++ b/src/drivers/driver.h
-@@ -777,6 +777,11 @@ struct hostapd_freq_params {
- 	 * for IEEE 802.11ay EDMG configuration.
- 	 */
- 	struct ieee80211_edmg_config edmg;
-+
-+	/**
-+	 * radar_offchan - Whether radar/CAC offchannel is requested
-+	 */
-+	int radar_offchan;
- };
- 
- /**
-@@ -2026,6 +2031,8 @@ struct wpa_driver_capa {
- #define WPA_DRIVER_FLAGS2_OCV			0x0000000000000080ULL
- /** Driver expects user space implementation of SME in AP mode */
- #define WPA_DRIVER_FLAGS2_AP_SME		0x0000000000000100ULL
-+/** Driver supports offchannel radar/CAC detection */
-+#define WPA_DRIVER_RADAR_OFFCHAN		0x0000000000000200ULL
- 	u64 flags2;
- 
- #define FULL_AP_CLIENT_STATE_SUPP(drv_flags) \
-diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 4db8cce..62c3cd8 100644
---- a/src/drivers/driver_nl80211.c
-+++ b/src/drivers/driver_nl80211.c
-@@ -4885,6 +4885,7 @@ static int nl80211_put_freq_params(struct nl_msg *msg,
- 	wpa_printf(MSG_DEBUG, "  * he_enabled=%d", freq->he_enabled);
- 	wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", freq->vht_enabled);
- 	wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", freq->ht_enabled);
-+	wpa_printf(MSG_DEBUG, "  * radar_offchan=%d", freq->radar_offchan);
- 
- 	hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
- 	is_24ghz = hw_mode == HOSTAPD_MODE_IEEE80211G ||
-@@ -4962,6 +4963,9 @@ static int nl80211_put_freq_params(struct nl_msg *msg,
- 				NL80211_CHAN_NO_HT))
- 			return -ENOBUFS;
- 	}
-+	if (freq->radar_offchan)
-+		nla_put_flag(msg, NL80211_ATTR_RADAR_OFFCHAN);
-+
- 	return 0;
- }
- 
-diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index cd596e3..e370ef3 100644
---- a/src/drivers/driver_nl80211_capa.c
-+++ b/src/drivers/driver_nl80211_capa.c
-@@ -665,6 +665,10 @@ static void wiphy_info_ext_feature_flags(struct wiphy_info_data *info,
- 	if (ext_feature_isset(ext_features, len,
- 			      NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION))
- 		capa->flags2 |= WPA_DRIVER_FLAGS2_OCV;
-+
-+	if (ext_feature_isset(ext_features, len,
-+			      NL80211_EXT_FEATURE_RADAR_OFFCHAN))
-+		capa->flags2 |= WPA_DRIVER_RADAR_OFFCHAN;
- }
- 
- 
-diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index f7be755..736b483 100644
---- a/src/drivers/nl80211_copy.h
-+++ b/src/drivers/nl80211_copy.h
-@@ -2573,6 +2573,10 @@ enum nl80211_commands {
-  * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
-  *	transmit power to stay within regulatory limits. u32, dBi.
-  *
-+ * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated chain available for radar
-+ *	detection on some hw. The chain can't be used to transmits or receives
-+ *	frames. The driver is supposed to implement CAC management in sw or fw.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3078,6 +3082,8 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
- 
-+	NL80211_ATTR_RADAR_OFFCHAN,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -5974,6 +5980,9 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-  *	detection and change announcemnts.
-  *
-+ * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
-+ *	detection.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6039,6 +6048,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
- 	NL80211_EXT_FEATURE_BSS_COLOR,
-+	NL80211_EXT_FEATURE_RADAR_OFFCHAN,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch b/recipes-connectivity/wpa-supplicant/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch
index f6832e3..ad9c926 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/905-master-Support-configuring-BSS-Termination-TSF-by-using-hos.patch
@@ -1,31 +1,21 @@
-From 56613ad9b568a3ac7467105beaa162c68ffbbf70 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 20:20:03 +0800
-Subject: [PATCH 4/9] Support configuring BSS Termination TSF by using
+From 6a949f8644546d689b7271228d19b1b1ad80632f Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 19:56:18 +0800
+Subject: [PATCH 1/6] Support configuring BSS Termination TSF by using
  hostapd_cli command
 
 ---
- hostapd/ctrl_iface.c | 9 +++++++++
- src/ap/ap_config.c   | 1 +
- src/ap/ap_config.h   | 1 +
- 3 files changed, 11 insertions(+)
+ hostapd/ctrl_iface.c   | 5 +++++
+ src/ap/ap_config.c     | 1 +
+ src/ap/ap_config.h     | 1 +
+ src/ap/ctrl_iface_ap.c | 4 ++++
+ 4 files changed, 11 insertions(+)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index f50fafb..1b5a091 100644
+index 4718368..e0a7e4f 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -954,6 +954,10 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
- 			return -1;
- 		}
-+		if (hapd->conf->bss_termination_tsf) {
-+			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
-+		}
-+
- 		end++;
- 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
- 	}
-@@ -1589,6 +1593,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
+@@ -1326,6 +1326,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
  #endif /* CONFIG_DPP */
  	} else if (os_strcasecmp(cmd, "setband") == 0) {
  		ret = hostapd_ctrl_iface_set_band(hapd, value);
@@ -38,7 +28,7 @@
  		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
  		if (ret)
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 1f04686..078a3fc 100644
+index 23b67e1..f248281 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
@@ -50,10 +40,10 @@
  
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index f3aff36..7301bbb 100644
+index f795ee9..5dab8be 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
-@@ -549,6 +549,7 @@ struct hostapd_bss_config {
+@@ -557,6 +557,7 @@ struct hostapd_bss_config {
  	int wnm_sleep_mode;
  	int wnm_sleep_mode_no_keys;
  	int bss_transition;
@@ -61,6 +51,21 @@
  
  	/* IEEE 802.11u - Interworking */
  	int interworking;
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index c496e4f..aad5180 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1202,6 +1202,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
+ 			return -1;
+ 		}
++		if (hapd->conf->bss_termination_tsf) {
++			WPA_PUT_LE64(&bss_term_dur[2], hapd->conf->bss_termination_tsf);
++		}
++
+ 		end++;
+ 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
+ 	}
 -- 
 2.18.0
 
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch b/recipes-connectivity/wpa-supplicant/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch
index 1bf102a..37f2d96 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/908-master-Support-including-neighbor-report-elements-in-BTM-re.patch
@@ -1,17 +1,17 @@
-From 9043eff145701c6324ae48966301681adacb89c4 Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:16:45 +0800
-Subject: [PATCH 7/9] Support including neighbor report elements in BTM request
+From e6f1c893d375aa952e1f9c8c1eb4ecacf588e4e2 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 19:58:57 +0800
+Subject: [PATCH 4/6] Support including neighbor report elements in BTM request
 
 ---
- hostapd/ctrl_iface.c | 7 ++++++-
+ src/ap/ctrl_iface_ap.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)
 
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 1b5a091..5a82ae6 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -984,8 +984,13 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index aad5180..fccc5f9 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1232,8 +1232,13 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
  		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
  	}
  
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch b/recipes-connectivity/wpa-supplicant/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch
index 14571fe..f77deb2 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/909-master-Add-hostapd_neighbor_set_own_report_pref.patch
@@ -1,21 +1,19 @@
-From 6fc069a54efb892e486dfde59cb97e0023dbbf5d Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:27:55 +0800
-Subject: [PATCH 8/9] Add hostapd_neighbor_set_own_report_pref()
+From 12b95b365372ca8167b8fdbfd192fcd4dcb11419 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 20:00:49 +0800
+Subject: [PATCH 5/6] Add hostapd_neighbor_set_own_report_pref()
 
-If my own BSS is going to terminate itself, the preference value of neighbor
-report must be set to 0.
 ---
- hostapd/ctrl_iface.c |  5 ++++-
- src/ap/neighbor_db.c | 36 ++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h |  2 ++
- 3 files changed, 42 insertions(+), 1 deletion(-)
+ src/ap/ctrl_iface_ap.c |  6 +++++-
+ src/ap/neighbor_db.c   | 36 ++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |  2 ++
+ 3 files changed, 43 insertions(+), 1 deletion(-)
 
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 5a82ae6..3146a25 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -993,8 +993,11 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index fccc5f9..d5d4e33 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1241,8 +1241,12 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
  	}
  	if (os_strstr(cmd, " abridged=1"))
  		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
@@ -25,14 +23,15 @@
 +		/* Set own BSS neighbor report preference value as 0 */
 +		hostapd_neighbor_set_own_report_pref(hapd, nei_rep, nei_len, 0);
 +	}
++
  
  #ifdef CONFIG_MBO
  	pos = os_strstr(cmd, "mbo=");
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index ce6865d..bc1b163 100644
+index fabe64d..20a4417 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
-@@ -352,3 +352,39 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
+@@ -355,3 +355,39 @@ void hostapd_neighbor_set_own_report(struct hostapd_data *hapd)
  	wpabuf_free(nr);
  #endif /* NEED_AP_MLME */
  }
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch b/recipes-connectivity/wpa-supplicant/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
index 632475c..8a9e47e 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
@@ -1,22 +1,20 @@
-From 7aab6cf66cfb7dea480d16e312e0f0eb08e758ab Mon Sep 17 00:00:00 2001
-From: "howard.hsu" <howard-yh.hsu@mediatek.com>
-Date: Wed, 19 Jan 2022 21:32:17 +0800
-Subject: [PATCH 9/9] Add hostapd_neighbor_set_pref_by_non_pref_chan()
+From be49aa855a83b3bb0c6a96380960b54cbdabcb56 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 9 Jun 2022 20:02:06 +0800
+Subject: [PATCH 6/6] Add hostapd_neighbor_set_pref_by_non_pref_chan()
 
-The preference value of neighbor report shall be modified according to struct
-non_pref_chan_info.
 ---
- hostapd/ctrl_iface.c |  2 ++
- src/ap/neighbor_db.c | 51 ++++++++++++++++++++++++++++++++++++++++++++
- src/ap/neighbor_db.h |  4 ++++
+ src/ap/ctrl_iface_ap.c |  2 ++
+ src/ap/neighbor_db.c   | 51 ++++++++++++++++++++++++++++++++++++++++++
+ src/ap/neighbor_db.h   |  4 ++++
  3 files changed, 57 insertions(+)
 
-diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 3146a25..974e5b9 100644
---- a/hostapd/ctrl_iface.c
-+++ b/hostapd/ctrl_iface.c
-@@ -1000,6 +1000,8 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
- 	}
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index d5d4e33..a888b76 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -1249,6 +1249,8 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
+ 
  
  #ifdef CONFIG_MBO
 +	hostapd_neighbor_set_pref_by_non_pref_chan(hapd, sta, nei_rep, nei_len);
@@ -25,10 +23,10 @@
  	if (pos) {
  		unsigned int mbo_reason, cell_pref, reassoc_delay;
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index bc1b163..75b6fcc 100644
+index 20a4417..8c27da9 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
-@@ -388,3 +388,54 @@ void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_b
+@@ -391,3 +391,54 @@ void hostapd_neighbor_set_own_report_pref(struct hostapd_data *hapd, char *nei_b
  		}
  	}
  }
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/912-master-add-the-destination-address-of-unsolicited-Probe.patch b/recipes-connectivity/wpa-supplicant/files/patches/912-master-add-the-destination-address-of-unsolicited-Probe.patch
deleted file mode 100644
index e9b630f..0000000
--- a/recipes-connectivity/wpa-supplicant/files/patches/912-master-add-the-destination-address-of-unsolicited-Probe.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 96a7f383290f78e15f1e7a5bc33099c81f104c5b Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Fri, 6 May 2022 11:02:36 +0800
-Subject: hostapd: Add the destination address of unsolicited Probe Response
- frame
-
-Without this, hostapd generates Probe Response frames with the null
-destination address when hostapd enables unsolicited Probe Response
-frame transmission. Fix this to use the broadcast address instead.
-
-Fixes: 024b4b2a298f ("AP: Unsolicited broadcast Probe Response configuration")
-Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
----
- src/ap/beacon.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index eaa403326..58872bfda 100644
---- a/src/ap/beacon.c
-+++ b/src/ap/beacon.c
-@@ -464,7 +464,8 @@ static u8 * hostapd_eid_supported_op_classes(struct hostapd_data *hapd, u8 *eid)
- 
- static u8 * hostapd_gen_probe_resp(struct hostapd_data *hapd,
- 				   const struct ieee80211_mgmt *req,
--				   int is_p2p, size_t *resp_len)
-+				   int is_p2p, size_t *resp_len,
-+				   bool bcast_probe_resp)
- {
- 	struct ieee80211_mgmt *resp;
- 	u8 *pos, *epos, *csa_pos;
-@@ -531,6 +532,9 @@ static u8 * hostapd_gen_probe_resp(struct hostapd_data *hapd,
- 					   WLAN_FC_STYPE_PROBE_RESP);
- 	if (req)
- 		os_memcpy(resp->da, req->sa, ETH_ALEN);
-+	else if (bcast_probe_resp)
-+		os_memset(resp->da, 0xff, ETH_ALEN);
-+
- 	os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
- 
- 	os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
-@@ -1141,7 +1145,7 @@ void handle_probe_req(struct hostapd_data *hapd,
- 		     " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
- 
- 	resp = hostapd_gen_probe_resp(hapd, mgmt, elems.p2p != NULL,
--				      &resp_len);
-+				      &resp_len, false);
- 	if (resp == NULL)
- 		return;
- 
-@@ -1210,7 +1214,7 @@ static u8 * hostapd_probe_resp_offloads(struct hostapd_data *hapd,
- 			   "this");
- 
- 	/* Generate a Probe Response template for the non-P2P case */
--	return hostapd_gen_probe_resp(hapd, NULL, 0, resp_len);
-+	return hostapd_gen_probe_resp(hapd, NULL, 0, resp_len, false);
- }
- 
- #endif /* NEED_AP_MLME */
-@@ -1228,7 +1232,8 @@ static u8 * hostapd_unsol_bcast_probe_resp(struct hostapd_data *hapd,
- 		hapd->conf->unsol_bcast_probe_resp_interval;
- 
- 	return hostapd_gen_probe_resp(hapd, NULL, 0,
--				      &params->unsol_bcast_probe_resp_tmpl_len);
-+				      &params->unsol_bcast_probe_resp_tmpl_len,
-+				      true);
- }
- #endif /* CONFIG_IEEE80211AX */
- 
--- 
-cgit v1.2.3-18-g5258
-
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch b/recipes-connectivity/wpa-supplicant/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch
index 306b221..d217f5d 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch
+++ b/recipes-connectivity/wpa-supplicant/files/patches/913-master-add-support-for-runtime-set-in-band-discover.patch
@@ -1,7 +1,7 @@
-From 8c9d9f2b8da1b0e3e0832e7d7b02d75c4c0a4f3e Mon Sep 17 00:00:00 2001
+From 31ec868f23a1bae48fceab6f2fb5f8b1a3a909a1 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Thu, 24 May 2022 21:48:21 +0800
-Subject: [PATCH] hostapd:v2 add support for runtime set in-band discovery-v2
+Date: Tue, 31 May 2022 21:15:54 +0800
+Subject: [PATCH] hostapd: add support for runtime set in-band discovery
 
 Usage:
 hostapd_cli unsolic_probe_resp [tx_type] [interval]
@@ -12,18 +12,18 @@
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
- hostapd/ctrl_iface.c         | 62 ++++++++++++++++++++++++++++++++++++
- hostapd/hostapd_cli.c        | 20 ++++++++++++
+ hostapd/ctrl_iface.c         | 66 ++++++++++++++++++++++++++++++++++++
+ hostapd/hostapd_cli.c        | 20 +++++++++++
  src/ap/beacon.c              |  5 ++-
  src/drivers/driver_nl80211.c |  8 +++--
  src/drivers/nl80211_copy.h   |  1 +
- 5 files changed, 92 insertions(+), 4 deletions(-)
+ 5 files changed, 96 insertions(+), 4 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 86adf18e5..41740cfd5 100644
+index 86adf18e5..ce04cd641 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -769,6 +769,65 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
+@@ -769,6 +769,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
  
  #endif /* CONFIG_INTERWORKING */
  
@@ -57,8 +57,10 @@
 +#define UNSOL_PROBE_RESP 1
 +#define FILS_DISCOVERY 2
 +
++#ifdef CONFIG_FILS
 +	conf->fils_discovery_max_int = 0;
 +	conf->fils_discovery_min_int = 0;
++#endif /* CONFIG_FILS */
 +	conf->unsol_bcast_probe_resp_interval = 0;
 +
 +	switch (tx_type) {
@@ -70,11 +72,13 @@
 +		/* Enable Unsolicited probe response */
 +		conf->unsol_bcast_probe_resp_interval = interval;
 +		break;
++#ifdef CONFIG_FILS
 +	case FILS_DISCOVERY:
 +		/* Enable FILS discovery */
 +		conf->fils_discovery_min_int = interval;
 +		conf->fils_discovery_max_int = interval;
 +		break;
++#endif /* CONFIG_FILS */
 +	}
 +
 +	ret = ieee802_11_update_beacons(hapd->iface);
@@ -89,7 +93,7 @@
  
  #ifdef CONFIG_WNM_AP
  
-@@ -3673,6 +3732,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+@@ -3673,6 +3736,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  		if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
  			reply_len = -1;
  #endif /* CONFIG_WNM_AP */
@@ -138,10 +142,10 @@
  };
  
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 3c49653cc..367e32611 100644
+index a96155ada..68e847956 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -1406,6 +1406,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+@@ -1408,6 +1408,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
  				   struct wpa_driver_ap_params *params)
  {
  	params->fd_max_int = hapd->conf->fils_discovery_max_int;
@@ -150,7 +154,7 @@
  	if (is_6ghz_op_class(hapd->iconf->op_class) &&
  	    params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
  		params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
-@@ -1414,7 +1416,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
+@@ -1416,7 +1418,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
  	if (params->fd_min_int > params->fd_max_int)
  		params->fd_min_int = params->fd_max_int;
  
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch b/recipes-connectivity/wpa-supplicant/files/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
new file mode 100644
index 0000000..3665c6c
--- /dev/null
+++ b/recipes-connectivity/wpa-supplicant/files/patches/990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch
@@ -0,0 +1,38 @@
+From f0e9f5aab52b3eab85d28338cc996972ced4c39c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 17 May 2022 23:07:59 +0200
+Subject: [PATCH] ctrl: make WNM_AP functions dependant on CONFIG_AP
+
+This fixes linking errors found when compiling wpa_supplicant with
+CONFIG_WNM_AP enabled but CONFIG_AP disabled.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ wpa_supplicant/ctrl_iface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
+index ac337e0f5..6e23114e6 100644
+--- a/wpa_supplicant/ctrl_iface.c
++++ b/wpa_supplicant/ctrl_iface.c
+@@ -12185,7 +12185,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+ 		if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
+ 			reply_len = -1;
+ #endif /* CONFIG_WNM */
+-#ifdef CONFIG_WNM_AP
++#if defined(CONFIG_AP) && defined(CONFIG_WNM_AP)
+ 	} else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
+ 		if (ap_ctrl_iface_disassoc_imminent(wpa_s, buf + 18))
+ 			reply_len = -1;
+@@ -12195,7 +12195,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
+ 	} else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
+ 		if (ap_ctrl_iface_bss_tm_req(wpa_s, buf + 11))
+ 			reply_len = -1;
+-#endif /* CONFIG_WNM_AP */
++#endif /* CONFIG_AP && CONFIG_WNM_AP */
+ 	} else if (os_strcmp(buf, "FLUSH") == 0) {
+ 		wpa_supplicant_ctrl_iface_flush(wpa_s);
+ 	} else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
+-- 
+2.35.1
+
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/patches.inc b/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
index 36ec650..af2e054 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
@@ -35,6 +35,7 @@
     file://461-driver_nl80211-use-new-parameters-during-ibss-join.patch \
     file://463-add-mcast_rate-to-11s.patch \
     file://464-fix-mesh-obss-check.patch \
+    file://465-hostapd-config-support-random-BSS-color.patch \
     file://470-survey_data_fallback.patch \
     file://500-lto-jobserver-support.patch \
     file://590-rrm-wnm-statistics.patch \
@@ -49,8 +50,7 @@
     file://740-snoop_iface.patch \
     file://750-qos_map_set_without_interworking.patch \
     file://751-qos_map_ignore_when_unsupported.patch \
-    file://900-master-sync-include-uapi-linux-nl80211.patch \
-    file://901-master-zero-wait_dfs.patch \
+    file://812-DFS-Rdd0-fail-to-rollback-non-DFS-channel-when-DFS-channels-under-NOP.patch \
     file://902-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_inse.patch \
     file://903-master-Support-including-neighbor-report-elements-in-ANQP-r.patch \
     file://904-master-Support-including-neignbor-report-elements-in-BTM-re.patch \
@@ -61,6 +61,6 @@
     file://909-master-Add-hostapd_neighbor_set_own_report_pref.patch \
     file://910-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch \
     file://911-master-print-sae-groups-by-hostapd-ctrl.patch \
-    file://912-master-add-the-destination-address-of-unsolicited-Probe.patch \
     file://913-master-add-support-for-runtime-set-in-band-discover.patch \
+    file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     "
diff --git a/recipes-connectivity/wpa-supplicant/files/src/src/ap/ubus.c b/recipes-connectivity/wpa-supplicant/files/src/src/ap/ubus.c
index fa325ea..1199098 100644
--- a/recipes-connectivity/wpa-supplicant/files/src/src/ap/ubus.c
+++ b/recipes-connectivity/wpa-supplicant/files/src/src/ap/ubus.c
@@ -445,6 +445,12 @@
 	blobmsg_add_u32(&b, "channel", channel);
 	blobmsg_add_u32(&b, "op_class", op_class);
 	blobmsg_add_u32(&b, "beacon_interval", hapd->iconf->beacon_int);
+#ifdef CONFIG_IEEE80211AX
+	blobmsg_add_u32(&b, "bss_color", hapd->iface->conf->he_op.he_bss_color_disabled ? -1 :
+					 hapd->iface->conf->he_op.he_bss_color);
+#else
+	blobmsg_add_u32(&b, "bss_color", -1);
+#endif
 
 	snprintf(phy_name, 17, "%s", hapd->iface->phy);
 	blobmsg_add_string(&b, "phy", phy_name);
@@ -888,10 +894,13 @@
 				css.freq_params.ht_enabled,
 				css.freq_params.vht_enabled,
 				css.freq_params.he_enabled,
+				css.freq_params.eht_enabled,
 				css.freq_params.sec_channel_offset,
 				chwidth, seg0, seg1,
 				iconf->vht_capab,
 				mode ? &mode->he_capab[IEEE80211_MODE_AP] :
+				NULL,
+				mode ? &mode->eht_capab[IEEE80211_MODE_AP] :
 				NULL);
 
 	for (i = 0; i < hapd->iface->num_bss; i++) {
@@ -1570,50 +1579,6 @@
 	return hostapd_bss_tr_send(hapd, addr, da_imminent, abridged, da_timer, valid_period,
 				   dialog_token, tb[BSS_TR_NEIGHBORS]);
 }
-
-enum {
-	WNM_DISASSOC_ADDR,
-	WNM_DISASSOC_DURATION,
-	WNM_DISASSOC_NEIGHBORS,
-	WNM_DISASSOC_ABRIDGED,
-	__WNM_DISASSOC_MAX,
-};
-
-static const struct blobmsg_policy wnm_disassoc_policy[__WNM_DISASSOC_MAX] = {
-	[WNM_DISASSOC_ADDR] = { "addr", BLOBMSG_TYPE_STRING },
-	[WNM_DISASSOC_DURATION] { "duration", BLOBMSG_TYPE_INT32 },
-	[WNM_DISASSOC_NEIGHBORS] { "neighbors", BLOBMSG_TYPE_ARRAY },
-	[WNM_DISASSOC_ABRIDGED] { "abridged", BLOBMSG_TYPE_BOOL },
-};
-
-static int
-hostapd_wnm_disassoc_imminent(struct ubus_context *ctx, struct ubus_object *obj,
-			      struct ubus_request_data *ureq, const char *method,
-			      struct blob_attr *msg)
-{
-	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-	struct blob_attr *tb[__WNM_DISASSOC_MAX];
-	struct sta_info *sta;
-	int duration = 10;
-	u8 addr[ETH_ALEN];
-	bool abridged;
-
-	blobmsg_parse(wnm_disassoc_policy, __WNM_DISASSOC_MAX, tb, blob_data(msg), blob_len(msg));
-
-	if (!tb[WNM_DISASSOC_ADDR])
-		return UBUS_STATUS_INVALID_ARGUMENT;
-
-	if (hwaddr_aton(blobmsg_data(tb[WNM_DISASSOC_ADDR]), addr))
-		return UBUS_STATUS_INVALID_ARGUMENT;
-
-	if (tb[WNM_DISASSOC_DURATION])
-		duration = blobmsg_get_u32(tb[WNM_DISASSOC_DURATION]);
-
-	abridged = !!(tb[WNM_DISASSOC_ABRIDGED] && blobmsg_get_bool(tb[WNM_DISASSOC_ABRIDGED]));
-
-	return hostapd_bss_tr_send(hapd, addr, true, abridged, duration, duration,
-				   1, tb[WNM_DISASSOC_NEIGHBORS]);
-}
 #endif
 
 #ifdef CONFIG_AIRTIME_POLICY
@@ -1698,7 +1663,6 @@
 	UBUS_METHOD("rrm_beacon_req", hostapd_rrm_beacon_req, beacon_req_policy),
 	UBUS_METHOD("link_measurement_req", hostapd_rrm_lm_req, lm_req_policy),
 #ifdef CONFIG_WNM_AP
-	UBUS_METHOD("wnm_disassoc_imminent", hostapd_wnm_disassoc_imminent, wnm_disassoc_policy),
 	UBUS_METHOD("bss_transition_request", hostapd_bss_transition_request, bss_tr_policy),
 #endif
 };
diff --git a/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb b/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb
index 7ac1b89..fad0f81 100644
--- a/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb
+++ b/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb
@@ -10,15 +10,12 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches:"
 
-SRCREV ?= "cff80b4f7d3c0a47c052e8187d671710f48939e4"
+SRCREV ?= "b859b9bceadccd882252ff0aa2fdba0d3b91764e"
 SRC_URI = "git://w1.fi/hostap.git;protocol=https;branch=main \
            file://wpa-supplicant.sh \
            file://wpa_supplicant.conf \
            file://wpa_supplicant.conf-sane \
            file://99_wpa_supplicant \
-           file://0001-build-Re-enable-options-for-libwpa_client.so-and-wpa.patch \
-           file://0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch \
-           file://0001-Install-wpa_passphrase-when-not-disabled.patch \
            file://wpa_supplicant-full.config \
            file://src \
            file://001-rdkb-remove-ubus-support.patch;apply=no \
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/328-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/328-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch
new file mode 100644
index 0000000..f0150dd
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/328-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch
@@ -0,0 +1,38 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 26 Mar 2022 23:58:35 +0100
+Subject: [PATCH] mac80211: do not wake queues on a vif that is being stopped
+
+When a vif is being removed and sdata->bss is cleared, __ieee80211_wake_txqs
+can still be called on it, which crashes as soon as sdata->bss is being
+dereferenced.
+To fix this properly, check for SDATA_STATE_RUNNING before waking queues,
+and take the fq lock when setting it (to ensure that __ieee80211_wake_txqs
+observes the change when running on a different CPU
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -377,7 +377,9 @@ static void ieee80211_do_stop(struct iee
+ 	bool cancel_scan;
+ 	struct cfg80211_nan_func *func;
+ 
++	spin_lock_bh(&local->fq.lock);
+ 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
++	spin_unlock_bh(&local->fq.lock);
+ 
+ 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+ 	if (cancel_scan)
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -301,6 +301,9 @@ static void __ieee80211_wake_txqs(struct
+ 	local_bh_disable();
+ 	spin_lock(&fq->lock);
+ 
++	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
++		goto out;
++
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP)
+ 		ps = &sdata->bss->ps;
+ 
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/330-mac80211-fix-overflow-issues-in-airtime-fairness-cod.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/330-mac80211-fix-overflow-issues-in-airtime-fairness-cod.patch
new file mode 100644
index 0000000..b7c1507
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/330-mac80211-fix-overflow-issues-in-airtime-fairness-cod.patch
@@ -0,0 +1,143 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 28 May 2022 16:44:53 +0200
+Subject: [PATCH] mac80211: fix overflow issues in airtime fairness code
+
+The airtime weight calculation overflows with a default weight value of 256
+whenever more than 8ms worth of airtime is reported.
+Bigger weight values impose even smaller limits on maximum airtime values.
+This can mess up airtime based calculations for drivers that don't report
+per-PPDU airtime values, but batch up values instead.
+
+Fix this by reordering multiplications/shifts and by reducing unnecessary
+intermediate precision (which was lost in a later stage anyway).
+
+The new shift value limits the maximum weight to 4096, which should be more
+than enough. Any values bigger than that will be rejected.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1602,6 +1602,9 @@ static int sta_apply_parameters(struct i
+ 	mask = params->sta_flags_mask;
+ 	set = params->sta_flags_set;
+ 
++	if (params->airtime_weight > BIT(IEEE80211_RECIPROCAL_SHIFT_STA))
++		return -EINVAL;
++
+ 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
+ 		/*
+ 		 * In mesh mode, ASSOCIATED isn't part of the nl80211
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1666,50 +1666,33 @@ static inline struct airtime_info *to_ai
+ /* To avoid divisions in the fast path, we keep pre-computed reciprocals for
+  * airtime weight calculations. There are two different weights to keep track
+  * of: The per-station weight and the sum of weights per phy.
+- *
+- * For the per-station weights (kept in airtime_info below), we use 32-bit
+- * reciprocals with a devisor of 2^19. This lets us keep the multiplications and
+- * divisions for the station weights as 32-bit operations at the cost of a bit
+- * of rounding error for high weights; but the choice of divisor keeps rounding
+- * errors <10% for weights <2^15, assuming no more than 8ms of airtime is
+- * reported at a time.
+- *
+- * For the per-phy sum of weights the values can get higher, so we use 64-bit
+- * operations for those with a 32-bit divisor, which should avoid any
+- * significant rounding errors.
++ * The per-sta shift value supports weight values of 1-4096
+  */
+-#define IEEE80211_RECIPROCAL_DIVISOR_64 0x100000000ULL
+-#define IEEE80211_RECIPROCAL_SHIFT_64 32
+-#define IEEE80211_RECIPROCAL_DIVISOR_32 0x80000U
+-#define IEEE80211_RECIPROCAL_SHIFT_32 19
++#define IEEE80211_RECIPROCAL_SHIFT_SUM	24
++#define IEEE80211_RECIPROCAL_SHIFT_STA	12
++#define IEEE80211_WEIGHT_SHIFT		8
+ 
+-static inline void airtime_weight_set(struct airtime_info *air_info, u16 weight)
++static inline void airtime_weight_set(struct airtime_info *air_info, u32 weight)
+ {
+ 	if (air_info->weight == weight)
+ 		return;
+ 
+ 	air_info->weight = weight;
+-	if (weight) {
+-		air_info->weight_reciprocal =
+-			IEEE80211_RECIPROCAL_DIVISOR_32 / weight;
+-	} else {
+-		air_info->weight_reciprocal = 0;
+-	}
++	if (weight)
++		weight = BIT(IEEE80211_RECIPROCAL_SHIFT_STA) / weight;
++	air_info->weight_reciprocal = weight;
+ }
+ 
+ static inline void airtime_weight_sum_set(struct airtime_sched_info *air_sched,
+-					  int weight_sum)
++					  u32 weight_sum)
+ {
+ 	if (air_sched->weight_sum == weight_sum)
+ 		return;
+ 
+ 	air_sched->weight_sum = weight_sum;
+-	if (air_sched->weight_sum) {
+-		air_sched->weight_sum_reciprocal = IEEE80211_RECIPROCAL_DIVISOR_64;
+-		do_div(air_sched->weight_sum_reciprocal, air_sched->weight_sum);
+-	} else {
+-		air_sched->weight_sum_reciprocal = 0;
+-	}
++	if (weight_sum)
++		weight_sum = BIT(IEEE80211_RECIPROCAL_SHIFT_SUM) / weight_sum;
++	air_sched->weight_sum_reciprocal = weight_sum;
+ }
+ 
+ /* A problem when trying to enforce airtime fairness is that we want to divide
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1894,9 +1894,9 @@ void ieee80211_register_airtime(struct i
+ {
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
+ 	struct ieee80211_local *local = sdata->local;
+-	u64 weight_sum, weight_sum_reciprocal;
+ 	struct airtime_sched_info *air_sched;
+ 	struct airtime_info *air_info;
++	u64 weight_sum_reciprocal;
+ 	u32 airtime = 0;
+ 
+ 	air_sched = &local->airtime[txq->ac];
+@@ -1907,27 +1907,21 @@ void ieee80211_register_airtime(struct i
+ 	if (local->airtime_flags & AIRTIME_USE_RX)
+ 		airtime += rx_airtime;
+ 
+-	/* Weights scale so the unit weight is 256 */
+-	airtime <<= 8;
+-
+ 	spin_lock_bh(&air_sched->lock);
+ 
+ 	air_info->tx_airtime += tx_airtime;
+ 	air_info->rx_airtime += rx_airtime;
+ 
+-	if (air_sched->weight_sum) {
+-		weight_sum = air_sched->weight_sum;
++	if (air_sched->weight_sum)
+ 		weight_sum_reciprocal = air_sched->weight_sum_reciprocal;
+-	} else {
+-		weight_sum = air_info->weight;
++	else
+ 		weight_sum_reciprocal = air_info->weight_reciprocal;
+-	}
+ 
+ 	/* Round the calculation of global vt */
+-	air_sched->v_t += (u64)((airtime + (weight_sum >> 1)) *
+-				weight_sum_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_64;
+-	air_info->v_t += (u32)((airtime + (air_info->weight >> 1)) *
+-			       air_info->weight_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_32;
++	air_sched->v_t += ((u64)airtime * weight_sum_reciprocal) >>
++			  (IEEE80211_RECIPROCAL_SHIFT_SUM - IEEE80211_WEIGHT_SHIFT);
++	air_info->v_t += (airtime * air_info->weight_reciprocal) >>
++			 (IEEE80211_RECIPROCAL_SHIFT_STA - IEEE80211_WEIGHT_SHIFT);
+ 	ieee80211_resort_txq(&local->hw, txq);
+ 
+ 	spin_unlock_bh(&air_sched->lock);
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/331-mac80211-improve-AQL-tx-time-estimation.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/331-mac80211-improve-AQL-tx-time-estimation.patch
new file mode 100644
index 0000000..529ad13
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/331-mac80211-improve-AQL-tx-time-estimation.patch
@@ -0,0 +1,80 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 11 Jun 2022 16:34:32 +0200
+Subject: [PATCH] mac80211: improve AQL tx time estimation
+
+If airtime cannot be calculated because of missing or unsupported rate info,
+use the smallest possible non-zero value for estimated tx time.
+This improves handling of these cases by preventing queueing of as many packets
+as the driver/hardware queue can hold for these stations.
+Also slightly improve limiting queueing by explicitly rounding up small values.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1107,20 +1107,24 @@ struct ieee80211_tx_info {
+ 	};
+ };
+ 
++#define IEEE80211_TX_TIME_EST_UNIT 4
++
++static inline u16
++ieee80211_info_get_tx_time_est(struct ieee80211_tx_info *info)
++{
++	return info->tx_time_est * IEEE80211_TX_TIME_EST_UNIT;
++}
++
+ static inline u16
+ ieee80211_info_set_tx_time_est(struct ieee80211_tx_info *info, u16 tx_time_est)
+ {
+ 	/* We only have 10 bits in tx_time_est, so store airtime
+ 	 * in increments of 4us and clamp the maximum to 2**12-1
+ 	 */
+-	info->tx_time_est = min_t(u16, tx_time_est, 4095) >> 2;
+-	return info->tx_time_est << 2;
+-}
++	tx_time_est = DIV_ROUND_UP(tx_time_est, IEEE80211_TX_TIME_EST_UNIT);
++	info->tx_time_est = min_t(u16, tx_time_est, BIT(10) - 1);
+ 
+-static inline u16
+-ieee80211_info_get_tx_time_est(struct ieee80211_tx_info *info)
+-{
+-	return info->tx_time_est << 2;
++	return ieee80211_info_get_tx_time_est(info);
+ }
+ 
+ /**
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -999,6 +999,8 @@ static void __ieee80211_tx_status(struct
+ 								   NULL,
+ 								   skb->len,
+ 								   false);
++			if (!airtime)
++				airtime = IEEE80211_TX_TIME_EST_UNIT;
+ 
+ 			ieee80211_register_airtime(txq, airtime, 0);
+ 		}
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3798,13 +3798,12 @@ encap_out:
+ 
+ 		airtime = ieee80211_calc_expected_tx_airtime(hw, vif, txq->sta,
+ 							     skb->len, ampdu);
+-		if (airtime) {
+-			airtime = ieee80211_info_set_tx_time_est(info, airtime);
+-			ieee80211_sta_update_pending_airtime(local, tx.sta,
+-							     txq->ac,
+-							     airtime,
+-							     false);
+-		}
++		if (!airtime)
++			airtime = IEEE80211_TX_TIME_EST_UNIT;
++
++		airtime = ieee80211_info_set_tx_time_est(info, airtime);
++		ieee80211_sta_update_pending_airtime(local, tx.sta, txq->ac,
++						     airtime, false);
+ 	}
+ 
+ 	return skb;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/332-mac80211-fix-ieee80211_txq_may_transmit-regression.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/332-mac80211-fix-ieee80211_txq_may_transmit-regression.patch
new file mode 100644
index 0000000..e3c08d3
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/332-mac80211-fix-ieee80211_txq_may_transmit-regression.patch
@@ -0,0 +1,91 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 11 Jun 2022 17:28:02 +0200
+Subject: [PATCH] mac80211: fix ieee80211_txq_may_transmit regression
+
+After switching to the virtual time based airtime scheduler, there were reports
+that ath10k with tx queueing in push-pull mode was experiencing significant
+latency for some stations.
+The reason for it is the fact that queues from which the ath10k firmware wants
+to pull are getting starved by airtime fairness constraints.
+Theoretically the same issue should have been there before the switch to virtual
+time, however it seems that in the old round-robin implementation it was simply
+looping until the requested txq was considered eligible, which led to it pretty
+much ignoring fairness constraints anyway.
+
+In order to fix the immediate regression, let's make bypassing airtime fairness
+explicit for now.
+Also update the documentation for ieee80211_txq_may_transmit, which was still
+referring to implementation details of the old round-robin scheduler
+
+Fixes: 2433647bc8d9 ("mac80211: Switch to a virtual time-based airtime scheduler")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -6700,22 +6700,11 @@ void ieee80211_return_txq(struct ieee802
+ /**
+  * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
+  *
+- * This function is used to check whether given txq is allowed to transmit by
+- * the airtime scheduler, and can be used by drivers to access the airtime
+- * fairness accounting without going using the scheduling order enfored by
+- * next_txq().
++ * Returns %true if there is remaining AQL budget for the tx queue and %false
++ * if it should be throttled. It will also mark the queue as active for the
++ * airtime scheduler.
+  *
+- * Returns %true if the airtime scheduler thinks the TXQ should be allowed to
+- * transmit, and %false if it should be throttled. This function can also have
+- * the side effect of rotating the TXQ in the scheduler rotation, which will
+- * eventually bring the deficit to positive and allow the station to transmit
+- * again.
+- *
+- * The API ieee80211_txq_may_transmit() also ensures that TXQ list will be
+- * aligned against driver's own round-robin scheduler list. i.e it rotates
+- * the TXQ list till it makes the requested node becomes the first entry
+- * in TXQ list. Thus both the TXQ list and driver's list are in sync. If this
+- * function returns %true, the driver is expected to schedule packets
++ * If this function returns %true, the driver is expected to schedule packets
+  * for transmission, and then return the TXQ through ieee80211_return_txq().
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4100,15 +4100,13 @@ EXPORT_SYMBOL(ieee80211_txq_airtime_chec
+ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
+ 				struct ieee80211_txq *txq)
+ {
+-	struct txq_info *first_txqi = NULL, *txqi = to_txq_info(txq);
+ 	struct ieee80211_local *local = hw_to_local(hw);
++	struct txq_info *txqi = to_txq_info(txq);
+ 	struct airtime_sched_info *air_sched;
+ 	struct airtime_info *air_info;
+-	struct rb_node *node = NULL;
+ 	bool ret = false;
+ 	u64 now;
+ 
+-
+ 	if (!ieee80211_txq_airtime_check(hw, txq))
+ 		return false;
+ 
+@@ -4120,19 +4118,6 @@ bool ieee80211_txq_may_transmit(struct i
+ 
+ 	now = ktime_get_coarse_boottime_ns();
+ 
+-	/* Like in ieee80211_next_txq(), make sure the first station in the
+-	 * scheduling order is eligible for transmission to avoid starvation.
+-	 */
+-	node = rb_first_cached(&air_sched->active_txqs);
+-	if (node) {
+-		first_txqi = container_of(node, struct txq_info,
+-					  schedule_order);
+-		air_info = to_airtime_info(&first_txqi->txq);
+-
+-		if (air_sched->v_t < air_info->v_t)
+-			airtime_catchup_v_t(air_sched, air_info->v_t, now);
+-	}
+-
+ 	air_info = to_airtime_info(&txqi->txq);
+ 	if (air_info->v_t <= air_sched->v_t) {
+ 		air_sched->last_schedule_activity = now;
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/333-mac80211-rework-the-airtime-fairness-implementation.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/333-mac80211-rework-the-airtime-fairness-implementation.patch
new file mode 100644
index 0000000..c900b25
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/333-mac80211-rework-the-airtime-fairness-implementation.patch
@@ -0,0 +1,819 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 28 May 2022 16:51:51 +0200
+Subject: [PATCH] mac80211: rework the airtime fairness implementation
+
+The current ATF implementation has a number of issues which have shown up
+during testing. Since it does not take into account the AQL budget of
+pending packets, the implementation might queue up large amounts of packets
+for a single txq until airtime gets reported after tx completion.
+The same then happens to the next txq afterwards. While the end result could
+still be considered fair, the bursty behavior introduces a large amount of
+latency.
+The current code also tries to avoid frequent re-sorting of txq entries in
+order to avoid having to re-balance the rbtree often.
+
+In order to fix these issues, introduce skip lists as a data structure, which
+offer similar lookup/insert/delete times as rbtree, but avoids the need for
+rebalacing by being probabilistic.
+Use this to keep tx entries sorted by virtual time + pending AQL budget and
+re-sort after each ieee80211_return_txq call.
+
+Since multiple txqs share a single air_time struct with a virtual time value,
+switch the active_txqs list to queue up air_time structs instead of queues.
+This helps avoid imbalance between shared txqs by servicing them round robin.
+
+ieee80211_next_txq now only dequeues the first element of active_txqs. To
+make that work for non-AQL or non-ATF drivers as well, add estimated tx
+airtime directly to air_info virtual time if either AQL or ATF is not
+supported.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ create mode 100644 include/linux/skiplist.h
+
+--- /dev/null
++++ b/include/linux/skiplist.h
+@@ -0,0 +1,250 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * A skip list is a probabilistic alternative to balanced trees. Unlike the
++ * red-black tree, it does not require rebalancing.
++ *
++ * This implementation uses only unidirectional next pointers and is optimized
++ * for use in a priority queue where elements are mostly deleted from the front
++ * of the queue.
++ *
++ * When storing up to 2^n elements in a n-level skiplist. lookup and deletion
++ * for the first element happens in O(1) time, other than that, insertion and
++ * deletion takes O(log n) time, assuming that the number of elements for an
++ * n-level list does not exceed 2^n.
++ *
++ * Usage:
++ * DECLARE_SKIPLIST_TYPE(foo, 5) will define the data types for a 5-level list:
++ * struct foo_list: the list data type
++ * struct foo_node: the node data for an element in the list
++ *
++ * DECLARE_SKIPLIST_IMPL(foo, foo_cmp_fn)
++ *
++ * Adds the skip list implementation. It depends on a provided function:
++ * int foo_cmp_fn(struct foo_list *list, struct foo_node *n1, struct foo_node *n2)
++ * This compares two elements given by their node pointers, returning values <0
++ * if n1 is less than n2, =0 and >0 for equal or bigger than respectively.
++ *
++ * This macro implements the following functions:
++ *
++ * void foo_list_init(struct foo_list *list)
++ *	initializes the skip list
++ *
++ * void foo_node_init(struct foo_node *node)
++ *	initializes a node. must be called before adding the node to the list
++ *
++ * struct foo_node *foo_node_next(struct foo_node *node)
++ *	gets the node directly after the provided node, or NULL if it was the last
++ *	element in the list.
++ *
++ * bool foo_is_queued(struct foo_node *node)
++ *	returns true if the node is on a list
++ *
++ * struct foo_node *foo_dequeue(struct foo_list *list)
++ *	deletes and returns the first element of the list (or returns NULL if empty)
++ *
++ * struct foo_node *foo_peek(struct foo_list *list)
++ *	returns the first element of the list
++ *
++ * void foo_insert(struct foo_list *list, struct foo_node *node)
++ *	inserts the node into the list. the node must be initialized and not on a
++ *	list already.
++ *
++ * void foo_delete(struct foo_list *list, struct foo_node *node)
++ *	deletes the node from the list, or does nothing if it's not on the list
++ */
++#ifndef __SKIPLIST_H
++#define __SKIPLIST_H
++
++#include <linux/bits.h>
++#include <linux/minmax.h>
++#include <linux/bug.h>
++#include <linux/prandom.h>
++
++#define SKIPLIST_POISON ((void *)1)
++
++#define DECLARE_SKIPLIST_TYPE(name, levels)				\
++struct name##_node {							\
++	struct name##_node *next[levels];				\
++};									\
++struct name##_list {							\
++	struct name##_node head;					\
++	unsigned int max_level;						\
++	unsigned int count;						\
++};
++
++#define DECLARE_SKIPLIST_IMPL(name, cmp_fn)				\
++static inline void							\
++name##_list_init(struct name##_list *list)				\
++{									\
++	memset(list, 0, sizeof(*list));					\
++}									\
++static inline void							\
++name##_node_init(struct name##_node *node)				\
++{									\
++	node->next[0] = SKIPLIST_POISON;				\
++}									\
++static inline struct name##_node *					\
++name##_node_next(struct name##_node *node)				\
++{									\
++	return node->next[0];						\
++}									\
++static inline bool							\
++name##_is_queued(struct name##_node *node)				\
++{									\
++	return node->next[0] != SKIPLIST_POISON;			\
++}									\
++static inline int							\
++__skiplist_##name##_cmp_impl(void *head, void *n1, void *n2)		\
++{									\
++	return cmp_fn(head, n1, n2);					\
++}									\
++static inline void							\
++__##name##_delete(struct name##_list *list)				\
++{									\
++	list->count--;							\
++	while (list->max_level &&					\
++	       !list->head.next[list->max_level])			\
++		list->max_level--;					\
++}									\
++static inline struct name##_node *					\
++name##_dequeue(struct name##_list *list)				\
++{									\
++	struct name##_node *ret;					\
++	unsigned int max_level = ARRAY_SIZE(list->head.next) - 1;	\
++	ret = (void *)__skiplist_dequeue((void **)&list->head,		\
++					 max_level);			\
++	if (!ret)							\
++		return NULL;						\
++	__##name##_delete(list);					\
++	return ret;							\
++}									\
++static inline struct name##_node *					\
++name##_peek(struct name##_list *list)					\
++{									\
++	return list->head.next[0];					\
++}									\
++static inline void							\
++name##_insert(struct name##_list *list, struct name##_node *node)	\
++{									\
++	int level = __skiplist_level(ARRAY_SIZE(list->head.next) - 1,	\
++				     list->count, prandom_u32());	\
++	level = min_t(int, level, list->max_level + 1);			\
++	__skiplist_insert((void *)&list->head, (void *)node, level,	\
++			  __skiplist_##name##_cmp_impl);		\
++	if (level > list->max_level)					\
++		list->max_level = level;				\
++	list->count++;							\
++}									\
++static inline void							\
++name##_delete(struct name##_list *list, struct name##_node *node)	\
++{									\
++	if (node->next[0] == SKIPLIST_POISON)				\
++	    return;							\
++	__skiplist_delete((void *)&list->head, (void *)node,		\
++			  ARRAY_SIZE(list->head.next) - 1,		\
++			  __skiplist_##name##_cmp_impl);		\
++	__##name##_delete(list);					\
++}
++
++
++typedef int (*__skiplist_cmp_t)(void *head, void *n1, void *n2);
++
++#define __skiplist_cmp(cmp, head, cur, node)				\
++	({								\
++		int cmp_val = cmp(head, cur, node);			\
++		if (!cmp_val)						\
++			cmp_val = (unsigned long)(cur) -		\
++				  (unsigned long)(node);		\
++		cmp_val;						\
++	})
++
++static inline void *
++__skiplist_dequeue(void **list, int max_level)
++{
++	void **node = list[0];
++	unsigned int i;
++
++	if (!node)
++		return NULL;
++
++	list[0] = node[0];
++	for (i = 1; i <= max_level; i++) {
++		if (list[i] != node)
++			break;
++
++		list[i] = node[i];
++	}
++	node[0] = SKIPLIST_POISON;
++
++	return node;
++}
++
++static inline void
++__skiplist_insert(void **list, void **node, int level, __skiplist_cmp_t cmp)
++{
++	void **head = list;
++
++	if (WARN(node[0] != SKIPLIST_POISON, "Insert on already inserted or uninitialized node"))
++	    return;
++	for (; level >= 0; level--) {
++		while (list[level] &&
++		       __skiplist_cmp(cmp, head, list[level], node) < 0)
++			list = list[level];
++
++		node[level] = list[level];
++		list[level] = node;
++	}
++}
++
++
++static inline void
++__skiplist_delete(void **list, void **node, int max_level, __skiplist_cmp_t cmp)
++{
++	void *head = list;
++	int i;
++
++	for (i = max_level; i >= 0; i--) {
++		while (list[i] && list[i] != node &&
++		       __skiplist_cmp(cmp, head, list[i], node) <= 0)
++			list = list[i];
++
++		if (list[i] != node)
++			continue;
++
++		list[i] = node[i];
++	}
++	node[0] = SKIPLIST_POISON;
++}
++
++static inline unsigned int
++__skiplist_level(unsigned int max_level, unsigned int count, unsigned int seed)
++{
++	unsigned int level = 0;
++
++	if (max_level >= 16 && !(seed & GENMASK(15, 0))) {
++		level += 16;
++		seed >>= 16;
++	}
++
++	if (max_level >= 8 && !(seed & GENMASK(7, 0))) {
++		level += 8;
++		seed >>= 8;
++	}
++
++	if (max_level >= 4 && !(seed & GENMASK(3, 0))) {
++		level += 4;
++		seed >>= 4;
++	}
++
++	if (!(seed & GENMASK(1, 0))) {
++		level += 2;
++		seed >>= 2;
++	}
++
++	if (!(seed & BIT(0)))
++		level++;
++
++	return min(level, max_level);
++}
++
++#endif
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1563,7 +1563,6 @@ static void sta_apply_airtime_params(str
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+ 		struct airtime_sched_info *air_sched = &local->airtime[ac];
+ 		struct airtime_info *air_info = &sta->airtime[ac];
+-		struct txq_info *txqi;
+ 		u8 tid;
+ 
+ 		spin_lock_bh(&air_sched->lock);
+@@ -1575,10 +1574,6 @@ static void sta_apply_airtime_params(str
+ 
+ 			airtime_weight_set(air_info, params->airtime_weight);
+ 
+-			txqi = to_txq_info(sta->sta.txq[tid]);
+-			if (RB_EMPTY_NODE(&txqi->schedule_order))
+-				continue;
+-
+ 			ieee80211_update_airtime_weight(local, air_sched,
+ 							0, true);
+ 		}
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -25,7 +25,8 @@
+ #include <linux/leds.h>
+ #include <linux/idr.h>
+ #include <linux/rhashtable.h>
+-#include <linux/rbtree.h>
++#include <linux/prandom.h>
++#include <linux/skiplist.h>
+ #include <net/ieee80211_radiotap.h>
+ #include <net/cfg80211.h>
+ #include <net/mac80211.h>
+@@ -854,6 +855,7 @@ enum txq_info_flags {
+ 	IEEE80211_TXQ_AMPDU,
+ 	IEEE80211_TXQ_NO_AMSDU,
+ 	IEEE80211_TXQ_STOP_NETIF_TX,
++	IEEE80211_TXQ_FORCE_ACTIVE,
+ };
+ 
+ /**
+@@ -870,7 +872,6 @@ struct txq_info {
+ 	struct fq_tin tin;
+ 	struct codel_vars def_cvars;
+ 	struct codel_stats cstats;
+-	struct rb_node schedule_order;
+ 
+ 	struct sk_buff_head frags;
+ 	unsigned long flags;
+@@ -1185,8 +1186,7 @@ enum mac80211_scan_state {
+  *
+  * @lock: spinlock that protects all the fields in this struct
+  * @active_txqs: rbtree of currently backlogged queues, sorted by virtual time
+- * @schedule_pos: the current position maintained while a driver walks the tree
+- *                with ieee80211_next_txq()
++ * @schedule_pos: last used airtime_info node while a driver walks the tree
+  * @active_list: list of struct airtime_info structs that were active within
+  *               the last AIRTIME_ACTIVE_DURATION (100 ms), used to compute
+  *               weight_sum
+@@ -1207,8 +1207,8 @@ enum mac80211_scan_state {
+  */
+ struct airtime_sched_info {
+ 	spinlock_t lock;
+-	struct rb_root_cached active_txqs;
+-	struct rb_node *schedule_pos;
++	struct airtime_sched_list active_txqs;
++	struct airtime_sched_node *schedule_pos;
+ 	struct list_head active_list;
+ 	u64 last_weight_update;
+ 	u64 last_schedule_activity;
+@@ -1663,6 +1663,20 @@ static inline struct airtime_info *to_ai
+ 	return &sdata->airtime[txq->ac];
+ }
+ 
++static inline int
++airtime_sched_cmp(struct airtime_sched_list *list,
++		  struct airtime_sched_node *n1, struct airtime_sched_node *n2)
++{
++	struct airtime_info *a1, *a2;
++
++	a1 = container_of(n1, struct airtime_info, schedule_order);
++	a2 = container_of(n2, struct airtime_info, schedule_order);
++
++	return a1->v_t_cur - a2->v_t_cur;
++}
++
++DECLARE_SKIPLIST_IMPL(airtime_sched, airtime_sched_cmp);
++
+ /* To avoid divisions in the fast path, we keep pre-computed reciprocals for
+  * airtime weight calculations. There are two different weights to keep track
+  * of: The per-station weight and the sum of weights per phy.
+@@ -1749,6 +1763,7 @@ static inline void init_airtime_info(str
+ 	air_info->aql_limit_high = air_sched->aql_txq_limit_high;
+ 	airtime_weight_set(air_info, IEEE80211_DEFAULT_AIRTIME_WEIGHT);
+ 	INIT_LIST_HEAD(&air_info->list);
++	airtime_sched_node_init(&air_info->schedule_order);
+ }
+ 
+ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -709,7 +709,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+ 		struct airtime_sched_info *air_sched = &local->airtime[i];
+ 
+-		air_sched->active_txqs = RB_ROOT_CACHED;
++		airtime_sched_list_init(&air_sched->active_txqs);
+ 		INIT_LIST_HEAD(&air_sched->active_list);
+ 		spin_lock_init(&air_sched->lock);
+ 		air_sched->aql_txq_limit_low = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1902,8 +1902,7 @@ void ieee80211_register_airtime(struct i
+ 	air_sched = &local->airtime[txq->ac];
+ 	air_info = to_airtime_info(txq);
+ 
+-	if (local->airtime_flags & AIRTIME_USE_TX)
+-		airtime += tx_airtime;
++	airtime += tx_airtime;
+ 	if (local->airtime_flags & AIRTIME_USE_RX)
+ 		airtime += rx_airtime;
+ 
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -135,11 +135,14 @@ enum ieee80211_agg_stop_reason {
+ #define AIRTIME_USE_TX		BIT(0)
+ #define AIRTIME_USE_RX		BIT(1)
+ 
++DECLARE_SKIPLIST_TYPE(airtime_sched, 5);
+ 
+ struct airtime_info {
++	struct airtime_sched_node schedule_order;
++	struct ieee80211_txq *txq[3];
+ 	u64 rx_airtime;
+ 	u64 tx_airtime;
+-	u64 v_t;
++	u64 v_t, v_t_cur;
+ 	u64 last_scheduled;
+ 	struct list_head list;
+ 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
+@@ -147,6 +150,7 @@ struct airtime_info {
+ 	u32 aql_limit_high;
+ 	u32 weight_reciprocal;
+ 	u16 weight;
++	u8 txq_idx;
+ };
+ 
+ void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -19,6 +19,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/export.h>
+ #include <linux/timekeeping.h>
++#include <linux/prandom.h>
+ #include <net/net_namespace.h>
+ #include <net/ieee80211_radiotap.h>
+ #include <net/cfg80211.h>
+@@ -1476,11 +1477,12 @@ void ieee80211_txq_init(struct ieee80211
+ 			struct sta_info *sta,
+ 			struct txq_info *txqi, int tid)
+ {
++	struct airtime_info *air_info;
++
+ 	fq_tin_init(&txqi->tin);
+ 	codel_vars_init(&txqi->def_cvars);
+ 	codel_stats_init(&txqi->cstats);
+ 	__skb_queue_head_init(&txqi->frags);
+-	RB_CLEAR_NODE(&txqi->schedule_order);
+ 
+ 	txqi->txq.vif = &sdata->vif;
+ 
+@@ -1489,7 +1491,7 @@ void ieee80211_txq_init(struct ieee80211
+ 		txqi->txq.tid = 0;
+ 		txqi->txq.ac = IEEE80211_AC_BE;
+ 
+-		return;
++		goto out;
+ 	}
+ 
+ 	if (tid == IEEE80211_NUM_TIDS) {
+@@ -1511,6 +1513,12 @@ void ieee80211_txq_init(struct ieee80211
+ 	txqi->txq.sta = &sta->sta;
+ 	txqi->txq.tid = tid;
+ 	sta->sta.txq[tid] = &txqi->txq;
++
++out:
++	air_info = to_airtime_info(&txqi->txq);
++	air_info->txq[air_info->txq_idx++] = &txqi->txq;
++	if (air_info->txq_idx == ARRAY_SIZE(air_info->txq))
++		air_info->txq_idx--;
+ }
+ 
+ void ieee80211_txq_purge(struct ieee80211_local *local,
+@@ -3633,6 +3641,8 @@ struct sk_buff *ieee80211_tx_dequeue(str
+ 	struct ieee80211_tx_data tx;
+ 	ieee80211_tx_result r;
+ 	struct ieee80211_vif *vif = txq->vif;
++	u32 airtime;
++	bool ampdu;
+ 
+ 	WARN_ON_ONCE(softirq_count() == 0);
+ 
+@@ -3791,20 +3801,35 @@ begin:
+ encap_out:
+ 	IEEE80211_SKB_CB(skb)->control.vif = vif;
+ 
+-	if (vif &&
+-	    wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
+-		bool ampdu = txq->ac != IEEE80211_AC_VO;
+-		u32 airtime;
+-
+-		airtime = ieee80211_calc_expected_tx_airtime(hw, vif, txq->sta,
+-							     skb->len, ampdu);
+-		if (!airtime)
+-			airtime = IEEE80211_TX_TIME_EST_UNIT;
+-
+-		airtime = ieee80211_info_set_tx_time_est(info, airtime);
+-		ieee80211_sta_update_pending_airtime(local, tx.sta, txq->ac,
+-						     airtime, false);
+-	}
++	if (!vif)
++		return skb;
++
++	ampdu = txq->ac != IEEE80211_AC_VO;
++	airtime = ieee80211_calc_expected_tx_airtime(hw, vif, txq->sta,
++						     skb->len, ampdu);
++	if (!airtime)
++		airtime = IEEE80211_TX_TIME_EST_UNIT;
++
++	/*
++	 * Tx queue scheduling always happens in airtime order and queues are
++	 * sorted by virtual time + pending AQL budget.
++	 * If AQL is not supported, pending AQL budget is always zero.
++	 * If airtime fairness is not supported, virtual time won't be directly
++	 * increased by driver tx completion.
++	 * Because of that, we register estimated tx time as airtime if either
++	 * AQL or ATF support is missing.
++	 */
++	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL) ||
++	    !wiphy_ext_feature_isset(local->hw.wiphy,
++				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++		ieee80211_register_airtime(txq, airtime, 0);
++
++	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
++		return skb;
++
++	airtime = ieee80211_info_set_tx_time_est(info, airtime);
++	ieee80211_sta_update_pending_airtime(local, tx.sta, txq->ac,
++					     airtime, false);
+ 
+ 	return skb;
+ 
+@@ -3815,85 +3840,92 @@ out:
+ }
+ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+ 
++static struct ieee80211_txq *
++airtime_info_next_txq_idx(struct airtime_info *air_info)
++{
++	air_info->txq_idx++;
++	if (air_info->txq_idx >= ARRAY_SIZE(air_info->txq) ||
++	    !air_info->txq[air_info->txq_idx])
++		air_info->txq_idx = 0;
++	return air_info->txq[air_info->txq_idx];
++}
++
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct airtime_sched_info *air_sched;
+ 	u64 now = ktime_get_coarse_boottime_ns();
+-	struct ieee80211_txq *ret = NULL;
++	struct airtime_sched_node *node = NULL;
++	struct ieee80211_txq *txq;
+ 	struct airtime_info *air_info;
+ 	struct txq_info *txqi = NULL;
+-	struct rb_node *node;
+-	bool first = false;
++	u8 txq_idx;
+ 
+ 	air_sched = &local->airtime[ac];
+ 	spin_lock_bh(&air_sched->lock);
+ 
+-	node = air_sched->schedule_pos;
+-
+ begin:
+-	if (!node) {
+-		node = rb_first_cached(&air_sched->active_txqs);
+-		first = true;
+-	} else {
+-		node = rb_next(node);
+-	}
++	txq = NULL;
++	if (airtime_sched_peek(&air_sched->active_txqs) ==
++	    air_sched->schedule_pos)
++		goto out;
+ 
++	node = airtime_sched_dequeue(&air_sched->active_txqs);
+ 	if (!node)
+ 		goto out;
+ 
+-	txqi = container_of(node, struct txq_info, schedule_order);
+-	air_info = to_airtime_info(&txqi->txq);
++	air_info = container_of(node, struct airtime_info, schedule_order);
+ 
+-	if (air_info->v_t > air_sched->v_t &&
+-	    (!first || !airtime_catchup_v_t(air_sched, air_info->v_t, now)))
+-		goto out;
+-
+-	if (!ieee80211_txq_airtime_check(hw, &txqi->txq)) {
+-		first = false;
++	txq = airtime_info_next_txq_idx(air_info);
++	txq_idx = air_info->txq_idx;
++	if (!ieee80211_txq_airtime_check(hw, txq))
+ 		goto begin;
++
++	while (1) {
++		txqi = to_txq_info(txq);
++		if (test_and_clear_bit(IEEE80211_TXQ_FORCE_ACTIVE, &txqi->flags))
++			break;
++
++		if (txq_has_queue(txq))
++			break;
++
++		txq = airtime_info_next_txq_idx(air_info);
++		if (txq_idx == air_info->txq_idx)
++			goto begin;
+ 	}
+ 
++	if (air_info->v_t_cur > air_sched->v_t)
++		airtime_catchup_v_t(air_sched, air_info->v_t_cur, now);
++
+ 	air_sched->schedule_pos = node;
+ 	air_sched->last_schedule_activity = now;
+-	ret = &txqi->txq;
+ out:
+ 	spin_unlock_bh(&air_sched->lock);
+-	return ret;
++	return txq;
+ }
+ EXPORT_SYMBOL(ieee80211_next_txq);
+ 
+-static void __ieee80211_insert_txq(struct rb_root_cached *root,
++static void __ieee80211_insert_txq(struct ieee80211_local *local,
++				   struct airtime_sched_info *air_sched,
+ 				   struct txq_info *txqi)
+ {
+-	struct rb_node **new = &root->rb_root.rb_node;
+-	struct airtime_info *old_air, *new_air;
+-	struct rb_node *parent = NULL;
+-	struct txq_info *__txqi;
+-	bool leftmost = true;
+-
+-	while (*new) {
+-		parent = *new;
+-		__txqi = rb_entry(parent, struct txq_info, schedule_order);
+-		old_air = to_airtime_info(&__txqi->txq);
+-		new_air = to_airtime_info(&txqi->txq);
++	struct airtime_info *air_info = to_airtime_info(&txqi->txq);
++	u32 aql_time = 0;
+ 
+-		if (new_air->v_t <= old_air->v_t) {
+-			new = &parent->rb_left;
+-		} else {
+-			new = &parent->rb_right;
+-			leftmost = false;
+-		}
++	if (wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
++	    aql_time = atomic_read(&air_info->aql_tx_pending);
++	    aql_time *= air_info->weight_reciprocal;
++	    aql_time >>= IEEE80211_RECIPROCAL_SHIFT_STA - IEEE80211_WEIGHT_SHIFT;
+ 	}
+ 
+-	rb_link_node(&txqi->schedule_order, parent, new);
+-	rb_insert_color_cached(&txqi->schedule_order, root, leftmost);
++	airtime_sched_delete(&air_sched->active_txqs, &air_info->schedule_order);
++	air_info->v_t_cur = air_info->v_t + aql_time;
++	airtime_sched_insert(&air_sched->active_txqs, &air_info->schedule_order);
+ }
+ 
+ void ieee80211_resort_txq(struct ieee80211_hw *hw,
+ 			  struct ieee80211_txq *txq)
+ {
+-	struct airtime_info *air_info = to_airtime_info(txq);
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct txq_info *txqi = to_txq_info(txq);
+ 	struct airtime_sched_info *air_sched;
+@@ -3901,41 +3933,7 @@ void ieee80211_resort_txq(struct ieee802
+ 	air_sched = &local->airtime[txq->ac];
+ 
+ 	lockdep_assert_held(&air_sched->lock);
+-
+-	if (!RB_EMPTY_NODE(&txqi->schedule_order)) {
+-		struct airtime_info *a_prev = NULL, *a_next = NULL;
+-		struct txq_info *t_prev, *t_next;
+-		struct rb_node *n_prev, *n_next;
+-
+-		/* Erasing a node can cause an expensive rebalancing operation,
+-		 * so we check the previous and next nodes first and only remove
+-		 * and re-insert if the current node is not already in the
+-		 * correct position.
+-		 */
+-		if ((n_prev = rb_prev(&txqi->schedule_order)) != NULL) {
+-			t_prev = container_of(n_prev, struct txq_info,
+-					      schedule_order);
+-			a_prev = to_airtime_info(&t_prev->txq);
+-		}
+-
+-		if ((n_next = rb_next(&txqi->schedule_order)) != NULL) {
+-			t_next = container_of(n_next, struct txq_info,
+-					      schedule_order);
+-			a_next = to_airtime_info(&t_next->txq);
+-		}
+-
+-		if ((!a_prev || a_prev->v_t <= air_info->v_t) &&
+-		    (!a_next || a_next->v_t > air_info->v_t))
+-			return;
+-
+-		if (air_sched->schedule_pos == &txqi->schedule_order)
+-			air_sched->schedule_pos = n_prev;
+-
+-		rb_erase_cached(&txqi->schedule_order,
+-				&air_sched->active_txqs);
+-		RB_CLEAR_NODE(&txqi->schedule_order);
+-		__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
+-	}
++	__ieee80211_insert_txq(local, air_sched, txqi);
+ }
+ 
+ void ieee80211_update_airtime_weight(struct ieee80211_local *local,
+@@ -3984,7 +3982,7 @@ void ieee80211_schedule_txq(struct ieee8
+ 	was_active = airtime_is_active(air_info, now);
+ 	airtime_set_active(air_sched, air_info, now);
+ 
+-	if (!RB_EMPTY_NODE(&txqi->schedule_order))
++	if (airtime_sched_is_queued(&air_info->schedule_order))
+ 		goto out;
+ 
+ 	/* If the station has been inactive for a while, catch up its v_t so it
+@@ -3996,7 +3994,7 @@ void ieee80211_schedule_txq(struct ieee8
+ 		air_info->v_t = air_sched->v_t;
+ 
+ 	ieee80211_update_airtime_weight(local, air_sched, now, !was_active);
+-	__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
++	__ieee80211_insert_txq(local, air_sched, txqi);
+ 
+ out:
+ 	spin_unlock_bh(&air_sched->lock);
+@@ -4017,24 +4015,14 @@ static void __ieee80211_unschedule_txq(s
+ 
+ 	lockdep_assert_held(&air_sched->lock);
+ 
++	airtime_sched_delete(&air_sched->active_txqs, &air_info->schedule_order);
+ 	if (purge) {
+ 		list_del_init(&air_info->list);
+ 		ieee80211_update_airtime_weight(local, air_sched, 0, true);
+-	}
+-
+-	if (RB_EMPTY_NODE(&txqi->schedule_order))
+-		return;
+-
+-	if (air_sched->schedule_pos == &txqi->schedule_order)
+-		air_sched->schedule_pos = rb_prev(&txqi->schedule_order);
+-
+-	if (!purge)
++	} else {
+ 		airtime_set_active(air_sched, air_info,
+ 				   ktime_get_coarse_boottime_ns());
+-
+-	rb_erase_cached(&txqi->schedule_order,
+-			&air_sched->active_txqs);
+-	RB_CLEAR_NODE(&txqi->schedule_order);
++	}
+ }
+ 
+ void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
+@@ -4054,14 +4042,22 @@ void ieee80211_return_txq(struct ieee802
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct txq_info *txqi = to_txq_info(txq);
++	struct airtime_sched_info *air_sched;
++	struct airtime_info *air_info;
+ 
+-	spin_lock_bh(&local->airtime[txq->ac].lock);
++	air_sched = &local->airtime[txq->ac];
++	air_info = to_airtime_info(&txqi->txq);
+ 
+-	if (!RB_EMPTY_NODE(&txqi->schedule_order) && !force &&
+-	    !txq_has_queue(txq))
+-		__ieee80211_unschedule_txq(hw, txq, false);
++	if (force)
++		set_bit(IEEE80211_TXQ_FORCE_ACTIVE, &txqi->flags);
+ 
+-	spin_unlock_bh(&local->airtime[txq->ac].lock);
++	spin_lock_bh(&air_sched->lock);
++	if (force || (txq_has_queue(txq) &&
++		      ieee80211_txq_airtime_check(hw, &txqi->txq)))
++		__ieee80211_insert_txq(local, air_sched, txqi);
++	else
++		__ieee80211_unschedule_txq(hw, txq, false);
++	spin_unlock_bh(&air_sched->lock);
+ }
+ EXPORT_SYMBOL(ieee80211_return_txq);
+ 
+@@ -4113,9 +4109,6 @@ bool ieee80211_txq_may_transmit(struct i
+ 	air_sched = &local->airtime[txq->ac];
+ 	spin_lock_bh(&air_sched->lock);
+ 
+-	if (RB_EMPTY_NODE(&txqi->schedule_order))
+-		goto out;
+-
+ 	now = ktime_get_coarse_boottime_ns();
+ 
+ 	air_info = to_airtime_info(&txqi->txq);
+@@ -4124,7 +4117,6 @@ bool ieee80211_txq_may_transmit(struct i
+ 		ret = true;
+ 	}
+ 
+-out:
+ 	spin_unlock_bh(&air_sched->lock);
+ 	return ret;
+ }
+@@ -4135,9 +4127,7 @@ void ieee80211_txq_schedule_start(struct
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct airtime_sched_info *air_sched = &local->airtime[ac];
+ 
+-	spin_lock_bh(&air_sched->lock);
+ 	air_sched->schedule_pos = NULL;
+-	spin_unlock_bh(&air_sched->lock);
+ }
+ EXPORT_SYMBOL(ieee80211_txq_schedule_start);
+ 
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/350-bss-color-collision.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/350-bss-color-collision.patch
index 5924a05..6339f85 100644
--- a/recipes-kernel/linux-mac80211/files/patches/subsys/350-bss-color-collision.patch
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/350-bss-color-collision.patch
@@ -26,7 +26,7 @@
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -2418,6 +2418,9 @@ struct ieee80211_txq {
+@@ -2422,6 +2422,9 @@ struct ieee80211_txq {
   *	usage and 802.11 frames with %RX_FLAG_ONLY_MONITOR set for monitor to
   *	the stack.
   *
@@ -36,7 +36,7 @@
   * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
   */
  enum ieee80211_hw_flags {
-@@ -2473,6 +2476,7 @@ enum ieee80211_hw_flags {
+@@ -2477,6 +2480,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_RX_DECAP_OFFLOAD,
  	IEEE80211_HW_SUPPORTS_CONC_MON_RX_DECAP,
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/500-mac80211_configure_antenna_gain.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/500-mac80211_configure_antenna_gain.patch
index 612b9d6..15632e4 100644
--- a/recipes-kernel/linux-mac80211/files/patches/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/500-mac80211_configure_antenna_gain.patch
@@ -18,7 +18,7 @@
  
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1566,6 +1566,7 @@ enum ieee80211_smps_mode {
+@@ -1570,6 +1570,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1586,6 +1587,7 @@ enum ieee80211_smps_mode {
+@@ -1590,6 +1591,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2845,6 +2845,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2843,6 +2843,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static void ieee80211_rfkill_poll(struct wiphy *wiphy)
  {
  	struct ieee80211_local *local = wiphy_priv(wiphy);
-@@ -4549,6 +4562,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -4547,6 +4560,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/783-sync-nl80211.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/783-sync-nl80211.patch
new file mode 100644
index 0000000..dc2b05b
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/783-sync-nl80211.patch
@@ -0,0 +1,22 @@
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -6027,6 +6027,11 @@ enum nl80211_feature_flags {
+  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
+  *	detection and change announcemnts.
+  *
++ * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD: Driver running in AP mode supports
++ *	FILS encryption and decryption for (Re)Association Request and Response
++ *	frames. Userspace has to share FILS AAD details to the driver by using
++ *	@NL80211_CMD_SET_FILS_AAD.
++ *
+  * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
+  *	detection.
+  *
+@@ -6095,6 +6100,7 @@ enum nl80211_ext_feature_index {
+ 	NL80211_EXT_FEATURE_SECURE_RTT,
+ 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
+ 	NL80211_EXT_FEATURE_BSS_COLOR,
++	NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
+ 	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
+ 
+ 	/* add new features before the definition below */
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/907-mac80211-fix-331-include-minmax-fail.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/907-mac80211-fix-331-include-minmax-fail.patch
new file mode 100644
index 0000000..aa96a7e
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/907-mac80211-fix-331-include-minmax-fail.patch
@@ -0,0 +1,16 @@
+diff --git a/include/linux/skiplist.h b/include/linux/skiplist.h
+index 2312ed8..0677cb7 100644
+--- a/include/linux/skiplist.h
++++ b/include/linux/skiplist.h
+@@ -56,7 +56,7 @@
+ #define __SKIPLIST_H
+ 
+ #include <linux/bits.h>
+-#include <linux/minmax.h>
++#include <linux/kernel.h>
+ #include <linux/bug.h>
+ #include <linux/prandom.h>
+ 
+-- 
+2.29.2
+
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/908-mac80211-add-s1g-category-to-_ieee80211_is_robust_mg.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/908-mac80211-add-s1g-category-to-_ieee80211_is_robust_mg.patch
new file mode 100644
index 0000000..03c81c6
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/908-mac80211-add-s1g-category-to-_ieee80211_is_robust_mg.patch
@@ -0,0 +1,25 @@
+From 3e8e9d601b30cc0d141108e93579fe72462039d5 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 8 Jun 2022 10:26:39 +0800
+Subject: [PATCH] mac80211: add s1g category to _ieee80211_is_robust_mgmt_frame
+
+Unprotected S1G with code 22 is not robust mgmt frame.
+---
+ include/linux/ieee80211.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 4d00f7a..6735494 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -3999,6 +3999,7 @@ static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
+ 			*category != WLAN_CATEGORY_SELF_PROTECTED &&
+ 			*category != WLAN_CATEGORY_UNPROT_DMG &&
+ 			*category != WLAN_CATEGORY_VHT &&
++			*category != WLAN_CATEGORY_S1G &&
+ 			*category != WLAN_CATEGORY_VENDOR_SPECIFIC;
+ 	}
+ 
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
index 89f1e95..7f39831 100644
--- a/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
@@ -25,15 +25,23 @@
     file://324-mac80211-MBSSID-beacon-handling-in-AP-mode.patch \
     file://325-mac80211-MBSSID-channel-switch.patch \
     file://326-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch \
+    file://328-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch \
     file://329-mac80211-minstrel_ht-fix-where-rate-stats-are-stored.patch \
+    file://330-mac80211-fix-overflow-issues-in-airtime-fairness-cod.patch \
+    file://331-mac80211-improve-AQL-tx-time-estimation.patch \
+    file://332-mac80211-fix-ieee80211_txq_may_transmit-regression.patch \
+    file://333-mac80211-rework-the-airtime-fairness-implementation.patch \
     file://350-bss-color-collision.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
+    file://783-sync-nl80211.patch \
     file://901-mac80211-check-twt-responder-when-setu-twt.patch \
     file://902-nl80211-internal-extend-CAC-time-for-weather-radar-c.patch \
     file://903-mac80211-it-s-invalid-case-when-frag_threshold-is-gr.patch \
     file://904-mac80211-correct-legacy-rates-check-in-ieee80211_cal.patch \
     file://905-mac80211-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch \
     file://906-mac80211-add-support-for-runtime-set-inband-discovery.patch \
+    file://907-mac80211-fix-331-include-minmax-fail.patch \
+    file://908-mac80211-add-s1g-category-to-_ieee80211_is_robust_mg.patch \
     "
diff --git a/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
index 4b45104..abdd03f 100644
--- a/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 9d16552ff5dc96dd576d15f263ac1ae180ac615e Mon Sep 17 00:00:00 2001
+From 31be26088119f67efdc8dcb79c64765abb10d356 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Wed, 19 Jan 2022 15:46:06 +0800
-Subject: [PATCH 1/6] mt76: mt7915: rework testmode init registers
+Date: Mon, 6 Jun 2022 19:46:26 +0800
+Subject: [PATCH 1/7] mt76: mt7915: rework testmode init registers
 
 ---
  mt7915/mmio.c     |  2 ++
@@ -10,10 +10,10 @@
  3 files changed, 54 insertions(+), 16 deletions(-)
 
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 5062e0d8..2466907e 100644
+index 46ee8a7d..71945ba9 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -53,6 +53,7 @@ static const u32 mt7986_reg[] = {
+@@ -59,6 +59,7 @@ static const u32 mt7986_reg[] = {
  };
  
  static const u32 mt7915_offs[] = {
@@ -21,7 +21,7 @@
  	[TMAC_CDTR]		= 0x090,
  	[TMAC_ODTR]		= 0x094,
  	[TMAC_ATCR]		= 0x098,
-@@ -126,6 +127,7 @@ static const u32 mt7915_offs[] = {
+@@ -132,6 +133,7 @@ static const u32 mt7915_offs[] = {
  };
  
  static const u32 mt7916_offs[] = {
@@ -30,10 +30,10 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e5f93c40..999dd7fc 100644
+index 77fd448b..c7c9e411 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -34,6 +34,7 @@ enum reg_rev {
+@@ -36,6 +36,7 @@ enum reg_rev {
  };
  
  enum offs_rev {
@@ -41,9 +41,9 @@
  	TMAC_CDTR,
  	TMAC_ODTR,
  	TMAC_ATCR,
-@@ -172,6 +173,12 @@ enum offs_rev {
- #define MT_MDP_TO_HIF			0
- #define MT_MDP_TO_WM			1
+@@ -185,6 +186,12 @@ enum offs_rev {
+ #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
+ #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
  
 +#define MT_MDP_TOP_DBG_WDT_CTRL			MT_MDP(0x0d0)
 +#define MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK	BIT(7)
@@ -54,7 +54,7 @@
  /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
  #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
  #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -180,6 +187,9 @@ enum offs_rev {
+@@ -193,6 +200,9 @@ enum offs_rev {
  #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
  #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
  
@@ -64,7 +64,7 @@
  #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
   #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
  #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -451,8 +461,10 @@ enum offs_rev {
+@@ -464,8 +474,10 @@ enum offs_rev {
  #define MT_AGG_PCR0_VHT_PROT		BIT(13)
  #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
  
diff --git a/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch b/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
index 2ece0e0..61256ba 100644
--- a/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
@@ -1,7 +1,7 @@
-From 2b65580db9081ac1ace74aed7b06cc855162d408 Mon Sep 17 00:00:00 2001
+From ce19a95831eeb721ce52bb913ac52bd5a0d88bab Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 25 Feb 2022 09:36:01 +0800
-Subject: [PATCH 2/6] mt76: testmode: rework tx antenna setting
+Subject: [PATCH 2/7] mt76: testmode: rework tx antenna setting
 
 ---
  mt7915/mcu.c      | 7 +------
@@ -10,10 +10,10 @@
  3 files changed, 4 insertions(+), 16 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2aba342c..549281a4 100644
+index 2a88c14b..bdef2b37 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2822,14 +2822,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+@@ -2933,14 +2933,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
  
  #ifdef CONFIG_NL80211_TESTMODE
  	if (phy->mt76->test.tx_antenna_mask &&
diff --git a/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch b/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
index 822aaad..fd20055 100644
--- a/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
@@ -1,7 +1,7 @@
-From 0b8c7d725830b5873c648777ab7813fff9d5951f Mon Sep 17 00:00:00 2001
+From ab8812a820a8b001d5abeb4d73b46db8e6453451 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 3 Jan 2022 17:09:53 +0800
-Subject: [PATCH 3/6] mt76: mt7915: rework rx testmode stats
+Subject: [PATCH 3/7] mt76: mt7915: rework rx testmode stats
 
 ---
  mac80211.c        |  3 +-
@@ -15,10 +15,10 @@
  8 files changed, 109 insertions(+), 17 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 5b53d008..5a4ac5de 100644
+index 5515e169..8c90db87 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -737,7 +737,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -745,7 +745,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -29,10 +29,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 81078be3..d5f8650f 100644
+index 4e8997c4..28720ee4 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -583,6 +583,8 @@ struct mt76_testmode_ops {
+@@ -604,6 +604,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -41,7 +41,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -614,6 +616,8 @@ struct mt76_testmode_data {
+@@ -635,6 +637,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -50,7 +50,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -621,6 +625,7 @@ struct mt76_testmode_data {
+@@ -642,6 +646,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -59,10 +59,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c3c93338..54419864 100644
+index 561fb036..aa14d2d4 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -980,6 +980,7 @@ enum {
+@@ -979,6 +979,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -71,7 +71,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 960072a4..52368dc3 100644
+index 5abde482..21aa9633 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -28,6 +28,7 @@ struct mt7915_mcu_txd {
diff --git a/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-fix-tx-descriptor.patch b/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-fix-tx-descriptor.patch
index c84c60e..acf3a52 100644
--- a/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-fix-tx-descriptor.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-fix-tx-descriptor.patch
@@ -1,17 +1,17 @@
-From d0a61bbe57616c1a87a3bb4676f141ed54110add Mon Sep 17 00:00:00 2001
+From 51cffe3e010931c8f070a101ece043072bed2512 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 19 Jan 2022 15:51:01 +0800
-Subject: [PATCH 4/6] mt76: mt7915: fix tx descriptor
+Subject: [PATCH 4/7] mt76: mt7915: fix tx descriptor
 
 ---
  mt7915/mac.c | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 47d5a993..887292da 100644
+index a57d2732..a3cf1b74 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1001,6 +1001,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -1002,6 +1002,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  	if (td->tx_rate_ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
  		val |= MT_TXD6_LDPC;
  
diff --git a/recipes-kernel/linux-mt76/files/patches/0015-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-kernel/linux-mt76/files/patches/0005-mt76-mt7915-drop-undefined-action-frame.patch
similarity index 77%
rename from recipes-kernel/linux-mt76/files/patches/0015-mt76-mt7915-drop-undefined-action-frame.patch
rename to recipes-kernel/linux-mt76/files/patches/0005-mt76-mt7915-drop-undefined-action-frame.patch
index f8f766e..cfb0764 100644
--- a/recipes-kernel/linux-mt76/files/patches/0015-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0005-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,17 +1,17 @@
-From 573b80a984695b338e12c6c30bb4e9f7af7e3495 Mon Sep 17 00:00:00 2001
+From 65c8978578ae5a485455617e5598ec83c2d519ae Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 5/7] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 1e0ddc13..81c582f2 100644
+index a3cf1b74..b0e86968 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1303,6 +1303,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1281,6 +1281,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info)
  {
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
@@ -20,7 +20,7 @@
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -1333,6 +1335,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1311,6 +1313,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
diff --git a/recipes-kernel/linux-mt76/files/patches/0019-mt76-mt7915-add-the-maximum-size-of-beacon-offload.patch b/recipes-kernel/linux-mt76/files/patches/0006-mt76-mt7915-add-the-maximum-size-of-beacon-offload.patch
similarity index 91%
rename from recipes-kernel/linux-mt76/files/patches/0019-mt76-mt7915-add-the-maximum-size-of-beacon-offload.patch
rename to recipes-kernel/linux-mt76/files/patches/0006-mt76-mt7915-add-the-maximum-size-of-beacon-offload.patch
index db4638d..5758ac2 100644
--- a/recipes-kernel/linux-mt76/files/patches/0019-mt76-mt7915-add-the-maximum-size-of-beacon-offload.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0006-mt76-mt7915-add-the-maximum-size-of-beacon-offload.patch
@@ -1,7 +1,7 @@
-From f5a80422207b76c740f284719539419b6a3dcc89 Mon Sep 17 00:00:00 2001
+From 29eed004474096aa960336f7850dc0bad49eda6a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 23 May 2022 17:09:52 +0800
-Subject: [PATCH] mt76: mt7915: add the maximum size of beacon offload
+Subject: [PATCH 6/7] mt76: mt7915: add the maximum size of beacon offload
 
 add the maximum size of beacon offload to avoid exceeding the size limit
 
@@ -13,7 +13,7 @@
  2 files changed, 12 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index bdef2b3..8155900 100644
+index bdef2b37..81559002 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2037,6 +2037,13 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
@@ -49,7 +49,7 @@
  
  	if (vif->bss_conf.nontransmitted)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 21aa963..d46c8da 100644
+index 21aa9633..d46c8da4 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -490,6 +490,9 @@ enum {
@@ -63,5 +63,5 @@
  					 sizeof(struct bss_info_omac) +	\
  					 sizeof(struct bss_info_basic) +\
 -- 
-2.29.2
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-update-mpdu-density-in-6g-capability.patch b/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-update-mpdu-density-in-6g-capability.patch
new file mode 100644
index 0000000..371424b
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-update-mpdu-density-in-6g-capability.patch
@@ -0,0 +1,28 @@
+From 173ee8c64b2e4cac133df1fbb1fd676c933fb7b1 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 6 Jun 2022 17:03:07 +0800
+Subject: [PATCH 7/7] mt76: mt7915: update mpdu density in 6g capability
+
+Set mpdu density to 2 usec in 6g capability.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7915/init.c b/mt7915/init.c
+index b4727526..66884be0 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -980,7 +980,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+ 			u16 cap = IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
+ 				  IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
+ 
+-			cap |= u16_encode_bits(IEEE80211_HT_MPDU_DENSITY_8,
++			cap |= u16_encode_bits(IEEE80211_HT_MPDU_DENSITY_2,
+ 					       IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START) |
+ 			       u16_encode_bits(IEEE80211_VHT_MAX_AMPDU_1024K,
+ 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP) |
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-update-mt7986-CR-for-different-adie-vers.patch b/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-update-mt7986-CR-for-different-adie-vers.patch
deleted file mode 100644
index 1340ac9..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-update-mt7986-CR-for-different-adie-vers.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 14baf1e2df409bdfdf3255dbe8ad5ecc1852b8b0 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Tue, 15 Mar 2022 14:21:13 +0800
-Subject: [PATCH] mt76: mt7915: update mt7986 CR for different adie version
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/regs.h |  1 +
- mt7915/soc.c  | 21 ++++++++++++++++++---
- 2 files changed, 19 insertions(+), 3 deletions(-)
-
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index cb7c7e14..97984aaf 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -822,6 +822,7 @@ enum offs_rev {
- 
- /* ADIE */
- #define MT_ADIE_CHIP_ID			0x02c
-+#define MT_ADIE_VERSION_MASK		GENMASK(15, 0)
- #define MT_ADIE_CHIP_ID_MASK		GENMASK(31, 16)
- #define MT_ADIE_IDX0			GENMASK(15, 0)
- #define MT_ADIE_IDX1			GENMASK(31, 16)
-diff --git a/mt7915/soc.c b/mt7915/soc.c
-index d465f8d8..a977f90a 100644
---- a/mt7915/soc.c
-+++ b/mt7915/soc.c
-@@ -469,17 +469,32 @@ static int mt7986_wmac_adie_xtal_trim_7976(struct mt7915_dev *dev, u8 adie)
- 
- static int mt7986_wmac_adie_patch_7976(struct mt7915_dev *dev, u8 adie)
- {
-+	u32 id, version, rg_xo_01, rg_xo_03;
- 	int ret;
- 
--	ret = mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_TOP_THADC, 0x4a563b00);
-+	ret = mt76_wmac_spi_read(dev, adie, MT_ADIE_CHIP_ID, &id);
- 	if (ret)
- 		return ret;
- 
--	ret = mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_01, 0x1d59080f);
-+	version = FIELD_GET(MT_ADIE_VERSION_MASK, id);
-+
-+	ret = mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_TOP_THADC, 0x4a563b00);
- 	if (ret)
- 		return ret;
- 
--	return mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_03, 0x34c00fe0);
-+	if (version == 0x8a00 || version == 0x8a10 || version == 0x8b00) {
-+		rg_xo_01 = 0x1d59080f;
-+		rg_xo_03 = 0x34c00fe0;
-+	} else {
-+		rg_xo_01 = 0x1959f80f;
-+		rg_xo_03 = 0x34d00fe0;
-+	}
-+
-+	ret = mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_01, rg_xo_01);
-+ 	if (ret)
-+	 		return ret;
-+
-+	return mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_03, rg_xo_03);
- }
- 
- static int
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0008-mt76-common-RF-CR-idx-require-8-bits.patch b/recipes-kernel/linux-mt76/files/patches/0008-mt76-common-RF-CR-idx-require-8-bits.patch
new file mode 100644
index 0000000..cef3c72
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/0008-mt76-common-RF-CR-idx-require-8-bits.patch
@@ -0,0 +1,28 @@
+From 01508ed2c2fb03cdacd855c5a870133cc04048f5 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Mon, 13 Jun 2022 23:10:26 +0800
+Subject: [PATCH] mt76: common: RF CR idx require 8 bits
+
+Change-Id: I95af9cca36052be090be776868822d0a74377c9d
+---
+ mt7915/mcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 9da3e85..3615195 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -4479,8 +4479,8 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+ 		__le32 ofs;
+ 		__le32 data;
+ 	} __packed req = {
+-		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 28))),
+-		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(27, 0))),
++		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
++		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
+ 		.data = set ? cpu_to_le32(*val) : 0,
+ 	};
+ 	struct sk_buff *skb;
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/0009-mt76-mt7915-fix-table_mask-to-u16.patch b/recipes-kernel/linux-mt76/files/patches/0009-mt76-mt7915-fix-table_mask-to-u16.patch
deleted file mode 100644
index e9184f3..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0009-mt76-mt7915-fix-table_mask-to-u16.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 053df93aaa079c2942eadf52fb33f76dfffa2f05 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Tue, 22 Mar 2022 15:49:04 +0800
-Subject: [PATCH] mt76: mt7915: fix table_mask to u16
-
-mt7915 can support 16 twt stations so modify table_mask to u16.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/mt7915.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6efa0a2e..4b6eda95 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -319,7 +319,7 @@ struct mt7915_dev {
- 	void *cal;
- 
- 	struct {
--		u8 table_mask;
-+		u16 table_mask;
- 		u8 n_agrt;
- 	} twt;
- 
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0012-mt76-mt7915-reject-duplicated-twt-flow.patch b/recipes-kernel/linux-mt76/files/patches/0012-mt76-mt7915-reject-duplicated-twt-flow.patch
deleted file mode 100644
index bf6ea87..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0012-mt76-mt7915-reject-duplicated-twt-flow.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 261d8a198f9fd9c7f58586f102eafabd2d73b80a Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Thu, 7 Apr 2022 08:40:05 +0800
-Subject: [PATCH 2/2] mt76: mt7915: reject duplicated twt flow
-
----
- mt7915/mac.c | 16 +++++++++++++++-
- 1 file changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index aa312b75..8c7edd98 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -2889,7 +2889,7 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw,
- 	enum ieee80211_twt_setup_cmd sta_setup_cmd;
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_twt_flow *flow;
--	int flowid, table_id;
-+	int flowid, table_id, i;
- 	u8 exp;
- 
- 	if (mt7915_mac_check_twt_req(twt))
-@@ -2907,10 +2907,24 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw,
- 	le16p_replace_bits(&twt_agrt->req_type, flowid,
- 			   IEEE80211_TWT_REQTYPE_FLOWID);
- 
-+
- 	table_id = ffs(~dev->twt.table_mask) - 1;
- 	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
- 	sta_setup_cmd = FIELD_GET(IEEE80211_TWT_REQTYPE_SETUP_CMD, req_type);
- 
-+	for (i = 0; i < 8; i++) {
-+		if (msta->twt.flowid_mask & BIT(i)) {
-+			flow = &msta->twt.flow[i];
-+			if (flow->duration == twt_agrt->min_twt_dur &&
-+			    flow->mantissa == twt_agrt->mantissa &&
-+			    flow->exp == exp &&
-+			    flow->protection == !!(req_type & IEEE80211_TWT_REQTYPE_PROTECTION) &&
-+			    flow->flowtype == !!(req_type & IEEE80211_TWT_REQTYPE_FLOWTYPE) &&
-+			    flow->trigger == !!(req_type & IEEE80211_TWT_REQTYPE_TRIGGER))
-+				goto unlock;
-+		}
-+	}
-+
- 	flow = &msta->twt.flow[flowid];
- 	memset(flow, 0, sizeof(*flow));
- 	INIT_LIST_HEAD(&flow->list);
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0014-mt76-mt7915-limit-minimum-twt-duration-due-to-hw-lim.patch b/recipes-kernel/linux-mt76/files/patches/0014-mt76-mt7915-limit-minimum-twt-duration-due-to-hw-lim.patch
deleted file mode 100644
index d5aafcb..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0014-mt76-mt7915-limit-minimum-twt-duration-due-to-hw-lim.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 58706d81a82726f488cda771097f5586708b47f2 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Tue, 12 Apr 2022 16:06:36 +0800
-Subject: [PATCH] mt76: mt7915: limit minimum twt duration due to hw limitation
-
----
- mt7915/mac.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 925f5eb9..fd897fd5 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -2698,6 +2698,7 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw,
- 			      struct ieee80211_sta *sta,
- 			      struct ieee80211_twt_setup *twt)
- {
-+#define MT7915_MIN_TWT_DUR 64
- 	enum ieee80211_twt_setup_cmd setup_cmd = TWT_SETUP_CMD_REJECT;
- 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
- 	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
-@@ -2719,6 +2720,12 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw,
- 	if (hweight8(msta->twt.flowid_mask) == ARRAY_SIZE(msta->twt.flow))
- 		goto unlock;
- 
-+	if (twt_agrt->min_twt_dur < MT7915_MIN_TWT_DUR) {
-+		setup_cmd = TWT_SETUP_CMD_DICTATE;
-+		twt_agrt->min_twt_dur = MT7915_MIN_TWT_DUR;
-+		goto unlock;
-+	}
-+
- 	flowid = ffs(~msta->twt.flowid_mask) - 1;
- 	le16p_replace_bits(&twt_agrt->req_type, flowid,
- 			   IEEE80211_TWT_REQTYPE_FLOWID);
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch b/recipes-kernel/linux-mt76/files/patches/0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch
deleted file mode 100755
index d4c81d9..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch
+++ /dev/null
@@ -1,278 +0,0 @@
-From f3f9ccbb417cae6e503084e13d627b68a141b0bd Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Thu, 5 May 2022 11:45:23 +0800
-Subject: [PATCH 02/10] mt76: mt7915: reowrk SER debugfs knob
-
-1. get status of system recovery from firmware.
-2. add more recovery points.
-3. make knob per phy.
-
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
----
- mt7915/debugfs.c | 106 ++++++++++++++++++++++++++++++++++++++++-------
- mt7915/mcu.c     |   5 +--
- mt7915/mcu.h     |  14 +++++++
- mt7915/mmio.c    |   3 ++
- mt7915/regs.h    |  18 +++++++-
- 5 files changed, 126 insertions(+), 20 deletions(-)
-
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 77bbeeed..b45181c1 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -44,35 +44,113 @@ mt7915_implicit_txbf_get(void *data, u64 *val)
- DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7915_implicit_txbf_get,
- 			 mt7915_implicit_txbf_set, "%lld\n");
- 
--/* test knob of system layer 1/2 error recovery */
--static int mt7915_ser_trigger_set(void *data, u64 val)
-+/* test knob of system error recovery */
-+static ssize_t
-+mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
-+		  size_t count, loff_t *ppos)
- {
--	enum {
--		SER_SET_RECOVER_L1 = 1,
--		SER_SET_RECOVER_L2,
--		SER_ENABLE = 2,
--		SER_RECOVER
--	};
--	struct mt7915_dev *dev = data;
-+	struct mt7915_phy *phy = file->private_data;
-+	struct mt7915_dev *dev = phy->dev;
-+	bool ext_phy = phy != &dev->phy;
-+	char buf[16];
- 	int ret = 0;
-+	u16 val;
-+
-+	if (count >= sizeof(buf))
-+		return -EINVAL;
-+
-+	if (copy_from_user(buf, user_buf, count))
-+		return -EFAULT;
-+
-+	if (count && buf[count - 1] == '\n')
-+		buf[count - 1] = '\0';
-+	else
-+		buf[count] = '\0';
-+
-+	if (kstrtou16(buf, 0, &val))
-+		return -EINVAL;
- 
- 	switch (val) {
-+	case SER_QUERY:
-+		/* grab firmware SER stats */
-+		ret = mt7915_mcu_set_ser(dev, 0, 0, ext_phy);
-+		break;
- 	case SER_SET_RECOVER_L1:
- 	case SER_SET_RECOVER_L2:
--		ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), 0);
-+	case SER_SET_RECOVER_L3_RX_ABORT:
-+	case SER_SET_RECOVER_L3_TX_ABORT:
-+	case SER_SET_RECOVER_L3_TX_DISABLE:
-+	case SER_SET_RECOVER_L3_BF:
-+		ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), ext_phy);
- 		if (ret)
- 			return ret;
- 
--		return mt7915_mcu_set_ser(dev, SER_RECOVER, val, 0);
-+		ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, ext_phy);
-+		break;
- 	default:
- 		break;
- 	}
- 
-+	return ret ? ret : count;
-+}
-+
-+static ssize_t
-+mt7915_fw_ser_get(struct file *file, char __user *user_buf,
-+		  size_t count, loff_t *ppos)
-+{
-+	struct mt7915_phy *phy = file->private_data;
-+	struct mt7915_dev *dev = phy->dev;
-+	char *buff;
-+	int desc = 0;
-+	ssize_t ret;
-+	static const size_t bufsz = 400;
-+
-+	buff = kmalloc(bufsz, GFP_KERNEL);
-+	if (!buff)
-+		return -ENOMEM;
-+
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_STATUS        = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_SER_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PLE_ERR       = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PLE_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PLE_ERR_1     = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PLE1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PLE_ERR_AMSDU = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PLE_AMSDU_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PSE_ERR       = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PSE_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PSE_ERR_1     = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PSE1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR6_B0 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN0_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR6_B1 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR7_B0 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN0_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR7_B1 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATS));
-+
-+	ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
-+	kfree(buff);
- 	return ret;
- }
- 
--DEFINE_DEBUGFS_ATTRIBUTE(fops_ser_trigger, NULL,
--			 mt7915_ser_trigger_set, "%lld\n");
-+static const struct file_operations mt7915_fw_ser_ops = {
-+	.write = mt7915_fw_ser_set,
-+	.read = mt7915_fw_ser_get,
-+	.open = simple_open,
-+	.llseek = default_llseek,
-+};
- 
- static int
- mt7915_radar_trigger(void *data, u64 val)
-@@ -914,6 +992,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
- 	debugfs_create_file("xmit-queues", 0400, dir, phy,
- 			    &mt7915_xmit_queues_fops);
- 	debugfs_create_file("tx_stats", 0400, dir, phy, &mt7915_tx_stats_fops);
-+	debugfs_create_file("fw_ser", 0600, dir, phy, &mt7915_fw_ser_ops);
- 	debugfs_create_file("fw_debug_wm", 0600, dir, dev, &fops_fw_debug_wm);
- 	debugfs_create_file("fw_debug_wa", 0600, dir, dev, &fops_fw_debug_wa);
- 	debugfs_create_file("fw_debug_bin", 0600, dir, dev, &fops_fw_debug_bin);
-@@ -927,7 +1006,6 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
- 			    &mt7915_rate_txpower_fops);
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
- 				    mt7915_twt_stats);
--	debugfs_create_file("ser_trigger", 0200, dir, dev, &fops_ser_trigger);
- 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
- 
- 	if (!dev->dbdc_support || phy->band_idx) {
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index c215bc9e..20f32f7f 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2471,10 +2471,7 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
- 	/* force firmware operation mode into normal state,
- 	 * which should be set before firmware download stage.
- 	 */
--	if (is_mt7915(&dev->mt76))
--		mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
--	else
--		mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
-+	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
- 
- 	ret = mt7915_driver_own(dev, 0);
- 	if (ret)
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index df7aefca..5cbc3ecf 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -464,6 +464,20 @@ enum {
- 	MURU_GET_TXC_TX_STATS = 151,
- };
- 
-+enum {
-+	SER_QUERY,
-+	/* recovery */
-+	SER_SET_RECOVER_L1,
-+	SER_SET_RECOVER_L2,
-+	SER_SET_RECOVER_L3_RX_ABORT,
-+	SER_SET_RECOVER_L3_TX_ABORT,
-+	SER_SET_RECOVER_L3_TX_DISABLE,
-+	SER_SET_RECOVER_L3_BF,
-+	/* action */
-+	SER_ENABLE = 2,
-+	SER_RECOVER
-+};
-+
- #define MT7915_BSS_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +	\
- 					 sizeof(struct bss_info_omac) +	\
- 					 sizeof(struct bss_info_basic) +\
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 0bd32daa..2d733d32 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -22,6 +22,7 @@ static const u32 mt7915_reg[] = {
- 	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
- 	[CBTOP1_PHY_END]	= 0x77ffffff,
- 	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
-+	[SWDEF_BASE_ADDR]	= 0x41f200,
- };
- 
- static const u32 mt7916_reg[] = {
-@@ -36,6 +37,7 @@ static const u32 mt7916_reg[] = {
- 	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
- 	[CBTOP1_PHY_END]	= 0x7fffffff,
- 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
-+	[SWDEF_BASE_ADDR]	= 0x411400,
- };
- 
- static const u32 mt7986_reg[] = {
-@@ -50,6 +52,7 @@ static const u32 mt7986_reg[] = {
- 	[WFDMA_EXT_CSR_ADDR]	= 0x27000,
- 	[CBTOP1_PHY_END]	= 0x7fffffff,
- 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
-+	[SWDEF_BASE_ADDR]	= 0x411400,
- };
- 
- static const u32 mt7915_offs[] = {
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 97984aaf..4251cf78 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -30,6 +30,7 @@ enum reg_rev {
- 	WFDMA_EXT_CSR_ADDR,
- 	CBTOP1_PHY_END,
- 	INFRA_MCU_ADDR_END,
-+	SWDEF_BASE_ADDR,
- 	__MT_REG_MAX,
- };
- 
-@@ -942,12 +943,25 @@ enum offs_rev {
- #define MT_ADIE_TYPE_MASK		BIT(1)
- 
- /* FW MODE SYNC */
--#define MT_SWDEF_MODE			0x41f23c
--#define MT_SWDEF_MODE_MT7916		0x41143c
-+#define MT_SWDEF_BASE			__REG(SWDEF_BASE_ADDR)
-+
-+#define MT_SWDEF(ofs)			(MT_SWDEF_BASE + (ofs))
-+#define MT_SWDEF_MODE			MT_SWDEF(0x3c)
- #define MT_SWDEF_NORMAL_MODE		0
- #define MT_SWDEF_ICAP_MODE		1
- #define MT_SWDEF_SPECTRUM_MODE		2
- 
-+#define MT_SWDEF_SER_STATS		MT_SWDEF(0x040)
-+#define MT_SWDEF_PLE_STATS		MT_SWDEF(0x044)
-+#define MT_SWDEF_PLE1_STATS		MT_SWDEF(0x048)
-+#define MT_SWDEF_PLE_AMSDU_STATS	MT_SWDEF(0x04C)
-+#define MT_SWDEF_PSE_STATS		MT_SWDEF(0x050)
-+#define MT_SWDEF_PSE1_STATS		MT_SWDEF(0x054)
-+#define MT_SWDEF_LAMC_WISR6_BN0_STATS	MT_SWDEF(0x058)
-+#define MT_SWDEF_LAMC_WISR6_BN1_STATS	MT_SWDEF(0x05C)
-+#define MT_SWDEF_LAMC_WISR7_BN0_STATS	MT_SWDEF(0x060)
-+#define MT_SWDEF_LAMC_WISR7_BN1_STATS	MT_SWDEF(0x064)
-+
- #define MT_DIC_CMD_REG_BASE		0x41f000
- #define MT_DIC_CMD_REG(ofs)		(MT_DIC_CMD_REG_BASE + (ofs))
- #define MT_DIC_CMD_REG_CMD		MT_DIC_CMD_REG(0x10)
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch b/recipes-kernel/linux-mt76/files/patches/0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch
deleted file mode 100755
index 9e20c45..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From a56d23330b0ac01929a54c427bd338b02a7e727e Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Fri, 6 May 2022 21:06:55 +0800
-Subject: [PATCH 03/10] mt76: mt7615/mt7915: do reset_work with mt76's work
- queue
-
-reset_work may be blocked when mcu message timeout occurs
-
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
----
- mt7615/mmio.c | 2 +-
- mt7915/mmio.c | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mt7615/mmio.c b/mt7615/mmio.c
-index ce45c3bf..a208035e 100644
---- a/mt7615/mmio.c
-+++ b/mt7615/mmio.c
-@@ -145,7 +145,7 @@ static void mt7615_irq_tasklet(struct tasklet_struct *t)
- 		return;
- 
- 	dev->reset_state = mcu_int;
--	ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
-+	queue_work(dev->mt76.wq, &dev->reset_work);
- 	wake_up(&dev->reset_wait);
- }
- 
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 2d733d32..4d4537cd 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -612,7 +612,7 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
- 		mt76_wr(dev, MT_MCU_CMD, val);
- 		if (val & MT_MCU_CMD_ERROR_MASK) {
- 			dev->reset_state = val;
--			ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
-+			queue_work(dev->mt76.wq, &dev->reset_work);
- 			wake_up(&dev->reset_wait);
- 		}
- 	}
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0018-mt76-mt7915-add-support-for-6G-in-band-discovery.patch b/recipes-kernel/linux-mt76/files/patches/0018-mt76-mt7915-add-support-for-6G-in-band-discovery.patch
deleted file mode 100644
index d710df8..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0018-mt76-mt7915-add-support-for-6G-in-band-discovery.patch
+++ /dev/null
@@ -1,282 +0,0 @@
-From 3b12e37a1c903b7f30c1515b6eec481c206abb4e Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
-Date: Mon, 25 Apr 2022 15:31:02 +0800
-Subject: [PATCH] mt76: mt7915: add support for 6G in-band discovery
-
-Add offloading FILS discovery and unsolicited broadcast probe response support.
-
-Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
----
- mt7915/init.c  |  2 +
- mt7915/mac.c   | 17 +++--
- mt7915/main.c  |  8 +-
- mt7915/mcu.c   | 75 ++++++++++++++++++-
- mt7915/mcu.h   | 15 +++-
- mt7915/mt7915.h    |  4 +-
- 6 files changed, 107 insertions(+), 14 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 70baad756dd0..d123ecb9fb0c 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -351,6 +351,8 @@ mt7915_init_wiphy(struct ieee80211_hw *hw)
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_HT);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_VHT);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_HE);
-+	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP);
-+	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_DISCOVERY);
- 
- 	if (!mdev->dev->of_node ||
- 	    !of_property_read_bool(mdev->dev->of_node,
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e353e8c44d6c..de7bf137c234 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -1177,7 +1177,7 @@ mt7915_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 
- void mt7915_mac_write_txwi(struct mt7915_dev *dev, __le32 *txwi,
- 			   struct sk_buff *skb, struct mt76_wcid *wcid, int pid,
--			   struct ieee80211_key_conf *key, bool beacon)
-+			   struct ieee80211_key_conf *key, u32 changed)
- {
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_vif *vif = info->control.vif;
-@@ -1188,6 +1188,10 @@ void mt7915_mac_write_txwi(struct mt7915_dev *dev, __le32 *txwi,
- 	bool mcast = false;
- 	u16 tx_count = 15;
- 	u32 val;
-+	bool beacon = !!(changed & (BSS_CHANGED_BEACON |
-+				    BSS_CHANGED_BEACON_ENABLED));
-+	bool inband_disc = !!(changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
-+					 BSS_CHANGED_FILS_DISCOVERY));
- 
- 	if (vif) {
- 		struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-@@ -1200,7 +1204,10 @@ void mt7915_mac_write_txwi(struct mt7915_dev *dev, __le32 *txwi,
- 	if (ext_phy && dev->mt76.phy2)
- 		mphy = dev->mt76.phy2;
- 
--	if (beacon) {
-+	if (inband_disc) {
-+		p_fmt = MT_TX_TYPE_FW;
-+		q_idx = MT_LMAC_ALTX0;
-+	} else if (beacon) {
- 		p_fmt = MT_TX_TYPE_FW;
- 		q_idx = MT_LMAC_BCN0;
- 	} else if (skb_get_queue_mapping(skb) >= MT_TXQ_PSD) {
-@@ -1308,8 +1315,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 		return id;
- 
- 	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
--	mt7915_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid, key,
--			      false);
-+	mt7915_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid, key, 0);
- 
- 	txp = (struct mt7915_txp *)(txwi + MT_TXD_SIZE);
- 	for (i = 0; i < nbuf; i++) {
-@@ -1919,7 +1925,8 @@ mt7915_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
- 	case NL80211_IFTYPE_MESH_POINT:
- 	case NL80211_IFTYPE_ADHOC:
- 	case NL80211_IFTYPE_AP:
--		mt7915_mcu_add_beacon(hw, vif, vif->bss_conf.enable_beacon);
-+		mt7915_mcu_add_beacon(hw, vif, vif->bss_conf.enable_beacon,
-+				      BSS_CHANGED_BEACON_ENABLED);
- 		break;
- 	default:
- 		break;
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 5177b19f9154..c2c615931782 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -622,8 +622,10 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
- 		mt7915_update_bss_color(hw, vif, &info->he_bss_color);
- 
- 	if (changed & (BSS_CHANGED_BEACON |
--		       BSS_CHANGED_BEACON_ENABLED))
--		mt7915_mcu_add_beacon(hw, vif, info->enable_beacon);
-+		       BSS_CHANGED_BEACON_ENABLED |
-+		       BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
-+		       BSS_CHANGED_FILS_DISCOVERY))
-+		mt7915_mcu_add_beacon(hw, vif, info->enable_beacon, changed);
- 
- 	mutex_unlock(&dev->mt76.mutex);
- }
-@@ -636,7 +638,7 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 
- 	mutex_lock(&dev->mt76.mutex);
--	mt7915_mcu_add_beacon(hw, vif, true);
-+	mt7915_mcu_add_beacon(hw, vif, true, BSS_CHANGED_BEACON);
- 	mutex_unlock(&dev->mt76.mutex);
- }
- 
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2a07a5d2a439..87e44c69d72b 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -1892,6 +1892,7 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 	u8 *buf;
- 	int len = sizeof(*cont) + MT_TXD_SIZE + skb->len;
- 
-+	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
- 	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_CONTENT,
- 					   len, &bcn->sub_ntlv, &bcn->len);
- 
-@@ -1910,7 +1911,7 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 
- 	buf = (u8 *)tlv + sizeof(*cont);
- 	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
--			      true);
-+			      BSS_CHANGED_BEACON);
- 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
- }
- 
-@@ -1992,8 +1993,71 @@ mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 	}
- }
- 
--int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
--			  struct ieee80211_vif *vif, int en)
-+static void
-+mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
-+				struct sk_buff *rskb, struct bss_info_bcn *bcn,
-+				u32 changed)
-+{
-+#define OFFLOAD_TX_MODE_SU	BIT(0)
-+#define OFFLOAD_TX_MODE_MU	BIT(1)
-+	struct ieee80211_hw *hw = mt76_hw(dev);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
-+	enum nl80211_band band = chandef->chan->band;
-+	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
-+	struct bss_info_inband_discovery *discov;
-+	struct ieee80211_tx_info *info;
-+	struct sk_buff *skb = NULL;
-+	struct tlv *tlv;
-+	bool ext_phy = phy != &dev->phy;
-+	u8 *buf, interval;
-+	int len;
-+
-+	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
-+	    vif->bss_conf.fils_discovery.max_interval) {
-+		interval = vif->bss_conf.fils_discovery.max_interval;
-+		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
-+	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-+		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
-+		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
-+		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
-+	}
-+
-+	if (!skb)
-+		return;
-+
-+	info = IEEE80211_SKB_CB(skb);
-+	info->control.vif = vif;
-+	info->band = band;
-+
-+	if (ext_phy)
-+		info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY;
-+
-+	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
-+	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
-+
-+	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
-+					   len, &bcn->sub_ntlv, &bcn->len);
-+	discov = (struct bss_info_inband_discovery *)tlv;
-+	discov->tx_mode = OFFLOAD_TX_MODE_SU;
-+	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
-+	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
-+	discov->tx_interval = interval;
-+	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
-+	discov->enable = true;
-+
-+	buf = (u8 *)tlv + sizeof(*discov);
-+
-+	mt7915_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
-+			      changed);
-+	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
-+
-+	dev_kfree_skb(skb);
-+}
-+
-+int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-+			  int en, u32 changed)
- {
- #define MAX_BEACON_SIZE 512
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -2044,6 +2108,11 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw,
- 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
- 	dev_kfree_skb(skb);
- 
-+	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
-+	    changed & BSS_CHANGED_FILS_DISCOVERY)
-+		mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
-+						bcn, changed);
-+
- out:
- 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
- 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 064d33e33738..e1d576701fdf 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -404,11 +404,23 @@ struct bss_info_bcn_cont {
- 	__le16 pkt_len;
- } __packed __aligned(4);
- 
-+struct bss_info_inband_discovery {
-+	__le16 tag;
-+	__le16 len;
-+	u8 tx_type;
-+	u8 tx_mode;
-+	u8 tx_interval;
-+	u8 enable;
-+	__le16 rsv;
-+	__le16 prob_rsp_len;
-+} __packed __aligned(4);
-+
- enum {
- 	BSS_INFO_BCN_CSA,
- 	BSS_INFO_BCN_BCC,
- 	BSS_INFO_BCN_MBSSID,
- 	BSS_INFO_BCN_CONTENT,
-+	BSS_INFO_BCN_DISCOV,
- 	BSS_INFO_BCN_MAX
- };
- 
-@@ -476,6 +488,7 @@ enum {
- #define MT7915_BEACON_UPDATE_SIZE	(sizeof(struct sta_req_hdr) +	\
- 					 sizeof(struct bss_info_bcn_cntdwn) + \
- 					 sizeof(struct bss_info_bcn_mbss) + \
--					 sizeof(struct bss_info_bcn_cont))
-+					 sizeof(struct bss_info_bcn_cont) + \
-+					 sizeof(struct bss_info_inband_discovery))
- 
- #endif
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6c590eff14f1..03431012b2ff 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -464,7 +464,7 @@ int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
- int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 				struct cfg80211_he_bss_color *he_bss_color);
- int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--			  int enable);
-+			  int enable, u32 changed);
- int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
-                             bool enable);
- int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
-@@ -551,7 +551,7 @@ void mt7915_mac_cca_stats_reset(struct mt7915_phy *phy);
- void mt7915_mac_enable_nf(struct mt7915_dev *dev, bool ext_phy);
- void mt7915_mac_write_txwi(struct mt7915_dev *dev, __le32 *txwi,
- 			   struct sk_buff *skb, struct mt76_wcid *wcid, int pid,
--			   struct ieee80211_key_conf *key, bool beacon);
-+			   struct ieee80211_key_conf *key, u32 changed);
- void mt7915_mac_set_timing(struct mt7915_phy *phy);
- int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 		       struct ieee80211_sta *sta);
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
old mode 100755
new mode 100644
index 94dff56..77cbc39
--- a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,26 +1,25 @@
-From 235e69804c130fd7381fd44b1853859984e97ac5 Mon Sep 17 00:00:00 2001
+From a9cf0fd711fdccf35e6171dd4aba0eb7f6588148 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Thu, 21 Apr 2022 19:42:55 +0800
+Date: Mon, 6 Jun 2022 20:08:58 +0800
 Subject: [PATCH] mt76: mt7915: add mtk internal debug tools for mt76
 
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
- .../wireless/mediatek/mt76/mt76_connac_mcu.h  |    6 +
- .../wireless/mediatek/mt76/mt7915/Makefile    |    2 +-
- .../wireless/mediatek/mt76/mt7915/debugfs.c   |   72 +-
- .../net/wireless/mediatek/mt76/mt7915/mac.c   |   14 +
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   |   41 +
- .../net/wireless/mediatek/mt76/mt7915/mcu.h   |    4 +
- .../wireless/mediatek/mt76/mt7915/mt7915.h    |   41 +
- .../mediatek/mt76/mt7915/mt7915_debug.h       | 1350 ++++++++
- .../mediatek/mt76/mt7915/mtk_debugfs.c        | 2921 +++++++++++++++++
- .../wireless/mediatek/mt76/mt7915/mtk_mcu.c   |   51 +
- .../net/wireless/mediatek/mt76/tools/fwlog.c  |   44 +-
- 11 files changed, 4533 insertions(+), 13 deletions(-)
- mode change 100644 => 100755 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
- create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mt7915_debug.h
- create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mtk_debugfs.c
- create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mtk_mcu.c
+ mt76_connac_mcu.h     |    6 +
+ mt7915/Makefile       |    2 +-
+ mt7915/debugfs.c      |   73 +-
+ mt7915/mac.c          |   14 +
+ mt7915/mcu.c          |   41 +
+ mt7915/mcu.h          |    4 +
+ mt7915/mt7915.h       |   41 +
+ mt7915/mt7915_debug.h | 1350 +++++++++++++++++++
+ mt7915/mtk_debugfs.c  | 2921 +++++++++++++++++++++++++++++++++++++++++
+ mt7915/mtk_mcu.c      |   51 +
+ tools/fwlog.c         |   44 +-
+ 11 files changed, 4534 insertions(+), 13 deletions(-)
+ mode change 100644 => 100755 mt7915/mcu.c
+ create mode 100644 mt7915/mt7915_debug.h
+ create mode 100644 mt7915/mtk_debugfs.c
+ create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
 index aa14d2d4..03134066 100644
@@ -54,7 +53,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index b45181c1..27321528 100644
+index 9f21d978..0cfb6068 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -70,16 +69,16 @@
 @@ -448,6 +451,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
  	int ret;
  
- 	dev->fw_debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
+ 	dev->fw.debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
 +#ifdef MTK_DEBUG
-+	dev->fw_debug_wm = val;
++	dev->fw.debug_wm = val;
 +#endif
  
- 	if (dev->fw_debug_bin)
+ 	if (dev->fw.debug_bin)
  		val = 16;
 @@ -472,6 +478,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
  		if (ret)
- 			return ret;
+ 			goto out;
  	}
 +#ifdef MTK_DEBUG
 +	mt7915_mcu_fw_dbg_ctrl(dev, 68, !!val);
@@ -92,28 +91,28 @@
  	mt76_wr(dev, MT_MCU_WM_CIRQ_IRQ_SOFT_ADDR, BIT(5));
  
 +#ifdef MTK_DEBUG
-+	if (dev->fw_debug_bin & BIT(3))
++	if (dev->fw.debug_bin & BIT(3))
 +		/* use bit 7 to indicate v2 magic number */
-+		dev->fw_debug_wm |= BIT(7);
++		dev->fw.debug_wm |= BIT(7);
 +#endif
 +
- 	return 0;
- }
- 
-@@ -487,7 +502,11 @@ mt7915_fw_debug_wm_get(void *data, u64 *val)
+ out:
+ 	if (ret)
+ 		dev->fw.debug_wm = 0;
+@@ -491,7 +506,11 @@ mt7915_fw_debug_wm_get(void *data, u64 *val)
  {
  	struct mt7915_dev *dev = data;
  
--	*val = dev->fw_debug_wm;
+-	*val = dev->fw.debug_wm;
 +#ifdef MTK_DEBUG
-+	*val = dev->fw_debug_wm & ~BIT(7);
++	*val = dev->fw.debug_wm & ~BIT(7);
 +#else
-+	val = dev->fw_debug_wm;
++	val = dev->fw.debug_wm;
 +#endif
  
  	return 0;
  }
-@@ -567,6 +586,16 @@ mt7915_fw_debug_bin_set(void *data, u64 val)
+@@ -576,6 +595,17 @@ mt7915_fw_debug_bin_set(void *data, u64 val)
  
  	relay_reset(dev->relay_fwlog);
  
@@ -127,10 +126,11 @@
 +		return 0;
 +#endif
 +
- 	return mt7915_fw_debug_wm_set(dev, dev->fw_debug_wm);
++
+ 	return mt7915_fw_debug_wm_set(dev, dev->fw.debug_wm);
  }
  
-@@ -1020,6 +1049,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1038,6 +1068,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	if (!ext_phy)
  		dev->debugfs_dir = dir;
  
@@ -142,7 +142,7 @@
  	return 0;
  }
  
-@@ -1060,17 +1094,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
+@@ -1078,17 +1113,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -167,7 +167,7 @@
  
 +#ifdef MTK_DEBUG
 +	/* old magic num */
-+	if (!(dev->fw_debug_wm & BIT(7))) {
++	if (!(dev->fw.debug_wm & BIT(7))) {
 +		hdr.timestamp = mt76_rr(dev, MT_LPON_FRCR(0));
 +		hdr.len = *(__le16 *)data;
 +		mt7915_debugfs_write_fwlog(dev, &hdr, sizeof(hdr), data, len);
@@ -197,7 +197,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index de5f3f10..ce760cdb 100644
+index b0e86968..9e92b32f 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -596,6 +596,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -222,7 +222,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		if (mt7915_reverse_frag0_hdr_trans(skb, hdr_gap))
  			return -EINVAL;
-@@ -1352,6 +1360,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1358,6 +1366,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -238,7 +238,7 @@
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
 old mode 100644
 new mode 100755
-index 20f32f7f..c325c4b6
+index 81559002..6ec321e1
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -298,6 +298,10 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -252,7 +252,7 @@
  	if (wait_seq)
  		*wait_seq = seq;
  
-@@ -3657,6 +3661,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3733,6 +3737,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -297,7 +297,7 @@
  {
  	struct {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 5cbc3ecf..3f303885 100644
+index d46c8da4..2f7007fd 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -296,6 +296,10 @@ enum {
@@ -312,7 +312,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e5f89161..92fedaf3 100644
+index bd985e6c..001a6015 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -323,7 +323,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_MAX_WMM_SETS		4
  #define MT7915_WTBL_SIZE		288
-@@ -326,6 +327,27 @@ struct mt7915_dev {
+@@ -339,6 +340,27 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -351,7 +351,7 @@
  };
  
  enum {
-@@ -595,4 +617,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -608,4 +630,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -4830,5 +4830,5 @@
  	return ret;
  }
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index 9286d3c..44dc578 100644
--- a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,7 +1,7 @@
-From 317b05bb3db50a63ef5e8497a9dc9c59e5830d9b Mon Sep 17 00:00:00 2001
+From fac076082992f4e6bf576b44778ad6d5c37d9abd Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Mon, 28 Mar 2022 09:12:54 +0800
-Subject: [PATCH] mt76: mt7915: csi: implement csi support
+Date: Mon, 6 Jun 2022 20:13:02 +0800
+Subject: [PATCH 1002/1007] mt76: mt7915: csi: implement csi support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -13,11 +13,12 @@
  mt7915/vendor.c   | 452 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7915/vendor.h   |  60 ++++++
  8 files changed, 762 insertions(+), 2 deletions(-)
+ mode change 100755 => 100644 mt7915/mcu.c
  create mode 100644 mt7915/vendor.c
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 494c5c71..6f84a0fc 100644
+index 03134066..96591a8c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -820,6 +820,7 @@ enum {
@@ -28,7 +29,7 @@
  };
  
  enum {
-@@ -991,6 +992,7 @@ enum {
+@@ -990,6 +991,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -54,10 +55,10 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 02eb0612..dbcdf147 100644
+index 66884be0..258bb20a 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -539,6 +539,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -541,6 +541,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
  	mt7915_init_wiphy(mphy->hw);
  
@@ -70,7 +71,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1027,6 +1033,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1030,6 +1036,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -96,7 +97,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1035,6 +1060,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1038,6 +1063,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -107,7 +108,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1047,6 +1076,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1050,6 +1079,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -118,7 +119,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1087,6 +1120,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1090,6 +1123,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,7 +133,9 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9a7941fa..26831327 100644
+old mode 100755
+new mode 100644
+index 6ec321e1..18b05b2e
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -89,6 +89,10 @@ struct mt7915_fw_region {
@@ -158,7 +161,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3677,6 +3686,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3737,6 +3746,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -268,12 +271,12 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 94e0a81b..007282d4 100644
+index 2f7007fd..cb854b28 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -493,4 +493,80 @@ enum {
- 					 sizeof(struct bss_info_bcn_mbss) + \
- 					 sizeof(struct bss_info_bcn_cont))
+@@ -513,4 +513,80 @@ enum {
+ 					 sizeof(struct bss_info_bcn_cont) + \
+ 					 sizeof(struct bss_info_inband_discovery))
  
 +#ifdef CONFIG_MTK_VENDOR
 +struct mt7915_mcu_csi {
@@ -353,10 +356,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e0ec262a..908c47c8 100644
+index 001a6015..ff957425 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -267,6 +267,20 @@ struct mt7915_phy {
+@@ -277,6 +277,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -377,7 +380,7 @@
  };
  
  struct mt7915_dev {
-@@ -615,6 +629,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -630,6 +644,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
diff --git a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index 32f206c..018c3f0 100644
--- a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,22 +1,22 @@
-From 03d314ba186fa4d49e599690d5e719650d62cd90 Mon Sep 17 00:00:00 2001
+From 2722263634d9890cfd956d924341c2239e1507b1 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1003/1005] mt76: mt7915: air monitor support
+Subject: [PATCH 1003/1007] mt76: mt7915: air monitor support
 
 ---
- .../wireless/mediatek/mt76/mt76_connac_mcu.h  |   2 +
- .../net/wireless/mediatek/mt76/mt7915/mac.c   |   4 +
- .../net/wireless/mediatek/mt76/mt7915/main.c  |   3 +
- .../wireless/mediatek/mt76/mt7915/mt7915.h    |  34 ++
- .../wireless/mediatek/mt76/mt7915/vendor.c    | 359 ++++++++++++++++++
- .../wireless/mediatek/mt76/mt7915/vendor.h    |  38 ++
+ mt76_connac_mcu.h |   2 +
+ mt7915/mac.c      |   4 +
+ mt7915/main.c     |   3 +
+ mt7915/mt7915.h   |  34 +++++
+ mt7915/vendor.c   | 359 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h   |  38 +++++
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 464b55f..b0f2d97 100644
+index 96591a8c..1c24dbf4 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -992,6 +992,8 @@ enum {
+@@ -991,6 +991,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,10 +26,10 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 261861a..78d2a96 100644
+index 9e92b32f..4989f437 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -827,6 +827,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -835,6 +835,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
  			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
  			qos_ctl = *ieee80211_get_qos_ctl(hdr);
  		}
@@ -41,10 +41,10 @@
  		status->flag |= RX_FLAG_8023;
  	}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c3f44d8..1beadd8 100644
+index 79349817..7d4e7838 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -677,6 +677,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -671,6 +671,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index df42286..6e62a46 100644
+index ff957425..ace01e15 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -222,6 +222,35 @@ struct mt7915_hif {
+@@ -232,6 +232,35 @@ struct mt7915_hif {
  	int irq;
  };
  
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -278,6 +307,8 @@ struct mt7915_phy {
+@@ -290,6 +319,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -626,6 +657,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -648,6 +679,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2..b94d787 100644
+index 98fd9c2d..b94d787e 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,353 @@ out:
@@ -491,7 +491,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a..976817f 100644
+index 9d3db2a7..976817f3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -4,6 +4,7 @@
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 31bdbf4..72f8d24 100644
--- a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,7 +1,8 @@
-From 6820d00b2fd86c760e281ea6e3e114cf2779cb12 Mon Sep 17 00:00:00 2001
+From 37b133c4d8fa05aae067dfb5fb68c24d3cabea2d Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 28 Mar 2022 09:19:29 +0800
-Subject: [PATCH] mt76: mt7915: add support for muru_onoff via debugfs
+Subject: [PATCH 1004/1007] mt76: mt7915: add support for muru_onoff via
+ debugfs
 
 ---
  mt7915/init.c        |  1 +
@@ -12,10 +13,10 @@
  5 files changed, 49 insertions(+), 4 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index ad2a9c9f..3eaf7916 100644
+index 258bb20a..2b8d758f 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -574,6 +574,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -576,6 +576,7 @@ static void mt7915_init_work(struct work_struct *work)
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
  	mt7915_txbf_init(dev);
@@ -24,7 +25,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index c7694819..cbcd3bd4 100755
+index 18b05b2e..5df0b4fd 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -944,6 +944,7 @@ mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
@@ -55,10 +56,10 @@
  	if (sta->vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f166eaea..ccb1c9d0 100644
+index cb854b28..0ff1fd11 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -573,4 +573,10 @@ struct csi_data {
+@@ -589,4 +589,10 @@ struct csi_data {
  };
  #endif
  
@@ -70,10 +71,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1b37cef7..e6b87239 100644
+index ace01e15..06f2737f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -390,6 +390,7 @@ struct mt7915_dev {
+@@ -403,6 +403,7 @@ struct mt7915_dev {
  		bool dump_rx_pkt;
  		bool dump_rx_raw;
  		u32 token_idx;
diff --git a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
index e4bef96..cac0cd4 100644
--- a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
@@ -1,9 +1,8 @@
-From f438253052b9cea4ec1339b53a44224393b0ad9d Mon Sep 17 00:00:00 2001
+From 1482994a9bfbc34fdb5887cd6438eb04be0c9d26 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Fri, 21 Jan 2022 11:22:10 +0800
-Subject: [PATCH] mt76: certification patches
+Date: Mon, 6 Jun 2022 20:15:51 +0800
+Subject: [PATCH 1005/1007] mt76: certification patches
 
-Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
 ---
  mt76_connac_mcu.h    |   1 +
  mt7915/init.c        |   7 +-
@@ -18,10 +17,10 @@
  10 files changed, 964 insertions(+), 6 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f5acdf20..e0e5d10d 100644
+index 1c24dbf4..82498039 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -994,6 +994,7 @@ enum {
+@@ -993,6 +993,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -30,10 +29,10 @@
  };
  
 diff --git a/mt7915/init.c b/mt7915/init.c
-index c58f045f..d6156453 100644
+index 2b8d758f..b4404aec 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -369,12 +369,17 @@ mt7915_init_wiphy(struct ieee80211_hw *hw)
+@@ -371,12 +371,17 @@ mt7915_init_wiphy(struct ieee80211_hw *hw)
  	if (!phy->dev->dbdc_support)
  		wiphy->txq_memory_limit = 32 << 20; /* 32 MiB */
  
@@ -53,7 +52,7 @@
  			IEEE80211_HT_CAP_LDPC_CODING |
  			IEEE80211_HT_CAP_MAX_AMSDU;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a56f9be8..6637fa44 100644
+index 4989f437..9af0644f 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -7,6 +7,7 @@
@@ -64,8 +63,8 @@
  
  #define to_rssi(field, rxv)	((FIELD_GET(field, rxv) - 220) / 2)
  
-@@ -2411,6 +2412,21 @@ void mt7915_mac_update_stats(struct mt7915_phy *phy)
- 	}
+@@ -2486,6 +2487,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+ 	phy->trb_ts = trb;
  }
  
 +#ifdef CONFIG_MTK_VENDOR
@@ -86,7 +85,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2433,6 +2449,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -2508,6 +2524,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -101,10 +100,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 12de9e35..d628f768 100644
+index 7d4e7838..24bc12f5 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -655,6 +655,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -649,6 +649,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -114,7 +113,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -680,7 +683,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -674,7 +677,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -134,10 +133,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 817298a1..e418742a 100644
+index 5df0b4fd..495f2368 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3793,6 +3793,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3850,6 +3850,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -611,10 +610,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a5e5afae..c15f89bf 100644
+index 0ff1fd11..364ea0dd 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -431,9 +431,13 @@ enum {
+@@ -433,9 +433,13 @@ enum {
  	RATE_PARAM_FIXED = 3,
  	RATE_PARAM_MMPS_UPDATE = 5,
  	RATE_PARAM_FIXED_HE_LTF = 7,
@@ -629,7 +628,7 @@
  };
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -445,6 +449,9 @@ enum {
+@@ -447,6 +451,9 @@ enum {
  #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
  #define RATE_CFG_HE_LTF			GENMASK(31, 28)
  
@@ -639,7 +638,7 @@
  enum {
  	THERMAL_PROTECT_PARAMETER_CTRL,
  	THERMAL_PROTECT_BASIC_INFO,
-@@ -574,5 +581,205 @@ struct csi_data {
+@@ -594,5 +601,205 @@ struct csi_data {
  #define OFDMA_UL			BIT(1)
  #define MUMIMO_DL			BIT(2)
  #define MUMIMO_UL			BIT(3)
@@ -846,10 +845,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 56057ace..ad4e20dd 100644
+index 06f2737f..80a17a7d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -664,6 +664,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -677,6 +677,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  #endif
  
  #ifdef CONFIG_MTK_VENDOR
@@ -870,10 +869,10 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 6c48f115..03de46a9 100644
+index d2dbae45..815be6d8 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2460,7 +2460,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+@@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
  
  	*val = dev->dbg.muru_onoff;
  
@@ -883,7 +882,7 @@
  		!!(dev->dbg.muru_onoff & MUMIMO_UL),
  		!!(dev->dbg.muru_onoff & MUMIMO_DL),
  		!!(dev->dbg.muru_onoff & OFDMA_UL),
-@@ -2473,8 +2474,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+@@ -2499,8 +2500,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
  {
  	struct mt7915_dev *dev = data;
  
diff --git a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
old mode 100755
new mode 100644
similarity index 91%
rename from recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
rename to recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
index 20ccd9d..34b74bb
--- a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
@@ -1,12 +1,9 @@
-From ce9d865db52e49410af55a3b348f00ed1511ccbc Mon Sep 17 00:00:00 2001
+From 295dac8799e536a2d5dc53e727e246e469739853 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Thu, 5 May 2022 16:25:44 +0800
-Subject: [PATCH 04/10] mt76: mt7915: add L0.5 system error recovery support
+Date: Mon, 6 Jun 2022 20:18:15 +0800
+Subject: [PATCH 1006/1007] mt76: mt7915: add L0.5 system error recovery
+ support
 
-add L0.5 system error recovery support
-auto trigger l0.5 ser when detect fw exception or mem dma hang.
-
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
  mt7915/debugfs.c |  88 ++++++++++++---
  mt7915/dma.c     |  48 ++++++++
@@ -21,10 +18,10 @@
  10 files changed, 493 insertions(+), 97 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index b45181c1..f07df470 100644
+index 27eae83b..c75d9e5b 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
-@@ -49,12 +49,17 @@ static ssize_t
+@@ -52,12 +52,17 @@ static ssize_t
  mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
  		  size_t count, loff_t *ppos)
  {
@@ -43,7 +40,7 @@
  
  	if (count >= sizeof(buf))
  		return -EINVAL;
-@@ -70,28 +75,71 @@ mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
+@@ -73,28 +78,71 @@ mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
  	if (kstrtou16(buf, 0, &val))
  		return -EINVAL;
  
@@ -131,7 +128,7 @@
  }
  
  static ssize_t
-@@ -140,6 +188,12 @@ mt7915_fw_ser_get(struct file *file, char __user *user_buf,
+@@ -143,6 +191,12 @@ mt7915_fw_ser_get(struct file *file, char __user *user_buf,
  			  "::E  R , SER_LMAC_WISR7_B1 = 0x%08x\n",
  			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATS));
  
@@ -204,7 +201,7 @@
  {
  	mt7915_dma_disable(dev, true);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 1c956d3d..4984ec8f 100644
+index b4404aec..80ada114 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
@@ -216,7 +213,7 @@
  mt7915_init_txpower(struct mt7915_dev *dev,
  		    struct ieee80211_supported_band *sband)
  {
-@@ -441,7 +441,7 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+@@ -448,7 +448,7 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
  	mt76_clear(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN);
  }
  
@@ -225,7 +222,7 @@
  {
  	int i;
  	u32 rx_len = is_mt7915(&dev->mt76) ? 0x400 : 0x680;
-@@ -471,7 +471,7 @@ static void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -478,7 +478,7 @@ static void mt7915_mac_init(struct mt7915_dev *dev)
  	}
  }
  
@@ -234,7 +231,7 @@
  {
  	int ret;
  
-@@ -1112,6 +1112,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1160,6 +1160,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
  
  	mt7915_init_debugfs(&dev->phy);
  
@@ -244,7 +241,7 @@
  
  unreg_thermal:
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index de5f3f10..1a1798d2 100644
+index 9af0644f..a9ebbf12 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -3,6 +3,7 @@
@@ -255,7 +252,7 @@
  #include "mt7915.h"
  #include "../dma.h"
  #include "mac.h"
-@@ -2037,85 +2038,188 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+@@ -2063,85 +2064,188 @@ mt7915_update_beacons(struct mt7915_dev *dev)
  		mt7915_update_vif_beacon, dev->mt76.phy2->hw);
  }
  
@@ -390,7 +387,13 @@
 +		if (dev->hif2)
 +			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0xff);
 +	}
-+
+ 
+-		if (is_mt7915(&dev->mt76))
+-			mt76_set(dev, MT_WFDMA1_GLO_CFG + hif1_ofs,
+-				 MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+-				 MT_WFDMA1_GLO_CFG_RX_DMA_EN |
+-				 MT_WFDMA1_GLO_CFG_OMIT_TX_INFO |
+-				 MT_WFDMA1_GLO_CFG_OMIT_RX_INFO);
 +	/* load firmware */
 +	ret = mt7915_run_firmware(dev);
 +	if (ret)
@@ -405,24 +408,18 @@
 +	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
 +	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 +	ret = mt7915_txbf_init(dev);
- 
--		if (is_mt7915(&dev->mt76))
--			mt76_set(dev, MT_WFDMA1_GLO_CFG + hif1_ofs,
--				 MT_WFDMA1_GLO_CFG_TX_DMA_EN |
--				 MT_WFDMA1_GLO_CFG_RX_DMA_EN |
--				 MT_WFDMA1_GLO_CFG_OMIT_TX_INFO |
--				 MT_WFDMA1_GLO_CFG_OMIT_RX_INFO);
++
 +	if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
 +		ret = __mt7915_start(dev->mphy.hw);
 +		if (ret)
 +			goto out;
-+	}
+ 	}
 +
 +	if (ext_phy && test_bit(MT76_STATE_RUNNING, &ext_phy->state)) {
 +		ret = __mt7915_start(ext_phy->hw);
 +		if (ret)
 +			goto out;
- 	}
++	}
 +
 +out:
 +	/* reset done */
@@ -502,7 +499,7 @@
  }
  
  /* system error recovery */
-@@ -2129,6 +2233,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -2156,6 +2260,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	ext_phy = dev->mt76.phy2;
  	phy2 = ext_phy ? ext_phy->priv : NULL;
  
@@ -539,7 +536,7 @@
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
-@@ -2155,7 +2289,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -2181,7 +2315,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
@@ -548,7 +545,7 @@
  
  		mt7915_tx_token_put(dev);
  		idr_init(&dev->mt76.token);
-@@ -2206,6 +2340,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -2230,6 +2364,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
  					     MT7915_WATCHDOG_TIME);
  }
  
@@ -584,7 +581,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 78bf5ffa..eabcd785 100644
+index 24bc12f5..082e27d4 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -20,17 +20,13 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
@@ -635,10 +632,10 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 20f32f7f..b29776e9 100644
+index 495f2368..4a921a50 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -203,19 +203,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
+@@ -207,19 +207,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
  		ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
  }
  
@@ -729,7 +726,7 @@
  	rxd = (struct mt7915_mcu_rxd *)skb->data;
  	if (seq != rxd->seq)
  		return -EAGAIN;
-@@ -2456,18 +2527,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2549,18 +2620,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  				 sizeof(req), true);
  }
  
@@ -749,7 +746,7 @@
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
  	 */
-@@ -2516,6 +2579,21 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+@@ -2609,6 +2672,21 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
  				 MCU_WA_PARAM_RED, 0, 0);
  }
  
@@ -772,10 +769,10 @@
  {
  	__mt76_mcu_restart(&dev->mt76);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 5cbc3ecf..229b9d72 100644
+index 364ea0dd..44d3722e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -466,8 +466,9 @@ enum {
+@@ -489,8 +489,9 @@ enum {
  
  enum {
  	SER_QUERY,
@@ -787,34 +784,34 @@
  	SER_SET_RECOVER_L3_RX_ABORT,
  	SER_SET_RECOVER_L3_TX_ABORT,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 4d4537cd..b3de3a7a 100644
+index 71945ba9..ba61ce2e 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -23,6 +23,7 @@ static const u32 mt7915_reg[] = {
- 	[CBTOP1_PHY_END]	= 0x77ffffff,
+@@ -24,6 +24,7 @@ static const u32 mt7915_reg[] = {
  	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
+ 	[FW_EXCEPTION_ADDR]	= 0x219848,
  	[SWDEF_BASE_ADDR]	= 0x41f200,
 +	[EXCEPTION_BASE_ADDR]	= 0x219848,
  };
  
  static const u32 mt7916_reg[] = {
-@@ -38,6 +39,7 @@ static const u32 mt7916_reg[] = {
- 	[CBTOP1_PHY_END]	= 0x7fffffff,
+@@ -40,6 +41,7 @@ static const u32 mt7916_reg[] = {
  	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
+ 	[FW_EXCEPTION_ADDR]	= 0x022050bc,
  	[SWDEF_BASE_ADDR]	= 0x411400,
 +	[EXCEPTION_BASE_ADDR]	= 0x022050BC,
  };
  
  static const u32 mt7986_reg[] = {
-@@ -53,6 +55,7 @@ static const u32 mt7986_reg[] = {
- 	[CBTOP1_PHY_END]	= 0x7fffffff,
+@@ -56,6 +58,7 @@ static const u32 mt7986_reg[] = {
  	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
+ 	[FW_EXCEPTION_ADDR]	= 0x02204ffc,
  	[SWDEF_BASE_ADDR]	= 0x411400,
 +	[EXCEPTION_BASE_ADDR]	= 0x02204FFC,
  };
  
  static const u32 mt7915_offs[] = {
-@@ -610,10 +613,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+@@ -613,10 +616,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
  		u32 val = mt76_rr(dev, MT_MCU_CMD);
  
  		mt76_wr(dev, MT_MCU_CMD, val);
@@ -828,10 +825,10 @@
  	}
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e5f89161..7f7ecdfe 100644
+index 80a17a7d..ae5ac72f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -297,6 +297,15 @@ struct mt7915_dev {
+@@ -353,6 +353,15 @@ struct mt7915_dev {
  	struct work_struct reset_work;
  	wait_queue_head_t reset_wait;
  	u32 reset_state;
@@ -847,7 +844,7 @@
  
  	struct list_head sta_rc_list;
  	struct list_head sta_poll_list;
-@@ -335,6 +344,12 @@ enum {
+@@ -416,6 +425,12 @@ enum {
  	__MT_WFDMA_MAX,
  };
  
@@ -860,7 +857,7 @@
  enum {
  	MT_CTX0,
  	MT_HIF0 = 0x0,
-@@ -446,6 +461,14 @@ s8 mt7915_eeprom_get_power_delta(struct mt7915_dev *dev, int band);
+@@ -527,6 +542,14 @@ s8 mt7915_eeprom_get_power_delta(struct mt7915_dev *dev, int band);
  int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2);
  void mt7915_dma_prefetch(struct mt7915_dev *dev);
  void mt7915_dma_cleanup(struct mt7915_dev *dev);
@@ -876,18 +873,18 @@
  int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  			       struct mt7915_vif *mvif,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 4251cf78..99834310 100644
+index c7c9e411..47bae86e 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -31,6 +31,7 @@ enum reg_rev {
- 	CBTOP1_PHY_END,
+@@ -32,6 +32,7 @@ enum reg_rev {
  	INFRA_MCU_ADDR_END,
+ 	FW_EXCEPTION_ADDR,
  	SWDEF_BASE_ADDR,
 +	EXCEPTION_BASE_ADDR,
  	__MT_REG_MAX,
  };
  
-@@ -112,6 +113,11 @@ enum offs_rev {
+@@ -113,6 +114,11 @@ enum offs_rev {
  #define __REG(id)			(dev->reg.reg_rev[(id)])
  #define __OFFS(id)			(dev->reg.offs_rev[(id)])
  
@@ -899,7 +896,7 @@
  /* MCU WFDMA0 */
  #define MT_MCU_WFDMA0_BASE		0x2000
  #define MT_MCU_WFDMA0(ofs)		(MT_MCU_WFDMA0_BASE + (ofs))
-@@ -556,6 +562,10 @@ enum offs_rev {
+@@ -565,6 +571,10 @@ enum offs_rev {
  #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
  #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
  
@@ -910,7 +907,7 @@
  /* WFDMA1 */
  #define MT_WFDMA1_BASE			0xd5000
  #define MT_WFDMA1(ofs)			(MT_WFDMA1_BASE + (ofs))
-@@ -701,6 +711,10 @@ enum offs_rev {
+@@ -710,6 +720,10 @@ enum offs_rev {
  #define MT_MCU_CMD_NORMAL_STATE		BIT(5)
  #define MT_MCU_CMD_ERROR_MASK		GENMASK(5, 1)
  
@@ -921,7 +918,7 @@
  /* TOP RGU */
  #define MT_TOP_RGU_BASE			0x18000000
  #define MT_TOP_PWR_CTRL			(MT_TOP_RGU_BASE + (0x0))
-@@ -974,6 +988,8 @@ enum offs_rev {
+@@ -985,6 +999,8 @@ enum offs_rev {
  #define MT_CPU_UTIL_PEAK_IDLE_CNT	MT_CPU_UTIL(0x0c)
  #define MT_CPU_UTIL_CTRL		MT_CPU_UTIL(0x1c)
  
diff --git a/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
similarity index 75%
rename from recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
rename to recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index ae9ca75..85c914e 100644
--- a/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,7 +1,8 @@
-From 71e967c4ea7f0e119ff66197491acae7b9bd87e0 Mon Sep 17 00:00:00 2001
+From eee8cdc1710c18f90b8e5345dc85a0749cffabe3 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
-Subject: [PATCH] mt76: mt7915:add support for runtime set in-band discovery
+Subject: [PATCH 1007/1007] mt76: mt7915:add support for runtime set in-band
+ discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
@@ -9,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 203fa32..73239df 100644
+index 4a921a50..5e7b3f4a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2014,8 +2014,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2102,8 +2102,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	u8 *buf, interval;
  	int len;
  
@@ -22,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2051,7 +2050,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2140,7 +2139,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
@@ -32,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.29.2
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
new file mode 100755
index 0000000..18be9d3
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -0,0 +1,130 @@
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index d547cf6..bec0cd0 100755
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3871,6 +3871,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+ 		if (val == 0)
+ 			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
+ 		break;
++	case RATE_PARAM_AUTO_HEMU:
++		if (val < 0 || val > 15) {
++			printk("Wrong value! The value is between 0-15.\n");
++			break;
++		}
++		dev->dbg.muru_onoff = val;
++		break;
+ 	}
+ }
+ 
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index af939c4..fc382cd 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -431,6 +431,7 @@ enum {
+ #ifdef CONFIG_MTK_VENDOR
+ 	RATE_PARAM_FIXED_MIMO = 30,
+ 	RATE_PARAM_FIXED_OFDMA = 31,
++	RATE_PARAM_AUTO_HEMU = 32,
+ #endif
+ };
+ 
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 7456c57..cb5b60f 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+ 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
+ };
+ 
++static const struct nla_policy
++hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
++	[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
++};
++
+ static const struct nla_policy
+ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
+ 	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
+@@ -942,6 +947,35 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+ 	return 0;
+ }
+ 
++static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
++				  struct wireless_dev *wdev,
++				  const void *data,
++				  int data_len)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct mt7915_dev *dev = phy->dev;
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL];
++	int err;
++	u8 val8;
++	u32 val32 = 0;
++
++	err = nla_parse(tb, MTK_VENDOR_ATTR_HEMU_CTRL_MAX, data, data_len,
++			hemu_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	if (tb[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF]);
++		val32 |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_AUTO_HEMU) |
++			 FIELD_PREP(RATE_CFG_VAL, val8);
++		ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
++			mt7915_set_wireless_vif, &val32);
++	}
++
++	return 0;
++}
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 	{
+ 		.info = {
+@@ -988,6 +1022,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 		.doit = mt7915_vendor_wireless_ctrl,
+ 		.policy = wireless_ctrl_policy,
+ 		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
++	},
++	{
++		.info = {
++			.vendor_id = MTK_NL80211_VENDOR_ID,
++			.subcmd = MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL,
++		},
++		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++			WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = mt7915_vendor_hemu_ctrl,
++		.policy = hemu_ctrl_policy,
++		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
+ 	}
+ };
+ 
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 1b08321..b5c1420 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ 	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
+ };
+ 
+ enum mtk_capi_control_changed {
+@@ -33,6 +34,17 @@ enum mtk_vendor_attr_wireless_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_hemu_ctrl {
++	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
++	MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
++};
++
+ enum mtk_vendor_attr_rfeature_ctrl {
+ 	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
+ 
diff --git a/recipes-kernel/linux-mt76/files/patches/1100-mt76-testmode-support-eeprom-handle.patch b/recipes-kernel/linux-mt76/files/patches/1100-mt76-testmode-support-eeprom-handle.patch
deleted file mode 100755
index 995777b..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1100-mt76-testmode-support-eeprom-handle.patch
+++ /dev/null
@@ -1,284 +0,0 @@
-From 223df0027748514563ede33a1283e5c1b9fbc342 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 29 Jun 2021 14:30:44 +0800
-Subject: [PATCH 1/2] mt76: testmode: support eeprom handle
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- drivers/net/wireless/mediatek/mt76/mt76.h     |  1 +
- .../net/wireless/mediatek/mt76/mt7915/init.c  |  2 +-
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   |  5 +-
- .../wireless/mediatek/mt76/mt7915/mt7915.h    |  2 +-
- .../wireless/mediatek/mt76/mt7915/testmode.c  | 54 +++++++++++++++++++
- drivers/net/wireless/mediatek/mt76/testmode.c | 46 +++++++++++++++-
- drivers/net/wireless/mediatek/mt76/testmode.h | 30 +++++++++++
- 7 files changed, 133 insertions(+), 7 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index 8f6279c5..6d78e7bf 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -602,6 +602,7 @@ struct mt76_testmode_ops {
- 	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
- 			  enum mt76_testmode_state new_state);
- 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
-+	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
- };
- 
- #define MT_TM_FW_RX_COUNT	BIT(0)
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 0b36083e..79dae0fc 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -573,7 +573,7 @@ static void mt7915_init_work(struct work_struct *work)
- 	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
- 				 init_work);
- 
--	mt7915_mcu_set_eeprom(dev);
-+	mt7915_mcu_set_eeprom(dev, dev->flash_mode);
- 	mt7915_mac_init(dev);
- 	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
- 	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 777fd890..681ede23 100755
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -289,7 +289,6 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
- 	if (mcu_txd->ext_cid) {
- 		mcu_txd->ext_cid_ack = 1;
- 
--		/* do not use Q_SET for efuse */
- 		if (cmd & __MCU_CMD_FIELD_QUERY)
- 			mcu_txd->set_query = MCU_Q_QUERY;
- 		else
-@@ -2955,14 +2954,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
- 	return 0;
- }
- 
--int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
-+int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
- {
- 	struct mt7915_mcu_eeprom req = {
- 		.buffer_mode = EE_MODE_EFUSE,
- 		.format = EE_FORMAT_WHOLE,
- 	};
- 
--	if (dev->flash_mode)
-+	if (flash_mode)
- 		return mt7915_mcu_set_eeprom_flash(dev);
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 09710562..24276da5 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -549,7 +549,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
- 				   struct ieee80211_vif *vif,
- 				   struct ieee80211_sta *sta,
- 				   void *data, u32 field);
--int mt7915_mcu_set_eeprom(struct mt7915_dev *dev);
-+int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
- int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
- int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
- int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index e8bf616c..a91f7e55 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -848,8 +848,62 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
- 	return mt7915_tm_get_rx_stats(phy, false);
- }
- 
-+static int
-+mt7915_tm_write_back_to_efuse(struct mt7915_dev *dev)
-+{
-+	struct mt7915_mcu_eeprom_info req = {};
-+	u8 *eeprom = dev->mt76.eeprom.data;
-+	int i, ret = -EINVAL;
-+
-+	/* prevent from damaging chip id in efuse */
-+	if (mt76_chip(&dev->mt76) != get_unaligned_le16(eeprom))
-+		goto out;
-+
-+	for (i = 0; i < mt7915_eeprom_size(dev); i += MT76_TM_EEPROM_BLOCK_SIZE) {
-+		req.addr = cpu_to_le32(i);
-+		memcpy(&req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
-+
-+		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_ACCESS),
-+					&req, sizeof(req), true);
-+		if (ret)
-+			return ret;
-+	}
-+
-+out:
-+	return ret;
-+}
-+
-+static int
-+mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
-+{
-+	struct mt7915_phy *phy = mphy->priv;
-+	struct mt7915_dev *dev = phy->dev;
-+	u8 *eeprom = dev->mt76.eeprom.data;
-+	int ret = 0;
-+
-+	if (offset >= mt7915_eeprom_size(dev))
-+		return -EINVAL;
-+
-+	switch (action) {
-+	case MT76_TM_EEPROM_ACTION_UPDATE_DATA:
-+		memcpy(eeprom + offset, val, MT76_TM_EEPROM_BLOCK_SIZE);
-+		break;
-+	case MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE:
-+		ret = mt7915_mcu_set_eeprom(dev, true);
-+		break;
-+	case MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE:
-+		ret = mt7915_tm_write_back_to_efuse(dev);
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return ret;
-+}
-+
- const struct mt76_testmode_ops mt7915_testmode_ops = {
- 	.set_state = mt7915_tm_set_state,
- 	.set_params = mt7915_tm_set_params,
- 	.dump_stats = mt7915_tm_dump_stats,
-+	.set_eeprom = mt7915_tm_set_eeprom,
- };
-diff --git a/testmode.c b/testmode.c
-index e6d1f702..1fbca660 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -402,6 +402,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
- 	return 0;
- }
- 
-+static int
-+mt76_testmode_set_eeprom(struct mt76_phy *phy, struct nlattr **tb)
-+{
-+	struct mt76_dev *dev = phy->dev;
-+	u8 action, val[MT76_TM_EEPROM_BLOCK_SIZE];
-+	u32 offset = 0;
-+	int err = -EINVAL;
-+
-+	if (!dev->test_ops->set_eeprom)
-+		return -EOPNOTSUPP;
-+
-+	if (mt76_tm_get_u8(tb[MT76_TM_ATTR_EEPROM_ACTION], &action,
-+			   0, MT76_TM_EEPROM_ACTION_MAX))
-+		goto out;
-+
-+	if (tb[MT76_TM_ATTR_EEPROM_OFFSET]) {
-+		struct nlattr *cur;
-+		int rem, idx = 0;
-+
-+		offset = nla_get_u32(tb[MT76_TM_ATTR_EEPROM_OFFSET]);
-+		if (!!(offset % MT76_TM_EEPROM_BLOCK_SIZE) ||
-+		    !tb[MT76_TM_ATTR_EEPROM_VAL])
-+			goto out;
-+
-+		nla_for_each_nested(cur, tb[MT76_TM_ATTR_EEPROM_VAL], rem) {
-+			if (nla_len(cur) != 1 || idx >= ARRAY_SIZE(val))
-+				goto out;
-+
-+			val[idx++] = nla_get_u8(cur);
-+		}
-+	}
-+
-+	err = dev->test_ops->set_eeprom(phy, offset, val, action);
-+
-+out:
-+	return err;
-+}
-+
- int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		      void *data, int len)
- {
-@@ -425,6 +463,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 
- 	mutex_lock(&dev->mutex);
- 
-+	if (tb[MT76_TM_ATTR_EEPROM_ACTION]) {
-+		err = mt76_testmode_set_eeprom(phy, tb);
-+		goto out;
-+	}
-+
- 	if (tb[MT76_TM_ATTR_RESET]) {
- 		mt76_testmode_set_state(phy, MT76_TM_STATE_OFF);
- 		memset(td, 0, sizeof(*td));
-@@ -484,8 +527,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 
- 	if (tb[MT76_TM_ATTR_TX_POWER]) {
- 		struct nlattr *cur;
--		int idx = 0;
--		int rem;
-+		int rem, idx = 0;
- 
- 		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TX_POWER], rem) {
- 			if (nla_len(cur) != 1 ||
-diff --git a/testmode.h b/testmode.h
-index 89613266..5900c762 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -6,6 +6,7 @@
- #define __MT76_TESTMODE_H
- 
- #define MT76_TM_TIMEOUT	10
-+#define MT76_TM_EEPROM_BLOCK_SIZE	16
- 
- /**
-  * enum mt76_testmode_attr - testmode attributes inside NL80211_ATTR_TESTDATA
-@@ -47,6 +48,13 @@
-  * @MT76_TM_ATTR_DRV_DATA: driver specific netlink attrs (nested)
-  *
-  * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
-+ *
-+ * @MT76_TM_ATTR_EEPROM_ACTION: eeprom setting actions
-+ * 	(u8, see &enum mt76_testmode_eeprom_action)
-+ * @MT76_TM_ATTR_EEPROM_OFFSET: offset of eeprom data block for writing (u32)
-+ * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
-+ * 	(nested, u8 attrs)
-+ *
-  */
- enum mt76_testmode_attr {
- 	MT76_TM_ATTR_UNSPEC,
-@@ -85,6 +93,10 @@ enum mt76_testmode_attr {
- 
- 	MT76_TM_ATTR_MAC_ADDRS,
- 
-+	MT76_TM_ATTR_EEPROM_ACTION,
-+	MT76_TM_ATTR_EEPROM_OFFSET,
-+	MT76_TM_ATTR_EEPROM_VAL,
-+
- 	/* keep last */
- 	NUM_MT76_TM_ATTRS,
- 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
-@@ -198,4 +210,22 @@ enum mt76_testmode_tx_mode {
- 
- extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
- 
-+/**
-+ * enum mt76_testmode_eeprom_action - eeprom setting actions
-+ *
-+ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
-+ * 	eeprom data block
-+ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
-+ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
-+ */
-+enum mt76_testmode_eeprom_action {
-+	MT76_TM_EEPROM_ACTION_UPDATE_DATA,
-+	MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE,
-+	MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE,
-+
-+	/* keep last */
-+	NUM_MT76_TM_EEPROM_ACTION,
-+	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
-+};
-+
- #endif
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1101-mt76-enable-more-5g-channels.patch b/recipes-kernel/linux-mt76/files/patches/1101-mt76-enable-more-5g-channels.patch
deleted file mode 100755
index 0faa2c1..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1101-mt76-enable-more-5g-channels.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 8316325d23bebf7fbc408380bd514455b2c8a74a Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Wed, 29 Sep 2021 14:03:02 +0800
-Subject: [PATCH 2/2] mt76: enable more 5g channels
-
-This is necessary for testmode.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- drivers/net/wireless/mediatek/mt76/mac80211.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/mac80211.c b/mac80211.c
-index 0b274930..b984e0dc 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
- 	CHAN5G(60, 5300),
- 	CHAN5G(64, 5320),
- 
-+	CHAN5G(68, 5340),
-+	CHAN5G(80, 5400),
-+	CHAN5G(84, 5420),
-+	CHAN5G(88, 5440),
-+	CHAN5G(92, 5460),
-+	CHAN5G(96, 5480),
-+
- 	CHAN5G(100, 5500),
- 	CHAN5G(104, 5520),
- 	CHAN5G(108, 5540),
-@@ -75,6 +82,11 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
- 	CHAN5G(165, 5825),
- 	CHAN5G(169, 5845),
- 	CHAN5G(173, 5865),
-+
-+	CHAN5G(184, 4920),
-+	CHAN5G(188, 4940),
-+	CHAN5G(192, 4960),
-+	CHAN5G(196, 4980),
- };
- 
- static const struct ieee80211_channel mt76_channels_6ghz[] = {
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1102-mt76-testmode-add-attributes-for-setting-rf-config.patch b/recipes-kernel/linux-mt76/files/patches/1102-mt76-testmode-add-attributes-for-setting-rf-config.patch
deleted file mode 100755
index 6fedd3c..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1102-mt76-testmode-add-attributes-for-setting-rf-config.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From fdf988d26cbea1d432e6cfb9a0ca82c160101771 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Fri, 4 Jun 2021 18:22:07 +0800
-Subject: [PATCH 1102/1112] mt76: testmode: add attributes for setting rf
- config
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- drivers/net/wireless/mediatek/mt76/mt76.h     |  5 ++++
- drivers/net/wireless/mediatek/mt76/testmode.c | 17 +++++++++++++-
- drivers/net/wireless/mediatek/mt76/testmode.h | 23 +++++++++++++++++++
- 3 files changed, 44 insertions(+), 1 deletion(-)
-
-diff --git a/mt76.h b/mt76.h
-index 8ad7674..157fd6d 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -619,6 +619,11 @@ struct mt76_testmode_data {
- 
- 	u8 flag;
- 
-+	struct {
-+		u8 type;
-+		u8 enable;
-+	} cfg;
-+
- 	u32 tx_pending;
- 	u32 tx_queued;
- 	u16 tx_queued_limit;
-diff --git a/testmode.c b/testmode.c
-index 1fbca66..f31e124 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -547,7 +547,22 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			if (nla_len(cur) != ETH_ALEN || idx >= 3)
- 				goto out;
- 
--			memcpy(td->addr[idx], nla_data(cur), ETH_ALEN);
-+			memcpy(td->addr[idx++], nla_data(cur), ETH_ALEN);
-+		}
-+	}
-+
-+	if (tb[MT76_TM_ATTR_CFG]) {
-+		struct nlattr *cur;
-+		int rem, idx = 0;
-+
-+		nla_for_each_nested(cur, tb[MT76_TM_ATTR_CFG], rem) {
-+			if (nla_len(cur) != 1 || idx >= 2)
-+				goto out;
-+
-+			if (idx == 0)
-+				td->cfg.type = nla_get_u8(cur);
-+			else
-+				td->cfg.enable = nla_get_u8(cur);
- 			idx++;
- 		}
- 	}
-diff --git a/testmode.h b/testmode.h
-index 5900c76..c469ce6 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -55,6 +55,8 @@
-  * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
-  * 	(nested, u8 attrs)
-  *
-+ * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
-+ *
-  */
- enum mt76_testmode_attr {
- 	MT76_TM_ATTR_UNSPEC,
-@@ -97,6 +99,8 @@ enum mt76_testmode_attr {
- 	MT76_TM_ATTR_EEPROM_OFFSET,
- 	MT76_TM_ATTR_EEPROM_VAL,
- 
-+	MT76_TM_ATTR_CFG,
-+
- 	/* keep last */
- 	NUM_MT76_TM_ATTRS,
- 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
-@@ -228,4 +232,23 @@ enum mt76_testmode_eeprom_action {
- 	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
- };
- 
-+/**
-+ * enum mt76_testmode_cfg - packet tx phy mode
-+ *
-+ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
-+ * 	eeprom data block
-+ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
-+ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
-+ */
-+enum mt76_testmode_cfg {
-+	MT76_TM_CFG_TSSI,
-+	MT76_TM_CFG_DPD,
-+	MT76_TM_CFG_RATE_POWER_OFFSET,
-+	MT76_TM_CFG_THERMAL_COMP,
-+
-+	/* keep last */
-+	NUM_MT76_TM_CFG,
-+	MT76_TM_CFG_MAX = NUM_MT76_TM_CFG - 1,
-+};
-+
- #endif
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1103-mt76-mt7915-implement-config-set-in-testmode.patch b/recipes-kernel/linux-mt76/files/patches/1103-mt76-mt7915-implement-config-set-in-testmode.patch
deleted file mode 100755
index bdba37f..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1103-mt76-mt7915-implement-config-set-in-testmode.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 63de755813ec9d82c785b4d70c4f59d5fb00ca69 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Fri, 4 Jun 2021 18:25:21 +0800
-Subject: [PATCH 1103/1112] mt76: mt7915: implement config set in testmode
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- .../net/wireless/mediatek/mt76/mt7915/mcu.h   |  4 +++
- .../wireless/mediatek/mt76/mt7915/testmode.c  | 26 +++++++++++++++++++
- 2 files changed, 30 insertions(+)
-
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c15f89b..4b78468 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -27,6 +27,10 @@ struct mt7915_mcu_txd {
- 
- enum {
- 	MCU_ATE_SET_TRX = 0x1,
-+	MCU_ATE_SET_TSSI = 0x5,
-+	MCU_ATE_SET_DPD = 0x6,
-+	MCU_ATE_SET_RATE_POWER_OFFSET = 0x7,
-+	MCU_ATE_SET_THERMAL_COMP = 0x8,
- 	MCU_ATE_SET_FREQ_OFFSET = 0xa,
- 	MCU_ATE_SET_PHY_COUNT = 0x11,
- 	MCU_ATE_SET_SLOT_TIME = 0x13,
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 2c859f6..98431d6 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -9,6 +9,7 @@
- enum {
- 	TM_CHANGED_TXPOWER,
- 	TM_CHANGED_FREQ_OFFSET,
-+	TM_CHANGED_CFG,
- 
- 	/* must be last */
- 	NUM_TM_CHANGED
-@@ -17,6 +18,7 @@ enum {
- static const u8 tm_change_map[] = {
- 	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
- 	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
-+	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
- };
- 
- struct reg_band {
-@@ -182,6 +184,28 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
- 	return mt7915_mcu_set_muru_ctrl(dev, MURU_SET_ARB_OP_MODE, op_mode);
- }
- 
-+static int
-+mt7915_tm_set_cfg(struct mt7915_phy *phy)
-+{
-+	static const u8 cfg_cmd[] = {
-+		[MT76_TM_CFG_TSSI] = MCU_ATE_SET_TSSI,
-+		[MT76_TM_CFG_DPD] = MCU_ATE_SET_DPD,
-+		[MT76_TM_CFG_RATE_POWER_OFFSET] = MCU_ATE_SET_RATE_POWER_OFFSET,
-+		[MT76_TM_CFG_THERMAL_COMP] = MCU_ATE_SET_THERMAL_COMP,
-+	};
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_tm_cmd req = {
-+		.testmode_en = !(phy->mt76->test.state == MT76_TM_STATE_OFF),
-+		.param_idx = cfg_cmd[td->cfg.type],
-+		.param.cfg.enable = td->cfg.enable,
-+		.param.cfg.band = phy != &dev->phy,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-+				 sizeof(req), false);
-+}
-+
- static int
- mt7915_tm_set_wmm_qid(struct mt7915_dev *dev, u8 qid, u8 aifs, u8 cw_min,
- 		      u16 cw_max, u16 txop)
-@@ -727,6 +751,8 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
- 		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
- 	if (changed & BIT(TM_CHANGED_TXPOWER))
- 		mt7915_tm_set_tx_power(phy);
-+	if (changed & BIT(TM_CHANGED_CFG))
-+		mt7915_tm_set_cfg(phy);
- }
- 
- static int
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1104-mt76-testmode-add-attributes-to-support-off-channel-.patch b/recipes-kernel/linux-mt76/files/patches/1104-mt76-testmode-add-attributes-to-support-off-channel-.patch
deleted file mode 100755
index 98b1d7b..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1104-mt76-testmode-add-attributes-to-support-off-channel-.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From c11cb393f5d03ff73809510a1056f7aef1799de9 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 28 Jun 2021 10:46:14 +0800
-Subject: [PATCH 1104/1112] mt76: testmode: add attributes to support off
- channel scan
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- drivers/net/wireless/mediatek/mt76/mt76.h     |  5 +++++
- drivers/net/wireless/mediatek/mt76/testmode.c | 21 +++++++++++++++++++
- drivers/net/wireless/mediatek/mt76/testmode.h | 10 +++++++++
- 3 files changed, 36 insertions(+)
-
-diff --git a/mt76.h b/mt76.h
-index 157fd6d..ab9482c 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -624,6 +624,11 @@ struct mt76_testmode_data {
- 		u8 enable;
- 	} cfg;
- 
-+	u8 off_ch_scan_ch;
-+	u8 off_ch_scan_center_ch;
-+	u8 off_ch_scan_bw;
-+	u8 off_ch_scan_path;
-+
- 	u32 tx_pending;
- 	u32 tx_queued;
- 	u16 tx_queued_limit;
-diff --git a/testmode.c b/testmode.c
-index f31e124..2376e00 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -567,6 +567,27 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		}
- 	}
- 
-+	if (tb[MT76_TM_ATTR_OFF_CH_SCAN_CH]) {
-+		u8 ch = nla_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CH]);
-+		struct ieee80211_supported_band *sband;
-+
-+		sband = ch > 14 ? &phy->sband_5g.sband :
-+				  &phy->sband_2g.sband;
-+		if (ch && (ch < sband->channels[0].hw_value ||
-+			   ch > sband->channels[sband->n_channels - 1].hw_value))
-+			goto out;
-+
-+		td->off_ch_scan_ch = ch;
-+
-+		if (mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH],
-+				   &td->off_ch_scan_center_ch, ch - 6, ch + 6) ||
-+		    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_BW],
-+				   &td->off_ch_scan_bw, 0, 6) ||
-+		    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_PATH],
-+				   &td->off_ch_scan_path, 1, 0xff))
-+			goto out;
-+	}
-+
- 	if (dev->test_ops->set_params) {
- 		err = dev->test_ops->set_params(phy, tb, state);
- 		if (err)
-diff --git a/testmode.h b/testmode.h
-index c469ce6..0fc0ddd 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -57,6 +57,11 @@
-  *
-  * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
-  *
-+ * @MT76_TM_ATTR_OFF_CH_SCAN_CH: monitored channel for off channel scan (u8)
-+ * @MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH: monitored channel for off channel scan (u8)
-+ * @MT76_TM_ATTR_OFF_CH_SCAN_BW: monitored bw for off channel scan (u8)
-+ * @MT76_TM_ATTR_OFF_CH_SCAN_PATH: monitored rx path for off channel scan (u8)
-+ *
-  */
- enum mt76_testmode_attr {
- 	MT76_TM_ATTR_UNSPEC,
-@@ -101,6 +106,11 @@ enum mt76_testmode_attr {
- 
- 	MT76_TM_ATTR_CFG,
- 
-+	MT76_TM_ATTR_OFF_CH_SCAN_CH,
-+	MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
-+	MT76_TM_ATTR_OFF_CH_SCAN_BW,
-+	MT76_TM_ATTR_OFF_CH_SCAN_PATH,
-+
- 	/* keep last */
- 	NUM_MT76_TM_ATTRS,
- 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1105-mt76-mt7915-add-off-channel-scan-support-in-testmode.patch b/recipes-kernel/linux-mt76/files/patches/1105-mt76-mt7915-add-off-channel-scan-support-in-testmode.patch
deleted file mode 100755
index ecad61f..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1105-mt76-mt7915-add-off-channel-scan-support-in-testmode.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 623e57c672ee85f8a4a9455888237d09df405962 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 28 Jun 2021 10:46:39 +0800
-Subject: [PATCH 1105/1112] mt76: mt7915: add off channel scan support in
- testmode
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- .../wireless/mediatek/mt76/mt7915/testmode.c  | 72 +++++++++++++++++++
- .../wireless/mediatek/mt76/mt7915/testmode.h  | 10 +++
- 2 files changed, 82 insertions(+)
-
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 98431d6..08bb700 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -10,6 +10,7 @@ enum {
- 	TM_CHANGED_TXPOWER,
- 	TM_CHANGED_FREQ_OFFSET,
- 	TM_CHANGED_CFG,
-+	TM_CHANGED_OFF_CH_SCAN_CH,
- 
- 	/* must be last */
- 	NUM_TM_CHANGED
-@@ -19,6 +20,7 @@ static const u8 tm_change_map[] = {
- 	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
- 	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
- 	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
-+	[TM_CHANGED_OFF_CH_SCAN_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CH,
- };
- 
- struct reg_band {
-@@ -36,6 +38,25 @@ struct reg_band {
- static struct reg_band reg_backup_list[TM_REG_MAX_ID];
- 
- 
-+static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
-+{
-+	static const u8 width_to_bw[] = {
-+		[NL80211_CHAN_WIDTH_40] = TM_CBW_40MHZ,
-+		[NL80211_CHAN_WIDTH_80] = TM_CBW_80MHZ,
-+		[NL80211_CHAN_WIDTH_80P80] = TM_CBW_8080MHZ,
-+		[NL80211_CHAN_WIDTH_160] = TM_CBW_160MHZ,
-+		[NL80211_CHAN_WIDTH_5] = TM_CBW_5MHZ,
-+		[NL80211_CHAN_WIDTH_10] = TM_CBW_10MHZ,
-+		[NL80211_CHAN_WIDTH_20] = TM_CBW_20MHZ,
-+		[NL80211_CHAN_WIDTH_20_NOHT] = TM_CBW_20MHZ,
-+	};
-+
-+	if (width >= ARRAY_SIZE(width_to_bw))
-+		return 0;
-+
-+	return width_to_bw[width];
-+}
-+
- static int
- mt7915_tm_set_tx_power(struct mt7915_phy *phy)
- {
-@@ -206,6 +227,55 @@ mt7915_tm_set_cfg(struct mt7915_phy *phy)
- 				 sizeof(req), false);
- }
- 
-+static int
-+mt7915_tm_set_off_channel_scan(struct mt7915_phy *phy)
-+{
-+#define OFF_CH_SCAN_SIMPLE_RX	2
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
-+	int freq1 = chandef->center_freq1;
-+	struct {
-+		u8 cur_pri_ch;
-+		u8 cur_center_ch;
-+		u8 cur_bw;
-+		u8 cur_tx_path;
-+		u8 cur_rx_path;
-+
-+		u8 scan_pri_ch;
-+		u8 scan_center_ch;
-+		u8 scan_bw;
-+		u8 scan_tx_path;
-+		u8 scan_rx_path;
-+
-+		u8 enable;
-+		u8 band_idx;
-+		u8 type;
-+		u8 is_5g;
-+		u8 _rsv[2];
-+	} __packed req = {
-+		.cur_pri_ch = chandef->chan->hw_value,
-+		.cur_center_ch = ieee80211_frequency_to_channel(freq1),
-+		.cur_bw = mt7915_tm_chan_bw(chandef->width),
-+		.cur_tx_path = td->tx_antenna_mask,
-+		.cur_rx_path = td->tx_antenna_mask,
-+
-+		.scan_pri_ch = td->off_ch_scan_ch,
-+		.scan_center_ch = td->off_ch_scan_center_ch,
-+		.scan_bw = td->off_ch_scan_bw,
-+		.scan_tx_path = td->off_ch_scan_path,
-+		.scan_rx_path = td->off_ch_scan_path,
-+
-+		.enable = !!td->off_ch_scan_ch,
-+		.band_idx = phy != &dev->phy,
-+		.type = OFF_CH_SCAN_SIMPLE_RX,
-+		.is_5g = td->off_ch_scan_ch > 14 ? 1 : 0,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL), &req,
-+				 sizeof(req), false);
-+}
-+
- static int
- mt7915_tm_set_wmm_qid(struct mt7915_dev *dev, u8 qid, u8 aifs, u8 cw_min,
- 		      u16 cw_max, u16 txop)
-@@ -753,6 +823,8 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
- 		mt7915_tm_set_tx_power(phy);
- 	if (changed & BIT(TM_CHANGED_CFG))
- 		mt7915_tm_set_cfg(phy);
-+	if (changed & BIT(TM_CHANGED_OFF_CH_SCAN_CH))
-+		mt7915_tm_set_off_channel_scan(phy);
- }
- 
- static int
-diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c8..d22aabe 100644
---- a/mt7915/testmode.h
-+++ b/mt7915/testmode.h
-@@ -130,4 +130,14 @@ struct mt7915_tm_rx_stat_band {
- 	__le16 mdrdy_cnt_ofdm;
- };
- 
-+enum {
-+	TM_CBW_20MHZ,
-+	TM_CBW_40MHZ,
-+	TM_CBW_80MHZ,
-+	TM_CBW_10MHZ,
-+	TM_CBW_5MHZ,
-+	TM_CBW_160MHZ,
-+	TM_CBW_8080MHZ,
-+};
-+
- #endif
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1106-mt76-testmode-add-virtual-stations-support.patch b/recipes-kernel/linux-mt76/files/patches/1106-mt76-testmode-add-virtual-stations-support.patch
deleted file mode 100755
index 16b0858..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1106-mt76-testmode-add-virtual-stations-support.patch
+++ /dev/null
@@ -1,224 +0,0 @@
-From ced1d19944f5da249dfacc0a4ef3d5616efc4f87 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 10 May 2021 20:50:43 +0800
-Subject: [PATCH 1106/1112] mt76: testmode: add virtual stations support
-
-Introduce a virtual station struct mt76_testmode_sta for the
-preparation of HE-MU and RU setting support in testmode.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- drivers/net/wireless/mediatek/mt76/mt76.h     | 103 +++++++++++++++---
- drivers/net/wireless/mediatek/mt76/testmode.c |   6 +-
- drivers/net/wireless/mediatek/mt76/testmode.h |   5 +
- drivers/net/wireless/mediatek/mt76/tx.c       |   3 +-
- 4 files changed, 99 insertions(+), 18 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index ab9482c..ce4a098 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -586,6 +586,22 @@ struct mt76_testmode_ops {
- 
- #define MT_TM_FW_RX_COUNT	BIT(0)
- 
-+struct mt76_testmode_sta_data {
-+	u16 tx_mpdu_len;
-+	u8 tx_rate_idx;
-+	u8 tx_rate_nss;
-+	u8 tx_rate_ldpc;
-+
-+	u8 aid;
-+	u8 ru_alloc;
-+	u8 ru_idx;
-+};
-+
-+struct mt76_testmode_sta {
-+	struct sk_buff *tx_skb;
-+	struct mt76_testmode_sta_data sd;
-+};
-+
- struct mt76_testmode_data {
- 	enum mt76_testmode_state state;
- 
-@@ -593,13 +609,9 @@ struct mt76_testmode_data {
- 	struct sk_buff *tx_skb;
- 
- 	u32 tx_count;
--	u16 tx_mpdu_len;
- 
- 	u8 tx_rate_mode;
--	u8 tx_rate_idx;
--	u8 tx_rate_nss;
- 	u8 tx_rate_sgi;
--	u8 tx_rate_ldpc;
- 	u8 tx_rate_stbc;
- 	u8 tx_ltf;
- 
-@@ -629,6 +641,22 @@ struct mt76_testmode_data {
- 	u8 off_ch_scan_bw;
- 	u8 off_ch_scan_path;
- 
-+	struct mt76_wcid *tm_wcid[MT76_TM_MAX_STA_NUM + 1];
-+	u16 tm_sta_mask;
-+	union {
-+		struct mt76_testmode_sta_data sd;
-+		struct {
-+			u16 tx_mpdu_len;
-+			u8 tx_rate_idx;
-+			u8 tx_rate_nss;
-+			u8 tx_rate_ldpc;
-+
-+			u8 aid;
-+			u8 ru_alloc;
-+			u8 ru_idx;
-+		};
-+	};
-+
- 	u32 tx_pending;
- 	u32 tx_queued;
- 	u16 tx_queued_limit;
-@@ -1107,22 +1135,69 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
- #endif
- }
- 
-+#ifdef CONFIG_NL80211_TESTMODE
-+static inline bool
-+mt76_testmode_has_sta(struct mt76_phy *phy)
-+{
-+	return phy->test.tm_sta_mask != 0;
-+}
-+
-+static inline struct mt76_testmode_sta *
-+mt76_testmode_aid_get_sta(struct mt76_phy *phy, u8 aid)
-+{
-+	struct mt76_wcid *wcid = phy->test.tm_wcid[aid];
-+
-+	if (!wcid || !aid)
-+		return NULL;
-+
-+	return (struct mt76_testmode_sta *)((u8 *)wcid + phy->hw->sta_data_size);
-+}
-+
-+#define mt76_testmode_for_each_sta(phy, aid, tm_sta)	\
-+	for (aid = 1, tm_sta = mt76_testmode_aid_get_sta(phy, 1);	\
-+	     aid <= hweight16(phy->test.tm_sta_mask);	\
-+	     aid = phy->test.tm_sta_mask >> aid ?	\
-+		   ffs(phy->test.tm_sta_mask >> aid) + aid :	\
-+		   aid + 1,	\
-+	     tm_sta = mt76_testmode_aid_get_sta(phy, aid))
-+
-+static inline bool
-+__mt76_testmode_check_skb(struct mt76_phy *phy, struct sk_buff *skb)
-+{
-+	struct mt76_testmode_sta *tm_sta;
-+	int i;
-+
-+	if (!mt76_testmode_has_sta(phy))
-+		return false;
-+
-+	mt76_testmode_for_each_sta(phy, i, tm_sta) {
-+		if (tm_sta->tx_skb == skb)
-+			return true;
-+	}
-+
-+	return false;
-+}
-+
- static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
- 					struct sk_buff *skb,
- 					struct ieee80211_hw **hw)
- {
--#ifdef CONFIG_NL80211_TESTMODE
--	if (skb == dev->phy.test.tx_skb)
--		*hw = dev->phy.hw;
--	else if (dev->phy2 && skb == dev->phy2->test.tx_skb)
--		*hw = dev->phy2->hw;
--	else
--		return false;
--	return true;
--#else
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct mt76_phy *phy = &dev->phy;
-+
-+	if ((info->hw_queue & MT_TX_HW_QUEUE_EXT_PHY) && dev->phy2)
-+		phy = dev->phy2;
-+
-+	if (mt76_testmode_enabled(phy) &&
-+	    (skb == phy->test.tx_skb ||
-+	    __mt76_testmode_check_skb(phy, skb))) {
-+		*hw = phy->hw;
-+		return true;
-+	}
-+
- 	return false;
--#endif
- }
-+#endif
- 
- void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb);
- void mt76_tx(struct mt76_phy *dev, struct ieee80211_sta *sta,
-diff --git a/testmode.c b/testmode.c
-index 2376e00..682ca3d 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -382,7 +382,6 @@ int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state
- 	}
- 
- 	return __mt76_testmode_set_state(phy, state);
--
- }
- EXPORT_SYMBOL(mt76_testmode_set_state);
- 
-@@ -495,7 +494,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
- 			   &td->tx_duty_cycle, 0, 99) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
--			   &td->tx_power_control, 0, 1))
-+			   &td->tx_power_control, 0, 1) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_ALLOC], &td->ru_alloc, 0, 0xff) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68))
- 		goto out;
- 
- 	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-diff --git a/testmode.h b/testmode.h
-index 0fc0ddd..b360d7a 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -7,6 +7,7 @@
- 
- #define MT76_TM_TIMEOUT	10
- #define MT76_TM_EEPROM_BLOCK_SIZE	16
-+#define MT76_TM_MAX_STA_NUM	16
- 
- /**
-  * enum mt76_testmode_attr - testmode attributes inside NL80211_ATTR_TESTDATA
-@@ -111,6 +112,10 @@ enum mt76_testmode_attr {
- 	MT76_TM_ATTR_OFF_CH_SCAN_BW,
- 	MT76_TM_ATTR_OFF_CH_SCAN_PATH,
- 
-+	MT76_TM_ATTR_AID,
-+	MT76_TM_ATTR_RU_ALLOC,
-+	MT76_TM_ATTR_RU_IDX,
-+
- 	/* keep last */
- 	NUM_MT76_TM_ATTRS,
- 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
-diff --git a/tx.c b/tx.c
-index 6b8c9dc..ca5e6d9 100644
---- a/tx.c
-+++ b/tx.c
-@@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
- 	if (mt76_is_testmode_skb(dev, skb, &hw)) {
- 		struct mt76_phy *phy = hw->priv;
- 
--		if (skb == phy->test.tx_skb)
--			phy->test.tx_done++;
-+		phy->test.tx_done++;
- 		if (phy->test.tx_queued == phy->test.tx_done)
- 			wake_up(&dev->tx_wait);
- 
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1107-mt76-testmode-support-to-dump-stats-from-different-v.patch b/recipes-kernel/linux-mt76/files/patches/1107-mt76-testmode-support-to-dump-stats-from-different-v.patch
deleted file mode 100755
index 78ad215..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1107-mt76-testmode-support-to-dump-stats-from-different-v.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From e5b15e6a5f8f8ee282e818172f9b1a9cb5a63942 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 17 May 2021 11:27:17 +0800
-Subject: [PATCH 1107/1112] mt76: testmode: support to dump stats from
- different virtual stations
-
-Support to
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- drivers/net/wireless/mediatek/mt76/testmode.c | 36 ++++++++++++++++---
- 1 file changed, 31 insertions(+), 5 deletions(-)
-
-diff --git a/testmode.c b/testmode.c
-index 682ca3d..bb15388 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -331,8 +331,11 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
- 	struct mt76_dev *dev = phy->dev;
- 	int err;
- 
--	if (prev_state == MT76_TM_STATE_TX_FRAMES)
-+	if (prev_state == MT76_TM_STATE_TX_FRAMES) {
-+		if (phy->test.tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
-+			dev->test_ops->set_state(phy, MT76_TM_STATE_IDLE);
- 		mt76_testmode_tx_stop(phy);
-+	}
- 
- 	if (state == MT76_TM_STATE_TX_FRAMES) {
- 		err = mt76_testmode_tx_init(phy);
-@@ -654,6 +657,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 	struct mt76_phy *phy = hw->priv;
- 	struct mt76_dev *dev = phy->dev;
- 	struct mt76_testmode_data *td = &phy->test;
-+	struct mt76_testmode_sta_data *sd = &td->sd;
- 	struct nlattr *tb[NUM_MT76_TM_ATTRS] = {};
- 	int err = 0;
- 	void *a;
-@@ -686,6 +690,23 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 		goto out;
- 	}
- 
-+	if (tb[MT76_TM_ATTR_AID]) {
-+		struct mt76_testmode_sta *tm_sta;
-+		u8 aid;
-+
-+		err = mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &aid, 1, 16);
-+		if (err)
-+			goto out;
-+
-+		tm_sta = mt76_testmode_aid_get_sta(phy, aid);
-+		if (!tm_sta) {
-+			err = -EINVAL;
-+			goto out;
-+		}
-+
-+		sd = &tm_sta->sd;
-+	}
-+
- 	mt76_testmode_init_defaults(phy);
- 
- 	err = -EMSGSIZE;
-@@ -698,12 +719,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 		goto out;
- 
- 	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
--	    nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, td->tx_mpdu_len) ||
- 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
--	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, td->tx_rate_nss) ||
--	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, td->tx_rate_idx) ||
- 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
--	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
- 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
- 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
- 	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
-@@ -723,6 +740,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 	     nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
- 		goto out;
- 
-+	if (nla_put_u8(msg, MT76_TM_ATTR_AID, sd->aid) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, sd->tx_rate_nss) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, sd->tx_rate_idx) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, sd->tx_rate_ldpc) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_RU_ALLOC, sd->ru_alloc) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_RU_IDX, sd->ru_idx) ||
-+	    nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, sd->tx_mpdu_len))
-+		goto out;
-+
- 	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
- 		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
- 		if (!a)
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1108-mt76-testmode-rework-the-flow-of-init-tx-skb.patch b/recipes-kernel/linux-mt76/files/patches/1108-mt76-testmode-rework-the-flow-of-init-tx-skb.patch
deleted file mode 100755
index 45e5af7..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1108-mt76-testmode-rework-the-flow-of-init-tx-skb.patch
+++ /dev/null
@@ -1,193 +0,0 @@
-From 323105f9f7d5057ffb445948318525f81b76506c Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 11 May 2021 10:24:46 +0800
-Subject: [PATCH 1108/1112] mt76: testmode: rework the flow of init tx skb
-
-This is the preparation for supporting virtual stations in testmode.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- drivers/net/wireless/mediatek/mt76/mt76.h     |  3 +-
- .../wireless/mediatek/mt76/mt7915/testmode.c  |  2 +-
- drivers/net/wireless/mediatek/mt76/testmode.c | 73 +++++++++++++++----
- 3 files changed, 61 insertions(+), 17 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index ce4a098..b5f1367 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -1289,7 +1289,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
- 		       struct netlink_callback *cb, void *data, int len);
- int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
--int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
-+int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len, u8 aid, struct sk_buff **skb);
- 
- static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
- {
-@@ -1303,7 +1303,6 @@ static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
- #endif
- }
- 
--
- /* internal */
- static inline struct ieee80211_hw *
- mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 08bb700..054829e 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -431,7 +431,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
- 	bitrate = cfg80211_calculate_bitrate(&rate);
- 	tx_len = bitrate * tx_time / 10 / 8;
- 
--	ret = mt76_testmode_alloc_skb(phy->mt76, tx_len);
-+	ret = mt76_testmode_init_skb(phy->mt76, tx_len, 0, &td->tx_skb);
- 	if (ret)
- 		return ret;
- 
-diff --git a/testmode.c b/testmode.c
-index bb15388..0f93338 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -87,15 +87,34 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
- }
- 
- static void
--mt76_testmode_free_skb(struct mt76_phy *phy)
-+mt76_testmode_free_skb(struct sk_buff **tx_skb)
-+{
-+	dev_kfree_skb(*tx_skb);
-+	*tx_skb = NULL;
-+}
-+
-+static void
-+mt76_testmode_free_skb_all(struct mt76_phy *phy)
- {
- 	struct mt76_testmode_data *td = &phy->test;
- 
--	dev_kfree_skb(td->tx_skb);
--	td->tx_skb = NULL;
-+	if (mt76_testmode_has_sta(phy)) {
-+		struct mt76_testmode_sta *tm_sta;
-+		int i;
-+
-+		mt76_testmode_for_each_sta(phy, i, tm_sta) {
-+			mt76_testmode_free_skb(&tm_sta->tx_skb);
-+		}
-+
-+		return;
-+	}
-+
-+	mt76_testmode_free_skb(&td->tx_skb);
- }
- 
--int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
-+static int
-+mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
-+			struct sk_buff **tx_skb, u8 *da)
- {
- #define MT_TXP_MAX_LEN	4095
- 	u16 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
-@@ -128,7 +147,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 	hdr->frame_control = cpu_to_le16(fc);
- 	memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
- 	memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
--	memcpy(hdr->addr3, td->addr[2], ETH_ALEN);
-+	/* memcpy(hdr->addr3, td->addr[2], ETH_ALEN); */
-+	memcpy(hdr->addr3, da, ETH_ALEN);
-+
- 	skb_set_queue_mapping(head, IEEE80211_AC_BE);
- 
- 	info = IEEE80211_SKB_CB(head);
-@@ -152,7 +173,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 
- 		frag = alloc_skb(frag_len, GFP_KERNEL);
- 		if (!frag) {
--			mt76_testmode_free_skb(phy);
-+			mt76_testmode_free_skb(tx_skb);
- 			dev_kfree_skb(head);
- 			return -ENOMEM;
- 		}
-@@ -165,23 +186,25 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 		frag_tail = &(*frag_tail)->next;
- 	}
- 
--	mt76_testmode_free_skb(phy);
--	td->tx_skb = head;
-+	mt76_testmode_free_skb(tx_skb);
-+	*tx_skb = head;
- 
- 	return 0;
- }
--EXPORT_SYMBOL(mt76_testmode_alloc_skb);
- 
--static int
--mt76_testmode_tx_init(struct mt76_phy *phy)
-+int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len, u8 aid,
-+			   struct sk_buff **tx_skb)
- {
- 	struct mt76_testmode_data *td = &phy->test;
- 	struct ieee80211_tx_info *info;
- 	struct ieee80211_tx_rate *rate;
- 	u8 max_nss = hweight8(phy->antenna_mask);
-+	u8 da[ETH_ALEN];
- 	int ret;
- 
--	ret = mt76_testmode_alloc_skb(phy, td->tx_mpdu_len);
-+	ether_addr_copy(da, phy->macaddr);
-+	da[0] += aid * 4;
-+	ret = mt76_testmode_alloc_skb(phy, len, tx_skb, da);
- 	if (ret)
- 		return ret;
- 
-@@ -191,7 +214,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
- 	if (td->tx_antenna_mask)
- 		max_nss = min_t(u8, max_nss, hweight8(td->tx_antenna_mask));
- 
--	info = IEEE80211_SKB_CB(td->tx_skb);
-+	info = IEEE80211_SKB_CB(*tx_skb);
- 	rate = &info->control.rates[0];
- 	rate->count = 1;
- 	rate->idx = td->tx_rate_idx;
-@@ -263,6 +286,28 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
- out:
- 	return 0;
- }
-+EXPORT_SYMBOL(mt76_testmode_init_skb);
-+
-+static int
-+mt76_testmode_tx_init(struct mt76_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->test;
-+	struct mt76_testmode_sta *tm_sta;
-+	int ret, i;
-+
-+	if (!mt76_testmode_has_sta(phy))
-+		return mt76_testmode_init_skb(phy, td->tx_mpdu_len,
-+					      0, &td->tx_skb);
-+
-+	mt76_testmode_for_each_sta(phy, i, tm_sta) {
-+		ret = mt76_testmode_init_skb(phy, tm_sta->sd.tx_mpdu_len,
-+					     tm_sta->sd.aid, &tm_sta->tx_skb);
-+		if (ret)
-+			return ret;
-+	}
-+
-+	return 0;
-+}
- 
- static void
- mt76_testmode_tx_start(struct mt76_phy *phy)
-@@ -291,7 +336,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
- 	wait_event_timeout(dev->tx_wait, td->tx_done == td->tx_queued,
- 			   MT76_TM_TIMEOUT * HZ);
- 
--	mt76_testmode_free_skb(phy);
-+	mt76_testmode_free_skb_all(phy);
- }
- 
- static inline void
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1109-mt76-testmode-add-support-to-queue-skb-of-multiple-s.patch b/recipes-kernel/linux-mt76/files/patches/1109-mt76-testmode-add-support-to-queue-skb-of-multiple-s.patch
deleted file mode 100755
index e92177a..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1109-mt76-testmode-add-support-to-queue-skb-of-multiple-s.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From 19e0036562d574c6ffe6a47790dbfa953b35050c Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 11 May 2021 15:17:31 +0800
-Subject: [PATCH 1109/1112] mt76: testmode: add support to queue skb of
- multiple stations
-
-Rework queue skb flow to support sending packet for multiple virtual
-stations.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- drivers/net/wireless/mediatek/mt76/mt76.h     |  1 +
- drivers/net/wireless/mediatek/mt76/testmode.c | 70 ++++++++++++++++---
- 2 files changed, 63 insertions(+), 8 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index b5f1367..4b502c6 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -642,6 +642,7 @@ struct mt76_testmode_data {
- 	u8 off_ch_scan_path;
- 
- 	struct mt76_wcid *tm_wcid[MT76_TM_MAX_STA_NUM + 1];
-+	u8 cur_aid;
- 	u16 tm_sta_mask;
- 	union {
- 		struct mt76_testmode_sta_data sd;
-diff --git a/testmode.c b/testmode.c
-index 0f93338..9da490c 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -25,18 +25,18 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
- };
- EXPORT_SYMBOL_GPL(mt76_tm_policy);
- 
--void mt76_testmode_tx_pending(struct mt76_phy *phy)
-+static u16
-+mt76_testmode_queue_tx(struct mt76_phy *phy, struct mt76_wcid *wcid,
-+		       struct sk_buff *skb, u32 limit)
- {
- 	struct mt76_testmode_data *td = &phy->test;
- 	struct mt76_dev *dev = phy->dev;
--	struct mt76_wcid *wcid = &dev->global_wcid;
--	struct sk_buff *skb = td->tx_skb;
- 	struct mt76_queue *q;
--	u16 tx_queued_limit;
-+	u16 tx_queued_limit, count = 0;
- 	int qid;
- 
--	if (!skb || !td->tx_pending)
--		return;
-+	if (!skb)
-+		return 0;
- 
- 	qid = skb_get_queue_mapping(skb);
- 	q = phy->q_tx[qid];
-@@ -45,7 +45,7 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
- 
- 	spin_lock_bh(&q->lock);
- 
--	while (td->tx_pending > 0 &&
-+	while (count < limit &&
- 	       td->tx_queued - td->tx_done < tx_queued_limit &&
- 	       q->queued < q->ndesc / 2) {
- 		int ret;
-@@ -55,13 +55,56 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
- 		if (ret < 0)
- 			break;
- 
--		td->tx_pending--;
- 		td->tx_queued++;
-+		count++;
- 	}
- 
- 	dev->queue_ops->kick(dev, q);
- 
- 	spin_unlock_bh(&q->lock);
-+
-+	return count;
-+}
-+
-+void mt76_testmode_tx_pending(struct mt76_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->test;
-+	u16 count;
-+
-+	if (!td->tx_pending)
-+		return;
-+
-+	if (!mt76_testmode_has_sta(phy)) {
-+		count = mt76_testmode_queue_tx(phy, &phy->dev->global_wcid,
-+					       td->tx_skb, td->tx_pending);
-+		td->tx_pending -= count;
-+
-+		return;
-+	}
-+
-+	while (true) {
-+		struct mt76_testmode_sta *tm_sta;
-+		struct mt76_wcid *wcid;
-+		u32 limit, per_sta_cnt = 1;
-+
-+		if (td->tx_rate_mode != MT76_TM_TX_MODE_HE_MU)
-+			per_sta_cnt = td->tx_count / hweight16(phy->test.tm_sta_mask);
-+
-+		limit = td->tx_pending % per_sta_cnt;
-+		if (limit == 0)
-+			limit = per_sta_cnt;
-+
-+		tm_sta = mt76_testmode_aid_get_sta(phy, td->cur_aid);
-+		wcid = td->tm_wcid[td->cur_aid];
-+		count = mt76_testmode_queue_tx(phy, wcid, tm_sta->tx_skb, limit);
-+
-+		td->tx_pending -= count;
-+
-+		if (td->tx_pending && (td->tx_pending % per_sta_cnt == 0))
-+			td->cur_aid = ffs(td->tm_sta_mask >> td->cur_aid) + td->cur_aid;
-+		else
-+			break;
-+	}
- }
- 
- static u32
-@@ -318,6 +361,17 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
- 	td->tx_queued = 0;
- 	td->tx_done = 0;
- 	td->tx_pending = td->tx_count;
-+
-+	if (mt76_testmode_has_sta(phy)) {
-+		td->cur_aid = ffs(td->tm_sta_mask);
-+
-+		/* The actual tx count of MU packets will be pass to FW
-+		 * by a mcu command in testmode.
-+		 */
-+		if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
-+			td->tx_pending = hweight16(phy->test.tm_sta_mask);
-+	}
-+
- 	mt76_worker_schedule(&dev->tx_worker);
- }
- 
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1110-mt76-mt7915-implement-aid-support-in-testmode.patch b/recipes-kernel/linux-mt76/files/patches/1110-mt76-mt7915-implement-aid-support-in-testmode.patch
deleted file mode 100755
index 90b53ea..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1110-mt76-mt7915-implement-aid-support-in-testmode.patch
+++ /dev/null
@@ -1,420 +0,0 @@
-From 8027e94f1564089d719a6fb0eab7d29bb2981bf0 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 11 May 2021 16:24:09 +0800
-Subject: [PATCH 1110/1112] mt76: mt7915: implement aid support in testmode
-
-Add support for virtual stations in mt7915 testmode.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- .../wireless/mediatek/mt76/mt76_connac_mcu.c  |   5 +
- .../net/wireless/mediatek/mt76/mt7915/mac.c   |  25 +-
- .../wireless/mediatek/mt76/mt7915/testmode.c  | 231 +++++++++++++++---
- 3 files changed, 216 insertions(+), 45 deletions(-)
-
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index eac096c..a361ab6 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -389,6 +389,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_MESH_POINT:
- 	case NL80211_IFTYPE_AP:
-+	case NL80211_IFTYPE_MONITOR:
- 		if (vif->p2p)
- 			conn_type = CONNECTION_P2P_GC;
- 		else
-@@ -577,6 +578,10 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
- 					     wtbl_tlv, sta_wtbl);
- 	spe = (struct wtbl_spe *)tlv;
- 	spe->spe_idx = 24;
-+
-+	/* check */
-+	if (vif->type == NL80211_IFTYPE_MONITOR)
-+		rx->rca1 = 0;
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_generic_tlv);
- 
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index fb42446..2ad4cb1 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -906,16 +906,28 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
- {
- #ifdef CONFIG_NL80211_TESTMODE
- 	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_testmode_sta_data *sd = &td->sd;
- 	const struct ieee80211_rate *r;
--	u8 bw, mode, nss = td->tx_rate_nss;
--	u8 rate_idx = td->tx_rate_idx;
-+	u8 bw, mode, nss, rate_idx;
- 	u16 rateval = 0;
- 	u32 val;
- 	bool cck = false;
- 	int band;
- 
--	if (skb != phy->mt76->test.tx_skb)
--		return;
-+	if (mt76_testmode_has_sta(phy->mt76)) {
-+		struct mt76_testmode_sta *tm_sta;
-+		int i;
-+
-+		mt76_testmode_for_each_sta(phy->mt76, i, tm_sta) {
-+			if (tm_sta->tx_skb == skb) {
-+				sd = &tm_sta->sd;
-+				break;
-+			}
-+		}
-+	}
-+
-+	nss = sd->tx_rate_nss;
-+	rate_idx = sd->tx_rate_idx;
- 
- 	switch (td->tx_rate_mode) {
- 	case MT76_TM_TX_MODE_HT:
-@@ -1005,7 +1017,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
- 	if (mode >= MT_PHY_TYPE_HE_SU)
- 		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
- 
--	if (td->tx_rate_ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
-+	if (sd->tx_rate_ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
- 		val |= MT_TXD6_LDPC;
- 
- 	txwi[1] &= ~cpu_to_le32(MT_TXD1_VTA);
-@@ -1474,6 +1486,9 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
- 				continue;
- 
- 			msta = container_of(wcid, struct mt7915_sta, wcid);
-+			if (mt76_testmode_enabled(msta->vif->phy->mt76))
-+				continue;
-+
- 			spin_lock_bh(&dev->sta_poll_lock);
- 			if (list_empty(&msta->poll_list))
- 				list_add_tail(&msta->poll_list, &dev->sta_poll_list);
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 054829e..29c173d 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -11,6 +11,7 @@ enum {
- 	TM_CHANGED_FREQ_OFFSET,
- 	TM_CHANGED_CFG,
- 	TM_CHANGED_OFF_CH_SCAN_CH,
-+	TM_CHANGED_AID,
- 
- 	/* must be last */
- 	NUM_TM_CHANGED
-@@ -21,6 +22,7 @@ static const u8 tm_change_map[] = {
- 	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
- 	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
- 	[TM_CHANGED_OFF_CH_SCAN_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CH,
-+	[TM_CHANGED_AID] = MT76_TM_ATTR_AID,
- };
- 
- struct reg_band {
-@@ -142,18 +144,33 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
- }
- 
- static int
--mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
-+mt7915_tm_clean_hwq(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
- 	struct mt7915_tm_cmd req = {
- 		.testmode_en = 1,
- 		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
--		.param.clean.wcid = wcid,
- 		.param.clean.band = phy != &dev->phy,
- 	};
-+	struct mt76_testmode_sta *tm_sta;
-+	int ret, i;
- 
--	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
--				 sizeof(req), false);
-+	if (!mt76_testmode_has_sta(phy->mt76)) {
-+		req.param.clean.wcid = dev->mt76.global_wcid.idx;
-+
-+		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
-+					 &req, sizeof(req), false);
-+	}
-+
-+	mt76_testmode_for_each_sta(phy->mt76, i, tm_sta) {
-+		req.param.clean.wcid = phy->mt76->test.tm_wcid[i]->idx;
-+		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
-+					&req, sizeof(req), false);
-+		if (ret)
-+			return ret;
-+	}
-+
-+	return 0;
- }
- 
- static int
-@@ -530,27 +547,109 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
- 	}
- }
- 
-+static int
-+mt7915_tm_sta_add(struct mt7915_phy *phy, u8 aid,
-+		  struct mt76_testmode_sta_data *sd)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_testmode_sta *tm_sta;
-+
-+	if (!aid)
-+		return 0;
-+
-+	if (!td->tm_wcid[aid]) {
-+		struct ieee80211_vif *vif = phy->monitor_vif;
-+		struct ieee80211_sband_iftype_data *data;
-+		struct ieee80211_supported_band *sband;
-+		struct ieee80211_sta *sta;
-+		struct mt7915_sta *msta;
-+		int ret;
-+
-+		sta = kzalloc(sizeof(*sta) + phy->mt76->hw->sta_data_size +
-+			      sizeof(*tm_sta), GFP_KERNEL);
-+		if (!sta)
-+			return -ENOMEM;
-+
-+		if (phy->mt76->chandef.chan->band == NL80211_BAND_5GHZ) {
-+			sband = &phy->mt76->sband_5g.sband;
-+			data = phy->iftype[NL80211_BAND_5GHZ];
-+		} else {
-+			sband = &phy->mt76->sband_2g.sband;
-+			data = phy->iftype[NL80211_BAND_2GHZ];
-+		}
-+
-+		ether_addr_copy(sta->addr, phy->mt76->macaddr);
-+		sta->addr[0] += aid * 4;
-+		memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
-+		memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
-+		memcpy(&sta->he_cap, &data[NL80211_IFTYPE_STATION].he_cap,
-+		       sizeof(sta->he_cap));
-+		sta->aid = aid;
-+		sta->wme = 1;
-+
-+		ret = mt7915_mac_sta_add(&phy->dev->mt76, vif, sta);
-+		if (ret) {
-+			kfree(sta);
-+			return ret;
-+		}
-+
-+		msta = (struct mt7915_sta *)sta->drv_priv;
-+		td->tm_wcid[aid] = &msta->wcid;
-+		td->tm_sta_mask |= BIT(aid - 1);
-+	}
-+
-+	tm_sta = mt76_testmode_aid_get_sta(phy->mt76, aid);
-+	memcpy(&tm_sta->sd, sd, sizeof(tm_sta->sd));
-+
-+	return 0;
-+}
-+
- static void
--mt7915_tm_init(struct mt7915_phy *phy, bool en)
-+mt7915_tm_sta_remove(struct mt7915_phy *phy, u8 aid)
- {
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_wcid *wcid = td->tm_wcid[aid];
- 	struct mt7915_dev *dev = phy->dev;
-+	struct ieee80211_sta *sta = wcid_to_sta(wcid);
- 
--	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
-+	mt7915_mac_sta_remove(&dev->mt76, phy->monitor_vif, sta);
-+	mt76_wcid_mask_clear(dev->mt76.wcid_mask, wcid->idx);
-+
-+	kfree(sta);
-+	td->tm_wcid[aid] = NULL;
-+	td->tm_sta_mask &= ~BIT(aid - 1);
-+}
-+
-+static void
-+mt7915_tm_sta_remove_all(struct mt7915_phy *phy)
-+{
-+	int i;
-+
-+	if (!mt76_testmode_has_sta(phy->mt76))
- 		return;
- 
--	mt7915_mcu_set_sku_en(phy, !en);
-+	for (i = 1; i < ARRAY_SIZE(phy->mt76->test.tm_wcid); i++) {
-+		if (phy->mt76->test.tm_wcid[i])
-+			mt7915_tm_sta_remove(phy, i);
-+	}
-+}
- 
--	mt7915_tm_mode_ctrl(dev, en);
--	mt7915_tm_reg_backup_restore(phy);
--	mt7915_tm_set_trx(phy, TM_MAC_TXRX, !en);
-+static int
-+mt7915_tm_set_sta(struct mt7915_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
- 
--	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
--	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
-+	if (!td->aid) {
-+		mt7915_tm_sta_remove_all(phy);
-+		return 0;
-+	}
- 
--	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
-+	if (td->tx_count == 0) {
-+		mt7915_tm_sta_remove(phy, td->aid);
-+		return 0;
-+	}
- 
--	if (!en)
--		mt7915_tm_set_tam_arb(phy, en, 0);
-+	return mt7915_tm_sta_add(phy, td->aid, &td->sd);
- }
- 
- static void
-@@ -563,22 +662,48 @@ mt7915_tm_update_channel(struct mt7915_phy *phy)
- 	mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(SET_RX_PATH));
- }
- 
-+static bool
-+mt7915_tm_check_skb(struct mt7915_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct ieee80211_tx_info *info;
-+
-+	if (!mt76_testmode_has_sta(phy->mt76)) {
-+		if (!td->tx_skb)
-+			return false;
-+
-+		info = IEEE80211_SKB_CB(td->tx_skb);
-+		info->control.vif = phy->monitor_vif;
-+	} else {
-+		struct mt76_testmode_sta *tm_sta;
-+		int i;
-+
-+		mt76_testmode_for_each_sta(phy->mt76, i, tm_sta) {
-+			if (!tm_sta->tx_skb)
-+				return false;
-+
-+			info = IEEE80211_SKB_CB(tm_sta->tx_skb);
-+			info->control.vif = phy->monitor_vif;
-+		}
-+	}
-+
-+	return true;
-+}
-+
- static void
- mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- {
- 	static const u8 spe_idx_map[] = {0, 0, 1, 0, 3, 2, 4, 0,
- 					 9, 8, 6, 10, 16, 12, 18, 0};
- 	struct mt76_testmode_data *td = &phy->mt76->test;
--	struct mt7915_dev *dev = phy->dev;
--	struct ieee80211_tx_info *info;
--	u8 duty_cycle = td->tx_duty_cycle;
--	u32 tx_time = td->tx_time;
--	u32 ipg = td->tx_ipg;
- 
- 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
--	mt7915_tm_clean_hwq(phy, dev->mt76.global_wcid.idx);
-+	mt7915_tm_set_trx(phy, TM_MAC_TX, false);
- 
- 	if (en) {
-+		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
-+		u8 duty_cycle = td->tx_duty_cycle;
-+
- 		mt7915_tm_update_channel(phy);
- 
- 		if (td->tx_spe_idx) {
-@@ -586,30 +711,29 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 		} else {
- 			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
- 		}
--	}
- 
--	mt7915_tm_set_tam_arb(phy, en,
--			      td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
--
--	/* if all three params are set, duty_cycle will be ignored */
--	if (duty_cycle && tx_time && !ipg) {
--		ipg = tx_time * 100 / duty_cycle - tx_time;
--	} else if (duty_cycle && !tx_time && ipg) {
--		if (duty_cycle < 100)
--			tx_time = duty_cycle * ipg / (100 - duty_cycle);
--	}
-+		/* if all three params are set, duty_cycle will be ignored */
-+		if (duty_cycle && tx_time && !ipg) {
-+			ipg = tx_time * 100 / duty_cycle - tx_time;
-+		} else if (duty_cycle && !tx_time && ipg) {
-+			if (duty_cycle < 100)
-+				tx_time = duty_cycle * ipg / (100 - duty_cycle);
-+		}
- 
--	mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
--	mt7915_tm_set_tx_len(phy, tx_time);
-+		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
-+		mt7915_tm_set_tx_len(phy, tx_time);
- 
--	if (ipg)
--		td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
-+		if (ipg)
-+			td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
- 
--	if (!en || !td->tx_skb)
--		return;
-+		if (!mt7915_tm_check_skb(phy))
-+			return;
-+	} else {
-+		mt7915_tm_clean_hwq(phy);
-+	}
- 
--	info = IEEE80211_SKB_CB(td->tx_skb);
--	info->control.vif = phy->monitor_vif;
-+	mt7915_tm_set_tam_arb(phy, en,
-+			      td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
- 
- 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
- }
-@@ -811,6 +935,31 @@ out:
- 				 sizeof(req), true);
- }
- 
-+static void
-+mt7915_tm_init(struct mt7915_phy *phy, bool en)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+
-+	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
-+		return;
-+
-+	mt7915_mcu_set_sku_en(phy, !en);
-+
-+	mt7915_tm_mode_ctrl(dev, en);
-+	mt7915_tm_reg_backup_restore(phy);
-+	mt7915_tm_set_trx(phy, TM_MAC_TXRX, !en);
-+
-+	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
-+	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
-+
-+	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
-+
-+	if (!en) {
-+		mt7915_tm_set_tam_arb(phy, en, 0);
-+		mt7915_tm_sta_remove_all(phy);
-+	}
-+}
-+
- static void
- mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
- {
-@@ -825,6 +974,8 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
- 		mt7915_tm_set_cfg(phy);
- 	if (changed & BIT(TM_CHANGED_OFF_CH_SCAN_CH))
- 		mt7915_tm_set_off_channel_scan(phy);
-+	if (changed & BIT(TM_CHANGED_AID))
-+		mt7915_tm_set_sta(phy);
- }
- 
- static int
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
new file mode 100644
index 0000000..fcea41b
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
@@ -0,0 +1,2927 @@
+From 2e542afa1d9932b4ec588ad2c622c74a16fa1edd Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 21 Apr 2022 15:43:19 +0800
+Subject: [PATCH] mt76: testmode: additional supports
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c      |    3 +-
+ drivers/net/wireless/mediatek/mt76/mac80211.c |   12 +
+ drivers/net/wireless/mediatek/mt76/mt76.h     |  111 +-
+ .../wireless/mediatek/mt76/mt76_connac_mcu.c  |    4 +
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |    2 +
+ .../net/wireless/mediatek/mt76/mt7915/init.c  |    2 +-
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |   37 +-
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |    2 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |   11 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |   31 +-
+ .../net/wireless/mediatek/mt76/mt7915/mmio.c  |    2 +
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |   14 +-
+ .../net/wireless/mediatek/mt76/mt7915/regs.h  |    3 +
+ .../wireless/mediatek/mt76/mt7915/testmode.c  | 1171 +++++++++++++++--
+ .../wireless/mediatek/mt76/mt7915/testmode.h  |  278 ++++
+ drivers/net/wireless/mediatek/mt76/testmode.c |  274 +++-
+ drivers/net/wireless/mediatek/mt76/testmode.h |   75 ++
+ .../net/wireless/mediatek/mt76/tools/fields.c |   80 ++
+ drivers/net/wireless/mediatek/mt76/tx.c       |    3 +-
+ 19 files changed, 1963 insertions(+), 152 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index 30de8be4..f6f5f129 100644
+--- a/dma.c
++++ b/dma.c
+@@ -426,8 +426,7 @@ free:
+ 	if (mt76_is_testmode_skb(dev, skb, &hw)) {
+ 		struct mt76_phy *phy = hw->priv;
+ 
+-		if (tx_info.skb == phy->test.tx_skb)
+-			phy->test.tx_done--;
++		phy->test.tx_done--;
+ 	}
+ #endif
+ 
+diff --git a/mac80211.c b/mac80211.c
+index 31602d7f..49b99f36 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
+ 	CHAN5G(60, 5300),
+ 	CHAN5G(64, 5320),
+ 
++	CHAN5G(68, 5340),
++	CHAN5G(80, 5400),
++	CHAN5G(84, 5420),
++	CHAN5G(88, 5440),
++	CHAN5G(92, 5460),
++	CHAN5G(96, 5480),
++
+ 	CHAN5G(100, 5500),
+ 	CHAN5G(104, 5520),
+ 	CHAN5G(108, 5540),
+@@ -75,6 +82,11 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
+ 	CHAN5G(165, 5825),
+ 	CHAN5G(169, 5845),
+ 	CHAN5G(173, 5865),
++
++	CHAN5G(184, 4920),
++	CHAN5G(188, 4940),
++	CHAN5G(192, 4960),
++	CHAN5G(196, 4980),
+ };
+ 
+ static const struct ieee80211_channel mt76_channels_6ghz[] = {
+diff --git a/mt76.h b/mt76.h
+index 8f6279c5..3d1e893d 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -602,6 +602,21 @@ struct mt76_testmode_ops {
+ 	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
+ 			  enum mt76_testmode_state new_state);
+ 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
++	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
++};
++
++struct mt76_testmode_entry_data {
++	struct sk_buff *tx_skb;
++
++	u16 tx_mpdu_len;
++	u8 tx_rate_idx;
++	u8 tx_rate_nss;
++	u8 tx_rate_ldpc;
++
++	u8 addr[3][ETH_ALEN];
++	u8 aid;
++	u8 ru_alloc;
++	u8 ru_idx;
+ };
+ 
+ #define MT_TM_FW_RX_COUNT	BIT(0)
+@@ -610,16 +625,11 @@ struct mt76_testmode_data {
+ 	enum mt76_testmode_state state;
+ 
+ 	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
+-	struct sk_buff *tx_skb;
+ 
+ 	u32 tx_count;
+-	u16 tx_mpdu_len;
+ 
+ 	u8 tx_rate_mode;
+-	u8 tx_rate_idx;
+-	u8 tx_rate_nss;
+ 	u8 tx_rate_sgi;
+-	u8 tx_rate_ldpc;
+ 	u8 tx_rate_stbc;
+ 	u8 tx_ltf;
+ 
+@@ -635,10 +645,37 @@ struct mt76_testmode_data {
+ 	u8 tx_power[4];
+ 	u8 tx_power_control;
+ 
+-	u8 addr[3][ETH_ALEN];
++	struct list_head tm_entry_list;
++	struct mt76_wcid *cur_entry;
++	u8 entry_num;
++	union {
++		struct mt76_testmode_entry_data ed;
++		struct {
++			/* must be the same as mt76_testmode_entry_data */
++			struct sk_buff *tx_skb;
++
++			u16 tx_mpdu_len;
++			u8 tx_rate_idx;
++			u8 tx_rate_nss;
++			u8 tx_rate_ldpc;
++
++			u8 addr[3][ETH_ALEN];
++			u8 aid;
++			u8 ru_alloc;
++			u8 ru_idx;
++		};
++	};
+ 
+ 	u8 flag;
+ 
++	struct {
++		u8 type;
++		u8 enable;
++	} cfg;
++
++	u8 txbf_act;
++	u16 txbf_param[8];
++
+ 	u32 tx_pending;
+ 	u32 tx_queued;
+ 	u16 tx_queued_limit;
+@@ -1120,14 +1157,69 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+ #endif
+ }
+ 
++#ifdef CONFIG_NL80211_TESTMODE
++static inline struct mt76_wcid *
++mt76_testmode_first_entry(struct mt76_phy *phy)
++{
++	if (list_empty(&phy->test.tm_entry_list) && !phy->test.aid)
++		return &phy->dev->global_wcid;
++
++	return list_first_entry(&phy->test.tm_entry_list,
++				typeof(struct mt76_wcid),
++				list);
++}
++
++static inline struct mt76_testmode_entry_data *
++mt76_testmode_entry_data(struct mt76_phy *phy, struct mt76_wcid *wcid)
++{
++	if (!wcid)
++		return NULL;
++	if (wcid == &phy->dev->global_wcid)
++		return &phy->test.ed;
++
++	return (struct mt76_testmode_entry_data *)((u8 *)wcid +
++						   phy->hw->sta_data_size);
++}
++
++#define mt76_tm_for_each_entry(phy, wcid, ed)				\
++	for (wcid = mt76_testmode_first_entry(phy),			\
++	     ed = mt76_testmode_entry_data(phy, wcid);			\
++	     ((phy->test.aid &&						\
++	       !list_entry_is_head(wcid, &phy->test.tm_entry_list, list)) ||	\
++	      (!phy->test.aid && wcid == &phy->dev->global_wcid)) && ed;	\
++	     wcid = list_next_entry(wcid, list),			\
++	     ed = mt76_testmode_entry_data(phy, wcid))
++#endif
++
++static inline bool __mt76_is_testmode_skb(struct mt76_phy *phy,
++					  struct sk_buff *skb)
++{
++#ifdef CONFIG_NL80211_TESTMODE
++	struct mt76_testmode_entry_data *ed = &phy->test.ed;
++	struct mt76_wcid *wcid;
++
++	if (skb == ed->tx_skb)
++		return true;
++
++	mt76_tm_for_each_entry(phy, wcid, ed)
++		if (skb == ed->tx_skb)
++			return true;
++	return false;
++#else
++	return false;
++#endif
++}
++
+ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+ 					struct sk_buff *skb,
+ 					struct ieee80211_hw **hw)
+ {
+ #ifdef CONFIG_NL80211_TESTMODE
+-	if (skb == dev->phy.test.tx_skb)
++	if (mt76_testmode_enabled(&dev->phy) &&
++	    __mt76_is_testmode_skb(&dev->phy, skb))
+ 		*hw = dev->phy.hw;
+-	else if (dev->phy2 && skb == dev->phy2->test.tx_skb)
++	else if (dev->phy2 && mt76_testmode_enabled(dev->phy2) &&
++		 __mt76_is_testmode_skb(dev->phy2, skb))
+ 		*hw = dev->phy2->hw;
+ 	else
+ 		return false;
+@@ -1227,7 +1319,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
+ 		       struct netlink_callback *cb, void *data, int len);
+ int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
+-int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
++int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len,
++			   struct sk_buff **tx_skb, u8 (*addr)[ETH_ALEN]);
+ 
+ static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
+ {
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 4e495d4f..ebb78d33 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -389,6 +389,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+ 	switch (vif->type) {
+ 	case NL80211_IFTYPE_MESH_POINT:
+ 	case NL80211_IFTYPE_AP:
++	case NL80211_IFTYPE_MONITOR:
+ 		if (vif->p2p)
+ 			conn_type = CONNECTION_P2P_GC;
+ 		else
+@@ -570,6 +571,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+ 	rx->rca2 = 1;
+ 	rx->rv = 1;
+ 
++	if (vif->type == NL80211_IFTYPE_MONITOR)
++		rx->rca1 = 0;
++
+ 	if (!is_connac_v1(dev))
+ 		return;
+ 
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 82498039..a3bbf5ca 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -816,6 +816,7 @@ enum {
+ 	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
+ 	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
+ 	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
++	MCU_EXT_EVENT_BF_STATUS_READ = 0x35,
+ 	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
+ 	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
+ 	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
+@@ -993,6 +994,7 @@ enum {
+ 	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
+ 	/* for vendor csi and air monitor */
+ 	MCU_EXT_CMD_SMESH_CTRL = 0xae,
++	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
+ 	MCU_EXT_CMD_CERT_CFG = 0xb7,
+ 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ };
+diff --git a/mt7915/init.c b/mt7915/init.c
+index e4f6617f..25a9b5de 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -573,7 +573,7 @@ static void mt7915_init_work(struct work_struct *work)
+ 	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
+ 				 init_work);
+ 
+-	mt7915_mcu_set_eeprom(dev);
++	mt7915_mcu_set_eeprom(dev, dev->flash_mode);
+ 	mt7915_mac_init(dev);
+ 	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
+ 	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index ffb0037b..12afb204 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -914,17 +914,39 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ {
+ #ifdef CONFIG_NL80211_TESTMODE
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_testmode_entry_data *ed;
++	struct mt76_wcid *wcid;
+ 	const struct ieee80211_rate *r;
+-	u8 bw, mode, nss = td->tx_rate_nss;
+-	u8 rate_idx = td->tx_rate_idx;
++	u8 bw, mode, nss, rate_idx, ldpc;
+ 	u16 rateval = 0;
+ 	u32 val;
+ 	bool cck = false;
+ 	int band;
+ 
+-	if (skb != phy->mt76->test.tx_skb)
++	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
++	txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
++					  phy->test.spe_idx));
++
++	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU) {
++		txwi[1] |= cpu_to_le32(BIT(18));
++		txwi[2] = 0;
++		txwi[3] &= ~cpu_to_le32(MT_TXD3_NO_ACK);
++		le32p_replace_bits(&txwi[3], 0x1f, MT_TXD3_REM_TX_COUNT);
++
++		return;
++	}
++
++	mt76_tm_for_each_entry(phy->mt76, wcid, ed)
++		if (ed->tx_skb == skb)
++			break;
++
++	if (!ed)
+ 		return;
+ 
++	nss = ed->tx_rate_nss;
++	rate_idx = ed->tx_rate_idx;
++	ldpc = ed->tx_rate_ldpc;
++
+ 	switch (td->tx_rate_mode) {
+ 	case MT76_TM_TX_MODE_HT:
+ 		nss = 1 + (rate_idx >> 3);
+@@ -1013,14 +1035,13 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ 	if (mode >= MT_PHY_TYPE_HE_SU)
+ 		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
+ 
+-	if (td->tx_rate_ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
++	if (ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
+ 		val |= MT_TXD6_LDPC;
+ 
+-	txwi[1] &= ~cpu_to_le32(MT_TXD1_VTA);
+-	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
++	if (phy->test.bf_en)
++		val |= MT_TXD6_TX_IBF | MT_TXD6_TX_EBF;
++
+ 	txwi[6] |= cpu_to_le32(val);
+-	txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
+-					  phy->test.spe_idx));
+ #endif
+ }
+ 
+diff --git a/mt7915/main.c b/mt7915/main.c
+index f2a6d9da..942b8a9a 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -221,7 +221,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	mvif->phy = phy;
+ 	mvif->mt76.band_idx = phy->band_idx;
+ 
+-	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
++	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP && vif->type != NL80211_IFTYPE_MONITOR);
+ 	if (ext_phy)
+ 		mvif->mt76.wmm_idx += 2;
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 8a3bd33f..8ed8700d 100755
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -360,7 +360,6 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 	if (mcu_txd->ext_cid) {
+ 		mcu_txd->ext_cid_ack = 1;
+ 
+-		/* do not use Q_SET for efuse */
+ 		if (cmd & __MCU_CMD_FIELD_QUERY)
+ 			mcu_txd->set_query = MCU_Q_QUERY;
+ 		else
+@@ -536,6 +535,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	case MCU_EXT_EVENT_BCC_NOTIFY:
+ 		mt7915_mcu_rx_bcc_notify(dev, skb);
+ 		break;
++#ifdef CONFIG_NL80211_TESTMODE
++	case MCU_EXT_EVENT_BF_STATUS_READ:
++		mt7915_tm_txbf_status_read(dev, skb);
++		break;
++#endif
+ 	default:
+ 		break;
+ 	}
+@@ -565,6 +569,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
+ 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
+ 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
++	    rxd->ext_eid == MCU_EXT_EVENT_BF_STATUS_READ ||
+ 	    !rxd->seq)
+ 		mt7915_mcu_rx_unsolicited_event(dev, skb);
+ 	else
+@@ -3030,14 +3035,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+ 	return 0;
+ }
+ 
+-int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
++int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+ {
+ 	struct mt7915_mcu_eeprom req = {
+ 		.buffer_mode = EE_MODE_EFUSE,
+ 		.format = EE_FORMAT_WHOLE,
+ 	};
+ 
+-	if (dev->flash_mode)
++	if (flash_mode)
+ 		return mt7915_mcu_set_eeprom_flash(dev);
+ 
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index adf71f10..82c21168 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -27,10 +27,15 @@ struct mt7915_mcu_txd {
+ 
+ enum {
+ 	MCU_ATE_SET_TRX = 0x1,
++	MCU_ATE_SET_TSSI = 0x5,
++	MCU_ATE_SET_DPD = 0x6,
++	MCU_ATE_SET_RATE_POWER_OFFSET = 0x7,
++	MCU_ATE_SET_THERMAL_COMP = 0x8,
+ 	MCU_ATE_SET_FREQ_OFFSET = 0xa,
+ 	MCU_ATE_SET_PHY_COUNT = 0x11,
+ 	MCU_ATE_SET_SLOT_TIME = 0x13,
+ 	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
++	MCU_ATE_SET_MU_RX_AID = 0x1e,
+ };
+ 
+ struct mt7915_mcu_rxd {
+@@ -455,6 +460,12 @@ enum {
+ 
+ enum {
+ 	MT_BF_SOUNDING_ON = 1,
++	MT_BF_DATA_PACKET_APPLY = 2,
++	MT_BF_PFMU_TAG_READ = 5,
++	MT_BF_PFMU_TAG_WRITE = 6,
++	MT_BF_PHASE_CAL = 14,
++	MT_BF_IBF_PHASE_COMP = 15,
++	MT_BF_PROFILE_WRITE_ALL = 17,
+ 	MT_BF_TYPE_UPDATE = 20,
+ 	MT_BF_MODULE_UPDATE = 25
+ };
+@@ -681,12 +692,20 @@ struct mt7915_muru {
+ #define MURU_OFDMA_SCH_TYPE_DL          BIT(0)
+ #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
+ 
+-/* Common Config */
+-#define MURU_COMM_PPDU_FMT              BIT(0)
+-#define MURU_COMM_SCH_TYPE              BIT(1)
+-#define MURU_COMM_SET                   (MURU_COMM_PPDU_FMT | MURU_COMM_SCH_TYPE)
+-
+-/* DL&UL User config*/
++/* Common Config */ 
++/* #define MURU_COMM_PPDU_FMT              BIT(0) */
++/* #define MURU_COMM_SCH_TYPE              BIT(1) */
++/* #define MURU_COMM_SET                   (MURU_COMM_PPDU_FMT | MURU_COMM_SCH_TYPE) */
++#define MURU_COMM_PPDU_FMT		BIT(0)
++#define MURU_COMM_SCH_TYPE		BIT(1)
++#define MURU_COMM_BAND			BIT(2)
++#define MURU_COMM_WMM			BIT(3)
++#define MURU_COMM_SPE_IDX		BIT(4)
++#define MURU_COMM_PROC_TYPE		BIT(5)
++#define MURU_COMM_SET		(MURU_COMM_PPDU_FMT | MURU_COMM_BAND | \
++				 MURU_COMM_WMM | MURU_COMM_SPE_IDX)
++
++/* DL&UL User config */
+ #define MURU_USER_CNT                   BIT(4)
+ 
+ enum {
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index b3de3a7a..bbf8b16c 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -73,6 +73,7 @@ static const u32 mt7915_offs[] = {
+ 	[ARB_DRNGR0]		= 0x194,
+ 	[ARB_SCR]		= 0x080,
+ 	[RMAC_MIB_AIRTIME14]	= 0x3b8,
++	[AGG_AALCR0]		= 0x048,
+ 	[AGG_AWSCR0]		= 0x05c,
+ 	[AGG_PCR0]		= 0x06c,
+ 	[AGG_ACR0]		= 0x084,
+@@ -147,6 +148,7 @@ static const u32 mt7916_offs[] = {
+ 	[ARB_DRNGR0]		= 0x1e0,
+ 	[ARB_SCR]		= 0x000,
+ 	[RMAC_MIB_AIRTIME14]	= 0x0398,
++	[AGG_AALCR0]		= 0x028,
+ 	[AGG_AWSCR0]		= 0x030,
+ 	[AGG_PCR0]		= 0x040,
+ 	[AGG_ACR0]		= 0x054,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index cf0630c8..4b375629 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -294,6 +294,9 @@ struct mt7915_phy {
+ 		u8 last_snr;
+ 
+ 		u8 spe_idx;
++
++		bool bf_en;
++		bool bf_ever_en;
+ 	} test;
+ #endif
+ 
+@@ -382,6 +385,14 @@ struct mt7915_dev {
+ 	void __iomem *dcm;
+ 	void __iomem *sku;
+ 
++#ifdef CONFIG_NL80211_TESTMODE
++	struct {
++		void *txbf_phase_cal;
++		void *txbf_pfmu_data;
++		void *txbf_pfmu_tag;
++	} test;
++#endif
++
+ #ifdef MTK_DEBUG
+ 	u16 wlan_idx;
+ 	struct {
+@@ -572,7 +583,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+ 				   struct ieee80211_vif *vif,
+ 				   struct ieee80211_sta *sta,
+ 				   void *data, u32 field);
+-int mt7915_mcu_set_eeprom(struct mt7915_dev *dev);
++int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
+ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
+ int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
+ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -605,6 +616,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_exit(struct mt7915_dev *dev);
++int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
+ 
+ static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
+ {
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 99834310..6ba5e9fe 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -50,6 +50,7 @@ enum offs_rev {
+ 	ARB_DRNGR0,
+ 	ARB_SCR,
+ 	RMAC_MIB_AIRTIME14,
++	AGG_AALCR0,
+ 	AGG_AWSCR0,
+ 	AGG_PCR0,
+ 	AGG_ACR0,
+@@ -458,6 +459,8 @@ enum offs_rev {
+ #define MT_WF_AGG_BASE(_band)		((_band) ? 0x820f2000 : 0x820e2000)
+ #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
+ 
++#define MT_AGG_AALCR0(_band, _n)	MT_WF_AGG(_band, (__OFFS(AGG_AALCR0) +	\
++			                                  (_n) * 4))
+ #define MT_AGG_AWSCR0(_band, _n)	MT_WF_AGG(_band, (__OFFS(AGG_AWSCR0) +	\
+ 							  (_n) * 4))
+ #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index e8bf616c..16c9e4ae 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -9,6 +9,9 @@
+ enum {
+ 	TM_CHANGED_TXPOWER,
+ 	TM_CHANGED_FREQ_OFFSET,
++	TM_CHANGED_AID,
++	TM_CHANGED_CFG,
++	TM_CHANGED_TXBF_ACT,
+ 
+ 	/* must be last */
+ 	NUM_TM_CHANGED
+@@ -17,6 +20,9 @@ enum {
+ static const u8 tm_change_map[] = {
+ 	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
+ 	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
++	[TM_CHANGED_AID] = MT76_TM_ATTR_AID,
++	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
++	[TM_CHANGED_TXBF_ACT] = MT76_TM_ATTR_TXBF_ACT,
+ };
+ 
+ struct reg_band {
+@@ -33,6 +39,38 @@ struct reg_band {
+ #define TM_REG_MAX_ID	20
+ static struct reg_band reg_backup_list[TM_REG_MAX_ID];
+ 
++static void mt7915_tm_update_entry(struct mt7915_phy *phy);
++
++static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
++{
++	static const u8 width_to_bw[] = {
++		[NL80211_CHAN_WIDTH_40] = TM_CBW_40MHZ,
++		[NL80211_CHAN_WIDTH_80] = TM_CBW_80MHZ,
++		[NL80211_CHAN_WIDTH_80P80] = TM_CBW_8080MHZ,
++		[NL80211_CHAN_WIDTH_160] = TM_CBW_160MHZ,
++		[NL80211_CHAN_WIDTH_5] = TM_CBW_5MHZ,
++		[NL80211_CHAN_WIDTH_10] = TM_CBW_10MHZ,
++		[NL80211_CHAN_WIDTH_20] = TM_CBW_20MHZ,
++		[NL80211_CHAN_WIDTH_20_NOHT] = TM_CBW_20MHZ,
++	};
++
++	if (width >= ARRAY_SIZE(width_to_bw))
++		return 0;
++
++	return width_to_bw[width];
++}
++
++static void
++mt7915_tm_update_channel(struct mt7915_phy *phy)
++{
++	mutex_unlock(&phy->dev->mt76.mutex);
++	mt7915_set_channel(phy);
++	mutex_lock(&phy->dev->mt76.mutex);
++
++	mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(SET_RX_PATH));
++
++	mt7915_tm_update_entry(phy);
++}
+ 
+ static int
+ mt7915_tm_set_tx_power(struct mt7915_phy *phy)
+@@ -119,18 +157,28 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
+ }
+ 
+ static int
+-mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
++mt7915_tm_clean_hwq(struct mt7915_phy *phy)
+ {
++	struct mt76_testmode_entry_data *ed;
++	struct mt76_wcid *wcid;
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt7915_tm_cmd req = {
+ 		.testmode_en = 1,
+ 		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
+-		.param.clean.wcid = wcid,
+ 		.param.clean.band = phy != &dev->phy,
+ 	};
+ 
+-	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
+-				 sizeof(req), false);
++	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++		int ret;
++
++		req.param.clean.wcid = wcid->idx;
++		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
++					&req, sizeof(req), false);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
+ }
+ 
+ static int
+@@ -182,11 +230,737 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
+ 	return mt7915_mcu_set_muru_ctrl(dev, MURU_SET_ARB_OP_MODE, op_mode);
+ }
+ 
++static int
++mt7915_tm_set_cfg(struct mt7915_phy *phy)
++{
++	static const u8 cfg_cmd[] = {
++		[MT76_TM_CFG_TSSI] = MCU_ATE_SET_TSSI,
++		[MT76_TM_CFG_DPD] = MCU_ATE_SET_DPD,
++		[MT76_TM_CFG_RATE_POWER_OFFSET] = MCU_ATE_SET_RATE_POWER_OFFSET,
++		[MT76_TM_CFG_THERMAL_COMP] = MCU_ATE_SET_THERMAL_COMP,
++	};
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_tm_cmd req = {
++		.testmode_en = !(phy->mt76->test.state == MT76_TM_STATE_OFF),
++		.param_idx = cfg_cmd[td->cfg.type],
++		.param.cfg.enable = td->cfg.enable,
++		.param.cfg.band = phy->band_idx,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
++				 sizeof(req), false);
++}
++
++static int
++mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
++		   struct ieee80211_sta *sta, u8 pfmu_idx, u8 nr,
++		   u8 nc, bool ebf)
++{
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
++	struct mt7915_dev *dev = phy->dev;
++	struct sk_buff *skb;
++	struct sta_rec_bf *bf;
++	struct tlv *tlv;
++	u8 ndp_rate;
++
++	if (nr == 1)
++		ndp_rate = 8;
++	else if (nr == 2)
++		ndp_rate = 16;
++	else
++		ndp_rate = 24;
++
++	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
++					    &msta->wcid);
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
++	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
++	bf = (struct sta_rec_bf *)tlv;
++
++	bf->pfmu = cpu_to_le16(pfmu_idx);
++	bf->sounding_phy = 1;
++	bf->bf_cap = ebf;
++	bf->ncol = nc;
++	bf->nrow = nr;
++	bf->ndp_rate = ndp_rate;
++	bf->ibf_timeout = 0xff;
++	bf->tx_mode = MT_PHY_TYPE_HT;
++
++	if (ebf) {
++		bf->mem[0].row = 0;
++		bf->mem[1].row = 1;
++		bf->mem[2].row = 2;
++		bf->mem[3].row = 3;
++	} else {
++		bf->mem[0].row = 4;
++		bf->mem[1].row = 5;
++		bf->mem[2].row = 6;
++		bf->mem[3].row = 7;
++	}
++
++	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				     MCU_EXT_CMD(STA_REC_UPDATE), true);
++}
++
++static int
++mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_testmode_entry_data *ed;
++	struct ieee80211_sband_iftype_data *sdata;
++	struct ieee80211_supported_band *sband;
++	struct ieee80211_sta *sta;
++	struct mt7915_sta *msta;
++	int tid, ret;
++
++	if (td->entry_num >= MT76_TM_MAX_ENTRY_NUM)
++		return -EINVAL;
++
++	sta = kzalloc(sizeof(*sta) + phy->mt76->hw->sta_data_size +
++		      sizeof(*ed), GFP_KERNEL);
++	if (!sta)
++		return -ENOMEM;
++
++	msta = (struct mt7915_sta *)sta->drv_priv;
++	ed = mt76_testmode_entry_data(phy->mt76, &msta->wcid);
++	memcpy(ed, &td->ed, sizeof(*ed));
++
++	if (phy->mt76->chandef.chan->band == NL80211_BAND_5GHZ) {
++		sband = &phy->mt76->sband_5g.sband;
++		sdata = phy->iftype[NL80211_BAND_5GHZ];
++	} else if (phy->mt76->chandef.chan->band == NL80211_BAND_6GHZ) {
++		sband = &phy->mt76->sband_6g.sband;
++		sdata = phy->iftype[NL80211_BAND_6GHZ];
++	} else {
++		sband = &phy->mt76->sband_2g.sband;
++		sdata = phy->iftype[NL80211_BAND_2GHZ];
++	}
++
++	memcpy(sta->addr, ed->addr[0], ETH_ALEN);
++	if (phy->test.bf_en) {
++		u8 addr[ETH_ALEN] = {0x00, 0x11, 0x11, 0x11, 0x11, 0x11};
++
++		memcpy(sta->addr, addr, ETH_ALEN);
++	}
++
++	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
++		memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
++	if (td->tx_rate_mode >= MT76_TM_TX_MODE_VHT)
++		memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
++	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_SU)
++		memcpy(&sta->he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
++		       sizeof(sta->he_cap));
++	sta->aid = aid;
++	sta->wme = 1;
++
++	ret = mt7915_mac_sta_add(&phy->dev->mt76, phy->monitor_vif, sta);
++	if (ret) {
++		kfree(sta);
++		return ret;
++	}
++
++	/* prevent from starting tx ba session */
++	for (tid = 0; tid < 8; tid++)
++		set_bit(tid, &msta->ampdu_state);
++
++	list_add_tail(&msta->wcid.list, &td->tm_entry_list);
++	td->entry_num++;
++
++	return 0;
++}
++
++static void
++mt7915_tm_entry_remove(struct mt7915_phy *phy, u8 aid)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_wcid *wcid, *tmp;
++
++	if (list_empty(&td->tm_entry_list))
++		return;
++
++	list_for_each_entry_safe(wcid, tmp, &td->tm_entry_list, list) {
++		struct mt76_testmode_entry_data *ed;
++		struct mt7915_dev *dev = phy->dev;
++		struct ieee80211_sta *sta;
++
++		ed = mt76_testmode_entry_data(phy->mt76, wcid);
++		if (aid && ed->aid != aid)
++			continue;
++
++		sta = wcid_to_sta(wcid);
++		mt7915_mac_sta_remove(&dev->mt76, phy->monitor_vif, sta);
++		mt76_wcid_mask_clear(dev->mt76.wcid_mask, wcid->idx);
++
++		list_del_init(&wcid->list);
++		kfree(sta);
++		phy->mt76->test.entry_num--;
++	}
++}
++
++static int
++mt7915_tm_set_entry(struct mt7915_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_testmode_entry_data *ed;
++	struct mt76_wcid *wcid;
++
++	if (!td->aid) {
++		if (td->state > MT76_TM_STATE_IDLE)
++			mt76_testmode_set_state(phy->mt76, MT76_TM_STATE_IDLE);
++		mt7915_tm_entry_remove(phy, td->aid);
++		return 0;
++	}
++
++	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++		if (ed->aid == td->aid) {
++			struct sk_buff *skb;
++
++			local_bh_disable();
++			skb = ed->tx_skb;
++			memcpy(ed, &td->ed, sizeof(*ed));
++			ed->tx_skb = skb;
++			local_bh_enable();
++
++			return 0;
++		}
++	}
++
++	return mt7915_tm_entry_add(phy, td->aid);
++}
++
++static void
++mt7915_tm_update_entry(struct mt7915_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_testmode_entry_data *ed, tmp;
++	struct mt76_wcid *wcid, *last;
++
++	if (!td->aid || phy->test.bf_en)
++		return;
++
++	memcpy(&tmp, &td->ed, sizeof(tmp));
++	last = list_last_entry(&td->tm_entry_list,
++			       struct mt76_wcid, list);
++
++	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++		memcpy(&td->ed, ed, sizeof(td->ed));
++		mt7915_tm_entry_remove(phy, td->aid);
++		mt7915_tm_entry_add(phy, td->aid);
++		if (wcid == last)
++			break;
++	}
++
++	memcpy(&td->ed, &tmp, sizeof(td->ed));
++}
++
++static int
++mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_dev *dev = phy->dev;
++	bool enable = val[0];
++	void *phase_cal, *pfmu_data, *pfmu_tag;
++	u8 addr[ETH_ALEN] = {0x00, 0x22, 0x22, 0x22, 0x22, 0x22};
++
++	if (!enable) {
++		phy->test.bf_en = 0;
++		return 0;
++	}
++
++	if (!dev->test.txbf_phase_cal) {
++		phase_cal = devm_kzalloc(dev->mt76.dev,
++					 sizeof(struct mt7915_tm_txbf_phase) *
++					 MAX_PHASE_GROUP_NUM,
++					 GFP_KERNEL);
++		if (!phase_cal)
++			return -ENOMEM;
++
++		dev->test.txbf_phase_cal = phase_cal;
++	}
++
++	if (!dev->test.txbf_pfmu_data) {
++		pfmu_data = devm_kzalloc(dev->mt76.dev, 512, GFP_KERNEL);
++		if (!pfmu_data)
++			return -ENOMEM;
++
++		dev->test.txbf_pfmu_data = pfmu_data;
++	}
++
++	if (!dev->test.txbf_pfmu_tag) {
++		pfmu_tag = devm_kzalloc(dev->mt76.dev,
++					sizeof(struct mt7915_tm_pfmu_tag), GFP_KERNEL);
++		if (!pfmu_tag)
++			return -ENOMEM;
++
++		dev->test.txbf_pfmu_tag = pfmu_tag;
++	}
++
++	memcpy(phy->monitor_vif->addr, addr, ETH_ALEN);
++	mt7915_mcu_add_dev_info(phy, phy->monitor_vif, true);
++
++	td->tx_rate_mode = MT76_TM_TX_MODE_HT;
++	td->tx_mpdu_len = 1024;
++	td->tx_rate_sgi = 0;
++	td->tx_ipg = 100;
++	phy->test.bf_en = 1;
++
++	return mt7915_tm_set_trx(phy, TM_MAC_TX, true);
++}
++
++static int
++mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 category;
++		u8 wlan_idx_lo;
++		u8 bw;
++		u8 jp_band;
++		u8 dbdc_idx;
++		bool read_from_e2p;
++		bool disable;
++		u8 wlan_idx_hi;
++		u8 buf[40];
++	} __packed req = {
++		.category = MT_BF_IBF_PHASE_COMP,
++		.bw = val[0],
++		.jp_band = (val[2] == 1) ? 1 : 0,
++		.dbdc_idx = phy->band_idx,
++		.read_from_e2p = val[3],
++		.disable = val[4],
++	};
++	struct mt7915_tm_txbf_phase *phase =
++		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++
++	wait_event_timeout(dev->mt76.tx_wait, phase[val[2]].status != 0, HZ);
++	memcpy(req.buf, &phase[val[2]].phase, sizeof(req.buf));
++
++	pr_info("ibf cal process: phase comp info\n");
++	print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, 16, 1,
++		       &req, sizeof(req), 0);
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), true);
++}
++
++static int
++mt7915_tm_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 format_id;
++		u8 pfmu_idx;
++		bool bfer;
++		u8 dbdc_idx;
++	} __packed req = {
++		.format_id = MT_BF_PFMU_TAG_READ,
++		.pfmu_idx = pfmu_idx,
++		.bfer = 1,
++		.dbdc_idx = phy != &dev->phy,
++	};
++	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++
++	tag->t1.pfmu_idx = 0;
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), true);
++}
++
++static int
++mt7915_tm_txbf_profile_tag_write(struct mt7915_phy *phy, u8 pfmu_idx,
++				 struct mt7915_tm_pfmu_tag *tag)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 format_id;
++		u8 pfmu_idx;
++		bool bfer;
++		u8 dbdc_idx;
++		u8 buf[64];
++	} __packed req = {
++		.format_id = MT_BF_PFMU_TAG_WRITE,
++		.pfmu_idx = pfmu_idx,
++		.bfer = 1,
++		.dbdc_idx = phy != &dev->phy,
++	};
++
++	memcpy(req.buf, tag, sizeof(*tag));
++	wait_event_timeout(dev->mt76.tx_wait, tag->t1.pfmu_idx != 0, HZ);
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), false);
++}
++
++static int
++mt7915_tm_txbf_apply_tx(struct mt7915_phy *phy, u16 wlan_idx, bool ebf,
++			bool ibf, bool phase_cal)
++{
++#define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
++#define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 category;
++		u8 wlan_idx_lo;
++		bool ebf;
++		bool ibf;
++		bool mu_txbf;
++		bool phase_cal;
++		u8 wlan_idx_hi;
++		u8 _rsv;
++	} __packed req = {
++		.category = MT_BF_DATA_PACKET_APPLY,
++		.wlan_idx_lo = to_wcid_lo(wlan_idx),
++		.ebf = ebf,
++		.ibf = ibf,
++		.phase_cal = phase_cal,
++		.wlan_idx_hi = to_wcid_hi(wlan_idx),
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), false);
++}
++
++static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
++				   struct mt76_wcid *wcid)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_testmode_entry_data *ed = mt76_testmode_entry_data(phy->mt76, wcid);
++	struct ieee80211_sta *sta = wcid_to_sta(wcid);
++	struct sta_phy rate = {};
++
++	if (!sta)
++		return 0;
++
++	rate.type = MT_PHY_TYPE_HT;
++	rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
++	rate.nss = ed->tx_rate_nss;
++	rate.mcs = ed->tx_rate_idx;
++	rate.ldpc = (rate.bw || ed->tx_rate_ldpc) * GENMASK(2, 0);
++
++	return mt7915_mcu_set_fixed_rate_ctrl(dev, phy->monitor_vif, sta,
++					      &rate, RATE_PARAM_FIXED);
++}
++
++static int
++mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
++{
++	bool bf_on = val[0], update = val[3];
++	/* u16 wlan_idx = val[2]; */
++	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_wcid *wcid;
++
++	if (bf_on) {
++		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
++		mt7915_tm_txbf_profile_tag_read(phy, 2);
++		tag->t1.invalid_prof = false;
++		mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
++
++		phy->test.bf_ever_en = true;
++
++		if (update)
++			mt7915_tm_txbf_apply_tx(phy, 1, 0, 1, 1);
++	} else {
++		if (!phy->test.bf_ever_en) {
++			if (update)
++				mt7915_tm_txbf_apply_tx(phy, 1, 0, 0, 0);
++		} else {
++			phy->test.bf_ever_en = false;
++
++			mt7915_tm_txbf_profile_tag_read(phy, 2);
++			tag->t1.invalid_prof = true;
++			mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
++		}
++	}
++
++	wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
++	mt7915_tm_txbf_set_rate(phy, wcid);
++
++	return 0;
++}
++
++static int
++mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
++{
++	static const u8 mode_to_lm[] = {
++		[MT76_TM_TX_MODE_CCK] = 0,
++		[MT76_TM_TX_MODE_OFDM] = 0,
++		[MT76_TM_TX_MODE_HT] = 1,
++		[MT76_TM_TX_MODE_VHT] = 2,
++		[MT76_TM_TX_MODE_HE_SU] = 3,
++		[MT76_TM_TX_MODE_HE_EXT_SU] = 3,
++		[MT76_TM_TX_MODE_HE_TB] = 3,
++		[MT76_TM_TX_MODE_HE_MU] = 3,
++	};
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_wcid *wcid;
++	struct ieee80211_vif *vif = phy->monitor_vif;
++	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	u8 pfmu_idx = val[0], nc = val[2], nr;
++	int ret;
++
++	if (td->tx_antenna_mask == 3)
++		nr = 1;
++	else if (td->tx_antenna_mask == 7)
++		nr = 2;
++	else
++		nr = 3;
++
++	memset(tag, 0, sizeof(*tag));
++	tag->t1.pfmu_idx = pfmu_idx;
++	tag->t1.ebf = ebf;
++	tag->t1.nr = nr;
++	tag->t1.nc = nc;
++	tag->t1.invalid_prof = true;
++
++	tag->t1.snr_sts4 = 0xc0;
++	tag->t1.snr_sts5 = 0xff;
++	tag->t1.snr_sts6 = 0xff;
++	tag->t1.snr_sts7 = 0xff;
++
++	if (ebf) {
++		tag->t1.row_id1 = 0;
++		tag->t1.row_id2 = 1;
++		tag->t1.row_id3 = 2;
++		tag->t1.row_id4 = 3;
++		tag->t1.lm = mode_to_lm[MT76_TM_TX_MODE_HT];
++	} else {
++		tag->t1.row_id1 = 4;
++		tag->t1.row_id2 = 5;
++		tag->t1.row_id3 = 6;
++		tag->t1.row_id4 = 7;
++		tag->t1.lm = mode_to_lm[MT76_TM_TX_MODE_OFDM];
++
++		tag->t2.ibf_timeout = 0xff;
++		tag->t2.ibf_nr = nr;
++	}
++
++	ret = mt7915_tm_txbf_profile_tag_write(phy, pfmu_idx, tag);
++	if (ret)
++		return ret;
++
++	wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
++	ret = mt7915_tm_add_txbf(phy, vif, wcid_to_sta(wcid), pfmu_idx, nr, nc, ebf);
++	if (ret)
++		return ret;
++
++	if (!ebf)
++		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
++
++	return 0;
++}
++
++static int
++mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
++{
++#define GROUP_L		0
++#define GROUP_M		1
++#define GROUP_H		2
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 category;
++		u8 group_l_m_n;
++		u8 group;
++		bool sx2;
++		u8 cal_type;
++		u8 lna_gain_level;
++		u8 _rsv[2];
++	} __packed req = {
++		.category = MT_BF_PHASE_CAL,
++		.group = val[0],
++		.group_l_m_n = val[1],
++		.sx2 = val[2],
++		.cal_type = val[3],
++		.lna_gain_level = 0, /* for test purpose */
++	};
++	struct mt7915_tm_txbf_phase *phase =
++		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++
++	phase[req.group].status = 0;
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), true);
++}
++
++int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++#define BF_PFMU_TAG	16
++#define BF_CAL_PHASE	21
++	u8 format_id;
++
++	skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
++	format_id = *(u8 *)skb->data;
++
++	if (format_id == BF_PFMU_TAG) {
++		struct mt7915_tm_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
++
++		skb_pull(skb, 8);
++		memcpy(tag, skb->data, sizeof(struct mt7915_tm_pfmu_tag));
++	} else if (format_id == BF_CAL_PHASE) {
++		struct mt7915_tm_ibf_cal_info *cal;
++		struct mt7915_tm_txbf_phase *phase =
++			(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++
++		cal = (struct mt7915_tm_ibf_cal_info *)skb->data;
++		switch (cal->cal_type) {
++		case IBF_PHASE_CAL_NORMAL:
++		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
++			if (cal->group_l_m_n != GROUP_M)
++				break;
++			phase = &phase[cal->group];
++			memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
++			phase->status = cal->status;
++			break;
++		case IBF_PHASE_CAL_VERIFY:
++		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
++			break;
++		default:
++			break;
++		}
++	}
++
++	wake_up(&dev->mt76.tx_wait);
++
++	return 0;
++}
++
++static int
++mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	u16 pfmu_idx = val[0];
++	u16 subc_id = val[1];
++	u16 angle11 = val[2];
++	u16 angle21 = val[3];
++	u16 angle31 = val[4];
++	u16 angle41 = val[5];
++	s16 phi11 = 0, phi21 = 0, phi31 = 0;
++	struct mt7915_tm_pfmu_data *pfmu_data;
++
++	if (subc_id > 63)
++		return -EINVAL;
++
++	if (td->tx_antenna_mask == 2) {
++		phi11 = (s16)(angle21 - angle11);
++	} else if (td->tx_antenna_mask == 3) {
++		phi11 = (s16)(angle31 - angle11);
++		phi21 = (s16)(angle31 - angle21);
++	} else {
++		phi11 = (s16)(angle41 - angle11);
++		phi21 = (s16)(angle41 - angle21);
++		phi31 = (s16)(angle41 - angle31);
++	}
++
++	pfmu_data = (struct mt7915_tm_pfmu_data *)phy->dev->test.txbf_pfmu_data;
++	pfmu_data = &pfmu_data[subc_id];
++
++	if (subc_id < 32)
++		pfmu_data->subc_idx = cpu_to_le16(subc_id + 224);
++	else
++		pfmu_data->subc_idx = cpu_to_le16(subc_id - 32);
++	pfmu_data->phi11 = cpu_to_le16(phi11);
++	pfmu_data->phi21 = cpu_to_le16(phi21);
++	pfmu_data->phi31 = cpu_to_le16(phi31);
++
++	if (subc_id == 63) {
++		struct mt7915_dev *dev = phy->dev;
++		struct {
++			u8 format_id;
++			u8 pfmu_idx;
++			u8 dbdc_idx;
++			u8 _rsv;
++			u8 buf[512];
++		} __packed req = {
++			.format_id = MT_BF_PROFILE_WRITE_ALL,
++			.pfmu_idx = pfmu_idx,
++			.dbdc_idx = phy != &dev->phy,
++		};
++
++		memcpy(req.buf, dev->test.txbf_pfmu_data, 512);
++
++		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
++					 &req, sizeof(req), true);
++	}
++
++	return 0;
++}
++
++static int
++mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
++{
++	struct mt7915_tm_txbf_phase *phase, *p;
++	struct mt7915_dev *dev = phy->dev;
++	u8 *eeprom = dev->mt76.eeprom.data;
++	u16 offset;
++	bool is_7976;
++	int i;
++
++	is_7976 = mt7915_check_adie(dev, false) || is_mt7916(&dev->mt76);
++	offset = is_7976 ? 0x60a : 0x651;
++
++	phase = (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	for (i = 0; i < MAX_PHASE_GROUP_NUM; i++) {
++		p = &phase[i];
++
++		if (!p->status)
++			continue;
++
++		/* copy phase cal data to eeprom */
++		memcpy(eeprom + offset + i * sizeof(p->phase), &p->phase,
++		       sizeof(p->phase));
++	}
++
++	return 0;
++}
++
++static int
++mt7915_tm_set_txbf(struct mt7915_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	u16 *val = td->txbf_param;
++
++	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u\n",
++		td->txbf_act, val[0], val[1], val[2], val[3], val[4]);
++
++	switch (td->txbf_act) {
++	case MT76_TM_TXBF_ACT_INIT:
++		return mt7915_tm_txbf_init(phy, val);
++	case MT76_TM_TXBF_ACT_UPDATE_CH:
++		mt7915_tm_update_channel(phy);
++		break;
++	case MT76_TM_TXBF_ACT_PHASE_COMP:
++		return mt7915_tm_txbf_phase_comp(phy, val);
++	case MT76_TM_TXBF_ACT_TX_PREP:
++		return mt7915_tm_txbf_set_tx(phy, val);
++	case MT76_TM_TXBF_ACT_IBF_PROF_UPDATE:
++		return mt7915_tm_txbf_profile_update(phy, val, false);
++	case MT76_TM_TXBF_ACT_EBF_PROF_UPDATE:
++		return mt7915_tm_txbf_profile_update(phy, val, true);
++	case MT76_TM_TXBF_ACT_PHASE_CAL:
++		return mt7915_tm_txbf_phase_cal(phy, val);
++	case MT76_TM_TXBF_ACT_PROF_UPDATE_ALL:
++		return mt7915_tm_txbf_profile_update_all(phy, val);
++	case MT76_TM_TXBF_ACT_E2P_UPDATE:
++		return mt7915_tm_txbf_e2p_update(phy);
++	default:
++		break;
++	};
++
++	return 0;
++}
++
+ static int
+ mt7915_tm_set_wmm_qid(struct mt7915_dev *dev, u8 qid, u8 aifs, u8 cw_min,
+-		      u16 cw_max, u16 txop)
++		      u16 cw_max, u16 txop, u8 tx_cmd)
+ {
+-	struct mt7915_mcu_tx req = { .total = 1 };
++	struct mt7915_mcu_tx req = {
++		.valid = true,
++		.mode = tx_cmd,
++		.total = 1,
++	};
+ 	struct edca *e = &req.edca[0];
+ 
+ 	e->queue = qid;
+@@ -261,7 +1035,8 @@ done:
+ 
+ 	return mt7915_tm_set_wmm_qid(dev,
+ 				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
+-				     aifsn, cw, cw, 0);
++				     aifsn, cw, cw, 0,
++				     mode == MT76_TM_TX_MODE_HE_MU);
+ }
+ 
+ static int
+@@ -337,7 +1112,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+ 	bitrate = cfg80211_calculate_bitrate(&rate);
+ 	tx_len = bitrate * tx_time / 10 / 8;
+ 
+-	ret = mt76_testmode_alloc_skb(phy->mt76, tx_len);
++	ret = mt76_testmode_init_skb(phy->mt76, tx_len, &td->tx_skb, td->addr);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -455,18 +1230,180 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ 
+ 	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
+ 
+-	if (!en)
++	if (!en) {
+ 		mt7915_tm_set_tam_arb(phy, en, 0);
++
++		phy->mt76->test.aid = 0;
++		phy->mt76->test.tx_mpdu_len = 0;
++		phy->test.bf_en = 0;
++		mt7915_tm_set_entry(phy);
++	}
++}
++
++static bool
++mt7915_tm_check_skb(struct mt7915_phy *phy)
++{
++	struct mt76_testmode_entry_data *ed;
++	struct mt76_wcid *wcid;
++
++	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++		struct ieee80211_tx_info *info;
++
++		if (!ed->tx_skb)
++			return false;
++
++		info = IEEE80211_SKB_CB(ed->tx_skb);
++		info->control.vif = phy->monitor_vif;
++	}
++
++	return true;
++}
++
++static int
++mt7915_tm_set_ba(struct mt7915_phy *phy)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_wcid *wcid;
++	struct ieee80211_vif *vif = phy->monitor_vif;
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct ieee80211_ampdu_params params = { .buf_size = 256 };
++
++	list_for_each_entry(wcid, &td->tm_entry_list, list) {
++		int tid, ret;
++
++		params.sta = wcid_to_sta(wcid);
++		for (tid = 0; tid < 8; tid++) {
++			params.tid = tid;
++			ret = mt7915_mcu_add_tx_ba(phy->dev, &params, true);
++			if (ret)
++				return ret;
++		}
++	}
++
++	mt76_wr(dev, MT_AGG_AALCR0(mvif->mt76.band_idx, mvif->mt76.wmm_idx),
++		0x01010101);
++
++	return 0;
++}
++
++static int
++mt7915_tm_set_muru_cfg(struct mt7915_phy *phy, struct mt7915_tm_muru *muru)
++{
++/* #define MURU_SET_MANUAL_CFG	100 */
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		__le32 cmd;
++		struct mt7915_tm_muru muru;
++	} __packed req = {
++		.cmd = cpu_to_le32(MURU_SET_MANUAL_CFG),
++	};
++
++	memcpy(&req.muru, muru, sizeof(struct mt7915_tm_muru));
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++				 sizeof(req), false);
++}
++
++static int
++mt7915_tm_set_muru_dl(struct mt7915_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_testmode_entry_data *ed;
++	struct mt76_wcid *wcid;
++	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
++	struct ieee80211_vif *vif = phy->monitor_vif;
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct mt7915_tm_muru muru = {};
++	struct mt7915_tm_muru_comm *comm = &muru.comm;
++	struct mt7915_tm_muru_dl *dl = &muru.dl;
++	int i;
++
++	comm->ppdu_format = MURU_PPDU_HE_MU;
++	comm->band = mvif->mt76.band_idx;
++	comm->wmm_idx = mvif->mt76.wmm_idx;
++	comm->spe_idx = phy->test.spe_idx;
++
++	dl->bw = mt7915_tm_chan_bw(chandef->width);
++	dl->gi = td->tx_rate_sgi;;
++	dl->ltf = td->tx_ltf;
++	dl->tx_mode = MT_PHY_TYPE_HE_MU;
++
++	for (i = 0; i < sizeof(dl->ru); i++)
++		dl->ru[i] = 0x71;
++
++	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
++		struct mt7915_tm_muru_dl_usr *dl_usr = &dl->usr[dl->user_num];
++
++		dl_usr->wlan_idx = cpu_to_le16(wcid->idx);
++		dl_usr->ru_alloc_seg = ed->aid < 8 ? 0 : 1;
++		dl_usr->ru_idx = ed->ru_idx;
++		dl_usr->mcs = ed->tx_rate_idx;
++		dl_usr->nss = ed->tx_rate_nss - 1;
++		dl_usr->ldpc = ed->tx_rate_ldpc;
++		dl->ru[dl->user_num] = ed->ru_alloc;
++
++		dl->user_num++;
++	}
++
++	muru.cfg_comm = cpu_to_le32(MURU_COMM_SET);
++	muru.cfg_dl = cpu_to_le32(MURU_DL_SET);
++
++	return mt7915_tm_set_muru_cfg(phy, &muru);
++}
++
++static int
++mt7915_tm_set_muru_pkt_cnt(struct mt7915_phy *phy, bool enable, u32 tx_count)
++{
++#define MURU_SET_TX_PKT_CNT 105
++#define MURU_SET_TX_EN 106
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		__le32 cmd;
++		u8 band;
++		u8 enable;
++		u8 _rsv[2];
++		__le32 tx_count;
++	} __packed req = {
++		.band = phy != &dev->phy,
++		.enable = enable,
++		.tx_count = enable ? cpu_to_le32(tx_count) : 0,
++	};
++	int ret;
++
++	req.cmd = enable ? cpu_to_le32(MURU_SET_TX_PKT_CNT) :
++			   cpu_to_le32(MURU_SET_TX_EN);
++
++	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++				sizeof(req), false);
++	if (ret)
++		return ret;
++
++	req.cmd = enable ? cpu_to_le32(MURU_SET_TX_EN) :
++			   cpu_to_le32(MURU_SET_TX_PKT_CNT);
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++				 sizeof(req), false);
+ }
+ 
+ static void
+-mt7915_tm_update_channel(struct mt7915_phy *phy)
++mt7915_tm_tx_frames_mu(struct mt7915_phy *phy, bool enable)
+ {
+-	mutex_unlock(&phy->dev->mt76.mutex);
+-	mt7915_set_channel(phy);
+-	mutex_lock(&phy->dev->mt76.mutex);
++	struct mt76_testmode_data *td = &phy->mt76->test;
+ 
+-	mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(SET_RX_PATH));
++	if (enable) {
++		struct mt7915_dev *dev = phy->dev;
++
++		mt7915_tm_set_ba(phy);
++		mt7915_tm_set_muru_dl(phy);
++		mt76_rr(dev, MT_MIB_DR8(phy != &dev->phy));
++	} else {
++		/* set to zero for counting real tx free num */
++		td->tx_done = 0;
++	}
++
++	mt7915_tm_set_muru_pkt_cnt(phy, enable, td->tx_count);
++	usleep_range(100000, 200000);
+ }
+ 
+ static void
+@@ -475,47 +1412,48 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 	static const u8 spe_idx_map[] = {0, 0, 1, 0, 3, 2, 4, 0,
+ 					 9, 8, 6, 10, 16, 12, 18, 0};
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+-	struct mt7915_dev *dev = phy->dev;
+-	struct ieee80211_tx_info *info;
+-	u8 duty_cycle = td->tx_duty_cycle;
+-	u32 tx_time = td->tx_time;
+-	u32 ipg = td->tx_ipg;
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+-	mt7915_tm_clean_hwq(phy, dev->mt76.global_wcid.idx);
++	mt7915_tm_set_trx(phy, TM_MAC_TX, false);
+ 
+ 	if (en) {
+-		mt7915_tm_update_channel(phy);
++		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
++		u8 duty_cycle = td->tx_duty_cycle;
++
++		if (!phy->test.bf_en)
++			mt7915_tm_update_channel(phy);
+ 
+ 		if (td->tx_spe_idx) {
+ 			phy->test.spe_idx = td->tx_spe_idx;
+ 		} else {
+ 			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
+ 		}
+-	}
+ 
+-	mt7915_tm_set_tam_arb(phy, en,
+-			      td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
++		/* if all three params are set, duty_cycle will be ignored */
++		if (duty_cycle && tx_time && !ipg) {
++			ipg = tx_time * 100 / duty_cycle - tx_time;
++		} else if (duty_cycle && !tx_time && ipg) {
++			if (duty_cycle < 100)
++				tx_time = duty_cycle * ipg / (100 - duty_cycle);
++		}
+ 
+-	/* if all three params are set, duty_cycle will be ignored */
+-	if (duty_cycle && tx_time && !ipg) {
+-		ipg = tx_time * 100 / duty_cycle - tx_time;
+-	} else if (duty_cycle && !tx_time && ipg) {
+-		if (duty_cycle < 100)
+-			tx_time = duty_cycle * ipg / (100 - duty_cycle);
+-	}
++		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
++		mt7915_tm_set_tx_len(phy, tx_time);
+ 
+-	mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
+-	mt7915_tm_set_tx_len(phy, tx_time);
++		if (ipg)
++			td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
+ 
+-	if (ipg)
+-		td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
++		if (!mt7915_tm_check_skb(phy))
++			return;
++	} else {
++		mt7915_tm_clean_hwq(phy);
++	}
+ 
+-	if (!en || !td->tx_skb)
+-		return;
++	mt7915_tm_set_tam_arb(phy, en,
++			      td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
+ 
+-	info = IEEE80211_SKB_CB(td->tx_skb);
+-	info->control.vif = phy->monitor_vif;
++	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++		mt7915_tm_tx_frames_mu(phy, en);
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
+ }
+@@ -544,10 +1482,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+ 		return ret;
+ 
+ 	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
+-	/* pr_info("mdrdy_cnt = %d\n", le32_to_cpu(rs_band->mdrdy_cnt)); */
+-	/* pr_info("fcs_err = %d\n", le16_to_cpu(rs_band->fcs_err)); */
+-	/* pr_info("len_mismatch = %d\n", le16_to_cpu(rs_band->len_mismatch)); */
+-	/* pr_info("fcs_ok = %d\n", le16_to_cpu(rs_band->fcs_succ)); */
+ 
+ 	if (!clear) {
+ 		enum mt76_rxq_id q = req.band ? MT_RXQ_EXT : MT_RXQ_MAIN;
+@@ -562,13 +1496,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+ 	return 0;
+ }
+ 
++static int
++mt7915_tm_set_rx_user_idx(struct mt7915_phy *phy, u8 aid)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_wcid *wcid = NULL;
++	struct mt76_testmode_entry_data *ed;
++	struct {
++		u8 band;
++		u8 _rsv;
++		__le16 wlan_idx;
++	} __packed req = {
++		.band = phy->band_idx,
++	};
++
++	mt76_tm_for_each_entry(phy->mt76, wcid, ed)
++		if (ed->aid == aid)
++			break;
++
++	if (!wcid)
++		return -EINVAL;
++
++	req.wlan_idx = cpu_to_le16(wcid->idx);
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_STAT_USER_CTRL),
++				 &req, sizeof(req), false);
++}
++
++static int
++mt7915_tm_set_muru_aid(struct mt7915_phy *phy, u16 aid)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_tm_cmd req = {
++		.testmode_en = 1,
++		.param_idx = MCU_ATE_SET_MU_RX_AID,
++		.param.rx_aid.band = cpu_to_le32(phy->band_idx),
++		.param.rx_aid.aid = cpu_to_le16(aid),
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
++				 sizeof(req), false);
++}
++
+ static void
+ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ {
++	struct mt76_testmode_data *td = &phy->mt76->test;
++
++	mt7915_tm_set_trx(phy, TM_MAC_TX, false);
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+ 
+ 	if (en) {
+-		mt7915_tm_update_channel(phy);
++		if (!phy->test.bf_en)
++			mt7915_tm_update_channel(phy);
++		if (td->aid)
++			mt7915_tm_set_rx_user_idx(phy, td->aid);
+ 
+ 		/* read-clear */
+ 		mt7915_tm_get_rx_stats(phy, true);
+@@ -576,9 +1558,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ 		/* clear fw count */
+ 		mt7915_tm_set_phy_count(phy, 0);
+ 		mt7915_tm_set_phy_count(phy, 1);
+-
+-		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ 	}
++
++	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++		mt7915_tm_set_muru_aid(phy, en ? td->aid : 0xf800);
++
++	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ }
+ 
+ static int
+@@ -615,35 +1600,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+ 	tx_cont->center_ch = freq1;
+ 	tx_cont->tx_ant = td->tx_antenna_mask;
+ 	tx_cont->band = phy != &dev->phy;
+-
+-	switch (chandef->width) {
+-	case NL80211_CHAN_WIDTH_40:
+-		tx_cont->bw = CMD_CBW_40MHZ;
+-		break;
+-	case NL80211_CHAN_WIDTH_80:
+-		tx_cont->bw = CMD_CBW_80MHZ;
+-		break;
+-	case NL80211_CHAN_WIDTH_80P80:
+-		tx_cont->bw = CMD_CBW_8080MHZ;
+-		break;
+-	case NL80211_CHAN_WIDTH_160:
+-		tx_cont->bw = CMD_CBW_160MHZ;
+-		break;
+-	case NL80211_CHAN_WIDTH_5:
+-		tx_cont->bw = CMD_CBW_5MHZ;
+-		break;
+-	case NL80211_CHAN_WIDTH_10:
+-		tx_cont->bw = CMD_CBW_10MHZ;
+-		break;
+-	case NL80211_CHAN_WIDTH_20:
+-		tx_cont->bw = CMD_CBW_20MHZ;
+-		break;
+-	case NL80211_CHAN_WIDTH_20_NOHT:
+-		tx_cont->bw = CMD_CBW_20MHZ;
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
++	tx_cont->bw = mt7915_tm_chan_bw(chandef->width);
+ 
+ 	if (!en) {
+ 		req.op.rf.param.func_data = cpu_to_le32(phy != &dev->phy);
+@@ -727,6 +1684,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ 		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
+ 	if (changed & BIT(TM_CHANGED_TXPOWER))
+ 		mt7915_tm_set_tx_power(phy);
++	if (changed & BIT(TM_CHANGED_AID))
++		mt7915_tm_set_entry(phy);
++	if (changed & BIT(TM_CHANGED_CFG))
++		mt7915_tm_set_cfg(phy);
++	if (changed & BIT(TM_CHANGED_TXBF_ACT))
++		mt7915_tm_set_txbf(phy);
+ }
+ 
+ static int
+@@ -800,6 +1763,7 @@ static int
+ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ {
+ 	struct mt7915_phy *phy = mphy->priv;
++	struct mt7915_dev *dev = phy->dev;
+ 	void *rx, *rssi;
+ 	int i;
+ 
+@@ -845,11 +1809,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ 
+ 	nla_nest_end(msg, rx);
+ 
++	if (mphy->test.tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++		mphy->test.tx_done += mt76_rr(dev, MT_MIB_DR8(phy != &dev->phy));
++
+ 	return mt7915_tm_get_rx_stats(phy, false);
+ }
+ 
++static int
++mt7915_tm_write_back_to_efuse(struct mt7915_dev *dev)
++{
++	struct mt7915_mcu_eeprom_info req = {};
++	u8 *eeprom = dev->mt76.eeprom.data;
++	int i, ret = -EINVAL;
++
++	/* prevent from damaging chip id in efuse */
++	if (mt76_chip(&dev->mt76) != get_unaligned_le16(eeprom))
++		goto out;
++
++	for (i = 0; i < mt7915_eeprom_size(dev); i += MT76_TM_EEPROM_BLOCK_SIZE) {
++		req.addr = cpu_to_le32(i);
++		memcpy(&req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++
++		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_ACCESS),
++					&req, sizeof(req), true);
++		if (ret)
++			return ret;
++	}
++
++out:
++	return ret;
++}
++
++static int
++mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
++{
++	struct mt7915_phy *phy = mphy->priv;
++	struct mt7915_dev *dev = phy->dev;
++	u8 *eeprom = dev->mt76.eeprom.data;
++	int ret = 0;
++
++	if (offset >= mt7915_eeprom_size(dev))
++		return -EINVAL;
++
++	switch (action) {
++	case MT76_TM_EEPROM_ACTION_UPDATE_DATA:
++		memcpy(eeprom + offset, val, MT76_TM_EEPROM_BLOCK_SIZE);
++		break;
++	case MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE:
++		ret = mt7915_mcu_set_eeprom(dev, true);
++		break;
++	case MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE:
++		ret = mt7915_tm_write_back_to_efuse(dev);
++		break;
++	default:
++		break;
++	}
++
++	return ret;
++}
++
+ const struct mt76_testmode_ops mt7915_testmode_ops = {
+ 	.set_state = mt7915_tm_set_state,
+ 	.set_params = mt7915_tm_set_params,
+ 	.dump_stats = mt7915_tm_dump_stats,
++	.set_eeprom = mt7915_tm_set_eeprom,
+ };
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index a1c54c89..01b08e9e 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -4,6 +4,8 @@
+ #ifndef __MT7915_TESTMODE_H
+ #define __MT7915_TESTMODE_H
+ 
++#include "mcu.h"
++
+ struct mt7915_tm_trx {
+ 	u8 type;
+ 	u8 enable;
+@@ -39,6 +41,11 @@ struct mt7915_tm_cfg {
+ 	u8 _rsv[2];
+ };
+ 
++struct mt7915_tm_mu_rx_aid {
++	__le32 band;
++	__le16 aid;
++};
++
+ struct mt7915_tm_cmd {
+ 	u8 testmode_en;
+ 	u8 param_idx;
+@@ -50,6 +57,7 @@ struct mt7915_tm_cmd {
+ 		struct mt7915_tm_slot_time slot;
+ 		struct mt7915_tm_clean_txq clean;
+ 		struct mt7915_tm_cfg cfg;
++		struct mt7915_tm_mu_rx_aid rx_aid;
+ 		u8 test[72];
+ 	} param;
+ } __packed;
+@@ -109,6 +117,16 @@ enum {
+ 	TAM_ARB_OP_MODE_FORCE_SU = 5,
+ };
+ 
++enum {
++	TM_CBW_20MHZ,
++	TM_CBW_40MHZ,
++	TM_CBW_80MHZ,
++	TM_CBW_10MHZ,
++	TM_CBW_5MHZ,
++	TM_CBW_160MHZ,
++	TM_CBW_8080MHZ,
++};
++
+ struct mt7915_tm_rx_stat_band {
+ 	u8 category;
+ 
+@@ -130,4 +148,264 @@ struct mt7915_tm_rx_stat_band {
+ 	__le16 mdrdy_cnt_ofdm;
+ };
+ 
++struct mt7915_tm_muru_comm {
++	u8 ppdu_format;
++	u8 sch_type;
++	u8 band;
++	u8 wmm_idx;
++	u8 spe_idx;
++	u8 proc_type;
++};
++
++struct mt7915_tm_muru_dl_usr {
++	__le16 wlan_idx;
++	u8 ru_alloc_seg;
++	u8 ru_idx;
++	u8 ldpc;
++	u8 nss;
++	u8 mcs;
++	u8 mu_group_idx;
++	u8 vht_groud_id;
++	u8 vht_up;
++	u8 he_start_stream;
++	u8 he_mu_spatial;
++	u8 ack_policy;
++	__le16 tx_power_alpha;
++};
++
++struct mt7915_tm_muru_dl {
++	u8 user_num;
++	u8 tx_mode;
++	u8 bw;
++	u8 gi;
++	u8 ltf;
++	/* sigB */
++	u8 mcs;
++	u8 dcm;
++	u8 cmprs;
++
++	u8 tx_power;
++	u8 ru[8];
++	u8 c26[2];
++	u8 ack_policy;
++
++	struct mt7915_tm_muru_dl_usr usr[16];
++};
++
++struct mt7915_tm_muru_ul_usr {
++	__le16 wlan_idx;
++	u8 ru_alloc;
++	u8 ru_idx;
++	u8 ldpc;
++	u8 nss;
++	u8 mcs;
++	u8 target_rssi;
++	__le32 trig_pkt_size;
++};
++
++struct mt7915_tm_muru_ul {
++	u8 user_num;
++
++	/* UL TX */
++	u8 trig_type;
++	__le16 trig_cnt;
++	__le16 trig_intv;
++	u8 bw;
++	u8 gi_ltf;
++	__le16 ul_len;
++	u8 pad;
++	u8 trig_ta[ETH_ALEN];
++	u8 ru[8];
++	u8 c26[2];
++
++	struct mt7915_tm_muru_ul_usr usr[16];
++	/* HE TB RX Debug */
++	__le32 rx_hetb_nonsf_en_bitmap;
++	__le32 rx_hetb_cfg[2];
++
++	/* DL TX */
++	u8 ba_type;
++};
++
++struct mt7915_tm_muru {
++	__le32 cfg_comm;
++	__le32 cfg_dl;
++	__le32 cfg_ul;
++
++	struct mt7915_tm_muru_comm comm;
++	struct mt7915_tm_muru_dl dl;
++	struct mt7915_tm_muru_ul ul;
++};
++
++#define MURU_PPDU_HE_MU		BIT(3)
++
++/* Common Config */
++/* #define MURU_COMM_PPDU_FMT		BIT(0) */
++/* #define MURU_COMM_SCH_TYPE		BIT(1) */
++/* #define MURU_COMM_BAND			BIT(2) */
++/* #define MURU_COMM_WMM			BIT(3) */
++/* #define MURU_COMM_SPE_IDX		BIT(4) */
++/* #define MURU_COMM_PROC_TYPE		BIT(5) */
++/* #define MURU_COMM_SET		(MURU_COMM_PPDU_FMT | MURU_COMM_BAND | \ */
++/* 				 MURU_COMM_WMM | MURU_COMM_SPE_IDX) */
++/* DL Config */
++#define MURU_DL_BW			BIT(0)
++#define MURU_DL_GI			BIT(1)
++#define MURU_DL_TX_MODE			BIT(2)
++#define MURU_DL_TONE_PLAN		BIT(3)
++#define MURU_DL_USER_CNT		BIT(4)
++#define MURU_DL_LTF			BIT(5)
++#define MURU_DL_SIGB_MCS		BIT(6)
++#define MURU_DL_SIGB_DCM		BIT(7)
++#define MURU_DL_SIGB_CMPRS		BIT(8)
++#define MURU_DL_ACK_POLICY		BIT(9)
++#define MURU_DL_TXPOWER			BIT(10)
++/* DL Per User Config */
++#define MURU_DL_USER_WLAN_ID		BIT(16)
++#define MURU_DL_USER_COD		BIT(17)
++#define MURU_DL_USER_MCS		BIT(18)
++#define MURU_DL_USER_NSS		BIT(19)
++#define MURU_DL_USER_RU_ALLOC		BIT(20)
++#define MURU_DL_USER_MUMIMO_GRP		BIT(21)
++#define MURU_DL_USER_MUMIMO_VHT		BIT(22)
++#define MURU_DL_USER_ACK_POLICY		BIT(23)
++#define MURU_DL_USER_MUMIMO_HE		BIT(24)
++#define MURU_DL_USER_PWR_ALPHA		BIT(25)
++#define MURU_DL_SET		(GENMASK(7, 0) | GENMASK(20, 16) | BIT(25))
++
++#define MAX_PHASE_GROUP_NUM	9
++
++struct mt7915_tm_txbf_phase {
++	u8 status;
++	struct {
++		u8 r0_uh;
++		u8 r0_h;
++		u8 r0_m;
++		u8 r0_l;
++		u8 r0_ul;
++		u8 r1_uh;
++		u8 r1_h;
++		u8 r1_m;
++		u8 r1_l;
++		u8 r1_ul;
++		u8 r2_uh;
++		u8 r2_h;
++		u8 r2_m;
++		u8 r2_l;
++		u8 r2_ul;
++		u8 r3_uh;
++		u8 r3_h;
++		u8 r3_m;
++		u8 r3_l;
++		u8 r3_ul;
++		u8 r2_uh_sx2;
++		u8 r2_h_sx2;
++		u8 r2_m_sx2;
++		u8 r2_l_sx2;
++		u8 r2_ul_sx2;
++		u8 r3_uh_sx2;
++		u8 r3_h_sx2;
++		u8 r3_m_sx2;
++		u8 r3_l_sx2;
++		u8 r3_ul_sx2;
++		u8 m_t0_h;
++		u8 m_t1_h;
++		u8 m_t2_h;
++		u8 m_t2_h_sx2;
++		u8 r0_reserved;
++		u8 r1_reserved;
++		u8 r2_reserved;
++		u8 r3_reserved;
++		u8 r2_sx2_reserved;
++		u8 r3_sx2_reserved;
++	} phase;
++};
++
++struct mt7915_tm_pfmu_tag1 {
++	__le32 pfmu_idx:10;
++	__le32 ebf:1;
++	__le32 data_bw:2;
++	__le32 lm:2;
++	__le32 is_mu:1;
++	__le32 nr:3, nc:3;
++	__le32 codebook:2;
++	__le32 ngroup:2;
++	__le32 _rsv:2;
++	__le32 invalid_prof:1;
++	__le32 rmsd:3;
++
++	__le32 col_id1:6, row_id1:10;
++	__le32 col_id2:6, row_id2:10;
++	__le32 col_id3:6, row_id3:10;
++	__le32 col_id4:6, row_id4:10;
++
++	__le32 ru_start_id:7;
++	__le32 _rsv1:1;
++	__le32 ru_end_id:7;
++	__le32 _rsv2:1;
++	__le32 mob_cal_en:1;
++	__le32 _rsv3:15;
++
++	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
++	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
++
++	__le32 _rsv4;
++} __packed;
++
++struct mt7915_tm_pfmu_tag2 {
++	__le32 smart_ant:24;
++	__le32 se_idx:5;
++	__le32 _rsv:3;
++
++	__le32 _rsv1:8;
++	__le32 rmsd_thres:3;
++	__le32 _rsv2:5;
++	__le32 ibf_timeout:8;
++	__le32 _rsv3:8;
++
++	__le32 _rsv4:16;
++	__le32 ibf_data_bw:2;
++	__le32 ibf_nc:3;
++	__le32 ibf_nr:3;
++	__le32 ibf_ru:8;
++
++	__le32 mob_delta_t:8;
++	__le32 mob_lq_result:7;
++	__le32 _rsv5:1;
++	__le32 _rsv6:16;
++
++	__le32 _rsv7;
++} __packed;
++
++struct mt7915_tm_pfmu_tag {
++	struct mt7915_tm_pfmu_tag1 t1;
++	struct mt7915_tm_pfmu_tag2 t2;
++};
++
++struct mt7915_tm_pfmu_data {
++	__le16 subc_idx;
++	__le16 phi11;
++	__le16 phi21;
++	__le16 phi31;
++};
++
++struct mt7915_tm_ibf_cal_info {
++	u8 format_id;
++	u8 group_l_m_n;
++	u8 group;
++	bool sx2;
++	u8 status;
++	u8 cal_type;
++	u8 _rsv[2];
++	u8 buf[1000];
++} __packed;
++
++enum {
++	IBF_PHASE_CAL_UNSPEC,
++	IBF_PHASE_CAL_NORMAL,
++	IBF_PHASE_CAL_VERIFY,
++	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
++	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
++};
++
+ #endif
+diff --git a/testmode.c b/testmode.c
+index e6d1f702..2c699ac8 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -25,28 +25,15 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+ };
+ EXPORT_SYMBOL_GPL(mt76_tm_policy);
+ 
+-void mt76_testmode_tx_pending(struct mt76_phy *phy)
++static void
++mt76_testmode_queue_tx(struct mt76_phy *phy, struct mt76_wcid *wcid,
++		       struct sk_buff *skb, struct mt76_queue *q, u16 limit)
+ {
+ 	struct mt76_testmode_data *td = &phy->test;
+ 	struct mt76_dev *dev = phy->dev;
+-	struct mt76_wcid *wcid = &dev->global_wcid;
+-	struct sk_buff *skb = td->tx_skb;
+-	struct mt76_queue *q;
+-	u16 tx_queued_limit;
+-	int qid;
+-
+-	if (!skb || !td->tx_pending)
+-		return;
++	u16 count = limit;
+ 
+-	qid = skb_get_queue_mapping(skb);
+-	q = phy->q_tx[qid];
+-
+-	tx_queued_limit = td->tx_queued_limit ? td->tx_queued_limit : 1000;
+-
+-	spin_lock_bh(&q->lock);
+-
+-	while (td->tx_pending > 0 &&
+-	       td->tx_queued - td->tx_done < tx_queued_limit &&
++	while (td->tx_pending > 0 && count &&
+ 	       q->queued < q->ndesc / 2) {
+ 		int ret;
+ 
+@@ -55,13 +42,65 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
+ 		if (ret < 0)
+ 			break;
+ 
++		count--;
+ 		td->tx_pending--;
+ 		td->tx_queued++;
++
++		if (td->tx_rate_mode != MT76_TM_TX_MODE_HE_MU)
++		    if (td->tx_queued - td->tx_done >= limit)
++			    break;
+ 	}
+ 
+ 	dev->queue_ops->kick(dev, q);
++}
++
++void mt76_testmode_tx_pending(struct mt76_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->test;
++	struct mt76_testmode_entry_data *ed;
++	struct mt76_queue *q;
++	int qid;
++	u16 tx_queued_limit;
++	u32 remain;
++	bool is_mu;
++
++	if (!td->tx_pending)
++		return;
++
++	/* tx_queued_limit = td->tx_queued_limit ?: 100; */
++	tx_queued_limit = 100;
++
++	if (!td->aid) {
++		qid = skb_get_queue_mapping(td->tx_skb);
++		q = phy->q_tx[qid];
++		spin_lock_bh(&q->lock);
++		mt76_testmode_queue_tx(phy, &phy->dev->global_wcid,
++				td->tx_skb, q, tx_queued_limit);
++		spin_unlock_bh(&q->lock);
++
++		return;
++	}
++
++	is_mu = td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU;
++	ed = mt76_testmode_entry_data(phy, td->cur_entry);
++	qid = skb_get_queue_mapping(ed->tx_skb);
++	q = phy->q_tx[qid];
++
++	spin_lock_bh(&q->lock);
++
++	remain = is_mu ? 1 : (td->tx_pending % td->tx_count) ?: td->tx_count;
++	if (remain < tx_queued_limit)
++		tx_queued_limit = remain;
++
++	mt76_testmode_queue_tx(phy, td->cur_entry, ed->tx_skb, q, tx_queued_limit);
++
++	if (td->tx_pending % td->tx_count == 0 || is_mu)
++		td->cur_entry = list_next_entry(td->cur_entry, list);
+ 
+ 	spin_unlock_bh(&q->lock);
++
++	if (is_mu && td->tx_pending)
++		mt76_worker_schedule(&phy->dev->tx_worker);
+ }
+ 
+ static u32
+@@ -87,15 +126,31 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
+ }
+ 
+ static void
+-mt76_testmode_free_skb(struct mt76_phy *phy)
++mt76_testmode_free_skb(struct sk_buff **tx_skb)
++{
++	if (!(*tx_skb))
++		return;
++
++	dev_kfree_skb(*tx_skb);
++	*tx_skb = NULL;
++}
++
++static void
++mt76_testmode_free_skb_all(struct mt76_phy *phy)
+ {
+ 	struct mt76_testmode_data *td = &phy->test;
++	struct mt76_testmode_entry_data *ed = &td->ed;
++	struct mt76_wcid *wcid;
++
++	mt76_testmode_free_skb(&ed->tx_skb);
+ 
+-	dev_kfree_skb(td->tx_skb);
+-	td->tx_skb = NULL;
++	mt76_tm_for_each_entry(phy, wcid, ed)
++		mt76_testmode_free_skb(&ed->tx_skb);
+ }
+ 
+-int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
++static int
++mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
++			struct sk_buff **tx_skb, u8 (*addr)[ETH_ALEN])
+ {
+ #define MT_TXP_MAX_LEN	4095
+ 	u16 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
+@@ -117,7 +172,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 	nfrags = len / MT_TXP_MAX_LEN;
+ 	head_len = nfrags ? MT_TXP_MAX_LEN : len;
+ 
+-	if (len > IEEE80211_MAX_FRAME_LEN)
++	if (len > IEEE80211_MAX_FRAME_LEN ||
++	    td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
+ 		fc |= IEEE80211_STYPE_QOS_DATA;
+ 
+ 	head = alloc_skb(head_len, GFP_KERNEL);
+@@ -126,9 +182,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 
+ 	hdr = __skb_put_zero(head, head_len);
+ 	hdr->frame_control = cpu_to_le16(fc);
+-	memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
+-	memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
+-	memcpy(hdr->addr3, td->addr[2], ETH_ALEN);
++	memcpy(hdr->addr1, addr[0], ETH_ALEN);
++	memcpy(hdr->addr2, addr[1], ETH_ALEN);
++	memcpy(hdr->addr3, addr[2], ETH_ALEN);
+ 	skb_set_queue_mapping(head, IEEE80211_AC_BE);
+ 
+ 	info = IEEE80211_SKB_CB(head);
+@@ -152,7 +208,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 
+ 		frag = alloc_skb(frag_len, GFP_KERNEL);
+ 		if (!frag) {
+-			mt76_testmode_free_skb(phy);
++			mt76_testmode_free_skb(tx_skb);
+ 			dev_kfree_skb(head);
+ 			return -ENOMEM;
+ 		}
+@@ -165,15 +221,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 		frag_tail = &(*frag_tail)->next;
+ 	}
+ 
+-	mt76_testmode_free_skb(phy);
+-	td->tx_skb = head;
++	mt76_testmode_free_skb(tx_skb);
++	*tx_skb = head;
+ 
+ 	return 0;
+ }
+-EXPORT_SYMBOL(mt76_testmode_alloc_skb);
+ 
+-static int
+-mt76_testmode_tx_init(struct mt76_phy *phy)
++int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len,
++			   struct sk_buff **tx_skb, u8 (*addr)[ETH_ALEN])
+ {
+ 	struct mt76_testmode_data *td = &phy->test;
+ 	struct ieee80211_tx_info *info;
+@@ -181,7 +236,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ 	u8 max_nss = hweight8(phy->antenna_mask);
+ 	int ret;
+ 
+-	ret = mt76_testmode_alloc_skb(phy, td->tx_mpdu_len);
++	ret = mt76_testmode_alloc_skb(phy, len, tx_skb, addr);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -191,7 +246,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ 	if (td->tx_antenna_mask)
+ 		max_nss = min_t(u8, max_nss, hweight8(td->tx_antenna_mask));
+ 
+-	info = IEEE80211_SKB_CB(td->tx_skb);
++	info = IEEE80211_SKB_CB(*tx_skb);
+ 	rate = &info->control.rates[0];
+ 	rate->count = 1;
+ 	rate->idx = td->tx_rate_idx;
+@@ -263,6 +318,25 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ out:
+ 	return 0;
+ }
++EXPORT_SYMBOL(mt76_testmode_init_skb);
++
++static int
++mt76_testmode_tx_init(struct mt76_phy *phy)
++{
++	struct mt76_testmode_entry_data *ed;
++	struct mt76_wcid *wcid;
++
++	mt76_tm_for_each_entry(phy, wcid, ed) {
++		int ret;
++
++		ret = mt76_testmode_init_skb(phy, ed->tx_mpdu_len,
++					     &ed->tx_skb, ed->addr);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
+ 
+ static void
+ mt76_testmode_tx_start(struct mt76_phy *phy)
+@@ -273,6 +347,14 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
+ 	td->tx_queued = 0;
+ 	td->tx_done = 0;
+ 	td->tx_pending = td->tx_count;
++	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++		td->tx_pending = 1;
++	if (td->entry_num) {
++		td->tx_pending *= td->entry_num;
++		td->cur_entry = list_first_entry(&td->tm_entry_list,
++						 struct mt76_wcid, list);
++	}
++
+ 	mt76_worker_schedule(&dev->tx_worker);
+ }
+ 
+@@ -291,7 +373,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+ 	wait_event_timeout(dev->tx_wait, td->tx_done == td->tx_queued,
+ 			   MT76_TM_TIMEOUT * HZ);
+ 
+-	mt76_testmode_free_skb(phy);
++	mt76_testmode_free_skb_all(phy);
+ }
+ 
+ static inline void
+@@ -322,6 +404,8 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+ 	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
+ 	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
+ 	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
++
++	INIT_LIST_HEAD(&phy->test.tm_entry_list);
+ }
+ 
+ static int
+@@ -331,8 +415,12 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+ 	struct mt76_dev *dev = phy->dev;
+ 	int err;
+ 
+-	if (prev_state == MT76_TM_STATE_TX_FRAMES)
++	if (prev_state == MT76_TM_STATE_TX_FRAMES) {
++		/* MU needs to clean hwq for free done event */
++		if (phy->test.tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++			dev->test_ops->set_state(phy, MT76_TM_STATE_IDLE);
+ 		mt76_testmode_tx_stop(phy);
++	}
+ 
+ 	if (state == MT76_TM_STATE_TX_FRAMES) {
+ 		err = mt76_testmode_tx_init(phy);
+@@ -402,6 +490,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
+ 	return 0;
+ }
+ 
++static int
++mt76_testmode_set_eeprom(struct mt76_phy *phy, struct nlattr **tb)
++{
++	struct mt76_dev *dev = phy->dev;
++	u8 action, val[MT76_TM_EEPROM_BLOCK_SIZE];
++	u32 offset = 0;
++	int err = -EINVAL;
++
++	if (!dev->test_ops->set_eeprom)
++		return -EOPNOTSUPP;
++
++	if (mt76_tm_get_u8(tb[MT76_TM_ATTR_EEPROM_ACTION], &action,
++			   0, MT76_TM_EEPROM_ACTION_MAX))
++		goto out;
++
++	if (tb[MT76_TM_ATTR_EEPROM_OFFSET]) {
++		struct nlattr *cur;
++		int rem, idx = 0;
++
++		offset = nla_get_u32(tb[MT76_TM_ATTR_EEPROM_OFFSET]);
++		if (!!(offset % MT76_TM_EEPROM_BLOCK_SIZE) ||
++		    !tb[MT76_TM_ATTR_EEPROM_VAL])
++			goto out;
++
++		nla_for_each_nested(cur, tb[MT76_TM_ATTR_EEPROM_VAL], rem) {
++			if (nla_len(cur) != 1 || idx >= ARRAY_SIZE(val))
++				goto out;
++
++			val[idx++] = nla_get_u8(cur);
++		}
++	}
++
++	err = dev->test_ops->set_eeprom(phy, offset, val, action);
++
++out:
++	return err;
++}
++
+ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      void *data, int len)
+ {
+@@ -425,6 +551,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 
+ 	mutex_lock(&dev->mutex);
+ 
++	if (tb[MT76_TM_ATTR_EEPROM_ACTION]) {
++		err = mt76_testmode_set_eeprom(phy, tb);
++		goto out;
++	}
++
+ 	if (tb[MT76_TM_ATTR_RESET]) {
+ 		mt76_testmode_set_state(phy, MT76_TM_STATE_OFF);
+ 		memset(td, 0, sizeof(*td));
+@@ -452,7 +583,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ 			   &td->tx_duty_cycle, 0, 99) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
+-			   &td->tx_power_control, 0, 1))
++			   &td->tx_power_control, 0, 1) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_ALLOC], &td->ru_alloc, 0, 0xff) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68))
+ 		goto out;
+ 
+ 	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
+@@ -484,8 +618,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 
+ 	if (tb[MT76_TM_ATTR_TX_POWER]) {
+ 		struct nlattr *cur;
+-		int idx = 0;
+-		int rem;
++		int rem, idx = 0;
+ 
+ 		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TX_POWER], rem) {
+ 			if (nla_len(cur) != 1 ||
+@@ -505,11 +638,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			if (nla_len(cur) != ETH_ALEN || idx >= 3)
+ 				goto out;
+ 
+-			memcpy(td->addr[idx], nla_data(cur), ETH_ALEN);
++			memcpy(td->addr[idx++], nla_data(cur), ETH_ALEN);
++		}
++	}
++
++	if (tb[MT76_TM_ATTR_CFG]) {
++		struct nlattr *cur;
++		int rem, idx = 0;
++
++		nla_for_each_nested(cur, tb[MT76_TM_ATTR_CFG], rem) {
++			if (nla_len(cur) != 1 || idx >= 2)
++				goto out;
++
++			if (idx == 0)
++				td->cfg.type = nla_get_u8(cur);
++			else
++				td->cfg.enable = nla_get_u8(cur);
+ 			idx++;
+ 		}
+ 	}
+ 
++	if (tb[MT76_TM_ATTR_TXBF_ACT]) {
++		struct nlattr *cur;
++		int rem, idx = 0;
++
++		if (!tb[MT76_TM_ATTR_TXBF_PARAM] ||
++		    mt76_tm_get_u8(tb[MT76_TM_ATTR_TXBF_ACT], &td->txbf_act,
++		    0, MT76_TM_TXBF_ACT_MAX))
++			goto out;
++
++		memset(td->txbf_param, 0, sizeof(td->txbf_param));
++		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
++			if (nla_len(cur) != 2 ||
++			    idx >= ARRAY_SIZE(td->txbf_param))
++				goto out;
++
++			td->txbf_param[idx++] = nla_get_u16(cur);
++		}
++	}
++
+ 	if (dev->test_ops->set_params) {
+ 		err = dev->test_ops->set_params(phy, tb, state);
+ 		if (err)
+@@ -574,6 +741,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 	struct mt76_phy *phy = hw->priv;
+ 	struct mt76_dev *dev = phy->dev;
+ 	struct mt76_testmode_data *td = &phy->test;
++	struct mt76_testmode_entry_data *ed = &td->ed;
+ 	struct nlattr *tb[NUM_MT76_TM_ATTRS] = {};
+ 	int err = 0;
+ 	void *a;
+@@ -606,6 +774,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 		goto out;
+ 	}
+ 
++	if (tb[MT76_TM_ATTR_AID]) {
++		struct mt76_wcid *wcid;
++		u8 aid;
++
++		err = mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &aid, 1, 16);
++		if (err)
++			goto out;
++
++		mt76_tm_for_each_entry(phy, wcid, ed)
++			if (ed->aid == aid)
++				ed = mt76_testmode_entry_data(phy, wcid);
++	}
++
+ 	mt76_testmode_init_defaults(phy);
+ 
+ 	err = -EMSGSIZE;
+@@ -618,12 +799,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 		goto out;
+ 
+ 	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
+-	    nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, td->tx_mpdu_len) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
+-	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, td->tx_rate_nss) ||
+-	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, td->tx_rate_idx) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
+-	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
+ 	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
+@@ -643,6 +820,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 	     nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
+ 		goto out;
+ 
++	if (nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, ed->tx_mpdu_len) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, ed->tx_rate_nss) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, ed->tx_rate_idx) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, ed->tx_rate_ldpc) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_AID, ed->aid) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_RU_ALLOC, ed->ru_alloc) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_RU_IDX, ed->ru_idx))
++		goto out;
++
+ 	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
+ 		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
+ 		if (!a)
+diff --git a/testmode.h b/testmode.h
+index 89613266..57949f2b 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -6,6 +6,8 @@
+ #define __MT76_TESTMODE_H
+ 
+ #define MT76_TM_TIMEOUT	10
++#define MT76_TM_MAX_ENTRY_NUM	16
++#define MT76_TM_EEPROM_BLOCK_SIZE	16
+ 
+ /**
+  * enum mt76_testmode_attr - testmode attributes inside NL80211_ATTR_TESTDATA
+@@ -47,6 +49,15 @@
+  * @MT76_TM_ATTR_DRV_DATA: driver specific netlink attrs (nested)
+  *
+  * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
++ *
++ * @MT76_TM_ATTR_EEPROM_ACTION: eeprom setting actions
++ * 	(u8, see &enum mt76_testmode_eeprom_action)
++ * @MT76_TM_ATTR_EEPROM_OFFSET: offset of eeprom data block for writing (u32)
++ * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
++ * 	(nested, u8 attrs)
++ *
++ * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
++ *
+  */
+ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_UNSPEC,
+@@ -84,6 +95,17 @@ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_DRV_DATA,
+ 
+ 	MT76_TM_ATTR_MAC_ADDRS,
++	MT76_TM_ATTR_AID,
++	MT76_TM_ATTR_RU_ALLOC,
++	MT76_TM_ATTR_RU_IDX,
++
++	MT76_TM_ATTR_EEPROM_ACTION,
++	MT76_TM_ATTR_EEPROM_OFFSET,
++	MT76_TM_ATTR_EEPROM_VAL,
++
++	MT76_TM_ATTR_CFG,
++	MT76_TM_ATTR_TXBF_ACT,
++	MT76_TM_ATTR_TXBF_PARAM,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_ATTRS,
+@@ -198,4 +220,57 @@ enum mt76_testmode_tx_mode {
+ 
+ extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
+ 
++/**
++ * enum mt76_testmode_eeprom_action - eeprom setting actions
++ *
++ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
++ * 	eeprom data block
++ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
++ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
++ */
++enum mt76_testmode_eeprom_action {
++	MT76_TM_EEPROM_ACTION_UPDATE_DATA,
++	MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE,
++	MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE,
++
++	/* keep last */
++	NUM_MT76_TM_EEPROM_ACTION,
++	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
++};
++
++/**
++ * enum mt76_testmode_cfg - packet tx phy mode
++ *
++ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
++ * 	eeprom data block
++ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
++ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
++ */
++enum mt76_testmode_cfg {
++	MT76_TM_CFG_TSSI,
++	MT76_TM_CFG_DPD,
++	MT76_TM_CFG_RATE_POWER_OFFSET,
++	MT76_TM_CFG_THERMAL_COMP,
++
++	/* keep last */
++	NUM_MT76_TM_CFG,
++	MT76_TM_CFG_MAX = NUM_MT76_TM_CFG - 1,
++};
++
++enum mt76_testmode_txbf_act {
++	MT76_TM_TXBF_ACT_INIT,
++	MT76_TM_TXBF_ACT_UPDATE_CH,
++	MT76_TM_TXBF_ACT_PHASE_COMP,
++	MT76_TM_TXBF_ACT_TX_PREP,
++	MT76_TM_TXBF_ACT_IBF_PROF_UPDATE,
++	MT76_TM_TXBF_ACT_EBF_PROF_UPDATE,
++	MT76_TM_TXBF_ACT_PHASE_CAL,
++	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
++	MT76_TM_TXBF_ACT_E2P_UPDATE,
++
++	/* keep last */
++	NUM_MT76_TM_TXBF_ACT,
++	MT76_TM_TXBF_ACT_MAX = NUM_MT76_TM_TXBF_ACT - 1,
++};
++
+ #endif
+diff --git a/tools/fields.c b/tools/fields.c
+index e3f69089..6e36ab27 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
+ 	[MT76_TM_STATE_IDLE] = "idle",
+ 	[MT76_TM_STATE_TX_FRAMES] = "tx_frames",
+ 	[MT76_TM_STATE_RX_FRAMES] = "rx_frames",
++	[MT76_TM_STATE_TX_CONT] = "tx_cont",
+ };
+ 
+ static const char * const testmode_tx_mode[] = {
+@@ -201,6 +202,63 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ 	printf("%srx_per=%.02f%%\n", prefix, 100 * failed / total);
+ }
+ 
++static bool parse_mac(const struct tm_field *field, int idx,
++		      struct nl_msg *msg, const char *val)
++{
++#define ETH_ALEN	6
++	bool ret = true;
++	char *str, *cur, *ap;
++	void *a;
++
++	ap = str = strdup(val);
++
++	a = nla_nest_start(msg, idx);
++
++	idx = 0;
++	while ((cur = strsep(&ap, ",")) != NULL) {
++		unsigned char addr[ETH_ALEN];
++		char *val, *tmp = cur;
++		int i = 0;
++
++		while ((val = strsep(&tmp, ":")) != NULL) {
++			if (i >= ETH_ALEN)
++				break;
++
++			addr[i++] = strtoul(val, NULL, 16);
++		}
++
++		nla_put(msg, idx, ETH_ALEN, addr);
++
++		idx++;
++	}
++
++	nla_nest_end(msg, a);
++
++	free(str);
++
++	return ret;
++}
++
++static void print_mac(const struct tm_field *field, struct nlattr *attr)
++{
++#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
++#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
++	unsigned char addr[3][6];
++	struct nlattr *cur;
++	int idx = 0;
++	int rem;
++
++	nla_for_each_nested(cur, attr, rem) {
++		if (nla_len(cur) != 6)
++			continue;
++		memcpy(addr[idx++], nla_data(cur), 6);
++	}
++
++	printf("" MACSTR "," MACSTR "," MACSTR "",
++	       MAC2STR(addr[0]), MAC2STR(addr[1]), MAC2STR(addr[2]));
++
++	return;
++}
+ 
+ #define FIELD_GENERIC(_field, _name, ...)	\
+ 	[FIELD_NAME(_field)] = {			\
+@@ -250,6 +308,13 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ 		 ##__VA_ARGS__				\
+ 	)
+ 
++#define FIELD_MAC(_field, _name)			\
++	[FIELD_NAME(_field)] = {			\
++		.name = _name,				\
++		.parse = parse_mac,			\
++		.print = print_mac			\
++	}
++
+ #define FIELD_NAME(_field) MT76_TM_RX_ATTR_##_field
+ static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
+ 	FIELD_RO(s32, FREQ_OFFSET, "freq_offset"),
+@@ -300,10 +365,18 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+ 	FIELD(u8, TX_RATE_LDPC, "tx_rate_ldpc"),
+ 	FIELD(u8, TX_RATE_STBC, "tx_rate_stbc"),
+ 	FIELD(u8, TX_LTF, "tx_ltf"),
++	FIELD(u8, TX_DUTY_CYCLE, "tx_duty_cycle"),
++	FIELD(u32, TX_IPG, "tx_ipg"),
++	FIELD(u32, TX_TIME, "tx_time"),
+ 	FIELD(u8, TX_POWER_CONTROL, "tx_power_control"),
+ 	FIELD_ARRAY(u8, TX_POWER, "tx_power"),
+ 	FIELD(u8, TX_ANTENNA, "tx_antenna"),
++	FIELD(u8, TX_SPE_IDX, "tx_spe_idx"),
+ 	FIELD(u32, FREQ_OFFSET, "freq_offset"),
++	FIELD(u8, AID, "aid"),
++	FIELD(u8, RU_ALLOC, "ru_alloc"),
++	FIELD(u8, RU_IDX, "ru_idx"),
++	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
+ 	FIELD_NESTED_RO(STATS, stats, "",
+ 			.print_extra = print_extra_stats),
+ };
+@@ -322,9 +395,16 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+ 	[MT76_TM_ATTR_TX_RATE_LDPC] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_RATE_STBC] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_LTF] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_DUTY_CYCLE] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_IPG] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
+ 	[MT76_TM_ATTR_TX_POWER_CONTROL] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_ANTENNA] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_SPE_IDX] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_AID] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_RU_ALLOC] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
+ };
+ 
+diff --git a/tx.c b/tx.c
+index 02067edc..0457c3eb 100644
+--- a/tx.c
++++ b/tx.c
+@@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
+ 	if (mt76_is_testmode_skb(dev, skb, &hw)) {
+ 		struct mt76_phy *phy = hw->priv;
+ 
+-		if (skb == phy->test.tx_skb)
+-			phy->test.tx_done++;
++		phy->test.tx_done++;
+ 		if (phy->test.tx_queued == phy->test.tx_done)
+ 			wake_up(&dev->tx_wait);
+ 
+-- 
+2.25.1
+
diff --git a/recipes-kernel/linux-mt76/files/patches/1111-mt76-tool-add-more-commands.patch b/recipes-kernel/linux-mt76/files/patches/1111-mt76-tool-add-more-commands.patch
deleted file mode 100755
index 630a68c..0000000
--- a/recipes-kernel/linux-mt76/files/patches/1111-mt76-tool-add-more-commands.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From ce9be27dcc763b3a9b399dfe8f62ee1c0fed9734 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Fri, 4 Feb 2022 21:35:14 +0800
-Subject: [PATCH 1111/1112] mt76: tool: add more commands
-
----
- .../net/wireless/mediatek/mt76/tools/fields.c | 76 +++++++++++++++++++
- 1 file changed, 76 insertions(+)
-
-diff --git a/tools/fields.c b/tools/fields.c
-index e3f6908..036406c 100644
---- a/tools/fields.c
-+++ b/tools/fields.c
-@@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
- 	[MT76_TM_STATE_IDLE] = "idle",
- 	[MT76_TM_STATE_TX_FRAMES] = "tx_frames",
- 	[MT76_TM_STATE_RX_FRAMES] = "rx_frames",
-+	[MT76_TM_STATE_TX_CONT] = "tx_cont",
- };
- 
- static const char * const testmode_tx_mode[] = {
-@@ -201,6 +202,63 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
- 	printf("%srx_per=%.02f%%\n", prefix, 100 * failed / total);
- }
- 
-+static bool parse_mac(const struct tm_field *field, int idx,
-+		      struct nl_msg *msg, const char *val)
-+{
-+#define ETH_ALEN	6
-+	bool ret = true;
-+	char *str, *cur, *ap;
-+	void *a;
-+
-+	ap = str = strdup(val);
-+
-+	a = nla_nest_start(msg, idx);
-+
-+	idx = 0;
-+	while ((cur = strsep(&ap, ",")) != NULL) {
-+		unsigned char addr[ETH_ALEN];
-+		char *val, *tmp = cur;
-+		int i = 0;
-+
-+		while ((val = strsep(&tmp, ":")) != NULL) {
-+			if (i >= ETH_ALEN)
-+				break;
-+
-+			addr[i++] = strtoul(val, NULL, 16);
-+		}
-+
-+		nla_put(msg, idx, ETH_ALEN, addr);
-+
-+		idx++;
-+	}
-+
-+	nla_nest_end(msg, a);
-+
-+	free(str);
-+
-+	return ret;
-+}
-+
-+static void print_mac(const struct tm_field *field, struct nlattr *attr)
-+{
-+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
-+#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
-+	unsigned char addr[3][6];
-+	struct nlattr *cur;
-+	int idx = 0;
-+	int rem;
-+
-+	nla_for_each_nested(cur, attr, rem) {
-+		if (nla_len(cur) != 6)
-+			continue;
-+		memcpy(addr[idx++], nla_data(cur), 6);
-+	}
-+
-+	printf("" MACSTR "," MACSTR "," MACSTR "",
-+	       MAC2STR(addr[0]), MAC2STR(addr[1]), MAC2STR(addr[2]));
-+
-+	return;
-+}
- 
- #define FIELD_GENERIC(_field, _name, ...)	\
- 	[FIELD_NAME(_field)] = {			\
-@@ -250,6 +308,13 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
- 		 ##__VA_ARGS__				\
- 	)
- 
-+#define FIELD_MAC(_field, _name)			\
-+	[FIELD_NAME(_field)] = {			\
-+		.name = _name,				\
-+		.parse = parse_mac,			\
-+		.print = print_mac			\
-+	}
-+
- #define FIELD_NAME(_field) MT76_TM_RX_ATTR_##_field
- static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
- 	FIELD_RO(s32, FREQ_OFFSET, "freq_offset"),
-@@ -300,10 +365,16 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
- 	FIELD(u8, TX_RATE_LDPC, "tx_rate_ldpc"),
- 	FIELD(u8, TX_RATE_STBC, "tx_rate_stbc"),
- 	FIELD(u8, TX_LTF, "tx_ltf"),
-+	FIELD(u8, TX_DUTY_CYCLE, "tx_duty_cycle"),
-+	FIELD(u32, TX_IPG, "tx_ipg"),
-+	FIELD(u32, TX_TIME, "tx_time"),
- 	FIELD(u8, TX_POWER_CONTROL, "tx_power_control"),
- 	FIELD_ARRAY(u8, TX_POWER, "tx_power"),
- 	FIELD(u8, TX_ANTENNA, "tx_antenna"),
-+	FIELD(u8, TX_SPE_IDX, "tx_spe_idx"),
- 	FIELD(u32, FREQ_OFFSET, "freq_offset"),
-+	FIELD(u8, AID, "aid"),
-+	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
- 	FIELD_NESTED_RO(STATS, stats, "",
- 			.print_extra = print_extra_stats),
- };
-@@ -322,9 +393,14 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
- 	[MT76_TM_ATTR_TX_RATE_LDPC] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_RATE_STBC] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_LTF] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_TX_DUTY_CYCLE] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_TX_IPG] = { .type = NLA_U32 },
-+	[MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_TX_POWER_CONTROL] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_ANTENNA] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_TX_SPE_IDX] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
-+	[MT76_TM_ATTR_AID] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
- };
- 
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
similarity index 70%
rename from recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
rename to recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index fb1188e..373557f 100644
--- a/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,17 +1,17 @@
-From 9d57f49dd5ff756854029c484876325b43fc2b78 Mon Sep 17 00:00:00 2001
+From 3b98e75fc0a9dfd1fbd36bdd98b73bd8bae00f18 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1113/1116] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1112/1115] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 5b0a6d02..f50dbbb5 100644
+index 55b4cefe..e2a3af4d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -651,6 +651,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -663,6 +663,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy;
  #endif
  	int ret, idx;
@@ -19,7 +19,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -672,6 +673,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -684,6 +685,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
diff --git a/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch b/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
similarity index 74%
rename from recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
rename to recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
index 743f41b..17142a1 100644
--- a/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
@@ -1,8 +1,8 @@
-From c83d3e3692a758084e4d78fad127043d8789d263 Mon Sep 17 00:00:00 2001
+From 7d082308e57e467607e4ca9e63938fea0eb00306 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 9 May 2022 16:36:38 +0800
-Subject: [PATCH] mt76: mt7915: drop packets when TWT stations use more tokens
- than 128
+Date: Mon, 6 Jun 2022 20:20:55 +0800
+Subject: [PATCH 1113/1115] mt76: mt7915: drop packets when TWT stations use
+ more tokens than 128
 
 ---
  mt7915/mac.c    | 21 ++++++++++++++++++---
@@ -10,10 +10,10 @@
  2 files changed, 20 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index c73e767b..588c0d58 100644
+index af72e268..bae700eb 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1292,6 +1292,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1322,6 +1322,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
  	struct ieee80211_vif *vif = info->control.vif;
@@ -21,7 +21,7 @@
  	struct mt76_txwi_cache *t;
  	struct mt7915_txp *txp;
  	int id, i, nbuf = tx_info->nbuf - 1;
-@@ -1305,8 +1306,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1335,8 +1336,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		wcid = &dev->mt76.global_wcid;
  
  	if (sta) {
@@ -30,9 +30,9 @@
  		msta = (struct mt7915_sta *)sta->drv_priv;
  
  		if (time_after(jiffies, msta->jiffies + HZ / 4)) {
-@@ -1318,10 +1317,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
- 	t->skb = tx_info->skb;
+@@ -1352,10 +1351,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	    mgmt->u.action.category == 0xff)
+ 		return -1;
  
 +	spin_lock_bh(&mdev->token_lock);
 +	if (msta && msta->twt.flowid_mask && msta->token_count > 128) {
@@ -51,9 +51,9 @@
 +	spin_unlock_bh(&mdev->token_lock);
 +
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
- 	mt7915_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid, key,
- 			      false);
-@@ -1513,6 +1524,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 	mt7915_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid, key, 0);
+ 
+@@ -1546,6 +1557,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	struct mt76_dev *mdev = &dev->mt76;
  	struct mt76_txwi_cache *txwi;
  	struct ieee80211_sta *sta = NULL;
@@ -61,7 +61,7 @@
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
-@@ -1536,7 +1548,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1569,7 +1581,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		 * 1'b0: msdu_id with the same 'wcid pair' as above.
  		 */
  		if (info & MT_TX_FREE_PAIR) {
@@ -69,7 +69,7 @@
  			struct mt76_wcid *wcid;
  			u16 idx;
  
-@@ -1569,6 +1580,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1602,6 +1613,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -81,10 +81,10 @@
  			mt7915_txwi_free(dev, txwi, sta, &free_list);
  		}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index cd54f087..b78b1a9a 100644
+index c99e700d..90391a07 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -136,6 +136,8 @@ struct mt7915_sta {
+@@ -137,6 +137,8 @@ struct mt7915_sta {
  		u8 flowid_mask;
  		struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
  	} twt;
diff --git a/recipes-kernel/linux-mt76/files/patches/1115-mt76-airtime-fairness-feature-off-in-mac80211.patch b/recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch
similarity index 70%
rename from recipes-kernel/linux-mt76/files/patches/1115-mt76-airtime-fairness-feature-off-in-mac80211.patch
rename to recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch
index a11702f..dfb8a1e 100644
--- a/recipes-kernel/linux-mt76/files/patches/1115-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1114-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,17 +1,17 @@
-From fcf24bbef66458b2c44feadcd6f75f9ee20360cf Mon Sep 17 00:00:00 2001
+From 110b036dfce5d60f59b02385a2d39c766921da30 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1115/1116] mt76: airtime fairness feature off in mac80211
+Subject: [PATCH 1114/1115] mt76: airtime fairness feature off in mac80211
 
 ---
  mac80211.c | 1 -
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 49b99f36..e17b04b1 100644
+index 022b63e7..4b4d8b99 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -419,7 +419,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
+@@ -425,7 +425,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
  			WIPHY_FLAG_AP_UAPSD;
  
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
diff --git a/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
new file mode 100644
index 0000000..8e53676
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -0,0 +1,256 @@
+From 33d4383e72491f7e8879c6e4334bf36c30704d18 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 20 May 2022 19:19:25 +0800
+Subject: [PATCH 1115/1115] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+
+Add pre-calibration for mt7986 and mt7916. It has different data size
+with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
+respectively. DPD cal needs 300k.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/eeprom.c | 15 +++++-----
+ mt7915/eeprom.h | 27 +++++++++++++++--
+ mt7915/mcu.c    | 80 ++++++++++++++++++++++++++++++++++++-------------
+ 3 files changed, 90 insertions(+), 32 deletions(-)
+
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index 4b1a9811..ee3049e5 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ {
+ 	struct mt76_dev *mdev = &dev->mt76;
+ 	u8 *eeprom = mdev->eeprom.data;
+-	u32 val = eeprom[MT_EE_DO_PRE_CAL];
+-	u32 offs;
++	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
++	u32 size, val = eeprom[offs];
+ 
+-	if (!dev->flash_mode)
++	if (!dev->flash_mode || !val)
+ 		return 0;
+ 
+-	if (val != (MT_EE_WIFI_CAL_DPD | MT_EE_WIFI_CAL_GROUP))
+-		return 0;
++	size = mt7915_get_cal_group_size(dev) +
++	       (is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2);
+ 
+-	val = MT_EE_CAL_GROUP_SIZE + MT_EE_CAL_DPD_SIZE;
+-	dev->cal = devm_kzalloc(mdev->dev, val, GFP_KERNEL);
++	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
+ 	if (!dev->cal)
+ 		return -ENOMEM;
+ 
+ 	offs = is_mt7915(&dev->mt76) ? MT_EE_PRECAL : MT_EE_PRECAL_V2;
+ 
+-	return mt76_get_of_eeprom(mdev, dev->cal, offs, val);
++	return mt76_get_of_eeprom(mdev, dev->cal, offs, size);
+ }
+ 
+ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index 7578ac6d..e924baef 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
+ 	MT_EE_DDIE_FT_VERSION =	0x050,
+ 	MT_EE_DO_PRE_CAL =	0x062,
+ 	MT_EE_WIFI_CONF =	0x190,
++	MT_EE_DO_PRE_CAL_V2 =	0x19a,
+ 	MT_EE_RATE_DELTA_2G =	0x252,
+ 	MT_EE_RATE_DELTA_5G =	0x29d,
+ 	MT_EE_TX0_POWER_2G =	0x2fc,
+@@ -39,10 +40,14 @@ enum mt7915_eeprom_field {
+ };
+ 
+ #define MT_EE_WIFI_CAL_GROUP			BIT(0)
+-#define MT_EE_WIFI_CAL_DPD			GENMASK(2, 1)
++#define MT_EE_WIFI_CAL_DPD			GENMASK(3, 1)
+ #define MT_EE_CAL_UNIT				1024
+-#define MT_EE_CAL_GROUP_SIZE			(49 * MT_EE_CAL_UNIT + 16)
+-#define MT_EE_CAL_DPD_SIZE			(54 * MT_EE_CAL_UNIT)
++#define MT_EE_CAL_GROUP_SIZE_7915		(49 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7916		(54 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7975		(54 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7976		(94 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
++#define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
+ 
+ #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
+ #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
+@@ -160,6 +165,22 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
+ 		return val & MT_EE_WIFI_CONF7_TSSI0_5G;
+ }
+ 
++static inline u32
++mt7915_get_cal_group_size(struct mt7915_dev *dev)
++{
++	switch (mt76_chip(&dev->mt76)) {
++	case 0x7915:
++		return MT_EE_CAL_GROUP_SIZE_7915;
++	case 0x7916:
++		return MT_EE_CAL_GROUP_SIZE_7916;
++	default:
++		if (mt7915_check_adie(dev, false))
++			return MT_EE_CAL_GROUP_SIZE_7976;
++
++		return MT_EE_CAL_GROUP_SIZE_7975;
++	}
++}
++
+ extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
+ 
+ #endif
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 17a36ea3..2b9797c8 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3203,9 +3203,10 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+ {
+ 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
+-	u32 total = MT_EE_CAL_GROUP_SIZE;
++	u32 total = mt7915_get_cal_group_size(dev);
++	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
+ 
+-	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
++	if (1 || !(eep[offs] & MT_EE_WIFI_CAL_GROUP))
+ 		return 0;
+ 
+ 	/*
+@@ -3241,9 +3242,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+ 	return -1;
+ }
+ 
+-static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
++static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
+ {
+-	static const u16 freq_list[] = {
++	static const u16 freq_list_v1[] = {
+ 		5180, 5200, 5220, 5240,
+ 		5260, 5280, 5300, 5320,
+ 		5500, 5520, 5540, 5560,
+@@ -3251,65 +3252,102 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+ 		5660, 5680, 5700, 5745,
+ 		5765, 5785, 5805, 5825
+ 	};
+-	int offset_2g = ARRAY_SIZE(freq_list);
++	static const u16 freq_list_v2[] = {
++		/* 6G BW20*/
++		5955, 5975, 5995, 6015,
++		6035, 6055, 6075, 6095,
++		6115, 6135, 6155, 6175,
++		6195, 6215, 6235, 6255,
++		6275, 6295, 6315, 6335,
++		6355, 6375, 6395, 6415,
++		6435, 6455, 6475, 6495,
++		6515, 6535, 6555, 6575,
++		6595, 6615, 6635, 6655,
++		6675, 6695, 6715, 6735,
++		6755, 6775, 6795, 6815,
++		6835, 6855, 6875, 6895,
++		6915, 6935, 6955, 6975,
++		6995, 7015, 7035, 7055,
++		7075, 7095, 7115,
++		/* 6G BW160 */
++		6025, 6185, 6345, 6505,
++		6665, 6825, 6985,
++		/* 5G BW20 */
++		5180, 5200, 5220, 5240,
++		5260, 5280, 5300, 5320,
++		5500, 5520, 5540, 5560,
++		5580, 5600, 5620, 5640,
++		5660, 5680, 5700, 5720,
++		5745, 5765, 5785, 5805,
++		5825, 5845, 5865, 5885,
++		/* 5G BW160 */
++		5250, 5570, 5815
++	};
++	static const u16 *freq_list = freq_list_v1;
++	int n_freqs = ARRAY_SIZE(freq_list_v1);
+ 	int idx;
+ 
++	if (!is_mt7915(&dev->mt76)) {
++		freq_list = freq_list_v2;
++		n_freqs = ARRAY_SIZE(freq_list_v2);
++	}
++
+ 	if (freq < 4000) {
+ 		if (freq < 2432)
+-			return offset_2g;
++			return n_freqs;
+ 		if (freq < 2457)
+-			return offset_2g + 1;
++			return n_freqs + 1;
+ 
+-		return offset_2g + 2;
++		return n_freqs + 2;
+ 	}
+ 
+-	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
++	if (bw == NL80211_CHAN_WIDTH_80P80)
+ 		return -1;
+ 
+ 	if (bw != NL80211_CHAN_WIDTH_20) {
+-		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
+-					   freq + 10);
++		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq + 10);
+ 		if (idx >= 0)
+ 			return idx;
+ 
+-		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
+-					   freq - 10);
++		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq - 10);
+ 		if (idx >= 0)
+ 			return idx;
+ 	}
+ 
+-	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
++	return mt7915_find_freq_idx(freq_list, n_freqs, freq);
+ }
+ 
+ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
+-	u16 total = 2, center_freq = chandef->center_freq1;
++	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
++	u16 center_freq = chandef->center_freq1;
+ 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
++	u8 cal_num = is_mt7915(&dev->mt76) ? 2 : 3;
+ 	int idx;
+ 
+-	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
++	if (1 || !(eep[offs] & MT_EE_WIFI_CAL_DPD))
+ 		return 0;
+ 
+-	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
++	idx = mt7915_dpd_freq_idx(dev, center_freq, chandef->width);
+ 	if (idx < 0)
+ 		return -EINVAL;
+ 
+ 	/* Items: Tx DPD, Tx Flatness */
+-	idx = idx * 2;
+-	cal += MT_EE_CAL_GROUP_SIZE;
++	idx = idx * cal_num;
++	cal += mt7915_get_cal_group_size(dev) + (idx * MT_EE_CAL_UNIT);
+ 
+-	while (total--) {
++	while (cal_num--) {
+ 		int ret;
+ 
+-		cal += (idx * MT_EE_CAL_UNIT);
+ 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
+ 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
+ 		if (ret)
+ 			return ret;
+ 
+ 		idx++;
++		cal += MT_EE_CAL_UNIT;
+ 	}
+ 
+ 	return 0;
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/3000-mt76-remove-WED-support-patch-for-build-err.patch b/recipes-kernel/linux-mt76/files/patches/3000-mt76-remove-WED-support-patch-for-build-err.patch
index 26fd886..d637999 100644
--- a/recipes-kernel/linux-mt76/files/patches/3000-mt76-remove-WED-support-patch-for-build-err.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3000-mt76-remove-WED-support-patch-for-build-err.patch
@@ -1,9 +1,8 @@
-From 1100bd66f9de10e2091d6640d8d9952d12891a42 Mon Sep 17 00:00:00 2001
+From 7caf2dd34d38bd98b5b1087c0f00ccdb009a461a Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Tue, 12 Apr 2022 15:58:28 +0800
+Date: Mon, 6 Jun 2022 20:22:35 +0800
 Subject: [PATCH] mt76:remove WED support patch for build err
 
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  dma.c           | 160 ++++++++++--------------------------------------
  mac80211.c      |   4 +-
@@ -24,9 +23,10 @@
  mt7921/dma.c    |   2 +-
  tx.c            |  16 +----
  18 files changed, 94 insertions(+), 497 deletions(-)
+ mode change 100644 => 100755 mt7915/mcu.c
 
 diff --git a/dma.c b/dma.c
-index 30de8be4..83787fc0 100644
+index f6f5f129..3f7456b1 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -7,36 +7,9 @@
@@ -105,7 +105,7 @@
  static int
  mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
  		 struct mt76_queue_buf *buf, int nbufs, u32 info,
-@@ -483,85 +486,6 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -482,85 +485,6 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	return frames;
  }
  
@@ -191,7 +191,7 @@
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
-@@ -643,29 +567,14 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -642,29 +566,14 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  static int
  mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  {
@@ -222,7 +222,7 @@
  		data = mt76_dma_dequeue(dev, q, false, &len, &info, &more);
  		if (!data)
  			break;
-@@ -806,8 +715,5 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -805,8 +714,5 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  	}
  
  	mt76_free_pending_txwi(dev);
@@ -232,10 +232,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 diff --git a/mac80211.c b/mac80211.c
-index e17b04b1..1b9a400b 100644
+index 4b4d8b99..19a2b849 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1594,7 +1594,7 @@ EXPORT_SYMBOL_GPL(mt76_get_antenna);
+@@ -1600,7 +1600,7 @@ EXPORT_SYMBOL_GPL(mt76_get_antenna);
  
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
@@ -244,7 +244,7 @@
  {
  	struct mt76_queue *hwq;
  	int err;
-@@ -1603,8 +1603,6 @@ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
+@@ -1609,8 +1609,6 @@ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
  	if (!hwq)
  		return ERR_PTR(-ENOMEM);
  
@@ -274,7 +274,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_set_irq_mask);
 diff --git a/mt76.h b/mt76.h
-index 768880f0..31671387 100644
+index 062c5ce4..ed1924c1 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -13,7 +13,6 @@
@@ -321,7 +321,7 @@
  };
  
  struct mt76_rx_status {
-@@ -785,7 +769,6 @@ struct mt76_dev {
+@@ -782,7 +766,6 @@ struct mt76_dev {
  
  	spinlock_t token_lock;
  	struct idr token;
@@ -329,7 +329,7 @@
  	u16 token_count;
  	u16 token_size;
  
-@@ -1011,14 +994,14 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
+@@ -1008,14 +991,14 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
  
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
@@ -347,7 +347,7 @@
  	if (IS_ERR(q))
  		return PTR_ERR(q);
  
-@@ -1033,7 +1016,7 @@ static inline int mt76_init_mcu_queue(struct mt76_dev *dev, int qid, int idx,
+@@ -1030,7 +1013,7 @@ static inline int mt76_init_mcu_queue(struct mt76_dev *dev, int qid, int idx,
  {
  	struct mt76_queue *q;
  
@@ -527,10 +527,10 @@
  		return ret;
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 588c0d58..f3049639 100644
+index bae700eb..094d10a5 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1380,29 +1380,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1413,29 +1413,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	return 0;
  }
  
@@ -560,7 +560,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1436,7 +1413,7 @@ mt7915_txp_skb_unmap(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+@@ -1469,7 +1446,7 @@ mt7915_txp_skb_unmap(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  
  	txp = mt7915_txwi_to_txp(dev, t);
  	for (i = 0; i < txp->nbuf; i++)
@@ -569,7 +569,7 @@
  				 le16_to_cpu(txp->len[i]), DMA_TO_DEVICE);
  }
  
-@@ -1445,7 +1422,6 @@ mt7915_txwi_free(struct mt7915_dev *dev, struct mt76_txwi_cache *t,
+@@ -1478,7 +1455,6 @@ mt7915_txwi_free(struct mt7915_dev *dev, struct mt76_txwi_cache *t,
  		 struct ieee80211_sta *sta, struct list_head *free_list)
  {
  	struct mt76_dev *mdev = &dev->mt76;
@@ -577,7 +577,7 @@
  	struct mt76_wcid *wcid;
  	__le32 *txwi;
  	u16 wcid_idx;
-@@ -1458,24 +1434,13 @@ mt7915_txwi_free(struct mt7915_dev *dev, struct mt76_txwi_cache *t,
+@@ -1491,24 +1467,13 @@ mt7915_txwi_free(struct mt7915_dev *dev, struct mt76_txwi_cache *t,
  	if (sta) {
  		wcid = (struct mt76_wcid *)sta->drv_priv;
  		wcid_idx = wcid->idx;
@@ -605,7 +605,7 @@
  	__mt76_tx_complete_skb(mdev, wcid_idx, t->skb, free_list);
  
  out:
-@@ -1483,56 +1448,30 @@ out:
+@@ -1516,56 +1481,30 @@ out:
  	mt76_put_txwi(mdev, t);
  }
  
@@ -671,7 +671,7 @@
  
  	total = le16_get_bits(free->ctrl, MT_TX_FREE_MSDU_CNT);
  	v3 = (FIELD_GET(MT_TX_FREE_VER, txd) == 0x4);
-@@ -1589,38 +1528,17 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1622,38 +1561,17 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		}
  	}
  
@@ -717,7 +717,7 @@
  }
  
  static bool
-@@ -1800,9 +1718,6 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
+@@ -1833,9 +1751,6 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
  	case PKT_TYPE_TXRX_NOTIFY:
  		mt7915_mac_tx_free(dev, data, len);
  		return false;
@@ -727,7 +727,7 @@
  	case PKT_TYPE_TXS:
  		for (rxd += 2; rxd + 8 <= end; rxd += 8)
  		    mt7915_mac_add_txs(dev, rxd);
-@@ -1830,10 +1745,6 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1863,10 +1778,6 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		mt7915_mac_tx_free(dev, skb->data, skb->len);
  		napi_consume_skb(skb, 1);
  		break;
@@ -759,10 +759,10 @@
  #define MT_TX_FREE_LATENCY		GENMASK(12, 0)
  /* 0: success, others: dropped */
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 87f4c5ab..ffc2ed0d 100644
+index 2d5a46d3..7da3eada 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1405,39 +1405,6 @@ out:
+@@ -1421,39 +1421,6 @@ out:
  	return ret;
  }
  
@@ -802,7 +802,7 @@
  const struct ieee80211_ops mt7915_ops = {
  	.tx = mt7915_tx,
  	.start = mt7915_start,
-@@ -1485,7 +1452,4 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1501,7 +1468,4 @@ const struct ieee80211_ops mt7915_ops = {
  	.sta_add_debugfs = mt7915_sta_add_debugfs,
  #endif
  	.set_radar_background = mt7915_set_radar_background,
@@ -811,10 +811,12 @@
 -#endif
  };
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d547cf6f..562f3346 100755
+old mode 100644
+new mode 100755
+index 2b9797c8..9da3e85c
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2575,9 +2575,6 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2656,9 +2656,6 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -825,10 +827,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b3de3a7a..3768c1a6 100644
+index 995c9ee0..4d196d74 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -555,21 +555,15 @@ static void mt7915_rx_poll_complete(struct mt76_dev *mdev,
+@@ -560,21 +560,15 @@ static void mt7915_rx_poll_complete(struct mt76_dev *mdev,
  static void mt7915_irq_tasklet(struct tasklet_struct *t)
  {
  	struct mt7915_dev *dev = from_tasklet(dev, t, irq_tasklet);
@@ -856,7 +858,7 @@
  
  	if (dev->hif2) {
  		intr1 = mt76_rr(dev, MT_INT1_SOURCE_CSR);
-@@ -623,15 +617,10 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+@@ -628,15 +622,10 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
  {
  	struct mt7915_dev *dev = dev_instance;
@@ -876,10 +878,10 @@
  	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
  		return IRQ_NONE;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b78b1a9a..fca0bfcb 100644
+index 90391a07..02a8c424 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -517,8 +517,6 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -541,8 +541,6 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
@@ -889,7 +891,7 @@
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
 diff --git a/mt7915/pci.c b/mt7915/pci.c
-index f6222ef1..1bab1cbb 100644
+index d74f6097..7cea49f2 100644
 --- a/mt7915/pci.c
 +++ b/mt7915/pci.c
 @@ -12,9 +12,6 @@
@@ -1010,9 +1012,9 @@
 -		goto free_wed_or_irq_vector;
 +		goto free_irq_vector;
  
- 	mt76_wr(dev, MT_INT_MASK_CSR, 0);
- 
-@@ -253,11 +174,8 @@ free_hif2:
+ 	/* master switch of PCIe tnterrupt enable */
+ 	mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
+@@ -251,11 +172,8 @@ free_hif2:
  	if (dev->hif2)
  		put_device(dev->hif2->dev);
  	devm_free_irq(mdev->dev, irq, dev);
@@ -1027,10 +1029,10 @@
  	mt76_free_device(&dev->mt76);
  
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 99834310..02d097fa 100644
+index 444440e1..1e7fbcee 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -591,31 +591,18 @@ enum offs_rev {
+@@ -603,31 +603,18 @@ enum offs_rev {
  
  /* WFDMA CSR */
  #define MT_WFDMA_EXT_CSR_BASE		__REG(WFDMA_EXT_CSR_ADDR)
diff --git a/recipes-kernel/linux-mt76/files/patches/patches.inc b/recipes-kernel/linux-mt76/files/patches/patches.inc
index da8acdd..5407a8a 100644
--- a/recipes-kernel/linux-mt76/files/patches/patches.inc
+++ b/recipes-kernel/linux-mt76/files/patches/patches.inc
@@ -4,37 +4,23 @@
     file://0002-mt76-testmode-rework-tx-antenna-setting.patch \
     file://0003-mt76-mt7915-rework-rx-testmode-stats.patch \
     file://0004-mt76-mt7915-fix-tx-descriptor.patch \
-    file://0007-mt76-mt7915-update-mt7986-CR-for-different-adie-vers.patch \
-    file://0009-mt76-mt7915-fix-table_mask-to-u16.patch \
-    file://0012-mt76-mt7915-reject-duplicated-twt-flow.patch \
-    file://0014-mt76-mt7915-limit-minimum-twt-duration-due-to-hw-lim.patch \
-    file://0015-mt76-mt7915-drop-undefined-action-frame.patch \
-    file://0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch \
-    file://0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch \
-    file://0018-mt76-mt7915-add-support-for-6G-in-band-discovery.patch \
-    file://0019-mt76-mt7915-add-the-maximum-size-of-beacon-offload.patch \
+    file://0005-mt76-mt7915-drop-undefined-action-frame.patch \
+    file://0006-mt76-mt7915-add-the-maximum-size-of-beacon-offload.patch \
+    file://0007-mt76-mt7915-update-mpdu-density-in-6g-capability.patch \
+    file://0008-mt76-common-RF-CR-idx-require-8-bits.patch \
     file://100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
     file://1003-mt76-mt7915-air-monitor-support.patch \
     file://1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch \
     file://1005-mt76-certification-patches.patch \
-    file://1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch \
-    file://1009-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch \
-    file://1100-mt76-testmode-support-eeprom-handle.patch \
-    file://1101-mt76-enable-more-5g-channels.patch \
-    file://1102-mt76-testmode-add-attributes-for-setting-rf-config.patch \
-    file://1103-mt76-mt7915-implement-config-set-in-testmode.patch \
-    file://1104-mt76-testmode-add-attributes-to-support-off-channel-.patch \
-    file://1105-mt76-mt7915-add-off-channel-scan-support-in-testmode.patch \
-    file://1106-mt76-testmode-add-virtual-stations-support.patch \
-    file://1107-mt76-testmode-support-to-dump-stats-from-different-v.patch \
-    file://1108-mt76-testmode-rework-the-flow-of-init-tx-skb.patch \
-    file://1109-mt76-testmode-add-support-to-queue-skb-of-multiple-s.patch \
-    file://1110-mt76-mt7915-implement-aid-support-in-testmode.patch \
-    file://1111-mt76-tool-add-more-commands.patch \
-    file://1113-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1114-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch \
-    file://1115-mt76-airtime-fairness-feature-off-in-mac80211.patch \
+    file://1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch \
+    file://1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch \
+    file://1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
+    file://1111-mt76-testmode-additional-supports.patch \
+    file://1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
+    file://1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch \
+    file://1114-mt76-airtime-fairness-feature-off-in-mac80211.patch \
+    file://1115-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
     file://3000-mt76-remove-WED-support-patch-for-build-err.patch \
     "
diff --git a/recipes-kernel/linux-mt76/linux-mt76.bb b/recipes-kernel/linux-mt76/linux-mt76.bb
index e218a39..7d5d610 100644
--- a/recipes-kernel/linux-mt76/linux-mt76.bb
+++ b/recipes-kernel/linux-mt76/linux-mt76.bb
@@ -7,7 +7,7 @@
 
 PV = "1.0"
 
-SRCREV ?= "a666d5637bc3afd3e310be09fac048906560097b"
+SRCREV ?= "1d8af168e86fa4087351b7d10572accd5dee4d36"
 SRC_URI = " \
     git://git@github.com/openwrt/mt76.git;protocol=https \
     file://COPYING;subdir=git \