diff --git a/recipes-wifi/atenl/files/iwpriv.sh b/recipes-wifi/atenl/files/iwpriv.sh
index a29c765..a9bcfab 100644
--- a/recipes-wifi/atenl/files/iwpriv.sh
+++ b/recipes-wifi/atenl/files/iwpriv.sh
@@ -101,6 +101,10 @@
             SOC_start_idx="1"
             SOC_end_idx="2"
             is_connac3="0"
+        elif [ ! -z "$(head -c 2 ${eeprom_file} | hexdump | grep "7981")" ]; then
+            SOC_start_idx="0"
+            SOC_end_idx="1"
+            is_connac3="0"
         elif [ ! -z "$(head -c 2 ${eeprom_file} | hexdump | grep "7986")" ]; then
             SOC_start_idx="0"
             SOC_end_idx="1"
@@ -116,7 +120,7 @@
         else
             echo "Interface Conversion Failed!"
             echo "Please use iwpriv <phy0/phy1/..> set <...> or configure the sku of your board manually by the following commands"
-            echo "For AX6000:"
+            echo "For AX3000/AX6000:"
             echo "      echo STARTIDX=0 >> ${interface_file}"
             echo "      echo ENDIDX=1 >> ${interface_file}"
             echo "      echo IS_CONNAC3=0 >> ${interface_file}"
diff --git a/recipes-wifi/atenl/files/src/atenl.h b/recipes-wifi/atenl/files/src/atenl.h
index 60feaf4..a5f9fbb 100644
--- a/recipes-wifi/atenl/files/src/atenl.h
+++ b/recipes-wifi/atenl/files/src/atenl.h
@@ -270,7 +270,7 @@
 	MT_EE_BAND_SEL_DUAL,
 };
 
-/* for mt7916/mt7986 */
+/* for mt7916/mt7981/mt7986 */
 enum {
 	MT_EE_BAND_SEL_2G,
 	MT_EE_BAND_SEL_5G,
@@ -400,6 +400,11 @@
 	return (an->chip_id == 0x7916) || (an->chip_id == 0x7906);
 }
 
+static inline bool is_mt7981(struct atenl *an)
+{
+	return an->chip_id == 0x7981;
+}
+
 static inline bool is_mt7986(struct atenl *an)
 {
 	return an->chip_id == 0x7986;
diff --git a/recipes-wifi/atenl/files/src/eeprom.c b/recipes-wifi/atenl/files/src/eeprom.c
index 10720d0..d112dc7 100644
--- a/recipes-wifi/atenl/files/src/eeprom.c
+++ b/recipes-wifi/atenl/files/src/eeprom.c
@@ -18,10 +18,10 @@
 
 	/* reserve space for pre-cal data in flash mode */
 	if (flash_mode) {
-		atenl_dbg("%s: init eeprom with flash mode\n", __func__);
+		atenl_dbg("%s: init eeprom with flash / binfile mode\n", __func__);
 		max_len = EEPROM_PART_SIZE;
 	} else {
-		atenl_dbg("%s: init eeprom with efuse mode\n", __func__);
+		atenl_dbg("%s: init eeprom with efuse / default bin mode\n", __func__);
 		max_len = 0x1e00;
 	}
 
@@ -117,7 +117,7 @@
 
 	if (is_mt7915(an)) {
 		an->adie_id = 0x7975;
-	} else if (is_mt7916(an)) {
+	} else if (is_mt7916(an) || is_mt7981(an)) {
 		an->adie_id = 0x7976;
 	} else if (is_mt7986(an)) {
 		bool is_7975 = false;
@@ -164,6 +164,7 @@
 		break;
 	case 0x7906:
 	case 0x7916:
+	case 0x7981:
 	case 0x7986:
 		an->eeprom_size = 4096;
 		an->eeprom_prek_offs = 0x19a;
@@ -209,7 +210,7 @@
 			anb->valid = true;
 			anb->cap = BAND_TYPE_5G;
 		}
-	} else if (is_mt7916(an) || is_mt7986(an)) {
+	} else if (is_mt7916(an) || is_mt7981(an) || is_mt7986(an)) {
 		struct atenl_band *anb;
 		u8 val, band_sel;
 		int i;
@@ -316,6 +317,10 @@
 		an->anb[0].chainmask = 0x3;
 		an->anb[1].chainmask = 0x3;
 		break;
+	case 0x7981:
+		an->anb[0].chainmask = 0x3;
+		an->anb[1].chainmask = 0x7;
+		break;
 	case 0x7986:
 		an->anb[0].chainmask = 0xf;
 		an->anb[1].chainmask = 0xf;
@@ -419,31 +424,27 @@
 
 int atenl_eeprom_write_mtd(struct atenl *an)
 {
-	bool flash_mode = an->mtd_part != NULL;
+#define TMP_FILE	"/tmp/tmp_eeprom.bin"
 	pid_t pid;
-	char offset[10];
+	u32 size = an->eeprom_size;
+	u32 *precal_info = an->eeprom_data + an->eeprom_size;
+	u32 precal_size = precal_info[0] + precal_info[1];
+	char cmd[100];
 
-	if (!flash_mode)
+	if (an->mtd_part == NULL || !(~an->mtd_offset))
 		return 0;
 
-	pid = fork();
-	if (pid < 0) {
-		perror("Fork");
-		return EXIT_FAILURE;
-	} else if (pid == 0) {
-		int ret;
-		char *part = strdup(an->mtd_part);
-		snprintf(offset, sizeof(offset), "%d", an->mtd_offset);
-		char *cmd[] = {"mtd", "-p", offset, "write", eeprom_file, part, NULL};
+	if (precal_size)
+		size += PRE_CAL_INFO + precal_size;
 
-		ret = execvp("mtd", cmd);
-		if (ret < 0) {
-			atenl_err("%s: exec error\n", __func__);
-			exit(0);
-		}
-	} else {
-		wait(&pid);
-	}
+	sprintf(cmd, "dd if=%s of=%s bs=1 count=%d", eeprom_file, TMP_FILE, size);
+	system(cmd);
+
+	sprintf(cmd, "mtd -p %d write %s %s", an->mtd_offset, TMP_FILE, an->mtd_part);
+	system(cmd);
+
+	sprintf(cmd, "rm %s", TMP_FILE);
+	system(cmd);
 
 	return 0;
 }
@@ -498,12 +499,9 @@
 
 void atenl_eeprom_cmd_handler(struct atenl *an, u8 phy_idx, char *cmd)
 {
-	bool flash_mode;
-
 	an->cmd_mode = true;
 
 	atenl_eeprom_init(an, phy_idx);
-	flash_mode = an->mtd_part != NULL;
 
 	if (!strncmp(cmd, "sync eeprom all", 15)) {
 		atenl_eeprom_write_mtd(an);
@@ -520,7 +518,11 @@
 			unlink(eeprom_file);
 		} else if (!strncmp(s, "file", 4)) {
 			atenl_info("%s\n", eeprom_file);
-			atenl_info("Flash mode: %d\n", flash_mode);
+			if (an->mtd_part != NULL)
+				atenl_info("%s mode\n",
+					   ~an->mtd_offset == 0 ? "Binfile" : "Flash");
+			else
+				atenl_info("Efuse / Default bin mode\n");
 		} else if (!strncmp(s, "set", 3)) {
 			u32 offset, val;
 
diff --git a/recipes-wifi/hostapd/files/003-rdkb-uc-script-support.patch b/recipes-wifi/hostapd/files/003-rdkb-uc-script-support.patch
index a6d1aba..09183c1 100644
--- a/recipes-wifi/hostapd/files/003-rdkb-uc-script-support.patch
+++ b/recipes-wifi/hostapd/files/003-rdkb-uc-script-support.patch
@@ -1,28 +1,17 @@
-From 85f654326e723173bc1c8329624ecbf75a0f98be Mon Sep 17 00:00:00 2001
+From f02136395a9d534f3255a7ee1232aa9554c3e01c Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
-Date: Wed, 25 Oct 2023 16:20:01 +0800
+Date: Tue, 14 Nov 2023 16:40:57 +0800
 Subject: [PATCH] rdkb uc script support
 
 ---
- common.uc         | 22 ++++++++++++----------
- hostapd.uc        |  6 +++---
- wdev.uc           | 20 ++++++++++----------
- wpa_supplicant.uc |  4 ++--
- 4 files changed, 27 insertions(+), 25 deletions(-)
+ common.uc | 2 ++
+ 1 file changed, 2 insertions(+)
 
 diff --git a/common.uc b/common.uc
-index ccffe3e..2b48d3e 100644
+index 4c33779..ee30df9 100644
 --- a/common.uc
 +++ b/common.uc
-@@ -1,6 +1,6 @@
- import * as nl80211 from "nl80211";
- import * as rtnl from "rtnl";
--import { readfile, glob, basename, readlink } from "fs";
-+import * as fs from "fs";
- 
- const iftypes = {
- 	ap: nl80211.const.NL80211_IFTYPE_AP,
-@@ -19,12 +19,14 @@ function __phy_is_fullmac(phyidx)
+@@ -49,6 +49,8 @@ function __phy_is_fullmac(phyidx)
  {
  	let data = nl80211.request(nl80211.const.NL80211_CMD_GET_WIPHY, 0, { wiphy: phyidx });
  
@@ -31,198 +20,6 @@
  	return !data.software_iftypes.ap_vlan;
  }
  
- function phy_is_fullmac(phy)
- {
--	let phyidx = int(trim(readfile(`/sys/class/ieee80211/${phy}/index`)));
-+	let phyidx = int(trim(fs.readfile(`/sys/class/ieee80211/${phy}/index`)));
- 
- 	return __phy_is_fullmac(phyidx);
- }
-@@ -39,14 +41,14 @@ function find_reusable_wdev(phyidx)
- 		nl80211.const.NLM_F_DUMP,
- 		{ wiphy: phyidx });
- 	for (let res in data)
--		if (trim(readfile(`/sys/class/net/${res.ifname}/operstate`)) == "down")
-+		if (trim(fs.readfile(`/sys/class/net/${res.ifname}/operstate`)) == "down")
- 			return res.ifname;
- 	return null;
- }
- 
- function wdev_create(phy, name, data)
- {
--	let phyidx = int(readfile(`/sys/class/ieee80211/${phy}/index`));
-+	let phyidx = int(fs.readfile(`/sys/class/ieee80211/${phy}/index`));
- 
- 	wdev_remove(name);
- 
-@@ -96,7 +98,7 @@ function wdev_create(phy, name, data)
- 
- function phy_sysfs_file(phy, name)
- {
--	return trim(readfile(`/sys/class/ieee80211/${phy}/${name}`));
-+	return trim(fs.readfile(`/sys/class/ieee80211/${phy}/${name}`));
- }
- 
- function macaddr_split(str)
-@@ -111,7 +113,7 @@ function macaddr_join(addr)
- 
- function wdev_macaddr(wdev)
- {
--	return trim(readfile(`/sys/class/net/${wdev}/address`));
-+	return trim(fs.readfile(`/sys/class/net/${wdev}/address`));
- }
- 
- const phy_proto = {
-@@ -221,10 +223,10 @@ const phy_proto = {
- 	},
- 
- 	for_each_wdev: function(cb) {
--		let wdevs = glob(`/sys/class/ieee80211/${this.name}/device/net/*`);
--		wdevs = map(wdevs, (arg) => basename(arg));
-+		let wdevs = fs.glob(`/sys/class/ieee80211/${this.name}/device/net/*`);
-+		wdevs = map(wdevs, (arg) => fs.basename(arg));
- 		for (let wdev in wdevs) {
--			if (basename(readlink(`/sys/class/net/${wdev}/phy80211`)) != this.name)
-+			if (fs.basename(fs.readlink(`/sys/class/net/${wdev}/phy80211`)) != this.name)
- 				continue;
- 
- 			cb(wdev);
-@@ -234,7 +236,7 @@ const phy_proto = {
- 
- function phy_open(phy)
- {
--	let phyidx = readfile(`/sys/class/ieee80211/${phy}/index`);
-+	let phyidx = fs.readfile(`/sys/class/ieee80211/${phy}/index`);
- 	if (!phyidx)
- 		return null;
- 
-diff --git a/hostapd.uc b/hostapd.uc
-index 1bce754..5f5ca35 100644
---- a/hostapd.uc
-+++ b/hostapd.uc
-@@ -1,5 +1,5 @@
- let libubus = require("ubus");
--import { open, readfile } from "fs";
-+import * as fs from "fs";
- import { wdev_create, wdev_remove, is_equal, vlist_new, phy_is_fullmac, phy_open } from "common";
- 
- let ubus = libubus.connect();
-@@ -562,7 +562,7 @@ function config_add_bss(config, name)
- 
- function iface_load_config(filename)
- {
--	let f = open(filename, "r");
-+	let f = fs.open(filename, "r");
- 	if (!f)
- 		return null;
- 
-@@ -620,7 +620,7 @@ function iface_load_config(filename)
- 		}
- 
- 		if (hostapd.data.file_fields[val[0]])
--			bss.hash[val[0]] = hostapd.sha1(readfile(val[1]));
-+			bss.hash[val[0]] = hostapd.sha1(fs.readfile(val[1]));
- 
- 		push(bss.data, line);
- 	}
-diff --git a/wdev.uc b/wdev.uc
-index cf438f7..5eb5e3c 100644
---- a/wdev.uc
-+++ b/wdev.uc
-@@ -1,7 +1,7 @@
- #!/usr/bin/env ucode
- 'use strict';
- import { vlist_new, is_equal, wdev_create, wdev_remove, phy_open } from "/usr/share/hostap/common.uc";
--import { readfile, writefile, basename, readlink, glob } from "fs";
-+import * as fs from "fs";
- let libubus = require("ubus");
- 
- let keep_devices = {};
-@@ -32,7 +32,7 @@ function iface_start(wdev)
- {
- 	let ifname = wdev.ifname;
- 
--	if (readfile(`/sys/class/net/${ifname}/ifindex`)) {
-+	if (fs.readfile(`/sys/class/net/${ifname}/ifindex`)) {
- 		system([ "ip", "link", "set", "dev", ifname, "down" ]);
- 		wdev_remove(ifname);
- 	}
-@@ -89,7 +89,7 @@ function iface_cb(new_if, old_if)
- function drop_inactive(config)
- {
- 	for (let key in config) {
--		if (!readfile(`/sys/class/net/${key}/ifindex`))
-+		if (!fs.readfile(`/sys/class/net/${key}/ifindex`))
- 			delete config[key];
- 	}
- }
-@@ -108,23 +108,23 @@ function delete_ifname(config)
- 
- function add_existing(phy, config)
- {
--	let wdevs = glob(`/sys/class/ieee80211/${phy}/device/net/*`);
--	wdevs = map(wdevs, (arg) => basename(arg));
-+	let wdevs = fs.glob(`/sys/class/ieee80211/${phy}/device/net/*`);
-+	wdevs = map(wdevs, (arg) => fs.basename(arg));
- 	for (let wdev in wdevs) {
- 		if (config[wdev])
- 			continue;
- 
--		if (basename(readlink(`/sys/class/net/${wdev}/phy80211`)) != phy)
-+		if (fs.basename(fs.readlink(`/sys/class/net/${wdev}/phy80211`)) != phy)
- 			continue;
- 
--		if (trim(readfile(`/sys/class/net/${wdev}/operstate`)) == "down")
-+		if (trim(fs.readfile(`/sys/class/net/${wdev}/operstate`)) == "down")
- 			config[wdev] = {};
- 	}
- }
- 
- function usage()
- {
--	warn(`Usage: ${basename(sourcepath())} <phy> <command> [<arguments>]
-+	warn(`Usage: ${fs.basename(sourcepath())} <phy> <command> [<arguments>]
- 
- Commands:
- 	set_config <config> [<device]...] - set phy configuration
-@@ -150,7 +150,7 @@ const commands = {
- 			exit(1);
- 		}
- 
--		let old_config = readfile(statefile);
-+		let old_config = fs.readfile(statefile);
- 		if (old_config)
- 			old_config = json(old_config);
- 
-@@ -175,7 +175,7 @@ const commands = {
- 
- 		drop_inactive(config.data);
- 		delete_ifname(config.data);
--		writefile(statefile, sprintf("%J", config.data));
-+		fs.writefile(statefile, sprintf("%J", config.data));
- 	},
- 	get_macaddr: function(args) {
- 		let data = {};
-diff --git a/wpa_supplicant.uc b/wpa_supplicant.uc
-index 2a9de67..cd149dc 100644
---- a/wpa_supplicant.uc
-+++ b/wpa_supplicant.uc
-@@ -1,5 +1,5 @@
- let libubus = require("ubus");
--import { open, readfile } from "fs";
-+import * as fs from "fs";
- import { wdev_create, wdev_remove, is_equal, vlist_new, phy_open } from "common";
- 
- let ubus = libubus.connect();
-@@ -62,7 +62,7 @@ function iface_cb(new_if, old_if)
- 
- function prepare_config(config)
- {
--	config.config_data = readfile(config.config);
-+	config.config_data = fs.readfile(config.config);
- 
- 	return { config: config };
- }
 -- 
 2.18.0
 
diff --git a/recipes-wifi/hostapd/files/common.uc b/recipes-wifi/hostapd/files/common.uc
index ccffe3e..4c33779 100644
--- a/recipes-wifi/hostapd/files/common.uc
+++ b/recipes-wifi/hostapd/files/common.uc
@@ -10,6 +10,36 @@
 	monitor: nl80211.const.NL80211_IFTYPE_MONITOR,
 };
 
+const mesh_params = {
+	mesh_retry_timeout: "retry_timeout",
+	mesh_confirm_timeout: "confirm_timeout",
+	mesh_holding_timeout: "holding_timeout",
+	mesh_max_peer_links: "max_peer_links",
+	mesh_max_retries: "max_retries",
+	mesh_ttl: "ttl",
+	mesh_element_ttl: "element_ttl",
+	mesh_auto_open_plinks: "auto_open_plinks",
+	mesh_hwmp_max_preq_retries: "hwmp_max_preq_retries",
+	mesh_path_refresh_time: "path_refresh_time",
+	mesh_min_discovery_timeout: "min_discovery_timeout",
+	mesh_hwmp_active_path_timeout: "hwmp_active_path_timeout",
+	mesh_hwmp_preq_min_interval: "hwmp_preq_min_interval",
+	mesh_hwmp_net_diameter_traversal_time: "hwmp_net_diam_trvs_time",
+	mesh_hwmp_rootmode: "hwmp_rootmode",
+	mesh_hwmp_rann_interval: "hwmp_rann_interval",
+	mesh_gate_announcements: "gate_announcements",
+	mesh_sync_offset_max_neighor: "sync_offset_max_neighbor",
+	mesh_rssi_threshold: "rssi_threshold",
+	mesh_hwmp_active_path_to_root_timeout: "hwmp_path_to_root_timeout",
+	mesh_hwmp_root_interval: "hwmp_root_interval",
+	mesh_hwmp_confirmation_interval: "hwmp_confirmation_interval",
+	mesh_awake_window: "awake_window",
+	mesh_plink_timeout: "plink_timeout",
+	mesh_fwding: "forwarding",
+	mesh_power_mode: "power_mode",
+	mesh_nolearn: "nolearn"
+};
+
 function wdev_remove(name)
 {
 	nl80211.request(nl80211.const.NL80211_CMD_DEL_INTERFACE, 0, { dev: name });
@@ -94,6 +124,31 @@
 	return null;
 }
 
+function wdev_set_mesh_params(name, data)
+{
+	let mesh_cfg = {};
+
+	for (let key in mesh_params) {
+		let val = data[key];
+		if (val == null)
+			continue;
+		mesh_cfg[mesh_params[key]] = int(val);
+	}
+
+	if (!length(mesh_cfg))
+		return null;
+
+	nl80211.request(nl80211.const.NL80211_CMD_SET_MESH_CONFIG, 0,
+		{ dev: name, mesh_params: mesh_cfg });
+
+	return nl80211.error();
+}
+
+function wdev_set_up(name, up)
+{
+	rtnl.request(rtnl.const.RTM_SETLINK, 0, { dev: name, change: 1, flags: up ? 1 : 0 });
+}
+
 function phy_sysfs_file(phy, name)
 {
 	return trim(readfile(`/sys/class/ieee80211/${phy}/${name}`));
@@ -315,4 +370,4 @@
 		}, vlist_proto);
 }
 
-export { wdev_remove, wdev_create, is_equal, vlist_new, phy_is_fullmac, phy_open };
+export { wdev_remove, wdev_create, wdev_set_mesh_params, wdev_set_up, is_equal, vlist_new, phy_is_fullmac, phy_open };
diff --git a/recipes-wifi/hostapd/files/hostapd.uc b/recipes-wifi/hostapd/files/hostapd.uc
index 1bce754..593840c 100644
--- a/recipes-wifi/hostapd/files/hostapd.uc
+++ b/recipes-wifi/hostapd/files/hostapd.uc
@@ -60,7 +60,6 @@
 function iface_freq_info(iface, config, params)
 {
 	let freq = params.frequency;
-	let bw320_offset = params.bw320_offset;
 	if (!freq)
 		return null;
 
@@ -69,29 +68,25 @@
 		sec_offset = 0;
 
 	let width = 0;
-	if (params.ch_width >= 0){
-		width = params.ch_width;
-	} else {
-		for (let line in config.radio.data) {
-			if (!sec_offset && match(line, /^ht_capab=.*HT40/)) {
-				sec_offset = null; // auto-detect
-				continue;
-			}
+	for (let line in config.radio.data) {
+		if (!sec_offset && match(line, /^ht_capab=.*HT40/)) {
+			sec_offset = null; // auto-detect
+			continue;
+		}
 
-			let val = match(line, /^(vht_oper_chwidth|he_oper_chwidth|eht_oper_chwidth)=(\d+)/);
-			if (!val)
-				continue;
+		let val = match(line, /^(vht_oper_chwidth|he_oper_chwidth)=(\d+)/);
+		if (!val)
+			continue;
 
-			val = int(val[2]);
-			if (val > width)
-				width = val;
-		}
+		val = int(val[2]);
+		if (val > width)
+			width = val;
 	}
 
 	if (freq < 4000)
 		width = 0;
 
-	return hostapd.freq_info(freq, sec_offset, width, bw320_offset);
+	return hostapd.freq_info(freq, sec_offset, width);
 }
 
 function iface_add(phy, config, phy_status)
@@ -576,7 +571,7 @@
 
 	let bss;
 	let line;
-	while ((line = trim(f.read("line"))) != null) {
+	while ((line = rtrim(f.read("line"), "\n")) != null) {
 		let val = split(line, "=", 2);
 		if (!val[0])
 			continue;
@@ -598,7 +593,7 @@
 		push(config.radio.data, line);
 	}
 
-	while ((line = trim(f.read("line"))) != null) {
+	while ((line = rtrim(f.read("line"), "\n")) != null) {
 		if (line == "#default_macaddr")
 			bss.default_macaddr = true;
 
@@ -663,8 +658,6 @@
 			up: true,
 			frequency: 0,
 			sec_chan_offset: 0,
-			ch_width: -1,
-			bw320_offset: 1,
 			csa: true,
 			csa_count: 0,
 		},
@@ -672,15 +665,6 @@
 			if (req.args.up == null || !req.args.phy)
 				return libubus.STATUS_INVALID_ARGUMENT;
 
-			hostapd.printf(`ucode: mtk: apsta state update`);
-			hostapd.printf(`    * phy: ${req.args.phy}`);
-			hostapd.printf(`    * up: ${req.args.up}`);
-			hostapd.printf(`    * freqeuncy: ${req.args.frequency}`);
-			hostapd.printf(`    * sec_chan_offset: ${req.args.sec_chan_offset}`);
-			hostapd.printf(`    * ch_width: ${req.args.ch_width}`);
-			hostapd.printf(`    * bw320_offset: ${req.args.bw320_offset}`);
-			hostapd.printf(`    * csa: ${req.args.csa}`);
-
 			let phy = req.args.phy;
 			let config = hostapd.data.config[phy];
 			if (!config || !config.bss || !config.bss[0] || !config.bss[0].ifname)
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/135-mbedtls-fix-owe-association.patch b/recipes-wifi/hostapd/files/patches-2.10.3/135-mbedtls-fix-owe-association.patch
new file mode 100644
index 0000000..0c29432
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/135-mbedtls-fix-owe-association.patch
@@ -0,0 +1,91 @@
+The code for hostapd-mbedtls did not work when used for OWE association.
+
+When handling association requests, the buffer offsets and length assumptions were incorrect, leading to never calculating the y point, thus denying association.
+
+Also when crafting the association response, the buffer contained the trailing key-type.
+
+Fix up both issues to adhere to the specification and make hostapd-mbedtls work with the OWE security type.
+
+--- a/src/crypto/crypto_mbedtls.c
++++ b/src/crypto/crypto_mbedtls.c
+@@ -2299,25 +2299,30 @@ struct crypto_ecdh * crypto_ecdh_init2(i
+ struct wpabuf * crypto_ecdh_get_pubkey(struct crypto_ecdh *ecdh, int inc_y)
+ {
+ 	mbedtls_ecp_group *grp = &ecdh->grp;
+-	size_t len = CRYPTO_EC_plen(grp);
++	size_t prime_len = CRYPTO_EC_plen(grp);
++	size_t output_len = prime_len;
++	u8 output_offset = 0;
++	u8 buf[256];
++
+   #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
+ 	/* len */
+   #endif
+   #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
+-	if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS)
+-		len = inc_y ? len*2+1 : len+1;
++	if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
++		output_len = inc_y ? prime_len * 2 + 1 : prime_len + 1;
++		output_offset = 1;
++	}
+   #endif
+-	struct wpabuf *buf = wpabuf_alloc(len);
+-	if (buf == NULL)
++
++	if (output_len > sizeof(buf))
+ 		return NULL;
++
+ 	inc_y = inc_y ? MBEDTLS_ECP_PF_UNCOMPRESSED : MBEDTLS_ECP_PF_COMPRESSED;
+-	if (mbedtls_ecp_point_write_binary(grp, &ecdh->Q, inc_y, &len,
+-	                                   wpabuf_mhead_u8(buf), len) == 0) {
+-		wpabuf_put(buf, len);
+-		return buf;
++	if (mbedtls_ecp_point_write_binary(grp, &ecdh->Q, inc_y, &output_len,
++	                                   buf, output_len) == 0) {
++		return wpabuf_alloc_copy(buf + output_offset, output_len - output_offset);
+ 	}
+ 
+-	wpabuf_free(buf);
+ 	return NULL;
+ }
+ 
+@@ -2379,10 +2384,7 @@ struct wpabuf * crypto_ecdh_set_peerkey(
+ 				os_memcpy(buf+2, key, len);
+ 			}
+ 			len >>= 1; /*(repurpose len to prime_len)*/
+-		}
+-		else if (key[0] == 0x02 || key[0] == 0x03) { /* (inc_y == 0) */
+-			--len; /*(repurpose len to prime_len)*/
+-
++		} else { /* (inc_y == 0) */
+ 			/* mbedtls_ecp_point_read_binary() does not currently support
+ 			 * MBEDTLS_ECP_PF_COMPRESSED format (buf[1] = 0x02 or 0x03)
+ 			 * (returns MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) */
+@@ -2390,22 +2392,21 @@ struct wpabuf * crypto_ecdh_set_peerkey(
+ 			/* derive y, amend buf[] with y for UNCOMPRESSED format */
+ 			if (sizeof(buf)-2 < len*2 || len == 0)
+ 				return NULL;
++
+ 			buf[0] = (u8)(1+len*2);
+ 			buf[1] = 0x04;
++			os_memcpy(buf+2, key, len);
++
+ 			mbedtls_mpi bn;
+ 			mbedtls_mpi_init(&bn);
+-			int ret = mbedtls_mpi_read_binary(&bn, key+1, len)
+-			       || crypto_mbedtls_short_weierstrass_derive_y(grp, &bn,
+-			                                                    key[0] & 1)
++			int ret = mbedtls_mpi_read_binary(&bn, key, len)
++			       || crypto_mbedtls_short_weierstrass_derive_y(grp, &bn, 0)
+ 			       || mbedtls_mpi_write_binary(&bn, buf+2+len, len);
+ 			mbedtls_mpi_free(&bn);
+ 			if (ret != 0)
+ 				return NULL;
+ 		}
+ 
+-		if (key[0] == 0) /*(repurpose len to prime_len)*/
+-			len = CRYPTO_EC_plen(grp);
+-
+ 		if (mbedtls_ecdh_read_public(&ecdh->ctx, buf, buf[0]+1))
+ 			return NULL;
+ 	}
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/301-mesh-noscan.patch b/recipes-wifi/hostapd/files/patches-2.10.3/301-mesh-noscan.patch
index 6b5416f..ceb6d0c 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/301-mesh-noscan.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/301-mesh-noscan.patch
@@ -24,8 +24,8 @@
  			   frequency);
  		goto out_free;
  	}
-+	if (ssid->noscan)
-+		conf->noscan = 1;
++	if (conf->noscan)
++		ssid->noscan = 1;
  
  	if (ssid->mesh_basic_rates == NULL) {
  		/*
@@ -45,7 +45,7 @@
  	unsigned int j;
  	static const int ht40plus[] = {
 -		36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
-+		1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
++		1, 2, 3, 4, 5, 6, 7, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
  		184, 192
  	};
  	int ht40 = -1;
@@ -58,6 +58,15 @@
  	u8 channel;
  	bool is_6ghz;
  	bool dfs_enabled = wpa_s->conf->country[0] && (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
+@@ -3080,6 +3080,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ 		freq->he_enabled = ibss_mesh_can_use_he(wpa_s, ssid, mode,
+ 							ieee80211_mode);
+ 	freq->channel = channel;
++	if (mode->mode == HOSTAPD_MODE_IEEE80211G && ssid->noscan)
++		ibss_mesh_select_40mhz(wpa_s, ssid, mode, freq, obss_scan, dfs_enabled);
+ 	/* Setup higher BW only for 5 GHz */
+ 	if (mode->mode == HOSTAPD_MODE_IEEE80211A) {
+ 		ibss_mesh_select_40mhz(wpa_s, ssid, mode, freq, obss_scan, dfs_enabled);
 --- a/wpa_supplicant/config_ssid.h
 +++ b/wpa_supplicant/config_ssid.h
 @@ -1035,6 +1035,8 @@ struct wpa_ssid {
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/310-rescan_immediately.patch b/recipes-wifi/hostapd/files/patches-2.10.3/310-rescan_immediately.patch
index e12b205..6e0244b 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/310-rescan_immediately.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/310-rescan_immediately.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -5767,7 +5767,7 @@ wpa_supplicant_alloc(struct wpa_supplica
+@@ -5769,7 +5769,7 @@ wpa_supplicant_alloc(struct wpa_supplica
  	if (wpa_s == NULL)
  		return NULL;
  	wpa_s->scan_req = INITIAL_SCAN_REQ;
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/recipes-wifi/hostapd/files/patches-2.10.3/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
index c6fe54e..dc19553 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
@@ -174,7 +174,7 @@
  	 * macsec_policy - Determines the policy for MACsec secure session
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -4175,6 +4175,12 @@ static void wpas_start_assoc_cb(struct w
+@@ -4177,6 +4177,12 @@ static void wpas_start_assoc_cb(struct w
  			params.beacon_int = ssid->beacon_int;
  		else
  			params.beacon_int = wpa_s->conf->beacon_int;
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/600-ubus_support.patch b/recipes-wifi/hostapd/files/patches-2.10.3/600-ubus_support.patch
index bc80ef0..a6ccf83 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/600-ubus_support.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/600-ubus_support.patch
@@ -348,7 +348,7 @@
  CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -7593,6 +7593,8 @@ struct wpa_supplicant * wpa_supplicant_a
+@@ -7595,6 +7595,8 @@ struct wpa_supplicant * wpa_supplicant_a
  	}
  #endif /* CONFIG_P2P */
  
@@ -357,7 +357,7 @@
  	return wpa_s;
  }
  
-@@ -7619,6 +7621,8 @@ int wpa_supplicant_remove_iface(struct w
+@@ -7621,6 +7623,8 @@ int wpa_supplicant_remove_iface(struct w
  	struct wpa_supplicant *parent = wpa_s->parent;
  #endif /* CONFIG_MESH */
  
@@ -366,7 +366,7 @@
  	/* Remove interface from the global list of interfaces */
  	prev = global->ifaces;
  	if (prev == wpa_s) {
-@@ -7965,8 +7969,12 @@ int wpa_supplicant_run(struct wpa_global
+@@ -7967,8 +7971,12 @@ int wpa_supplicant_run(struct wpa_global
  	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
  	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
  
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/601-ucode_support.patch b/recipes-wifi/hostapd/files/patches-2.10.3/601-ucode_support.patch
index de182b9..23f535b 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/601-ucode_support.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/601-ucode_support.patch
@@ -196,7 +196,7 @@
  
  #ifdef CONFIG_BGSCAN
  	if (state == WPA_COMPLETED && wpa_s->current_ssid != wpa_s->bgscan_ssid)
-@@ -7594,6 +7595,7 @@ struct wpa_supplicant * wpa_supplicant_a
+@@ -7596,6 +7597,7 @@ struct wpa_supplicant * wpa_supplicant_a
  #endif /* CONFIG_P2P */
  
  	wpas_ubus_add_bss(wpa_s);
@@ -204,7 +204,7 @@
  
  	return wpa_s;
  }
-@@ -7621,6 +7623,7 @@ int wpa_supplicant_remove_iface(struct w
+@@ -7623,6 +7625,7 @@ int wpa_supplicant_remove_iface(struct w
  	struct wpa_supplicant *parent = wpa_s->parent;
  #endif /* CONFIG_MESH */
  
@@ -212,7 +212,7 @@
  	wpas_ubus_free_bss(wpa_s);
  
  	/* Remove interface from the global list of interfaces */
-@@ -7931,6 +7934,7 @@ struct wpa_global * wpa_supplicant_init(
+@@ -7933,6 +7936,7 @@ struct wpa_global * wpa_supplicant_init(
  
  	eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
  			       wpas_periodic, global, NULL);
@@ -220,7 +220,7 @@
  
  	return global;
  }
-@@ -7969,12 +7973,8 @@ int wpa_supplicant_run(struct wpa_global
+@@ -7971,12 +7975,8 @@ int wpa_supplicant_run(struct wpa_global
  	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
  	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
  
@@ -233,7 +233,7 @@
  	return 0;
  }
  
-@@ -8007,6 +8007,8 @@ void wpa_supplicant_deinit(struct wpa_gl
+@@ -8009,6 +8009,8 @@ void wpa_supplicant_deinit(struct wpa_gl
  
  	wpas_notify_supplicant_deinitialized(global);
  
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch b/recipes-wifi/hostapd/files/patches-2.10.3/992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch
new file mode 100644
index 0000000..c7b595d
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch
@@ -0,0 +1,62 @@
+From: David Bauer <mail@david-bauer.net>
+To: hostap@lists.infradead.org
+Cc: =?utf-8?q?=C3=89tienne_Morice?= <neon.emorice@mail.com>
+Subject: [PATCH] nl80211: add extra-ies only if allowed by driver
+Date: Sun, 30 Jan 2022 20:22:00 +0100
+Message-Id: <20220130192200.10883-1-mail@david-bauer.net>
+List-Id: <hostap.lists.infradead.org>
+
+Upgrading wpa_supplicant from 2.9 to 2.10 breaks broadcom-wl
+based adapters. The reason for it is hostapd tries to install additional
+IEs for scanning while the driver does not support this.
+
+The kernel indicates the maximum number of bytes for additional scan IEs
+using the NL80211_ATTR_MAX_SCAN_IE_LEN attribute. Save this value and
+only add additional scan IEs in case the driver can accommodate these
+additional IEs.
+
+Reported-by: Étienne Morice <neon.emorice@mail.com>
+Tested-by: Étienne Morice <neon.emorice@mail.com>
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ src/drivers/driver.h              | 3 +++
+ src/drivers/driver_nl80211_capa.c | 4 ++++
+ src/drivers/driver_nl80211_scan.c | 2 +-
+ 3 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -2283,6 +2283,9 @@ struct wpa_driver_capa {
+ 	/** Maximum number of iterations in a single scan plan */
+ 	u32 max_sched_scan_plan_iterations;
+ 
++	/** Maximum number of extra IE bytes for scans */
++	u16 max_scan_ie_len;
++
+ 	/** Whether sched_scan (offloaded scanning) is supported */
+ 	int sched_scan_supported;
+ 
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -949,6 +949,10 @@ static int wiphy_info_handler(struct nl_
+ 			nla_get_u32(tb[NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS]);
+ 	}
+ 
++	if (tb[NL80211_ATTR_MAX_SCAN_IE_LEN])
++		capa->max_scan_ie_len =
++			nla_get_u16(tb[NL80211_ATTR_MAX_SCAN_IE_LEN]);
++
+ 	if (tb[NL80211_ATTR_MAX_MATCH_SETS])
+ 		capa->max_match_sets =
+ 			nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
+--- a/src/drivers/driver_nl80211_scan.c
++++ b/src/drivers/driver_nl80211_scan.c
+@@ -222,7 +222,7 @@ nl80211_scan_common(struct i802_bss *bss
+ 		wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
+ 	}
+ 
+-	if (params->extra_ies) {
++	if (params->extra_ies && drv->capa.max_scan_ie_len >= params->extra_ies_len) {
+ 		wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
+ 			    params->extra_ies, params->extra_ies_len);
+ 		if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
index 4c214c1..600fad1 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
@@ -12,6 +12,7 @@
     file://110-mbedtls-TLS-crypto-option-initial-port.patch \
     file://120-mbedtls-fips186_2_prf.patch \
     file://130-mbedtls-annotate-with-TEST_FAIL-for-hwsim-tests.patch \
+    file://135-mbedtls-fix-owe-association.patch \
     file://140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch \
     file://150-add-NULL-checks-encountered-during-tests-hwsim.patch \
     file://160-dpp_pkex-EC-point-mul-w-value-prime.patch \
@@ -60,6 +61,7 @@
     file://770-radius_server.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://991-Fix-OpenWrt-13156.patch \
+    file://992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch \
     file://mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch \
     file://mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
     file://mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch \
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0045-hostapd-mtk-add-log-in-extender-mode.patch b/recipes-wifi/hostapd/files/patches/mtk-0045-hostapd-mtk-add-log-in-extender-mode.patch
new file mode 100644
index 0000000..b0530a0
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0045-hostapd-mtk-add-log-in-extender-mode.patch
@@ -0,0 +1,51 @@
+From ffd6770c6cb58a8b7cb6bd4ec7a1c5f161e86d1d Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Fri, 27 Oct 2023 10:12:59 +0800
+Subject: [PATCH] hostapd: mtk: add log in extender mode
+
+---
+ hostapd/ctrl_iface.c   | 8 ++++++++
+ src/ap/ctrl_iface_ap.c | 1 +
+ 2 files changed, 9 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 89594ec..aa435ee 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -186,6 +186,13 @@ static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
+ 			break;
+ 	}
+ 
++	wpa_printf(MSG_INFO, "mtk: new channel information: channel=%u, "
++		   "secondary_channel=%d, center_segment0=%u, "
++		   "center_segment1=%u, op_class=%u\n",
++		   conf->channel, conf->secondary_channel,
++		   hostapd_get_oper_centr_freq_seg0_idx(conf),
++		   hostapd_get_oper_centr_freq_seg1_idx(conf), conf->op_class);
++
+ 	return conf;
+ }
+ 
+@@ -199,6 +206,7 @@ static int hostapd_ctrl_iface_update(struct hostapd_data *hapd, char *txt)
+ 	iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
+ 	reload_opts = txt;
+ 
++	wpa_printf(MSG_INFO, "mtk: update iface for %s\n", iface->phy);
+ 	for (j = 0; j < iface->num_bss; j++)
+ 		iface->bss[j]->stopped_by_supplicant = 0;
+ 
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 1ad37c5..86e8729 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -951,6 +951,7 @@ int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd)
+ 	struct hostapd_iface *iface = hapd->iface;
+ 	int i;
+ 
++	wpa_printf(MSG_INFO, "mtk: stop iface for %s\n", iface->phy);
+ 	for (i = 0; i < iface->num_bss; i++){
+ 		iface->bss[i]->stopped_by_supplicant = 1;
+ 		hostapd_drv_stop_ap(iface->bss[i]);
+-- 
+2.25.1
+
diff --git a/recipes-wifi/hostapd/files/patches/patches.inc b/recipes-wifi/hostapd/files/patches/patches.inc
index 0574840..9121a2f 100644
--- a/recipes-wifi/hostapd/files/patches/patches.inc
+++ b/recipes-wifi/hostapd/files/patches/patches.inc
@@ -106,4 +106,5 @@
     file://mtk-0041-hostapd-mtk-6g-bss-connect-ignore-ht-opera.patch \
     file://mtk-0042-hostapd-mtk-avoid-unnecessary-beacon-update-for-6-GH.patch \
     file://mtk-0044-hostapd-mtk-Add-ACS-chanlist-info-in-get_config.patch \
+    file://mtk-0045-hostapd-mtk-add-log-in-extender-mode.patch \
     "
diff --git a/recipes-wifi/hostapd/files/wdev.uc b/recipes-wifi/hostapd/files/wdev.uc
index cf438f7..ff4d629 100644
--- a/recipes-wifi/hostapd/files/wdev.uc
+++ b/recipes-wifi/hostapd/files/wdev.uc
@@ -1,6 +1,6 @@
 #!/usr/bin/env ucode
 'use strict';
-import { vlist_new, is_equal, wdev_create, wdev_remove, phy_open } from "/usr/share/hostap/common.uc";
+import { vlist_new, is_equal, wdev_create, wdev_set_mesh_params, wdev_remove, wdev_set_up, phy_open } from "/usr/share/hostap/common.uc";
 import { readfile, writefile, basename, readlink, glob } from "fs";
 let libubus = require("ubus");
 
@@ -9,17 +9,6 @@
 let command = shift(ARGV);
 let phydev;
 
-const mesh_params = [
-	"mesh_retry_timeout", "mesh_confirm_timeout", "mesh_holding_timeout", "mesh_max_peer_links",
-	"mesh_max_retries", "mesh_ttl", "mesh_element_ttl", "mesh_hwmp_max_preq_retries",
-	"mesh_path_refresh_time", "mesh_min_discovery_timeout", "mesh_hwmp_active_path_timeout",
-	"mesh_hwmp_preq_min_interval", "mesh_hwmp_net_diameter_traversal_time", "mesh_hwmp_rootmode",
-	"mesh_hwmp_rann_interval", "mesh_gate_announcements", "mesh_sync_offset_max_neighor",
-	"mesh_rssi_threshold", "mesh_hwmp_active_path_to_root_timeout", "mesh_hwmp_root_interval",
-	"mesh_hwmp_confirmation_interval", "mesh_awake_window", "mesh_plink_timeout",
-	"mesh_auto_open_plinks", "mesh_fwding", "mesh_power_mode"
-];
-
 function iface_stop(wdev)
 {
 	if (keep_devices[wdev.ifname])
@@ -33,7 +22,7 @@
 	let ifname = wdev.ifname;
 
 	if (readfile(`/sys/class/net/${ifname}/ifindex`)) {
-		system([ "ip", "link", "set", "dev", ifname, "down" ]);
+		wdev_set_up(ifname, false);
 		wdev_remove(ifname);
 	}
 	let wdev_config = {};
@@ -42,7 +31,7 @@
 	if (!wdev_config.macaddr && wdev.mode != "monitor")
 		wdev_config.macaddr = phydev.macaddr_next();
 	wdev_create(phy, ifname, wdev_config);
-	system([ "ip", "link", "set", "dev", ifname, "up" ]);
+	wdev_set_up(ifname, true);
 	if (wdev.freq)
 		system(`iw dev ${ifname} set freq ${wdev.freq} ${wdev.htmode}`);
 	if (wdev.mode == "adhoc") {
@@ -60,19 +49,8 @@
 				push(cmd, key, wdev[key]);
 		system(cmd);
 
-		cmd = ["iw", "dev", ifname, "set", "mesh_param" ];
-		let len = length(cmd);
-
-		for (let param in mesh_params)
-			if (wdev[param])
-				push(cmd, param, wdev[param]);
-
-		if (len == length(cmd))
-			return;
-
-		system(cmd);
+		wdev_set_mesh_params(ifname, wdev);
 	}
-
 }
 
 function iface_cb(new_if, old_if)
diff --git a/recipes-wifi/hostapd/files/wpa_supplicant.uc b/recipes-wifi/hostapd/files/wpa_supplicant.uc
index 2a9de67..d624f27 100644
--- a/recipes-wifi/hostapd/files/wpa_supplicant.uc
+++ b/recipes-wifi/hostapd/files/wpa_supplicant.uc
@@ -1,6 +1,6 @@
 let libubus = require("ubus");
 import { open, readfile } from "fs";
-import { wdev_create, wdev_remove, is_equal, vlist_new, phy_open } from "common";
+import { wdev_create, wdev_set_mesh_params, wdev_remove, is_equal, wdev_set_up, vlist_new, phy_open } from "common";
 
 let ubus = libubus.connect();
 
@@ -40,6 +40,7 @@
 	let ret = wdev_create(phy, ifname, wdev_config);
 	if (ret)
 		wpas.printf(`Failed to create device ${ifname}: ${ret}`);
+	wdev_set_up(ifname, true);
 	wpas.add_iface(iface.config);
 	iface.running = true;
 }
@@ -261,7 +262,6 @@
 	let status = iface.status();
 	let msg = { phy: phy };
 
-	wpas.printf(`ucode: mtk: wpa_s in state ${state} notifies hostapd`);
 	switch (state) {
 	case "DISCONNECTED":
 	case "AUTHENTICATING":
@@ -276,8 +276,6 @@
 		msg.up = true;
 		msg.frequency = status.frequency;
 		msg.sec_chan_offset = status.sec_chan_offset;
-		msg.ch_width = status.ch_width;
-		msg.bw320_offset = status.bw320_offset;
 		break;
 	default:
 		return;
@@ -294,8 +292,6 @@
 		csa: true,
 		csa_count: info.csa_count ? info.csa_count - 1 : 0,
 		frequency: info.frequency,
-		ch_width: info.ch_width,
-		bw320_offset: info.bw320_offset,
 		sec_chan_offset: info.sec_chan_offset,
 	};
 	ubus.call("hostapd", "apsta_state", msg);
@@ -321,6 +317,23 @@
 		}
 
 		iface_hostapd_notify(phy, ifname, iface, state);
+
+		if (state != "COMPLETED")
+			return;
+
+		let phy_data = wpas.data.config[phy];
+		if (!phy_data)
+			return;
+
+		let iface_data = phy_data.data[ifname];
+		if (!iface_data)
+			return;
+
+		let wdev_config = iface_data.config;
+		if (!wdev_config || wdev_config.mode != "mesh")
+			return;
+
+		wdev_set_mesh_params(ifname, wdev_config);
 	},
 	event: function(ifname, iface, ev, info) {
 		let phy = wpas.data.iface_phy[ifname];
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/004-fix-kconf-compiling.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/004-fix-kconf-compiling.patch
new file mode 100644
index 0000000..8bae836
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/004-fix-kconf-compiling.patch
@@ -0,0 +1,47 @@
+--- a/Makefile.real
++++ b/Makefile.real
+@@ -6,6 +6,18 @@ else
+ export BACKPORTS_GIT_TRACKER_DEF=
+ endif
+ 
++ifneq ($(LLVM),)
++ifneq ($(filter %/,$(LLVM)),)
++LLVM_PREFIX := $(LLVM)
++else ifneq ($(filter -%,$(LLVM)),)
++LLVM_SUFFIX := $(LLVM)
++endif
++
++HOSTCC	= $(LLVM_PREFIX)clang$(LLVM_SUFFIX)
++else
++HOSTCC	= gcc
++endif
++
+ # disable built-in rules for this file
+ .SUFFIXES:
+ 
+@@ -24,21 +36,21 @@ listnewconfig oldaskconfig oldconfig \
+ silentoldconfig olddefconfig oldnoconfig \
+ allnoconfig allyesconfig allmodconfig \
+ alldefconfig randconfig:
+-	@$(MAKE) -C kconf conf
++	@$(MAKE) -C kconf CC=$(HOSTCC) conf
+ 	@./kconf/conf --$@ Kconfig
+ 
+ .PHONY: usedefconfig
+ usedefconfig:
+-	@$(MAKE) -C kconf conf
++	@$(MAKE) -C kconf CC=$(HOSTCC) conf
+ 	@./kconf/conf --defconfig=defconfig Kconfig
+ 
+ .PHONY: savedefconfig
+ savedefconfig:
+-	@$(MAKE) -C kconf conf
++	@$(MAKE) -C kconf CC=$(HOSTCC) conf
+ 	@./kconf/conf --savedefconfig=defconfig Kconfig
+ 
+ defconfig-%::
+-	@$(MAKE) -C kconf conf
++	@$(MAKE) -C kconf CC=$(HOSTCC) conf
+ 	@./kconf/conf --defconfig=defconfigs/$(@:defconfig-%=%) Kconfig
+ 
+ .config:
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
index 39a6ecc..fc9e402 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
@@ -4,6 +4,7 @@
     file://001-fix_build.patch \
     file://002-change_allconfig.patch \
     file://003-remove_bogus_modparams.patch \
+    file://004-fix-kconf-compiling.patch \
     file://012-kernel_build_check.patch \
     file://060-no_local_ssb_bcma.patch \
     file://070-remove-broken-wext-select.patch \
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9904-mac80211-mtk-add-packet-count-input-for-dev_sw_netst.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9904-mac80211-mtk-add-packet-count-input-for-dev_sw_netst.patch
new file mode 100644
index 0000000..c846782
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-9904-mac80211-mtk-add-packet-count-input-for-dev_sw_netst.patch
@@ -0,0 +1,119 @@
+From ff7b783e3ecad58a18fba135e56afead7ee05e13 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Wed, 1 Nov 2023 07:50:56 +0800
+Subject: [PATCH] mac80211: mtk: add packet count input for
+ dev_sw_netstat_rx_add
+
+Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
+---
+ backport-include/linux/netdevice.h                       | 6 ++++--
+ drivers/net/usb/qmi_wwan.c                               | 2 +-
+ drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c | 2 +-
+ drivers/net/wireless/quantenna/qtnfmac/pcie/topaz_pcie.c | 2 +-
+ net/mac80211/rx.c                                        | 8 ++++----
+ 5 files changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/backport-include/linux/netdevice.h b/backport-include/linux/netdevice.h
+index e177319..87fccdf 100644
+--- a/backport-include/linux/netdevice.h
++++ b/backport-include/linux/netdevice.h
+@@ -115,13 +115,15 @@ int netif_rx_any_context(struct sk_buff *skb);
+ 
+ #if LINUX_VERSION_IS_LESS(5,10,0)
+ #define dev_sw_netstats_rx_add LINUX_BACKPORT(dev_sw_netstats_rx_add)
+-static inline void dev_sw_netstats_rx_add(struct net_device *dev, unsigned int len)
++static inline void dev_sw_netstats_rx_add(struct net_device *dev,
++					  unsigned int packets,
++					  unsigned int len)
+ {
+ 	struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
+ 
+ 	u64_stats_update_begin(&tstats->syncp);
+ 	tstats->rx_bytes += len;
+-	tstats->rx_packets++;
++	tstats->rx_packets += packets;
+ 	u64_stats_update_end(&tstats->syncp);
+ }
+ #endif /* < 5.10 */
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index df0852f..e754400 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -228,7 +228,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ 			net->stats.rx_errors++;
+ 			return 0;
+ 		} else {
+-			dev_sw_netstats_rx_add(net, pkt_len);
++			dev_sw_netstats_rx_add(net, 1, pkt_len);
+ 		}
+ 
+ skip:
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c
+index 840728e..b6fe82b 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c
+@@ -756,7 +756,7 @@ static int qtnf_pcie_pearl_rx_poll(struct napi_struct *napi, int budget)
+ 			skb_put(skb, psize);
+ 			ndev = qtnf_classify_skb(bus, skb);
+ 			if (likely(ndev)) {
+-				dev_sw_netstats_rx_add(ndev, skb->len);
++				dev_sw_netstats_rx_add(ndev, 1, skb->len);
+ 				skb->protocol = eth_type_trans(skb, ndev);
+ 				napi_gro_receive(napi, skb);
+ 			} else {
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/topaz_pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/topaz_pcie.c
+index 9534e1b..d15cfe0 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/topaz_pcie.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/topaz_pcie.c
+@@ -662,7 +662,7 @@ static int qtnf_topaz_rx_poll(struct napi_struct *napi, int budget)
+ 			skb_put(skb, psize);
+ 			ndev = qtnf_classify_skb(bus, skb);
+ 			if (likely(ndev)) {
+-				dev_sw_netstats_rx_add(ndev, skb->len);
++				dev_sw_netstats_rx_add(ndev, 1, skb->len);
+ 				skb->protocol = eth_type_trans(skb, ndev);
+ 				netif_receive_skb(skb);
+ 			} else {
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 7304dbd..86d541b 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -856,7 +856,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
+ 
+ 			if (skb) {
+ 				skb->dev = sdata->dev;
+-				dev_sw_netstats_rx_add(skb->dev, skb->len);
++				dev_sw_netstats_rx_add(skb->dev, 1, skb->len);
+ 				netif_receive_skb(skb);
+ 			}
+ 		}
+@@ -2643,7 +2643,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
+ 
+ 	if (!wiphy_ext_feature_isset(sdata->local->hw.wiphy,
+ 	    NL80211_EXT_FEATURE_STAS_COUNT) || !rx->sta)
+-		dev_sw_netstats_rx_add(dev, skb->len);
++		dev_sw_netstats_rx_add(dev, 1, skb->len);
+ 
+ 	if (rx->sta) {
+ 		/* The seqno index has the same property as needed
+@@ -3917,7 +3917,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
+ 		}
+ 
+ 		prev_dev = sdata->dev;
+-		dev_sw_netstats_rx_add(sdata->dev, skb->len);
++		dev_sw_netstats_rx_add(sdata->dev, 1, skb->len);
+ 	}
+ 
+ 	if (prev_dev) {
+@@ -4549,7 +4549,7 @@ static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
+ 
+ 	if (!wiphy_ext_feature_isset(sta->local->hw.wiphy,
+ 	    NL80211_EXT_FEATURE_STAS_COUNT))
+-		dev_sw_netstats_rx_add(fast_rx->dev, skb->len);
++		dev_sw_netstats_rx_add(fast_rx->dev, 1, skb->len);
+ 
+ 	/* The seqno index has the same property as needed
+ 	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
index 6295da6..0000f77 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
@@ -83,4 +83,5 @@
     file://mtk-9901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
     file://mtk-9902-mac80211-mtk-add-support-for-letting-drivers-registe.patch \
     file://mtk-9903-mac80211-mtk-add-per-bss-flag-to-support-vendors-cou.patch \
+    file://mtk-9904-mac80211-mtk-add-packet-count-input-for-dev_sw_netst.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-Fixed-null-pointer-dereference-.patch b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-Fixed-null-pointer-dereference-.patch
new file mode 100644
index 0000000..db43154
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-Fixed-null-pointer-dereference-.patch
@@ -0,0 +1,42 @@
+From ab20e5711ee36a8c0bace4b39d081626c616b94b Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Thu, 26 Oct 2023 21:11:05 +0800
+Subject: [PATCH] wifi: mt76: mt7915: Fixed null pointer dereference
+ issue
+
+Without this patch, when the station is still in Authentication stage and
+sends a "Notify bandwidth change action frame" to AP at the same time,
+there will be a race condition that causes a crash to occur because the AP
+access "msta->vif" that has not been fully initialized.
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Money Wang <money.wang@mediatek.com>
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ mt7915/main.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 96336b6..f2fe250 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1165,9 +1165,16 @@ static void mt7915_sta_rc_update(struct ieee80211_hw *hw,
+ 				 struct ieee80211_sta *sta,
+ 				 u32 changed)
+ {
++	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ 	struct mt7915_dev *dev = phy->dev;
+ 
++	if (!msta->vif) {
++		dev_warn(dev->mt76.dev, "Un-initialized STA %pM wcid %d in rc_work\n",
++			 sta->addr, msta->wcid.idx);
++		return;
++	}
++
+ 	mt7915_sta_rc_work(&changed, sta);
+ 	ieee80211_queue_work(hw, &dev->rc_work);
+ }
+-- 
+2.39.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
index ba96f5f..ee5851c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
@@ -460,10 +460,10 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 00000000..fa8794fd
+index 0000000..4ab113e
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
-@@ -0,0 +1,1418 @@
+@@ -0,0 +1,1432 @@
 +#ifndef __MT7915_DEBUG_H
 +#define __MT7915_DEBUG_H
 +
@@ -634,6 +634,15 @@
 +	[MT_DBG_SWDEF_BASE]		= 0x411400,
 +};
 +
++static const u32 mt7981_dbg_base[] = {
++	[MT_DBG_WFDMA0_BASE]		= 0x24000,
++	[MT_DBG_WFDMA1_BASE]		= 0x25000,
++	[MT_DBG_WFDMA0_PCIE1_BASE]	= 0x28000,
++	[MT_DBG_WFDMA1_PCIE1_BASE]	= 0x29000,
++	[MT_DBG_WFDMA_EXT_CSR_BASE]	= 0x27000,
++	[MT_DBG_SWDEF_BASE]		= 0x411400,
++};
++
 +static const u32 mt7986_dbg_base[] = {
 +	[MT_DBG_WFDMA0_BASE]		= 0x24000,
 +	[MT_DBG_WFDMA1_BASE]		= 0x25000,
@@ -888,6 +897,11 @@
 +	  mt7916_dbg_reg,
 +	  mt7916_dbg_mask
 +	},
++	{ 0x7981,
++	  mt7981_dbg_base,
++	  mt7916_dbg_reg,
++	  mt7916_dbg_mask
++	},
 +	{ 0x7986,
 +	  mt7986_dbg_base,
 +	  mt7916_dbg_reg,
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
index b8198c4..34cfb64 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From d35da7aef3ecc8b64605277374e676dcf3bffd94 Mon Sep 17 00:00:00 2001
+From 2dcee575f60d16902ef7fc10fda827a9f389f61a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1004/1040] wifi: mt76: mt7915: certification patches
+Subject: [PATCH] wifi: mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -11,9 +11,9 @@
  mt7915/mcu.h         | 207 ++++++++++++++++++-
  mt7915/mt7915.h      |  13 ++
  mt7915/mtk_debugfs.c |   7 +-
- mt7915/vendor.c      | 187 +++++++++++++++++
+ mt7915/vendor.c      | 188 +++++++++++++++++
  mt7915/vendor.h      |  42 ++++
- 9 files changed, 954 insertions(+), 5 deletions(-)
+ 9 files changed, 955 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
 index c1d9191..9b065f3 100644
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index d667b44..ce5dcb3 100644
+index 7c27897..0b6622e 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -747,6 +747,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -748,6 +748,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -775,7 +778,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -776,7 +779,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -842,7 +842,7 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index b7c54cc..96655db 100644
+index 803cabc..587497b 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2562,7 +2562,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
@@ -867,7 +867,7 @@
  	}
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 43f9690..5a1cce1 100644
+index 43f9690..19c9e71 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -900,7 +900,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -779,6 +802,148 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -779,6 +802,149 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len + 1;
  }
  
@@ -1015,6 +1015,7 @@
 +			mt7915_set_wireless_vif, &val32);
 +		if (val8 == 3) /* DL20and80 */
 +			mt7915_mcu_set_dynalgo(phy, 1); /* Enable dynamic algo */
++		mt7915_mcu_set_mu_prot_frame_th(phy, 9999);
 +	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]) {
 +		val16 = nla_get_u16(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]);
 +		hw->max_tx_aggregation_subframes = val16;
@@ -1049,7 +1050,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -803,6 +968,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -803,6 +969,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_amnt_ctrl_dump,
  		.policy = amnt_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
index ca61e6e..9f92153 100644
--- a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 555abaed13e0426eb3295c7f7b02de57320a63e6 Mon Sep 17 00:00:00 2001
+From e7c6d49d0b5582ba7cb37d9d844a341b18c5a393 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH] wifi: mt76: testmode: additional supports
+Subject: [PATCH 1009/1042] wifi: mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -20,13 +20,13 @@
  mt7915/mmio.c     |    2 +
  mt7915/mt7915.h   |   17 +-
  mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1238 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.c | 1244 ++++++++++++++++++++++++++++++++++++++++++---
  mt7915/testmode.h |  278 ++++++++++
  testmode.c        |  287 +++++++++--
  testmode.h        |   79 +++
  tools/fields.c    |   90 +++-
  tx.c              |    3 +-
- 20 files changed, 2058 insertions(+), 167 deletions(-)
+ 20 files changed, 2063 insertions(+), 168 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index 24b44e7..8049830 100644
@@ -395,7 +395,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index ce5dcb3..3b18c95 100644
+index 0b6622e..44a1b21 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -642,7 +642,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4693919..8367204 100644
+index 4693919..32dc85c 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,10 @@
@@ -1528,7 +1528,18 @@
  	if (ret)
  		return ret;
  
-@@ -458,64 +1255,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -447,7 +1244,9 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
+ 		return;
+ 
+-	mt7915_mcu_set_sku_en(phy, !en);
++	phy->sku_limit_en = !en;
++	phy->sku_path_en = !en;
++	mt7915_mcu_set_sku_en(phy);
+ 
+ 	mt7915_tm_mode_ctrl(dev, en);
+ 	mt7915_tm_reg_backup_restore(phy);
+@@ -458,64 +1257,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  
  	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
  
@@ -1787,7 +1798,7 @@
  
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
-@@ -544,10 +1504,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -544,10 +1506,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  		return ret;
  
  	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
@@ -1798,7 +1809,7 @@
  
  	if (!clear) {
  		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
-@@ -562,13 +1518,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -562,13 +1520,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  	return 0;
  }
  
@@ -1861,7 +1872,7 @@
  
  		/* read-clear */
  		mt7915_tm_get_rx_stats(phy, true);
-@@ -576,9 +1580,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -576,9 +1582,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  		/* clear fw count */
  		mt7915_tm_set_phy_count(phy, 0);
  		mt7915_tm_set_phy_count(phy, 1);
@@ -1876,7 +1887,7 @@
  }
  
  static int
-@@ -617,34 +1624,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+@@ -617,34 +1626,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  	tx_cont->tx_ant = td->tx_antenna_mask;
  	tx_cont->band = band;
  
@@ -1912,12 +1923,14 @@
  
  	if (!en) {
  		req.op.rf.param.func_data = cpu_to_le32(band);
-@@ -728,6 +1708,16 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -728,6 +1710,18 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
  	if (changed & BIT(TM_CHANGED_TXPOWER))
  		mt7915_tm_set_tx_power(phy);
 +	if (changed & BIT(TM_CHANGED_SKU_EN)) {
-+		mt7915_mcu_set_sku_en(phy, td->sku_en);
++		phy->sku_limit_en = td->sku_en;
++		phy->sku_path_en = td->sku_en;
++		mt7915_mcu_set_sku_en(phy);
 +		mt7915_mcu_set_txpower_sku(phy);
 +	}
 +	if (changed & BIT(TM_CHANGED_AID))
@@ -1929,7 +1942,7 @@
  }
  
  static int
-@@ -737,6 +1727,11 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -737,6 +1731,11 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	struct mt7915_phy *phy = mphy->priv;
  	enum mt76_testmode_state prev_state = td->state;
  
@@ -1941,7 +1954,7 @@
  	mphy->test.state = state;
  
  	if (prev_state == MT76_TM_STATE_TX_FRAMES ||
-@@ -757,7 +1752,7 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -757,7 +1756,7 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	    (state == MT76_TM_STATE_OFF &&
  	     prev_state == MT76_TM_STATE_IDLE)) {
  		u32 changed = 0;
@@ -1950,7 +1963,7 @@
  
  		for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
  			u16 cur = tm_change_map[i];
-@@ -766,6 +1761,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -766,6 +1765,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  				changed |= BIT(i);
  		}
  
@@ -1961,7 +1974,7 @@
  		mt7915_tm_update_params(phy, changed);
  	}
  
-@@ -778,10 +1777,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+@@ -778,10 +1781,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
  {
  	struct mt76_testmode_data *td = &mphy->test;
  	struct mt7915_phy *phy = mphy->priv;
@@ -1974,7 +1987,7 @@
  
  	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
  
-@@ -789,9 +1786,9 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+@@ -789,9 +1790,9 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
  	    td->state == MT76_TM_STATE_OFF)
  		return 0;
  
@@ -1987,7 +2000,7 @@
  
  	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
  		if (tb[tm_change_map[i]])
-@@ -807,6 +1804,7 @@ static int
+@@ -807,6 +1808,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1995,7 +2008,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -827,6 +1825,16 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -827,6 +1829,16 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rssi);
  
@@ -2012,7 +2025,7 @@
  	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_IB_RSSI);
  	if (!rssi)
  		return -ENOMEM;
-@@ -852,11 +1860,75 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -852,11 +1864,75 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
index e6f1971..eedc6de 100644
--- a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
@@ -1,8 +1,8 @@
-From ea0393c4c9076db02c3ebe34b87dc381c34e5a3d Mon Sep 17 00:00:00 2001
+From abf253c784db9cb42cf14ca7b825227ef982c3cd Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH 1013/1040] wifi: mt76: testmode: add iBF/eBF cal and cert
- commands with golden
+Subject: [PATCH] wifi: mt76: testmode: add iBF/eBF cal and cert commands with
+ golden
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -15,20 +15,20 @@
  mt7915/mmio.c        |   2 +
  mt7915/mt7915.h      |  14 +-
  mt7915/mtk_debugfs.c |  35 ++++
- mt7915/mtk_mcu.c     | 246 ++++++++++++++++++++++-
+ mt7915/mtk_mcu.c     | 247 ++++++++++++++++++++++-
  mt7915/regs.h        |   4 +
  mt7915/testmode.c    | 461 ++++++++++++++++++++++++++++---------------
  mt7915/testmode.h    | 134 +------------
  testmode.c           |   1 +
  testmode.h           |   9 +
  tools/fields.c       |   9 +
- 16 files changed, 857 insertions(+), 324 deletions(-)
+ 16 files changed, 858 insertions(+), 324 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index ed69106..fa9c6a4 100644
+index 7ae061d..d16accd 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -716,6 +716,7 @@ struct mt76_testmode_data {
+@@ -718,6 +718,7 @@ struct mt76_testmode_data {
  
  	struct list_head tm_entry_list;
  	struct mt76_wcid *cur_entry;
@@ -36,7 +36,7 @@
  	u8 entry_num;
  	union {
  		struct mt76_testmode_entry_data ed;
-@@ -744,6 +745,9 @@ struct mt76_testmode_data {
+@@ -746,6 +747,9 @@ struct mt76_testmode_data {
  
  	u8 txbf_act;
  	u16 txbf_param[8];
@@ -68,10 +68,10 @@
  		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index bd0efd5..4244177 100644
+index 06a5fb1..948f07b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -729,8 +729,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -730,8 +730,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  		val |= MT_TXD6_LDPC;
  
  	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
@@ -84,7 +84,7 @@
  	txwi[6] |= cpu_to_le32(val);
  #endif
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3b18c95..169d597 100644
+index 44a1b21..8c9b0b2 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
@@ -146,7 +146,7 @@
  
  	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
  	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
-@@ -279,7 +270,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -280,7 +271,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
@@ -468,10 +468,10 @@
  	[AGG_AALCR0]		= 0x028,
  	[AGG_AWSCR0]		= 0x030,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 33ac2d2..135b39b 100644
+index 78ddbaf..2ef63a3 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -274,7 +274,6 @@ struct mt7915_phy {
+@@ -275,7 +275,6 @@ struct mt7915_phy {
  
  		u8 spe_idx;
  
@@ -479,7 +479,7 @@
  		bool bf_ever_en;
  	} test;
  #endif
-@@ -379,7 +378,7 @@ struct mt7915_dev {
+@@ -380,7 +379,7 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -488,7 +488,7 @@
  	struct {
  		void *txbf_phase_cal;
  		void *txbf_pfmu_data;
-@@ -518,6 +517,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+@@ -519,6 +518,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int mt7915_dma_start(struct mt7915_dev *dev, bool reset, bool wed_reset);
  int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
@@ -496,7 +496,7 @@
  void mt7915_reset(struct mt7915_dev *dev);
  int mt7915_run(struct ieee80211_hw *hw);
  int mt7915_mcu_init(struct mt7915_dev *dev);
-@@ -598,8 +598,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -599,8 +599,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -508,7 +508,7 @@
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
-@@ -734,4 +736,10 @@ enum {
+@@ -735,4 +737,10 @@ enum {
  
  #endif
  
@@ -520,7 +520,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 96655db..7fc6a3f 100644
+index 587497b..2ce1837 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2890,6 +2890,36 @@ mt7915_txpower_level_set(void *data, u64 val)
@@ -564,16 +564,16 @@
  	debugfs_create_file("txpower_level", 0400, dir, dev,
  			    &fops_txpower_level);
  
-+	debugfs_create_file("txbf_pfmu_tag_idx", 0600, dir, phy,
++	debugfs_create_file("pfmu_tag_read", 0600, dir, phy,
 +			    &fops_txbf_pfmu_tag_idx);
-+	debugfs_create_file("txbf_sta_rec", 0600, dir, dev,
++	debugfs_create_file("bf_starec_read", 0600, dir, dev,
 +			    &fops_txbf_sta_rec);
 +
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
  	return 0;
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
-index 143dae2..906c872 100644
+index 143dae2..7a2d28c 100644
 --- a/mt7915/mtk_mcu.c
 +++ b/mt7915/mtk_mcu.c
 @@ -1,9 +1,10 @@
@@ -588,7 +588,7 @@
  
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
  {
-@@ -49,3 +50,246 @@ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
+@@ -49,3 +50,247 @@ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
  }
@@ -809,10 +809,11 @@
 +		.bfer = bfer,
 +		.dbdc_idx = phy->mt76->band_idx,
 +	};
-+	struct mt7915_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
 +
 +	/* Reset to 0 for mt7915_tm_txbf_profile_tag_write wait_event */
-+	tag->t1.pfmu_idx = 0;
++	if (tag)
++		tag->t1.pfmu_idx = 0;
 +
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
 +				 sizeof(req), true);
@@ -858,10 +859,10 @@
  #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
  #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index e321848..d5c74df 100644
+index 1e6791e..5e20cb9 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
-@@ -53,6 +53,8 @@ struct reg_band {
+@@ -55,6 +55,8 @@ struct reg_band {
  static struct reg_band reg_backup_list[TM_REG_MAX_ID];
  
  static void mt7915_tm_update_entry(struct mt7915_phy *phy);
@@ -870,7 +871,7 @@
  
  static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
  {
-@@ -92,6 +94,25 @@ mt7915_tm_check_antenna(struct mt7915_phy *phy)
+@@ -94,6 +96,25 @@ mt7915_tm_check_antenna(struct mt7915_phy *phy)
  	return 0;
  }
  
@@ -896,7 +897,7 @@
  static void
  mt7915_tm_update_channel(struct mt7915_phy *phy)
  {
-@@ -292,17 +313,33 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -294,17 +315,33 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_dev *dev = phy->dev;
@@ -937,7 +938,7 @@
  
  	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
  					    &msta->wcid);
-@@ -318,8 +355,11 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -320,8 +357,11 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	bf->ncol = nc;
  	bf->nrow = nr;
  	bf->ndp_rate = ndp_rate;
@@ -950,7 +951,7 @@
  
  	if (ebf) {
  		bf->mem[0].row = 0;
-@@ -372,11 +412,8 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+@@ -374,11 +414,8 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
  	}
  
  	memcpy(sta->addr, ed->addr[0], ETH_ALEN);
@@ -964,7 +965,7 @@
  
  	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
  		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
-@@ -401,6 +438,14 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+@@ -403,6 +440,14 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
  	list_add_tail(&msta->wcid.list, &td->tm_entry_list);
  	td->entry_num++;
  
@@ -979,7 +980,7 @@
  	return 0;
  }
  
-@@ -470,7 +515,7 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+@@ -472,7 +517,7 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
  	struct mt76_testmode_entry_data *ed, tmp;
  	struct mt76_wcid *wcid, *last;
  
@@ -988,7 +989,7 @@
  		return;
  
  	memcpy(&tmp, &td->ed, sizeof(tmp));
-@@ -491,20 +536,30 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+@@ -493,20 +538,30 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
  static int
  mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
  {
@@ -1022,7 +1023,7 @@
  					 MAX_PHASE_GROUP_NUM,
  					 GFP_KERNEL);
  		if (!phase_cal)
-@@ -514,7 +569,10 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+@@ -516,7 +571,10 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
  	}
  
  	if (!dev->test.txbf_pfmu_data) {
@@ -1034,7 +1035,7 @@
  		if (!pfmu_data)
  			return -ENOMEM;
  
-@@ -523,21 +581,77 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+@@ -525,21 +583,77 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
  
  	if (!dev->test.txbf_pfmu_tag) {
  		pfmu_tag = devm_kzalloc(dev->mt76.dev,
@@ -1118,7 +1119,7 @@
  
  	return mt7915_tm_set_trx(phy, TM_MAC_TX, true);
  }
-@@ -564,8 +678,7 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+@@ -566,8 +680,7 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
  		.read_from_e2p = val[3],
  		.disable = val[4],
  	};
@@ -1128,7 +1129,7 @@
  
  	wait_event_timeout(dev->mt76.tx_wait, phase[val[2]].status != 0, HZ);
  	memcpy(req.buf, &phase[val[2]].phase, sizeof(req.buf));
-@@ -578,32 +691,9 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+@@ -580,32 +693,9 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
  				 sizeof(req), true);
  }
  
@@ -1162,7 +1163,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct {
-@@ -630,8 +720,6 @@ static int
+@@ -632,8 +722,6 @@ static int
  mt7915_tm_txbf_apply_tx(struct mt7915_phy *phy, u16 wlan_idx, bool ebf,
  			bool ibf, bool phase_cal)
  {
@@ -1171,7 +1172,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 category;
-@@ -660,14 +748,15 @@ static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
+@@ -662,14 +750,15 @@ static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct mt76_testmode_entry_data *ed = mt76_testmode_entry_data(phy->mt76, wcid);
@@ -1189,7 +1190,7 @@
  	rate.nss = ed->tx_rate_nss;
  	rate.mcs = ed->tx_rate_idx;
  	rate.ldpc = (rate.bw || ed->tx_rate_ldpc) * GENMASK(2, 0);
-@@ -681,13 +770,14 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+@@ -683,13 +772,14 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
  {
  	bool bf_on = val[0], update = val[3];
  	/* u16 wlan_idx = val[2]; */
@@ -1206,7 +1207,7 @@
  		tag->t1.invalid_prof = false;
  		mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
  
-@@ -702,7 +792,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+@@ -704,7 +794,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
  		} else {
  			phy->test.bf_ever_en = false;
  
@@ -1215,7 +1216,7 @@
  			tag->t1.invalid_prof = true;
  			mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
  		}
-@@ -717,6 +807,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+@@ -719,6 +809,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
  static int
  mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  {
@@ -1223,7 +1224,7 @@
  	static const u8 mode_to_lm[] = {
  		[MT76_TM_TX_MODE_CCK] = 0,
  		[MT76_TM_TX_MODE_OFDM] = 0,
-@@ -730,7 +821,8 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+@@ -732,7 +823,8 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  	struct mt76_testmode_data *td = &phy->mt76->test;
  	struct mt76_wcid *wcid;
  	struct ieee80211_vif *vif = phy->monitor_vif;
@@ -1233,7 +1234,7 @@
  	u8 pfmu_idx = val[0], nc = val[2], nr;
  	bool is_atenl = val[6];
  	int ret;
-@@ -748,18 +840,22 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+@@ -750,18 +842,22 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  	tag->t1.nr = nr;
  	tag->t1.nc = nc;
  	tag->t1.invalid_prof = true;
@@ -1262,7 +1263,7 @@
  	} else {
  		tag->t1.row_id1 = 4;
  		tag->t1.row_id2 = 5;
-@@ -780,6 +876,20 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+@@ -782,6 +878,20 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  	if (ret)
  		return ret;
  
@@ -1283,7 +1284,7 @@
  	if (!ebf && is_atenl)
  		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
  
-@@ -797,7 +907,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+@@ -799,7 +909,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
  		u8 category;
  		u8 group_l_m_n;
  		u8 group;
@@ -1292,7 +1293,7 @@
  		u8 cal_type;
  		u8 lna_gain_level;
  		u8 _rsv[2];
-@@ -805,12 +915,12 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+@@ -807,12 +917,12 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
  		.category = MT_BF_PHASE_CAL,
  		.group = val[0],
  		.group_l_m_n = val[1],
@@ -1308,7 +1309,7 @@
  
  	phase[req.group].status = 0;
  
-@@ -818,53 +928,10 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+@@ -820,53 +930,10 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
  				 sizeof(req), true);
  }
  
@@ -1363,7 +1364,7 @@
  	struct mt76_testmode_data *td = &phy->mt76->test;
  	u8 nss = hweight8(td->tx_antenna_mask);
  	u16 pfmu_idx = val[0];
-@@ -874,9 +941,9 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -876,9 +943,9 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  	u16 angle31 = val[4];
  	u16 angle41 = val[5];
  	s16 phi11 = 0, phi21 = 0, phi31 = 0;
@@ -1375,7 +1376,7 @@
  		return -EINVAL;
  
  	if (nss == 2) {
-@@ -890,7 +957,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -892,7 +959,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  		phi31 = (s16)(angle41 - angle31);
  	}
  
@@ -1384,7 +1385,7 @@
  	pfmu_data = &pfmu_data[subc_id];
  
  	if (subc_id < 32)
-@@ -900,21 +967,21 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -902,21 +969,21 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  	pfmu_data->phi11 = cpu_to_le16(phi11);
  	pfmu_data->phi21 = cpu_to_le16(phi21);
  	pfmu_data->phi31 = cpu_to_le16(phi31);
@@ -1409,7 +1410,7 @@
  
  		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
  					 &req, sizeof(req), true);
-@@ -926,7 +993,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -928,7 +995,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  static int
  mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
  {
@@ -1418,7 +1419,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	u8 *eeprom = dev->mt76.eeprom.data;
  	u16 offset;
-@@ -936,7 +1003,7 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+@@ -938,7 +1005,7 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
  	is_7976 = mt7915_check_adie(dev, false) || is_mt7916(&dev->mt76);
  	offset = is_7976 ? 0x60a : 0x651;
  
@@ -1427,7 +1428,7 @@
  	for (i = 0; i < MAX_PHASE_GROUP_NUM; i++) {
  		p = &phase[i];
  
-@@ -951,17 +1018,75 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+@@ -953,17 +1020,75 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
  	return 0;
  }
  
@@ -1505,7 +1506,7 @@
  		return mt7915_tm_txbf_init(phy, val);
  	case MT76_TM_TXBF_ACT_UPDATE_CH:
  		mt7915_tm_update_channel(phy);
-@@ -987,6 +1112,36 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+@@ -989,6 +1114,36 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
  
  		return mt7915_tm_txbf_apply_tx(phy, wlan_idx, ebf, ibf, phase_cal);
  	}
@@ -1542,7 +1543,7 @@
  	default:
  		break;
  	};
-@@ -1262,9 +1417,10 @@ mt7915_tm_set_ipi(struct mt7915_phy *phy)
+@@ -1264,9 +1419,10 @@ mt7915_tm_set_ipi(struct mt7915_phy *phy)
  
  static int
  mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
@@ -1555,7 +1556,7 @@
  	struct mt7915_mcu_tx req = {
  		.valid = true,
  		.mode = tx_cmd,
-@@ -1272,6 +1428,9 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+@@ -1274,6 +1430,9 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
  	};
  	struct edca *e = &req.edca[0];
  
@@ -1565,7 +1566,7 @@
  	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
  	e->set = WMM_PARAM_SET;
  
-@@ -1284,17 +1443,19 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+@@ -1286,17 +1445,19 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
  }
  
  static int
@@ -1586,7 +1587,7 @@
  	u8 band = phy->mt76->band_idx;
  	u32 i2t_time, tr2t_time, txv_time;
  	u16 cw = 0;
-@@ -1308,6 +1469,7 @@ mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
+@@ -1310,6 +1471,7 @@ mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
  	ipg -= sig_ext;
  
  	if (ipg <= (TM_MAX_SIFS + slot_time)) {
@@ -1594,7 +1595,7 @@
  		sifs = ipg - slot_time;
  	} else {
  		u32 val = (ipg + slot_time) / slot_time;
-@@ -1343,10 +1505,12 @@ done:
+@@ -1345,10 +1507,12 @@ done:
  
  	mt7915_tm_set_slot_time(phy, slot_time, sifs);
  
@@ -1609,7 +1610,7 @@
  }
  
  static int
-@@ -1545,7 +1709,7 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -1547,7 +1711,7 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  
  		phy->mt76->test.aid = 0;
  		phy->mt76->test.tx_mpdu_len = 0;
@@ -1618,7 +1619,7 @@
  		mt7915_tm_set_entry(phy);
  	} else {
  		INIT_DELAYED_WORK(&phy->ipi_work, mt7915_tm_ipi_work);
-@@ -1730,7 +1894,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1732,7 +1896,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
  		u8 duty_cycle = td->tx_duty_cycle;
  
@@ -1627,7 +1628,7 @@
  			mt7915_tm_update_channel(phy);
  
  		if (td->tx_spe_idx)
-@@ -1745,7 +1909,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1747,7 +1911,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  			if (duty_cycle < 100)
  				tx_time = duty_cycle * ipg / (100 - duty_cycle);
  		}
@@ -1636,7 +1637,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
  		if (ipg)
-@@ -1764,6 +1928,9 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1766,6 +1930,9 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  		mt7915_tm_tx_frames_mu(phy, en);
  
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
@@ -1646,7 +1647,7 @@
  }
  
  static int
-@@ -1855,7 +2022,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -1857,7 +2024,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
  
  	if (en) {
@@ -1655,7 +1656,7 @@
  			mt7915_tm_update_channel(phy);
  		if (td->aid)
  			mt7915_tm_set_rx_user_idx(phy, td->aid);
-@@ -1872,6 +2039,9 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -1874,6 +2041,9 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  		mt7915_tm_set_muru_aid(phy, en ? td->aid : 0xf800);
  
  	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
@@ -1665,7 +1666,7 @@
  }
  
  static int
-@@ -1931,34 +2101,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+@@ -1933,34 +2103,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  		rate_idx = sband->bitrates[idx].hw_value & 0xff;
  	}
  
@@ -1846,10 +1847,10 @@
  
  #endif
 diff --git a/testmode.c b/testmode.c
-index babae8d..4ea5877 100644
+index 4c22dfc..410c7ab 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -195,6 +195,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
+@@ -196,6 +196,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
  
  	hdr = __skb_put_zero(head, sizeof(*hdr));
  	hdr->frame_control = cpu_to_le16(fc);
@@ -1858,10 +1859,10 @@
  	memcpy(hdr->addr2, addr[1], ETH_ALEN);
  	memcpy(hdr->addr3, addr[2], ETH_ALEN);
 diff --git a/testmode.h b/testmode.h
-index 97e7596..e13920e 100644
+index b39cf51..20fab3e 100644
 --- a/testmode.h
 +++ b/testmode.h
-@@ -299,7 +299,10 @@ enum mt76_testmode_cfg {
+@@ -303,7 +303,10 @@ enum mt76_testmode_cfg {
  };
  
  enum mt76_testmode_txbf_act {
@@ -1872,7 +1873,7 @@
  	MT76_TM_TXBF_ACT_UPDATE_CH,
  	MT76_TM_TXBF_ACT_PHASE_COMP,
  	MT76_TM_TXBF_ACT_TX_PREP,
-@@ -310,6 +313,12 @@ enum mt76_testmode_txbf_act {
+@@ -314,6 +317,12 @@ enum mt76_testmode_txbf_act {
  	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
  	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
  	MT76_TM_TXBF_ACT_E2P_UPDATE,
@@ -1886,7 +1887,7 @@
  	/* keep last */
  	NUM_MT76_TM_TXBF_ACT,
 diff --git a/tools/fields.c b/tools/fields.c
-index fc01043..7caacb9 100644
+index e2cf4b9..027b8cd 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -33,7 +33,10 @@ static const char * const testmode_tx_mode[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
index 9ab86d5..230ef81 100644
--- a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,24 +1,25 @@
-From 21c0d49738d105ad23e248a213da069e4e57dd21 Mon Sep 17 00:00:00 2001
+From b33cf2d53b4719f00d96ba1b5280b7df593870cf Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1019/1040] wifi: mt76: mt7915: implement bin file mode
+Subject: [PATCH] wifi: mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- eeprom.c             | 20 ++++++++++++++++++++
- mt76.h               |  4 ++++
- mt7915/eeprom.c      | 36 +++++++++++++++++++++++++++++++++---
- mt7915/eeprom.h      |  7 +++++++
- mt7915/mt7915.h      |  3 +++
- mt7915/mtk_debugfs.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
- 6 files changed, 111 insertions(+), 3 deletions(-)
+ eeprom.c             | 25 +++++++++++++++++
+ mt76.h               |  4 +++
+ mt7915/eeprom.c      | 65 +++++++++++++++++++++++++++++++++++++++++---
+ mt7915/eeprom.h      |  7 +++++
+ mt7915/mt7915.h      |  3 ++
+ mt7915/mtk_debugfs.c | 44 ++++++++++++++++++++++++++++++
+ testmode.h           |  2 +-
+ 7 files changed, 145 insertions(+), 5 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 9b63799..eb532c7 100644
+index 9b63799..d5b8c56 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -159,6 +159,26 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
+@@ -159,6 +159,31 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
  }
  EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
  
@@ -33,8 +34,13 @@
 +	of_property_read_string(np, "bin_file_name", &bin_file_name);
 +
 +	dev->bin_file_name = bin_file_name;
-+	if (dev->bin_file_name)
++	if (dev->bin_file_name) {
 +		dev_info(dev->dev, "Using bin file %s\n", dev->bin_file_name);
++#ifdef CONFIG_NL80211_TESTMODE
++		dev->test_mtd.name = devm_kstrdup(dev->dev, bin_file_name, GFP_KERNEL);
++		dev->test_mtd.offset = -1;
++#endif
++	}
 +
 +	of_node_put(np);
 +
@@ -46,10 +52,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index fa9c6a4..13796ad 100644
+index d16accd..9673926 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -941,6 +941,9 @@ struct mt76_dev {
+@@ -943,6 +943,9 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -59,7 +65,7 @@
  };
  
  /* per-phy stats.  */
-@@ -1173,6 +1176,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1175,6 +1178,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -68,10 +74,53 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index a5c99a5..fd08d42 100644
+index a5c99a5..5eb9f88 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -47,8 +47,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+@@ -5,6 +5,30 @@
+ #include "mt7915.h"
+ #include "eeprom.h"
+ 
++static int
++mt7915_eeprom_load_precal_binfile(struct mt7915_dev *dev, u32 offs, u32 size)
++{
++	const struct firmware *fw = NULL;
++	int ret;
++
++	ret = request_firmware(&fw, dev->mt76.bin_file_name, dev->mt76.dev);
++	if (ret)
++		return ret;
++
++	if (!fw || !fw->data) {
++		dev_err(dev->mt76.dev, "Invalid bin (bin file mode), load precal fail\n");
++		ret = -EINVAL;
++		goto out;
++	}
++
++	memcpy(dev->cal, fw->data + offs, size);
++
++out:
++	release_firmware(fw);
++
++	return ret;
++}
++
+ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ {
+ 	struct mt76_dev *mdev = &dev->mt76;
+@@ -24,7 +48,10 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ 
+ 	offs = is_mt7915(&dev->mt76) ? MT_EE_PRECAL : MT_EE_PRECAL_V2;
+ 
+-	return mt76_get_of_eeprom(mdev, dev->cal, offs, size);
++	if (!dev->bin_file_mode)
++		return mt76_get_of_eeprom(mdev, dev->cal, offs, size);
++	else
++		return mt7915_eeprom_load_precal_binfile(dev, offs, size);
+ }
+ 
+ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+@@ -47,8 +74,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
  	}
  }
  
@@ -84,7 +133,7 @@
  	switch (mt76_chip(&dev->mt76)) {
  	case 0x7915:
  		return dev->dbdc_support ?
-@@ -89,7 +92,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
+@@ -89,7 +119,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
  		return ret;
  
  	if (!fw || !fw->data) {
@@ -96,7 +145,7 @@
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -114,6 +120,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -114,6 +147,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  
  	if (ret) {
  		dev->flash_mode = true;
@@ -104,7 +153,7 @@
  	} else {
  		u8 free_block_num;
  		u32 block_num, i;
-@@ -134,6 +141,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -134,6 +168,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  			if (ret < 0)
  				return ret;
  		}
@@ -113,7 +162,7 @@
  	}
  
  	return mt7915_check_eeprom(dev);
-@@ -239,12 +248,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -239,12 +275,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
  
@@ -167,10 +216,10 @@
  mt7915_get_channel_group_5g(int channel, bool is_7976)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c5f4e94..b6a564e 100644
+index 795af63..992323d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -350,6 +350,8 @@ struct mt7915_dev {
+@@ -351,6 +351,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -179,7 +228,7 @@
  	bool muru_debug;
  	bool ibf;
  
-@@ -726,6 +728,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
+@@ -727,6 +729,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
  int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
@@ -188,7 +237,7 @@
  #define PKT_BIN_DEBUG_MAGIC	0xc8763123
  enum {
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 7fc6a3f..b949ad7 100644
+index 7105cf0..5c676d8 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
@@ -256,6 +305,19 @@
  	return 0;
  }
  #endif
+diff --git a/testmode.h b/testmode.h
+index 20fab3e..91d1e86 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -17,7 +17,7 @@
+  * @MT76_TM_ATTR_RESET: reset parameters to default (flag)
+  * @MT76_TM_ATTR_STATE: test state (u32), see &enum mt76_testmode_state
+  *
+- * @MT76_TM_ATTR_MTD_PART: mtd partition used for eeprom data (string)
++ * @MT76_TM_ATTR_MTD_PART: mtd partition or binfile used for eeprom data (string)
+  * @MT76_TM_ATTR_MTD_OFFSET: offset of eeprom data within the partition (u32)
+  * @MT76_TM_ATTR_BAND_IDX: band idx of the chip (u8)
+  *
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index 17d289a..032e44d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,19 +1,21 @@
-From f793f54b26302abc942574b2e6f19f609b3a1c0e Mon Sep 17 00:00:00 2001
+From 51e7036b3f6295eb7a8e5925dea43cb71998f0dd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1025/1040] wifi: mt76: mt7915: add bf backoff limit table
+Subject: [PATCH 1025/1042] wifi: mt76: mt7915: add bf backoff limit table
  support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  debugfs.c        |   2 +-
- eeprom.c         |  34 +++++++++++-
+ eeprom.c         |  43 ++++++++++--
  mt76.h           |   8 +++
- mt7915/debugfs.c |  73 ++++++++++++++++++++++++--
- mt7915/mcu.c     | 132 ++++++++++++++++++++++++++++++++++++-----------
- mt7915/mcu.h     |   6 +++
- mt7915/mt7915.h  |   4 +-
- 7 files changed, 220 insertions(+), 39 deletions(-)
+ mt7915/debugfs.c |  73 ++++++++++++++++++--
+ mt7915/init.c    |   7 ++
+ mt7915/main.c    |   8 ++-
+ mt7915/mcu.c     | 175 +++++++++++++++++++++++++++++++++++++----------
+ mt7915/mcu.h     |   6 ++
+ mt7915/mt7915.h  |   9 ++-
+ 9 files changed, 279 insertions(+), 52 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
 index 1c8328d..19a835c 100644
@@ -29,10 +31,31 @@
  		seq_printf(file, " %2d", val[i]);
  	seq_puts(file, "\n");
 diff --git a/eeprom.c b/eeprom.c
-index eb532c7..4189525 100644
+index eb532c7..c0536f1 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -367,12 +367,16 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -326,9 +326,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
+ static void
+ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+ 			     const __be32 *data, size_t len, s8 target_power,
+-			     s8 nss_delta, s8 *max_power)
++			     s8 nss_delta)
+ {
+ 	int i, cur;
++	s8 max_power = -128;
+ 
+ 	if (!data)
+ 		return;
+@@ -340,7 +341,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+ 			break;
+ 
+ 		mt76_apply_array_limit(pwr + pwr_len * i, pwr_len, data + 1,
+-				       target_power, nss_delta, max_power);
++				       target_power, nss_delta, &max_power);
+ 		if (--cur > 0)
+ 			continue;
+ 
+@@ -367,12 +368,16 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	char band;
  	size_t len;
  	s8 max_power = -127;
@@ -50,9 +73,18 @@
  
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
-@@ -425,7 +429,33 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -418,14 +423,40 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+ 	val = mt76_get_of_array(np, "rates-mcs", &len, mcs_rates + 1);
+ 	mt76_apply_multi_array_limit(dest->mcs[0], ARRAY_SIZE(dest->mcs[0]),
+ 				     ARRAY_SIZE(dest->mcs), val, len,
+-				     target_power, txs_delta, &max_power);
++				     target_power, txs_delta);
+ 
+ 	val = mt76_get_of_array(np, "rates-ru", &len, ru_rates + 1);
+ 	mt76_apply_multi_array_limit(dest->ru[0], ARRAY_SIZE(dest->ru[0]),
  				     ARRAY_SIZE(dest->ru), val, len,
- 				     target_power, txs_delta, &max_power);
+-				     target_power, txs_delta, &max_power);
++				     target_power, txs_delta);
  
 -	return max_power;
 +	max_power_backoff = max_power;
@@ -71,12 +103,12 @@
 +	val = mt76_get_of_array(np, "paths-ru", &len, ARRAY_SIZE(dest->path.ru[0]) + 1);
 +	mt76_apply_multi_array_limit(dest->path.ru[0], ARRAY_SIZE(dest->path.ru[0]),
 +				     ARRAY_SIZE(dest->path.ru), val, len,
-+				     target_power_combine, txs_delta, &max_power_backoff);
++				     target_power_combine, txs_delta);
 +
 +	val = mt76_get_of_array(np, "paths-ru-bf", &len, ARRAY_SIZE(dest->path.ru_bf[0]) + 1);
 +	mt76_apply_multi_array_limit(dest->path.ru_bf[0], ARRAY_SIZE(dest->path.ru_bf[0]),
 +				     ARRAY_SIZE(dest->path.ru_bf), val, len,
-+				     target_power_combine, txs_delta, &max_power_backoff);
++				     target_power_combine, txs_delta);
 +
 +	if (max_power_backoff == target_power_combine)
 +		return max_power;
@@ -86,10 +118,10 @@
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
  
 diff --git a/mt76.h b/mt76.h
-index 13796ad..05c1874 100644
+index 9673926..6ed3e1e 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1047,6 +1047,14 @@ struct mt76_power_limits {
+@@ -1049,6 +1049,14 @@ struct mt76_power_limits {
  	s8 mcs[4][10];
  	s8 ru[7][12];
  	s8 eht[16][16];
@@ -216,8 +248,53 @@
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
+diff --git a/mt7915/init.c b/mt7915/init.c
+index d908a58..b2fdd43 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -284,6 +284,8 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+ 	int pwr_delta = mt7915_eeprom_get_power_delta(dev, sband->band);
+ 	struct mt76_power_limits limits;
+ 
++	phy->sku_limit_en = true;
++	phy->sku_path_en = true;
+ 	for (i = 0; i < sband->n_channels; i++) {
+ 		struct ieee80211_channel *chan = &sband->channels[i];
+ 		u32 target_power = 0;
+@@ -300,6 +302,11 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+ 		target_power = mt76_get_rate_power_limits(phy->mt76, chan,
+ 							  &limits,
+ 							  target_power);
++
++		/* MT7915N can not enable Backoff table without setting value in dts */
++		if (!limits.path.ofdm[0])
++			phy->sku_path_en = false;
++
+ 		target_power += nss_delta;
+ 		target_power = DIV_ROUND_UP(target_power, 2);
+ 		chan->max_power = min_t(int, chan->max_reg_power,
+diff --git a/mt7915/main.c b/mt7915/main.c
+index da9cfc6..df7aab5 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -74,10 +74,12 @@ int mt7915_run(struct ieee80211_hw *hw)
+ 		goto out;
+ 
+ #ifdef MTK_DEBUG
+-	ret = mt7915_mcu_set_sku_en(phy, !dev->dbg.sku_disable);
+-#else
+-	ret = mt7915_mcu_set_sku_en(phy, true);
++	if (dev->dbg.sku_disable) {
++		phy->sku_limit_en = false;
++		phy->sku_path_en = false;
++	}
+ #endif
++	ret = mt7915_mcu_set_sku_en(phy);
+ 	if (ret)
+ 		goto out;
+ 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7e33386..f65f0ec 100644
+index 7e33386..224ce21 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3311,7 +3311,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
@@ -230,8 +307,35 @@
  	if (ret)
  		return ret;
  
-@@ -3353,51 +3354,106 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3351,53 +3352,139 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+ 				 sizeof(req), true);
+ }
  
++static void
++mt7915_update_txpower(struct mt7915_phy *phy, int tx_power)
++{
++	struct mt76_phy *mphy = phy->mt76;
++	struct ieee80211_channel *chan = mphy->main_chan;
++	int chain_idx, val, e2p_power_limit = 0;
++
++	if (chan == NULL) {
++		mphy->txpower_cur = tx_power;
++		return;
++	}
++
++	for (chain_idx = 0; chain_idx < hweight16(mphy->chainmask); chain_idx++) {
++		val = mt7915_eeprom_get_target_power(phy->dev, chan, chain_idx);
++		val += mt7915_eeprom_get_power_delta(phy->dev, chan->band);
++
++		e2p_power_limit = max_t(int, e2p_power_limit, val);
++	}
++
++	if (phy->sku_limit_en)
++		mphy->txpower_cur = min_t(int, e2p_power_limit, tx_power);
++	else
++		mphy->txpower_cur = e2p_power_limit;
++}
++
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  {
 +#define TX_POWER_LIMIT_TABLE_RATE	0
@@ -259,31 +363,39 @@
 +	struct sk_buff *skb;
  
  	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
- 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
+-	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
 -					      &limits_array, tx_power);
-+					      &la, tx_power);
- 	mphy->txpower_cur = tx_power;
+-	mphy->txpower_cur = tx_power;
  
 -	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
 -		u8 mcs_num, len = mt7915_sku_group_len[i];
 -		int j;
++	if (phy->sku_limit_en) {
++		tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
++					      	      &la, tx_power);
++		mt7915_update_txpower(phy, tx_power);
++	} else {
++		mt7915_update_txpower(phy, tx_power);
++		return 0;
++	}
+ 
+-		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
+-			mcs_num = 10;
 +	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 +				 sizeof(hdr) + MT7915_SKU_RATE_NUM);
 +	if (!skb)
 +		return -ENOMEM;
  
--		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
--			mcs_num = 10;
-+	skb_put_data(skb, &hdr, sizeof(hdr));
-+	skb_put_data(skb, &la.cck, len[SKU_CCK] + len[SKU_OFDM]);
-+	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
-+	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
- 
 -			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
 -				la = (s8 *)&limits_array + 12;
 -		} else {
 -			mcs_num = len;
 -		}
++	skb_put_data(skb, &hdr, sizeof(hdr));
++	skb_put_data(skb, &la.cck, len[SKU_CCK] + len[SKU_OFDM]);
++	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
++	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
++
 +	/* vht */
 +	for (i = 0; i < 4; i++) {
 +		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
@@ -299,13 +411,13 @@
 +				    MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
 +	if (ret)
 +		return ret;
-+
-+	/* only set per-path power table when it's configured */
-+	if (!la.path.ofdm[0])
-+		return 0;
  
 -		la += mcs_num;
 -		idx += len;
++	/* only set per-path power table when it's configured */
++	if (!phy->sku_path_en)
++		return 0;
++
 +	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 +				 sizeof(hdr) + MT7915_SKU_PATH_NUM);
 +	if (!skb)
@@ -362,7 +474,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3406,10 +3462,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3406,10 +3493,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -374,7 +486,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3419,9 +3474,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3419,9 +3505,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -393,9 +505,21 @@
  
  	dev_kfree_skb(skb);
  
+@@ -3450,7 +3542,7 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+ 				 sizeof(req), false);
+ }
+ 
-@@ -3463,9 +3524,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+-int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
++int mt7915_mcu_set_sku_en(struct mt7915_phy *phy)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt7915_sku {
+@@ -3461,10 +3553,21 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+ 	} __packed req = {
+ 		.format_id = TX_POWER_LIMIT_ENABLE,
  		.band_idx = phy->mt76->band_idx,
- 		.sku_enable = enable,
+-		.sku_enable = enable,
++		.sku_enable = phy->sku_limit_en,
  	};
 +	int ret;
 +
@@ -404,14 +528,16 @@
 +				sizeof(req), true);
 +	if (ret)
 +		return ret;
- 
- 	pr_info("%s: enable = %d\n", __func__, enable);
++
++	pr_info("%s: sku enable = %d, path enable = %d\n", __func__,
++		phy->sku_limit_en, phy->sku_path_en);
  
+-	pr_info("%s: enable = %d\n", __func__, enable);
++	req.sku_enable = phy->sku_path_en;
 +	req.format_id = TX_POWER_LIMIT_PATH_ENABLE;
-+
+ 
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
- 				 sizeof(req), true);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
 index 5fc4e2e..142bfc1 100644
 --- a/mt7915/mcu.h
@@ -436,7 +562,7 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a3d7b4b..4dc3825 100644
+index 25a6815..c2fb12d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -72,6 +72,7 @@
@@ -447,9 +573,22 @@
  
  #define MT7915_MAX_TWT_AGRT		16
  #define MT7915_MAX_STA_TWT_AGRT		8
-@@ -572,7 +573,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+@@ -263,6 +264,9 @@ struct mt7915_phy {
+ 	struct list_head stats_list;
+ 	spinlock_t stats_lock;
+ 
++	bool sku_limit_en;
++	bool sku_path_en;
++
+ #ifdef CONFIG_NL80211_TESTMODE
+ 	struct {
+ 		u32 *reg_backup;
+@@ -571,9 +575,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+ 			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
- int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
+-int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
++int mt7915_mcu_set_sku_en(struct mt7915_phy *phy);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
 -int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
 +int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
diff --git a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
index 47b364d..96441b6 100644
--- a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
@@ -1,19 +1,19 @@
-From c499d09d496d723dab109aee2e3af8a28278a54c Mon Sep 17 00:00:00 2001
+From 378077f87cb5c696dbb2b313d9d4ef08383b1a6e Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Fri, 11 Aug 2023 16:46:53 +0800
-Subject: [PATCH 1036/1040] wifi: mt76: mt7915: Disable RegDB when enable
+Subject: [PATCH 1036/1042] wifi: mt76: mt7915: Disable RegDB when enable
  single sku
 
 ---
  eeprom.c         |  3 ++-
  mt76.h           |  3 +++
  mt7915/debugfs.c | 49 +++++++++++++++++++++++++++++++++++++++++++-----
- mt7915/init.c    |  9 ++++++++-
+ mt7915/init.c    | 11 +++++++++--
  mt7915/regs.h    |  8 ++++----
- 5 files changed, 61 insertions(+), 11 deletions(-)
+ 5 files changed, 62 insertions(+), 12 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 4189525..38b0a58 100644
+index c0536f1..cf5e933 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -216,7 +216,7 @@ static bool mt76_string_prop_find(struct property *prop, const char *str)
@@ -34,10 +34,10 @@
  static const __be32 *
  mt76_get_of_array(struct device_node *np, char *name, size_t *len, int min)
 diff --git a/mt76.h b/mt76.h
-index 05c1874..91da8c5 100644
+index 6ed3e1e..e3f0dff 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1673,6 +1673,9 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
+@@ -1675,6 +1675,9 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
  
  void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr, u32 clear, u32 set);
  
@@ -140,29 +140,32 @@
  	return ret;
  }
 diff --git a/mt7915/init.c b/mt7915/init.c
-index a942bc2..82fe443 100644
+index 39bc2f6..fdfd284 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -283,7 +283,9 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+@@ -283,9 +283,11 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
  	int nss_delta = mt76_tx_power_nss_delta(n_chains);
  	int pwr_delta = mt7915_eeprom_get_power_delta(dev, sband->band);
  	struct mt76_power_limits limits;
 +	struct device_node *np;
  
+ 	phy->sku_limit_en = true;
+ 	phy->sku_path_en = true;
 +	np = mt76_find_power_limits_node(&dev->mt76);
  	for (i = 0; i < sband->n_channels; i++) {
  		struct ieee80211_channel *chan = &sband->channels[i];
  		u32 target_power = 0;
-@@ -302,8 +304,13 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
- 							  target_power);
+@@ -309,8 +311,13 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+ 
  		target_power += nss_delta;
  		target_power = DIV_ROUND_UP(target_power, 2);
 -		chan->max_power = min_t(int, chan->max_reg_power,
+-					target_power);
 +
 +		/* can NOT find country node in dts */
 +		if (!np)
 +			chan->max_power = min_t(int, chan->max_reg_power,
- 					target_power);
++						target_power);
 +		else
 +			chan->max_power = target_power;
  		chan->orig_mpwr = target_power;
diff --git a/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-mt7915-add-cheetah-eeprom-related-fix.patch b/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-mt7915-add-cheetah-eeprom-related-fix.patch
new file mode 100644
index 0000000..9ff6874
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-mt7915-add-cheetah-eeprom-related-fix.patch
@@ -0,0 +1,44 @@
+From 02120d0ab9b6d2f864706c2a0d6583c7b8fc60e8 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 31 Oct 2023 16:28:52 +0800
+Subject: [PATCH] wifi: mt76: mt7915: add cheetah eeprom related fix
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/eeprom.h | 3 ++-
+ mt7915/main.c   | 5 +++--
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index 9056d78..a1ab05a 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -160,7 +160,8 @@ static inline bool
+ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
+ {
+ 	u8 *eep = dev->mt76.eeprom.data;
+-	u8 val = eep[MT_EE_WIFI_CONF + 7];
++	u8 offs = is_mt7981(&dev->mt76) ? 8 : 7;
++	u8 val = eep[MT_EE_WIFI_CONF + offs];
+ 
+ 	if (band == NL80211_BAND_2GHZ)
+ 		return val & MT_EE_WIFI_CONF7_TSSI0_2G;
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 797a3b4..9ab93f4 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1110,8 +1110,9 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+ 
+ 	phy->mt76->antenna_mask = tx_ant;
+ 
+-	/* handle a variant of mt7916 which has 3T3R but nss2 on 5 GHz band */
+-	if (is_mt7916(&dev->mt76) && band && hweight8(tx_ant) == max_nss)
++	/* handle a variant of mt7916/mt7981 which has 3T3R but nss2 on 5 GHz band */
++	if ((is_mt7916(&dev->mt76) || is_mt7981(&dev->mt76)) &&
++	    band && hweight8(tx_ant) == max_nss)
+ 		phy->mt76->chainmask = (dev->chainmask >> chainshift) << chainshift;
+ 	else
+ 		phy->mt76->chainmask = tx_ant << (chainshift * band);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-testmode-add-cheetah-support.patch b/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-testmode-add-cheetah-support.patch
new file mode 100644
index 0000000..0f53710
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-testmode-add-cheetah-support.patch
@@ -0,0 +1,142 @@
+From 14b505d62c856f210ce46e831886ae0fab253252 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 31 Oct 2023 16:29:13 +0800
+Subject: [PATCH] wifi: mt76: testmode: add cheetah support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/eeprom.c   |  3 +--
+ mt7915/eeprom.h   | 12 ++++++++++++
+ mt7915/mcu.c      | 21 +++++++++++++++++++--
+ mt7915/testmode.c |  9 +++++----
+ 4 files changed, 37 insertions(+), 8 deletions(-)
+
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index f8166dd..50ed7ba 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -39,8 +39,7 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ 	if (!dev->flash_mode || !val)
+ 		return 0;
+ 
+-	size = mt7915_get_cal_group_size(dev) +
+-	       (is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2);
++	size = mt7915_get_cal_group_size(dev) + mt7915_get_cal_dpd_size(dev);
+ 
+ 	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
+ 	if (!dev->cal)
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index a1ab05a..99101f9 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -52,6 +52,7 @@ enum mt7915_eeprom_field {
+ #define MT_EE_CAL_GROUP_SIZE_7916_6G		(94 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
+ #define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
++#define MT_EE_CAL_DPD_SIZE_V2_7981		(102 * MT_EE_CAL_UNIT)	/* no 6g dpd data */
+ 
+ #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
+ #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
+@@ -192,6 +193,17 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
+ 	}
+ }
+ 
++static inline u32
++mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
++{
++	if (is_mt7915(&dev->mt76))
++		return MT_EE_CAL_DPD_SIZE_V1;
++	else if (is_mt7981(&dev->mt76))
++		return MT_EE_CAL_DPD_SIZE_V2_7981;
++	else
++		return MT_EE_CAL_DPD_SIZE_V2;
++}
++
+ extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
+ 
+ #endif
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index cd4f472..492cfcd 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3035,13 +3035,30 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
+ 		/* 5G BW160 */
+ 		5250, 5570, 5815
+ 	};
++	const u16 freq_list_v2_7981[] = {
++		/* 5G BW20 */
++		5180, 5200, 5220, 5240,
++		5260, 5280, 5300, 5320,
++		5500, 5520, 5540, 5560,
++		5580, 5600, 5620, 5640,
++		5660, 5680, 5700, 5720,
++		5745, 5765, 5785, 5805,
++		5825, 5845, 5865, 5885,
++		/* 5G BW160 */
++		5250, 5570, 5815
++	};
+ 	const u16 *freq_list = freq_list_v1;
+ 	int n_freqs = ARRAY_SIZE(freq_list_v1);
+ 	int idx;
+ 
+ 	if (!is_mt7915(&dev->mt76)) {
+-		freq_list = freq_list_v2;
+-		n_freqs = ARRAY_SIZE(freq_list_v2);
++		if (is_mt7981(&dev->mt76)) {
++			freq_list = freq_list_v2_7981;
++			n_freqs = ARRAY_SIZE(freq_list_v2_7981);
++		} else {
++			freq_list = freq_list_v2;
++			n_freqs = ARRAY_SIZE(freq_list_v2);
++		}
+ 	}
+ 
+ 	if (freq < 4000) {
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 5e20cb9..4aa7eb6 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -2149,7 +2149,7 @@ mt7915_tm_group_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
+ 	eeprom = mdev->eeprom.data;
+ 	dev->cur_prek_offset = 0;
+ 	group_size = mt7915_get_cal_group_size(dev);
+-	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++	dpd_size = mt7915_get_cal_dpd_size(dev);
+ 	size = group_size + dpd_size;
+ 	offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
+ 
+@@ -2231,11 +2231,11 @@ mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
+ 	eeprom = mdev->eeprom.data;
+ 	dev->cur_prek_offset = 0;
+ 	group_size = mt7915_get_cal_group_size(dev);
++	dpd_size = mt7915_get_cal_dpd_size(dev);
+ 	dev->dpd_chan_num_2g = hweight32(DPD_2G_CH_BW20_BITMAP_0);
+ 	if (is_mt7915(&dev->mt76)) {
+ 		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_7915_0);
+ 		dev->dpd_chan_num_6g = 0;
+-		dpd_size = MT_EE_CAL_DPD_SIZE_V1;
+ 		offs = MT_EE_DO_PRE_CAL;
+ 	} else {
+ 		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_0) +
+@@ -2244,7 +2244,8 @@ mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
+ 		dev->dpd_chan_num_6g = hweight32(DPD_6G_CH_BW20_BITMAP_0) +
+ 				       hweight32(DPD_6G_CH_BW20_BITMAP_1) +
+ 				       ARRAY_SIZE(bw160_6g_freq);
+-		dpd_size = MT_EE_CAL_DPD_SIZE_V2;
++		if (is_mt7981(&dev->mt76))
++			dev->dpd_chan_num_6g = 0;
+ 		offs = MT_EE_DO_PRE_CAL_V2;
+ 	}
+ 	size = group_size + dpd_size;
+@@ -2707,7 +2708,7 @@ mt7915_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int
+ 	}
+ 
+ 	group_size = mt7915_get_cal_group_size(dev);
+-	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++	dpd_size = mt7915_get_cal_dpd_size(dev);
+ 	dpd_per_chan_size = is_mt7915(&dev->mt76) ? 2 : 3;
+ 	total_size = group_size + dpd_size;
+ 	pre_cal = dev->cal;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 4c9198f..c30f05a 100644
--- a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 125ddf12e213498dbddda005b1b84587bc1f1a46 Mon Sep 17 00:00:00 2001
+From c6f5b4acf35c16b737f9dd72c4fc7245ed7224dc Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH] wifi: mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 2004/2012] wifi: mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
@@ -16,7 +16,7 @@
  7 files changed, 844 insertions(+), 4 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 49258905..9ad18833 100644
+index 4925890..9ad1883 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1175,6 +1175,7 @@ enum {
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 6dcee10c..ca42b698 100644
+index 6dcee10..ca42b69 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -466,10 +466,10 @@
  	if (!dev->dbdc_support || phy->mt76->band_idx) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 36621ad3..db627500 100644
+index e31a5a6..c643c33 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -600,10 +600,65 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -607,10 +607,65 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  	}
  }
  
@@ -535,7 +535,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -627,6 +682,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -634,6 +689,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		mt7915_mac_init_band(dev, i);
  
  	mt7915_init_led_mux(dev);
@@ -546,10 +546,10 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2dd4881f..8bcffd3f 100644
+index ee58f1c..040bc75 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -217,6 +217,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+@@ -219,6 +219,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct mt7915_dev *dev = phy->dev;
@@ -557,7 +557,7 @@
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
  	int idx, ret = 0;
-@@ -279,6 +280,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+@@ -281,6 +282,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
@@ -567,7 +567,7 @@
  	return ret;
  }
  
-@@ -769,6 +773,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -771,6 +775,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -575,7 +575,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
  #endif
-@@ -819,6 +824,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -821,6 +826,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (phy->muru_onoff & MUMIMO_DL_CERT)
  		mt7915_mcu_set_mimo(phy, 0);
  #endif
@@ -592,7 +592,7 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d8b93180..e5bfca3d 100644
+index 45344ac..636a2ab 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1674,7 +1674,7 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
@@ -624,7 +624,7 @@
  	ret = mt7915_mcu_add_group(dev, vif, sta);
  	if (ret) {
  		dev_kfree_skb(skb);
-@@ -3568,6 +3568,169 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3601,6 +3601,169 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -795,7 +795,7 @@
  {
  #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1d89814e..2b4ed04c 100644
+index 0c0bd82..90bfc47 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -141,6 +141,58 @@ struct mt7915_twt_flow {
@@ -865,7 +865,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -420,6 +473,8 @@ struct mt7915_dev {
+@@ -423,6 +476,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -874,7 +874,7 @@
  };
  
  enum {
-@@ -452,6 +507,15 @@ enum mt7915_rdd_cmd {
+@@ -455,6 +510,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -890,7 +890,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -581,6 +645,11 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -584,6 +648,11 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -899,11 +899,11 @@
 +int mt7915_mcu_set_vow_feature_ctrl(struct mt7915_dev *dev);
 +int mt7915_mcu_set_vow_band(struct mt7915_dev *dev, struct mt7915_vif *mvif);
 +void mt7915_vow_init_sta_bss_grp(struct mt7915_sta *sta);
- int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
+ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9fe7dcb1..9ff4c5cd 100644
+index 9fe7dcb..9ff4c5c 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1368,7 +1368,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch b/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
new file mode 100644
index 0000000..e9267b5
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
@@ -0,0 +1,211 @@
+From 72f6ac700c7a66508aeb8a8341789b138360c416 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Wed, 1 Nov 2023 07:50:08 +0800
+Subject: [PATCH 1/6] wifi: mt76: mt7915: wed: add per bss statistic info
+
+---
+ mt7915/init.c        |  1 +
+ mt7915/mac.c         | 21 +++++++++++++++++++++
+ mt7915/main.c        |  2 +-
+ mt7915/mcu.c         | 30 +++++++++++++++++++++++++++---
+ mt7915/mmio.c        | 24 ++++++++++++++++++++++++
+ mt7915/mt7915.h      |  3 ++-
+ mt7915/mtk_debugfs.c |  2 +-
+ 7 files changed, 77 insertions(+), 6 deletions(-)
+
+diff --git a/mt7915/init.c b/mt7915/init.c
+index c643c33..9978edb 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -397,6 +397,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_DISCOVERY);
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
++	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STAS_COUNT);
+ 
+ 	if (!is_mt7915(&dev->mt76))
+ 		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STA_TX_PWR);
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index a473fc6..e403f0f 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1067,6 +1067,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 	struct mt7915_phy *phy;
+ 	struct mt76_wcid *wcid;
+ 	__le32 *txs_data = data;
++	u64 last_bytes;
+ 	u16 wcidx;
+ 	u8 pid;
+ 
+@@ -1085,6 +1086,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 	if (!wcid)
+ 		goto out;
+ 
++	last_bytes = wcid->stats.tx_bytes;
+ 	msta = container_of(wcid, struct mt7915_sta, wcid);
+ 
+ 	if (pid == MT_PACKET_ID_WED)
+@@ -1095,6 +1097,24 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 	if (!wcid->sta)
+ 		goto out;
+ 
++	if (wiphy_ext_feature_isset(dev->mphy.hw->wiphy,
++				    NL80211_EXT_FEATURE_STAS_COUNT)) {
++		struct ieee80211_vif *vif;
++		struct wireless_dev *wdev;
++
++		vif = container_of((void *)msta->vif, struct ieee80211_vif,
++				   drv_priv);
++		if (!vif)
++			goto out;
++
++		wdev = ieee80211_vif_to_wdev(vif);
++
++		if (vif->type == NL80211_IFTYPE_MONITOR)
++			goto out;
++
++		dev_sw_netstats_tx_add(wdev->netdev, 0, (wcid->stats.tx_bytes - last_bytes));
++	}
++
+ 	spin_lock_bh(&dev->mt76.sta_poll_lock);
+ 	if (list_empty(&msta->wcid.poll_list))
+ 		list_add_tail(&msta->wcid.poll_list, &dev->mt76.sta_poll_list);
+@@ -2081,6 +2101,7 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+ 		spin_unlock_bh(&phy->stats_lock);
+ 
+ 		mt7915_mcu_get_tx_rate(phy, sta->wcid.idx);
++		mt7915_mcu_wed_wa_tx_stats(phy->dev, sta->wcid.idx, sta);
+ 
+ 		spin_lock_bh(&phy->stats_lock);
+ 	}
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 72bcaab..9595b55 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1188,7 +1188,7 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
+ 
+-		if (!mt7915_mcu_wed_wa_tx_stats(phy->dev, msta->wcid.idx)) {
++		if (!mt7915_mcu_wed_wa_tx_stats(phy->dev, msta->wcid.idx, msta)) {
+ 			sinfo->tx_packets = msta->wcid.stats.tx_packets;
+ 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
+ 		}
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index fe3f151..72f74e1 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -4467,7 +4467,8 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+ 				 &req, sizeof(req), true);
+ }
+ 
+-int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
++int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx,
++			       struct mt7915_sta *sta)
+ {
+ 	struct {
+ 		__le32 cmd;
+@@ -4511,11 +4512,34 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
+ 	rcu_read_lock();
+ 
+ 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
+-	if (wcid)
++	if (wcid) {
++		struct ieee80211_vif *vif;
++		struct wireless_dev *wdev;
++
+ 		wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
+-	else
++
++		if (!wiphy_ext_feature_isset(dev->mphy.hw->wiphy,
++					     NL80211_EXT_FEATURE_STAS_COUNT) ||
++		    !sta)
++			 goto unlock;
++
++		vif = container_of((void *)sta->vif,
++				   struct ieee80211_vif,
++				   drv_priv);
++		if (!vif)
++			goto unlock;
++
++		wdev = ieee80211_vif_to_wdev(vif);
++
++		if (vif->type == NL80211_IFTYPE_MONITOR)
++			goto unlock;
++
++		dev_sw_netstats_tx_add(wdev->netdev, le32_to_cpu(res->tx_packets), 0);
++	} else {
+ 		ret = -EINVAL;
++	}
+ 
++unlock:
+ 	rcu_read_unlock();
+ out:
+ 	dev_kfree_skb(skb);
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 2ad7ba4..ce976b4 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -742,8 +742,32 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
+ 		wcid->stats.rx_packets += le32_to_cpu(stats->rx_pkt_cnt);
+ 		wcid->stats.rx_errors += le32_to_cpu(stats->rx_err_cnt);
+ 		wcid->stats.rx_drops += le32_to_cpu(stats->rx_drop_cnt);
++
++		if (wiphy_ext_feature_isset(dev->mphy.hw->wiphy,
++					    NL80211_EXT_FEATURE_STAS_COUNT)) {
++			struct mt7915_sta *msta;
++			struct ieee80211_vif *vif;
++			struct wireless_dev *wdev;
++
++			msta = container_of(wcid, struct mt7915_sta, wcid);
++
++			vif = container_of((void *)msta->vif,
++					   struct ieee80211_vif,
++					   drv_priv);
++			if (!vif)
++				goto unlock;
++
++			wdev = ieee80211_vif_to_wdev(vif);
++
++			if (vif->type == NL80211_IFTYPE_MONITOR)
++				goto unlock;
++
++			dev_sw_netstats_rx_add(wdev->netdev, le32_to_cpu(stats->rx_pkt_cnt),
++					       le32_to_cpu(stats->rx_byte_cnt));
++		}
+ 	}
+ 
++unlock:
+ 	rcu_read_unlock();
+ }
+ 
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 091af43..1510f10 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -683,7 +683,8 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 			   struct ieee80211_sta *sta, struct rate_info *rate);
+ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
+ 				     struct cfg80211_chan_def *chandef);
+-int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wcid);
++int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wcid,
++			       struct mt7915_sta *sta);
+ int mt7915_get_tx_stat(struct mt7915_phy *phy, u16 wlan_idx);
+ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
+ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index e73db5d..f481231 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -3812,7 +3812,7 @@ static int mt7915_reset_counter(void *data, u64 val)
+ 	struct mt76_wcid *wcid;
+ 
+ 	/* Clear the firmware counters */
+-	mt7915_mcu_wed_wa_tx_stats(dev, dev->wlan_idx);
++	mt7915_mcu_wed_wa_tx_stats(dev, dev->wlan_idx, NULL);
+ 	mt7915_get_tx_stat(phy, dev->wlan_idx);
+ 
+ 	rcu_read_lock();
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/2012-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch b/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches/2012-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
rename to recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
index aea2ccd..6d7a03f 100644
--- a/recipes-wifi/linux-mt76/files/patches/2012-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
@@ -1,8 +1,8 @@
-From 5959391d31be290f08b6614c178231a298b4b91e Mon Sep 17 00:00:00 2001
+From 5fb134dd94aaa8986704094e0b0a62c9f2bfd391 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 23 Oct 2023 10:25:13 +0800
-Subject: [PATCH 2012/2015] Revert "wifi: mt76: mt7921: fix the wrong rate
- selected in fw for the chanctx driver"
+Subject: [PATCH 2/6] Revert "wifi: mt76: mt7921: fix the wrong rate selected
+ in fw for the chanctx driver"
 
 This reverts commit 9fc37b0ac5467cfe5e3d2ad8a29e9a7646ece2be.
 ---
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 7 deletions(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index aa99bd78..3a6404a7 100644
+index 07bd57b..1d22ab9 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -837,9 +837,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -846,9 +846,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  			     struct ieee80211_vif *vif,
  			     u8 rcpi, u8 sta_state)
  {
@@ -24,7 +24,7 @@
  	enum nl80211_band band = chandef->chan->band;
  	struct mt76_dev *dev = mphy->dev;
  	struct sta_rec_ra_info *ra_info;
-@@ -1345,10 +1343,7 @@ EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
+@@ -1354,10 +1352,7 @@ EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
  const struct ieee80211_sta_he_cap *
  mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch b/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
rename to recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
index 4997109..92b04dc 100644
--- a/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
@@ -1,8 +1,8 @@
-From b5cc571132a848d5daa3bec3ee07274205a98df0 Mon Sep 17 00:00:00 2001
+From 8beef73782b0b068ed1d86dcfec92f16e8297d4e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 23 Oct 2023 10:25:18 +0800
-Subject: [PATCH 2013/2015] Revert "wifi: mt76: mt7921: fix the wrong rate
- pickup for the chanctx driver"
+Subject: [PATCH 3/6] Revert "wifi: mt76: mt7921: fix the wrong rate pickup for
+ the chanctx driver"
 
 This reverts commit 66d5694e1898c5584a83c60876bec16909ebe2b0.
 ---
@@ -12,10 +12,10 @@
  3 files changed, 5 insertions(+), 14 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 137c5204..37e6a627 100644
+index 6232534..e7c4dc4 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1710,16 +1710,11 @@ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
+@@ -1715,16 +1715,11 @@ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
  }
  EXPORT_SYMBOL_GPL(mt76_init_queue);
  
@@ -35,7 +35,7 @@
  
  	/* pick the lowest rate for hidden nodes */
 diff --git a/mt76.h b/mt76.h
-index 0a7f4f14..05144b2c 100644
+index 0a7f4f1..05144b2 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -1207,8 +1207,7 @@ bool mt76_check_bin_file_mode(struct mt76_dev *dev);
@@ -49,7 +49,7 @@
  				     int n_desc, int ring_base, u32 flags)
  {
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index faeae26d..431d60d3 100644
+index 02d5232..f2b4ec9 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -293,10 +293,7 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
diff --git a/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch b/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
rename to recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
index 27dc9f6..db3e36c 100644
--- a/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
@@ -1,8 +1,8 @@
-From ae8181c30d187de764055ab15fd7f3efd8aa736c Mon Sep 17 00:00:00 2001
+From 7ff6353fd667964cc3e814dce1d79859e07fbdf4 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 23 Oct 2023 10:25:25 +0800
-Subject: [PATCH 2014/2015] Revert "wifi: mt76: move struct
- ieee80211_chanctx_conf up to struct mt76_vif"
+Subject: [PATCH 4/6] Revert "wifi: mt76: move struct ieee80211_chanctx_conf up
+ to struct mt76_vif"
 
 This reverts commit d1881b1b2bf6018d1cb1b91e4301a60021cacaa3.
 ---
@@ -13,7 +13,7 @@
  4 files changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 05144b2c..3ff348f2 100644
+index 05144b2..3ff348f 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -798,7 +798,6 @@ struct mt76_vif {
@@ -25,7 +25,7 @@
  
  struct mt76_phy {
 diff --git a/mt7921/main.c b/mt7921/main.c
-index 6a5c2cae..28c7e04b 100644
+index 6a5c2ca..28c7e04 100644
 --- a/mt7921/main.c
 +++ b/mt7921/main.c
 @@ -756,7 +756,7 @@ void mt7921_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -83,7 +83,7 @@
  	mt792x_mutex_release(dev);
  }
 diff --git a/mt792x.h b/mt792x.h
-index 548e89fa..39cbd139 100644
+index 548e89f..39cbd13 100644
 --- a/mt792x.h
 +++ b/mt792x.h
 @@ -93,6 +93,7 @@ struct mt792x_vif {
@@ -95,7 +95,7 @@
  
  struct mt792x_phy {
 diff --git a/mt792x_core.c b/mt792x_core.c
-index 7c4a74fb..8c97ac00 100644
+index 7c4a74f..8c97ac0 100644
 --- a/mt792x_core.c
 +++ b/mt792x_core.c
 @@ -243,7 +243,7 @@ int mt792x_assign_vif_chanctx(struct ieee80211_hw *hw,
diff --git a/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-fix-race-condition-related-to-check.patch b/recipes-wifi/linux-mt76/files/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
rename to recipes-wifi/linux-mt76/files/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
index 91507f4..d23662b 100644
--- a/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
@@ -1,7 +1,7 @@
-From 20d498a3d24a4c20a421bc6bc19a058620aa86ec Mon Sep 17 00:00:00 2001
+From 04de28f9fec0bce1f37dd6bb3c2081d91bdc218e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 23 Oct 2023 10:26:01 +0800
-Subject: [PATCH 2015/2015] Revert "wifi: mt76: fix race condition related to
+Subject: [PATCH 5/6] Revert "wifi: mt76: fix race condition related to
  checking tx queue fill status"
 
 This reverts commit f1e1e67d97d1e9a8bb01b59ab20c45ebc985a958.
@@ -12,7 +12,7 @@
  3 files changed, 20 insertions(+), 120 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 37e6a627..923c6a31 100644
+index e7c4dc4..4caa714 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -427,9 +427,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -41,7 +41,7 @@
  	ieee80211_unregister_hw(hw);
  }
  EXPORT_SYMBOL_GPL(mt76_unregister_device);
-@@ -1460,9 +1455,6 @@ EXPORT_SYMBOL_GPL(mt76_sta_pre_rcu_remove);
+@@ -1465,9 +1460,6 @@ EXPORT_SYMBOL_GPL(mt76_sta_pre_rcu_remove);
  
  void mt76_wcid_init(struct mt76_wcid *wcid)
  {
@@ -51,7 +51,7 @@
  	INIT_LIST_HEAD(&wcid->list);
  	idr_init(&wcid->pktid);
  }
-@@ -1470,32 +1462,13 @@ EXPORT_SYMBOL_GPL(mt76_wcid_init);
+@@ -1475,32 +1467,13 @@ EXPORT_SYMBOL_GPL(mt76_wcid_init);
  
  void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
  {
@@ -85,7 +85,7 @@
  EXPORT_SYMBOL_GPL(mt76_wcid_cleanup);
  
 diff --git a/mt76.h b/mt76.h
-index 3ff348f2..5eb571ef 100644
+index 3ff348f..5eb571e 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -354,9 +354,6 @@ struct mt76_wcid {
@@ -108,10 +108,10 @@
  
  	struct cfg80211_chan_def chandef;
 diff --git a/tx.c b/tx.c
-index 23a1e4e2..9dfc2890 100644
+index 96f9009..c88fb29 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -322,32 +322,40 @@ void
+@@ -328,32 +328,40 @@ void
  mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
  	struct mt76_wcid *wcid, struct sk_buff *skb)
  {
@@ -164,7 +164,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_tx);
  
-@@ -578,86 +586,10 @@ void mt76_txq_schedule(struct mt76_phy *phy, enum mt76_txq_id qid)
+@@ -584,86 +592,10 @@ void mt76_txq_schedule(struct mt76_phy *phy, enum mt76_txq_id qid)
  }
  EXPORT_SYMBOL_GPL(mt76_txq_schedule);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
index 3d2e07e..3132a24 100644
--- a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,7 +1,7 @@
-From 87cc43ed074bca81b765e0961bd24da23f6e997e Mon Sep 17 00:00:00 2001
+From 8a9009b2bed6a9ae4c7a3a4d12fe8d7e15293103 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 5 Apr 2023 08:29:19 +0800
-Subject: [PATCH] mt76: revert for backports-5.15 wireless stack
+Subject: [PATCH 6/6] mt76: revert for backports-5.15 wireless stack
 
 wifi: mt76: mt7915: add support for he ldpc control from hostapd
 ---
@@ -24,7 +24,7 @@
  16 files changed, 259 insertions(+), 226 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 7c5e623c..908852c0 100644
+index 7c5e623..908852c 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -996,7 +996,7 @@ mt76_dma_init(struct mt76_dev *dev,
@@ -37,10 +37,10 @@
  		napi_enable(&dev->napi[i]);
  	}
 diff --git a/mac80211.c b/mac80211.c
-index 62325345..137c5204 100644
+index 4caa714..923c6a3 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1046,14 +1046,9 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1041,14 +1041,9 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  	status->enc_flags = mstat.enc_flags;
  	status->encoding = mstat.encoding;
  	status->bw = mstat.bw;
@@ -58,7 +58,7 @@
  	status->rate_idx = mstat.rate_idx;
  	status->nss = mstat.nss;
  	status->band = mstat.band;
-@@ -1573,7 +1568,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
+@@ -1546,7 +1541,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
  static void
  __mt76_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -67,7 +67,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -1595,7 +1590,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1568,7 +1563,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct mt76_dev *dev = priv;
  
@@ -77,7 +77,7 @@
  
  	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
 diff --git a/mt7615/dma.c b/mt7615/dma.c
-index 0ce01ccc..ad324850 100644
+index 0ce01cc..ad32485 100644
 --- a/mt7615/dma.c
 +++ b/mt7615/dma.c
 @@ -282,8 +282,8 @@ int mt7615_dma_init(struct mt7615_dev *dev)
@@ -92,7 +92,7 @@
  
  	mt76_poll(dev, MT_WPDMA_GLO_CFG,
 diff --git a/mt7615/main.c b/mt7615/main.c
-index dab16b5f..d32a7520 100644
+index dab16b5..d32a752 100644
 --- a/mt7615/main.c
 +++ b/mt7615/main.c
 @@ -473,7 +473,7 @@ static int mt7615_config(struct ieee80211_hw *hw, u32 changed)
@@ -123,7 +123,7 @@
  	if (changed & BSS_CHANGED_MU_GROUPS)
  		 mt7615_update_mu_group(hw, vif, info);
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index db337aad..c4d97434 100644
+index db337aa..c4d9743 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -353,7 +353,7 @@ out:
@@ -163,10 +163,10 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 02d52328..faeae26d 100644
+index f2b4ec9..431d60d 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -1110,7 +1110,7 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -1107,7 +1107,7 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  	u32 val;
  
  	if (!sta ||
@@ -176,7 +176,7 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 07bd57b8..aa99bd78 100644
+index 1d22ab9..3a6404a 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -198,7 +198,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
@@ -314,7 +314,7 @@
  	}
  
  	return mode;
-@@ -858,25 +849,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -856,25 +847,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	u16 supp_rates;
  
  	/* starec ht */
@@ -346,7 +346,7 @@
  	}
  
  	/* starec uapsd */
-@@ -885,11 +876,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -883,11 +874,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	if (!is_mt7921(dev))
  		return;
  
@@ -360,7 +360,7 @@
  		mt76_connac_mcu_sta_he_tlv(skb, sta);
  		mt76_connac_mcu_sta_he_tlv_v2(skb, sta);
  		if (band == NL80211_BAND_6GHZ &&
-@@ -899,7 +890,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -897,7 +888,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
  						      sizeof(*he_6g_capa));
  			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
@@ -369,7 +369,7 @@
  		}
  	}
  
-@@ -909,14 +900,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -907,14 +898,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
  	phy->rcpi = rcpi;
  	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
@@ -387,7 +387,7 @@
  	if (band == NL80211_BAND_2GHZ)
  		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
  			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
-@@ -925,18 +916,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -923,18 +914,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  
  	ra_info->legacy = cpu_to_le16(supp_rates);
  
@@ -411,7 +411,7 @@
  			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
  	}
  }
-@@ -952,7 +943,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
+@@ -950,7 +941,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
  					     wtbl_tlv, sta_wtbl);
  	smps = (struct wtbl_smps *)tlv;
@@ -420,7 +420,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
  
-@@ -964,27 +955,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -962,27 +953,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u32 flags = 0;
  
@@ -456,7 +456,7 @@
  		struct wtbl_vht *vht;
  		u8 af;
  
-@@ -993,18 +984,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -991,18 +982,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sta_wtbl);
  		vht = (struct wtbl_vht *)tlv;
  		vht->ldpc = vht_ldpc &&
@@ -478,7 +478,7 @@
  		/* sgi */
  		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
  			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
-@@ -1014,15 +1005,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1012,15 +1003,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sizeof(*raw), wtbl_tlv,
  						     sta_wtbl);
  
@@ -499,7 +499,7 @@
  				flags |= MT_WTBL_W5_SHORT_GI_160;
  		}
  		raw = (struct wtbl_raw *)tlv;
-@@ -1311,9 +1302,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1309,9 +1300,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  		return 0x38;
  
  	if (sta) {
@@ -512,7 +512,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -1636,7 +1627,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1631,7 +1622,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	for (i = 0; i < sreq->n_ssids; i++) {
  		if (!sreq->ssids[i].ssid_len)
  			continue;
@@ -520,7 +520,7 @@
  		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
  		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
  		       sreq->ssids[i].ssid_len);
-@@ -1776,7 +1766,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
+@@ -1771,7 +1761,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
  		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
  		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
  	}
@@ -528,7 +528,7 @@
  	req->match_num = sreq->n_match_sets;
  	for (i = 0; i < req->match_num; i++) {
  		match = &sreq->match_sets[i];
-@@ -2272,10 +2261,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2267,10 +2256,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  				      struct mt76_vif *vif,
  				      struct ieee80211_bss_conf *info)
  {
@@ -540,7 +540,7 @@
  			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
  	struct {
  		struct {
-@@ -2303,7 +2290,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2298,7 +2285,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  
  	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
  	for (i = 0; i < len; i++)
@@ -550,7 +550,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
  }
 diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-index d5db6ffd..fec3d10d 100644
+index d5db6ff..fec3d10 100644
 --- a/mt76x02_mac.c
 +++ b/mt76x02_mac.c
 @@ -404,7 +404,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
@@ -575,7 +575,7 @@
  		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
  			ba_size = 0;
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index fd35b579..117ebb56 100644
+index fd35b57..117ebb5 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -2049,8 +2049,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
@@ -590,7 +590,7 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index f71ec55b..b4e231b7 100644
+index f71ec55..b4e231b 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -590,8 +590,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -605,10 +605,10 @@
  
  	mt7915_dma_enable(dev, false);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index db627500..0ce17775 100644
+index 9978edb..d50e694 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1173,8 +1173,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -1181,8 +1181,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  			mt76_connac_gen_ppe_thresh(he_cap->ppe_thres, nss);
  		} else {
  			he_cap_elem->phy_cap_info[9] |=
@@ -619,10 +619,10 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8bcffd3f..7af49404 100644
+index 9595b55..29bfec8 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -538,7 +538,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -540,7 +540,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  
  static int
  mt7915_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -631,7 +631,7 @@
  	       const struct ieee80211_tx_queue_params *params)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-@@ -639,7 +639,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
+@@ -641,7 +641,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
  static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  				    struct ieee80211_vif *vif,
  				    struct ieee80211_bss_conf *info,
@@ -640,7 +640,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -655,7 +655,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -657,7 +657,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	    vif->type == NL80211_IFTYPE_STATION)
  		set_bss_info = set_sta = !is_zero_ether_addr(info->bssid);
  	if (changed & BSS_CHANGED_ASSOC)
@@ -649,7 +649,7 @@
  	if (changed & BSS_CHANGED_BEACON_ENABLED &&
  	    vif->type != NL80211_IFTYPE_AP)
  		set_bss_info = set_sta = info->enable_beacon;
-@@ -703,27 +703,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -705,27 +705,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -678,7 +678,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -731,8 +712,6 @@ mt7915_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -733,8 +714,6 @@ mt7915_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -687,7 +687,7 @@
  	err = mt7915_mcu_add_bss_info(phy, vif, true);
  	if (err)
  		goto out;
-@@ -744,8 +723,7 @@ out:
+@@ -746,8 +725,7 @@ out:
  }
  
  static void
@@ -697,7 +697,7 @@
  {
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
  
-@@ -1307,10 +1285,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
+@@ -1317,10 +1295,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
@@ -711,7 +711,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ebacfd27..95c4188d 100644
+index 72f74e1..cb534af 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -67,7 +67,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
@@ -1303,7 +1303,7 @@
  	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
  	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
  	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
-@@ -3331,17 +3411,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3351,17 +3431,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1325,7 +1325,7 @@
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b6779474..1e998113 100644
+index ce976b4..3755690 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -689,7 +689,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
@@ -1338,7 +1338,7 @@
  			skb_free_frag(ptr);
  			mt76_put_rxwi(&dev->mt76, r);
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 5e20cb9e..a765f387 100644
+index ecd6271..b2c442b 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -418,12 +418,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
@@ -1359,7 +1359,7 @@
  	sta->wme = 1;
  
 diff --git a/tx.c b/tx.c
-index 96f9009b..23a1e4e2 100644
+index c88fb29..9dfc289 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 9219623..8eeae08 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -8,6 +8,7 @@
     file://0006-wifi-mt76-mt7915-rework-mmio-access-flow.patch \
     file://0007-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch \
     file://0008-wifi-mt76-mt7915-add-new-chip-version-in-power-on-se.patch \
+    file://0009-wifi-mt76-mt7915-Fixed-null-pointer-dereference-.patch \
     file://0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch \
     file://1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch \
     file://1001-wifi-mt76-mt7915-csi-implement-csi-support.patch \
@@ -52,6 +53,8 @@
     file://1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch \
     file://1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch \
     file://1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch \
+    file://1043-wifi-mt76-mt7915-add-cheetah-eeprom-related-fix.patch \
+    file://1044-wifi-mt76-testmode-add-cheetah-support.patch \
     file://2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch \
     file://2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch \
@@ -64,9 +67,10 @@
     file://2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch \
     file://2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch \
     file://2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch \
-    file://2012-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch \
-    file://2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch \
-    file://2014-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch \
-    file://2015-Revert-wifi-mt76-fix-race-condition-related-to-check.patch \
+    file://2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch \
+    file://2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch \
+    file://2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch \
+    file://2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch \
+    file://2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch \
     file://9999-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "
diff --git a/recipes-wifi/ucode/files/0001-change-cmakelist.patch b/recipes-wifi/ucode/files/0001-change-cmakelist.patch
deleted file mode 100644
index 2770833..0000000
--- a/recipes-wifi/ucode/files/0001-change-cmakelist.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index d8dd34a..07e37a5 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -23,8 +23,8 @@ OPTION(FS_SUPPORT "Filesystem plugin support" ON)
- OPTION(MATH_SUPPORT "Math plugin support" ON)
- OPTION(UBUS_SUPPORT "Ubus plugin support" ON)
- OPTION(UCI_SUPPORT "UCI plugin support" ON)
--OPTION(RTNL_SUPPORT "Route Netlink plugin support" ${LINUX})
--OPTION(NL80211_SUPPORT "Wireless Netlink plugin support" ${LINUX})
-+OPTION(RTNL_SUPPORT "Route Netlink plugin support" ON)
-+OPTION(NL80211_SUPPORT "Wireless Netlink plugin support" ON)
- OPTION(RESOLV_SUPPORT "NS resolve plugin support" ON)
- OPTION(STRUCT_SUPPORT "Struct plugin support" ON)
- OPTION(ULOOP_SUPPORT "Uloop plugin support" ON)
diff --git a/recipes-wifi/ucode/ucode_git.bb b/recipes-wifi/ucode/ucode_git.bb
index e8d62a9..64c9c09 100644
--- a/recipes-wifi/ucode/ucode_git.bb
+++ b/recipes-wifi/ucode/ucode_git.bb
@@ -8,7 +8,7 @@
     git://git@github.com/jow-/ucode.git;protocol=https \
 "
 
-SRCREV = "07c03173d4e6a30953f92fa88ed29b0b956c9106"
+SRCREV = "a6e75e02528e36f3610a7f0073453018336def2e"
 PV = "git${SRCPV}"
 
 S = "${WORKDIR}/git"
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/135-mbedtls-fix-owe-association.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/135-mbedtls-fix-owe-association.patch
new file mode 100644
index 0000000..0c29432
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/135-mbedtls-fix-owe-association.patch
@@ -0,0 +1,91 @@
+The code for hostapd-mbedtls did not work when used for OWE association.
+
+When handling association requests, the buffer offsets and length assumptions were incorrect, leading to never calculating the y point, thus denying association.
+
+Also when crafting the association response, the buffer contained the trailing key-type.
+
+Fix up both issues to adhere to the specification and make hostapd-mbedtls work with the OWE security type.
+
+--- a/src/crypto/crypto_mbedtls.c
++++ b/src/crypto/crypto_mbedtls.c
+@@ -2299,25 +2299,30 @@ struct crypto_ecdh * crypto_ecdh_init2(i
+ struct wpabuf * crypto_ecdh_get_pubkey(struct crypto_ecdh *ecdh, int inc_y)
+ {
+ 	mbedtls_ecp_group *grp = &ecdh->grp;
+-	size_t len = CRYPTO_EC_plen(grp);
++	size_t prime_len = CRYPTO_EC_plen(grp);
++	size_t output_len = prime_len;
++	u8 output_offset = 0;
++	u8 buf[256];
++
+   #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
+ 	/* len */
+   #endif
+   #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
+-	if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS)
+-		len = inc_y ? len*2+1 : len+1;
++	if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
++		output_len = inc_y ? prime_len * 2 + 1 : prime_len + 1;
++		output_offset = 1;
++	}
+   #endif
+-	struct wpabuf *buf = wpabuf_alloc(len);
+-	if (buf == NULL)
++
++	if (output_len > sizeof(buf))
+ 		return NULL;
++
+ 	inc_y = inc_y ? MBEDTLS_ECP_PF_UNCOMPRESSED : MBEDTLS_ECP_PF_COMPRESSED;
+-	if (mbedtls_ecp_point_write_binary(grp, &ecdh->Q, inc_y, &len,
+-	                                   wpabuf_mhead_u8(buf), len) == 0) {
+-		wpabuf_put(buf, len);
+-		return buf;
++	if (mbedtls_ecp_point_write_binary(grp, &ecdh->Q, inc_y, &output_len,
++	                                   buf, output_len) == 0) {
++		return wpabuf_alloc_copy(buf + output_offset, output_len - output_offset);
+ 	}
+ 
+-	wpabuf_free(buf);
+ 	return NULL;
+ }
+ 
+@@ -2379,10 +2384,7 @@ struct wpabuf * crypto_ecdh_set_peerkey(
+ 				os_memcpy(buf+2, key, len);
+ 			}
+ 			len >>= 1; /*(repurpose len to prime_len)*/
+-		}
+-		else if (key[0] == 0x02 || key[0] == 0x03) { /* (inc_y == 0) */
+-			--len; /*(repurpose len to prime_len)*/
+-
++		} else { /* (inc_y == 0) */
+ 			/* mbedtls_ecp_point_read_binary() does not currently support
+ 			 * MBEDTLS_ECP_PF_COMPRESSED format (buf[1] = 0x02 or 0x03)
+ 			 * (returns MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) */
+@@ -2390,22 +2392,21 @@ struct wpabuf * crypto_ecdh_set_peerkey(
+ 			/* derive y, amend buf[] with y for UNCOMPRESSED format */
+ 			if (sizeof(buf)-2 < len*2 || len == 0)
+ 				return NULL;
++
+ 			buf[0] = (u8)(1+len*2);
+ 			buf[1] = 0x04;
++			os_memcpy(buf+2, key, len);
++
+ 			mbedtls_mpi bn;
+ 			mbedtls_mpi_init(&bn);
+-			int ret = mbedtls_mpi_read_binary(&bn, key+1, len)
+-			       || crypto_mbedtls_short_weierstrass_derive_y(grp, &bn,
+-			                                                    key[0] & 1)
++			int ret = mbedtls_mpi_read_binary(&bn, key, len)
++			       || crypto_mbedtls_short_weierstrass_derive_y(grp, &bn, 0)
+ 			       || mbedtls_mpi_write_binary(&bn, buf+2+len, len);
+ 			mbedtls_mpi_free(&bn);
+ 			if (ret != 0)
+ 				return NULL;
+ 		}
+ 
+-		if (key[0] == 0) /*(repurpose len to prime_len)*/
+-			len = CRYPTO_EC_plen(grp);
+-
+ 		if (mbedtls_ecdh_read_public(&ecdh->ctx, buf, buf[0]+1))
+ 			return NULL;
+ 	}
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/301-mesh-noscan.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/301-mesh-noscan.patch
index 6b5416f..ceb6d0c 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/301-mesh-noscan.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/301-mesh-noscan.patch
@@ -24,8 +24,8 @@
  			   frequency);
  		goto out_free;
  	}
-+	if (ssid->noscan)
-+		conf->noscan = 1;
++	if (conf->noscan)
++		ssid->noscan = 1;
  
  	if (ssid->mesh_basic_rates == NULL) {
  		/*
@@ -45,7 +45,7 @@
  	unsigned int j;
  	static const int ht40plus[] = {
 -		36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
-+		1, 2, 3, 4, 5, 6, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
++		1, 2, 3, 4, 5, 6, 7, 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157, 165, 173,
  		184, 192
  	};
  	int ht40 = -1;
@@ -58,6 +58,15 @@
  	u8 channel;
  	bool is_6ghz;
  	bool dfs_enabled = wpa_s->conf->country[0] && (wpa_s->drv_flags & WPA_DRIVER_FLAGS_RADAR);
+@@ -3080,6 +3080,8 @@ void ibss_mesh_setup_freq(struct wpa_sup
+ 		freq->he_enabled = ibss_mesh_can_use_he(wpa_s, ssid, mode,
+ 							ieee80211_mode);
+ 	freq->channel = channel;
++	if (mode->mode == HOSTAPD_MODE_IEEE80211G && ssid->noscan)
++		ibss_mesh_select_40mhz(wpa_s, ssid, mode, freq, obss_scan, dfs_enabled);
+ 	/* Setup higher BW only for 5 GHz */
+ 	if (mode->mode == HOSTAPD_MODE_IEEE80211A) {
+ 		ibss_mesh_select_40mhz(wpa_s, ssid, mode, freq, obss_scan, dfs_enabled);
 --- a/wpa_supplicant/config_ssid.h
 +++ b/wpa_supplicant/config_ssid.h
 @@ -1035,6 +1035,8 @@ struct wpa_ssid {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/310-rescan_immediately.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/310-rescan_immediately.patch
index e12b205..6e0244b 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/310-rescan_immediately.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/310-rescan_immediately.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -5767,7 +5767,7 @@ wpa_supplicant_alloc(struct wpa_supplica
+@@ -5769,7 +5769,7 @@ wpa_supplicant_alloc(struct wpa_supplica
  	if (wpa_s == NULL)
  		return NULL;
  	wpa_s->scan_req = INITIAL_SCAN_REQ;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
index c6fe54e..dc19553 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch
@@ -174,7 +174,7 @@
  	 * macsec_policy - Determines the policy for MACsec secure session
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -4175,6 +4175,12 @@ static void wpas_start_assoc_cb(struct w
+@@ -4177,6 +4177,12 @@ static void wpas_start_assoc_cb(struct w
  			params.beacon_int = ssid->beacon_int;
  		else
  			params.beacon_int = wpa_s->conf->beacon_int;
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/600-ubus_support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/600-ubus_support.patch
index bc80ef0..a6ccf83 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/600-ubus_support.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/600-ubus_support.patch
@@ -348,7 +348,7 @@
  CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -7593,6 +7593,8 @@ struct wpa_supplicant * wpa_supplicant_a
+@@ -7595,6 +7595,8 @@ struct wpa_supplicant * wpa_supplicant_a
  	}
  #endif /* CONFIG_P2P */
  
@@ -357,7 +357,7 @@
  	return wpa_s;
  }
  
-@@ -7619,6 +7621,8 @@ int wpa_supplicant_remove_iface(struct w
+@@ -7621,6 +7623,8 @@ int wpa_supplicant_remove_iface(struct w
  	struct wpa_supplicant *parent = wpa_s->parent;
  #endif /* CONFIG_MESH */
  
@@ -366,7 +366,7 @@
  	/* Remove interface from the global list of interfaces */
  	prev = global->ifaces;
  	if (prev == wpa_s) {
-@@ -7965,8 +7969,12 @@ int wpa_supplicant_run(struct wpa_global
+@@ -7967,8 +7971,12 @@ int wpa_supplicant_run(struct wpa_global
  	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
  	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
  
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/601-ucode_support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/601-ucode_support.patch
index de182b9..23f535b 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/601-ucode_support.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/601-ucode_support.patch
@@ -196,7 +196,7 @@
  
  #ifdef CONFIG_BGSCAN
  	if (state == WPA_COMPLETED && wpa_s->current_ssid != wpa_s->bgscan_ssid)
-@@ -7594,6 +7595,7 @@ struct wpa_supplicant * wpa_supplicant_a
+@@ -7596,6 +7597,7 @@ struct wpa_supplicant * wpa_supplicant_a
  #endif /* CONFIG_P2P */
  
  	wpas_ubus_add_bss(wpa_s);
@@ -204,7 +204,7 @@
  
  	return wpa_s;
  }
-@@ -7621,6 +7623,7 @@ int wpa_supplicant_remove_iface(struct w
+@@ -7623,6 +7625,7 @@ int wpa_supplicant_remove_iface(struct w
  	struct wpa_supplicant *parent = wpa_s->parent;
  #endif /* CONFIG_MESH */
  
@@ -212,7 +212,7 @@
  	wpas_ubus_free_bss(wpa_s);
  
  	/* Remove interface from the global list of interfaces */
-@@ -7931,6 +7934,7 @@ struct wpa_global * wpa_supplicant_init(
+@@ -7933,6 +7936,7 @@ struct wpa_global * wpa_supplicant_init(
  
  	eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
  			       wpas_periodic, global, NULL);
@@ -220,7 +220,7 @@
  
  	return global;
  }
-@@ -7969,12 +7973,8 @@ int wpa_supplicant_run(struct wpa_global
+@@ -7971,12 +7975,8 @@ int wpa_supplicant_run(struct wpa_global
  	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
  	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
  
@@ -233,7 +233,7 @@
  	return 0;
  }
  
-@@ -8007,6 +8007,8 @@ void wpa_supplicant_deinit(struct wpa_gl
+@@ -8009,6 +8009,8 @@ void wpa_supplicant_deinit(struct wpa_gl
  
  	wpas_notify_supplicant_deinitialized(global);
  
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch
new file mode 100644
index 0000000..c7b595d
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch
@@ -0,0 +1,62 @@
+From: David Bauer <mail@david-bauer.net>
+To: hostap@lists.infradead.org
+Cc: =?utf-8?q?=C3=89tienne_Morice?= <neon.emorice@mail.com>
+Subject: [PATCH] nl80211: add extra-ies only if allowed by driver
+Date: Sun, 30 Jan 2022 20:22:00 +0100
+Message-Id: <20220130192200.10883-1-mail@david-bauer.net>
+List-Id: <hostap.lists.infradead.org>
+
+Upgrading wpa_supplicant from 2.9 to 2.10 breaks broadcom-wl
+based adapters. The reason for it is hostapd tries to install additional
+IEs for scanning while the driver does not support this.
+
+The kernel indicates the maximum number of bytes for additional scan IEs
+using the NL80211_ATTR_MAX_SCAN_IE_LEN attribute. Save this value and
+only add additional scan IEs in case the driver can accommodate these
+additional IEs.
+
+Reported-by: Étienne Morice <neon.emorice@mail.com>
+Tested-by: Étienne Morice <neon.emorice@mail.com>
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ src/drivers/driver.h              | 3 +++
+ src/drivers/driver_nl80211_capa.c | 4 ++++
+ src/drivers/driver_nl80211_scan.c | 2 +-
+ 3 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -2283,6 +2283,9 @@ struct wpa_driver_capa {
+ 	/** Maximum number of iterations in a single scan plan */
+ 	u32 max_sched_scan_plan_iterations;
+ 
++	/** Maximum number of extra IE bytes for scans */
++	u16 max_scan_ie_len;
++
+ 	/** Whether sched_scan (offloaded scanning) is supported */
+ 	int sched_scan_supported;
+ 
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -949,6 +949,10 @@ static int wiphy_info_handler(struct nl_
+ 			nla_get_u32(tb[NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS]);
+ 	}
+ 
++	if (tb[NL80211_ATTR_MAX_SCAN_IE_LEN])
++		capa->max_scan_ie_len =
++			nla_get_u16(tb[NL80211_ATTR_MAX_SCAN_IE_LEN]);
++
+ 	if (tb[NL80211_ATTR_MAX_MATCH_SETS])
+ 		capa->max_match_sets =
+ 			nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
+--- a/src/drivers/driver_nl80211_scan.c
++++ b/src/drivers/driver_nl80211_scan.c
+@@ -222,7 +222,7 @@ nl80211_scan_common(struct i802_bss *bss
+ 		wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
+ 	}
+ 
+-	if (params->extra_ies) {
++	if (params->extra_ies && drv->capa.max_scan_ie_len >= params->extra_ies_len) {
+ 		wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
+ 			    params->extra_ies, params->extra_ies_len);
+ 		if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
index 4c214c1..600fad1 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
@@ -12,6 +12,7 @@
     file://110-mbedtls-TLS-crypto-option-initial-port.patch \
     file://120-mbedtls-fips186_2_prf.patch \
     file://130-mbedtls-annotate-with-TEST_FAIL-for-hwsim-tests.patch \
+    file://135-mbedtls-fix-owe-association.patch \
     file://140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch \
     file://150-add-NULL-checks-encountered-during-tests-hwsim.patch \
     file://160-dpp_pkex-EC-point-mul-w-value-prime.patch \
@@ -60,6 +61,7 @@
     file://770-radius_server.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://991-Fix-OpenWrt-13156.patch \
+    file://992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch \
     file://mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch \
     file://mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
     file://mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch \
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0045-hostapd-mtk-add-log-in-extender-mode.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0045-hostapd-mtk-add-log-in-extender-mode.patch
new file mode 100644
index 0000000..b0530a0
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0045-hostapd-mtk-add-log-in-extender-mode.patch
@@ -0,0 +1,51 @@
+From ffd6770c6cb58a8b7cb6bd4ec7a1c5f161e86d1d Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Fri, 27 Oct 2023 10:12:59 +0800
+Subject: [PATCH] hostapd: mtk: add log in extender mode
+
+---
+ hostapd/ctrl_iface.c   | 8 ++++++++
+ src/ap/ctrl_iface_ap.c | 1 +
+ 2 files changed, 9 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 89594ec..aa435ee 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -186,6 +186,13 @@ static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
+ 			break;
+ 	}
+ 
++	wpa_printf(MSG_INFO, "mtk: new channel information: channel=%u, "
++		   "secondary_channel=%d, center_segment0=%u, "
++		   "center_segment1=%u, op_class=%u\n",
++		   conf->channel, conf->secondary_channel,
++		   hostapd_get_oper_centr_freq_seg0_idx(conf),
++		   hostapd_get_oper_centr_freq_seg1_idx(conf), conf->op_class);
++
+ 	return conf;
+ }
+ 
+@@ -199,6 +206,7 @@ static int hostapd_ctrl_iface_update(struct hostapd_data *hapd, char *txt)
+ 	iface->interfaces->config_read_cb = hostapd_ctrl_iface_config_read;
+ 	reload_opts = txt;
+ 
++	wpa_printf(MSG_INFO, "mtk: update iface for %s\n", iface->phy);
+ 	for (j = 0; j < iface->num_bss; j++)
+ 		iface->bss[j]->stopped_by_supplicant = 0;
+ 
+diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
+index 1ad37c5..86e8729 100644
+--- a/src/ap/ctrl_iface_ap.c
++++ b/src/ap/ctrl_iface_ap.c
+@@ -951,6 +951,7 @@ int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd)
+ 	struct hostapd_iface *iface = hapd->iface;
+ 	int i;
+ 
++	wpa_printf(MSG_INFO, "mtk: stop iface for %s\n", iface->phy);
+ 	for (i = 0; i < iface->num_bss; i++){
+ 		iface->bss[i]->stopped_by_supplicant = 1;
+ 		hostapd_drv_stop_ap(iface->bss[i]);
+-- 
+2.25.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/patches.inc b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
index 0574840..9121a2f 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
@@ -106,4 +106,5 @@
     file://mtk-0041-hostapd-mtk-6g-bss-connect-ignore-ht-opera.patch \
     file://mtk-0042-hostapd-mtk-avoid-unnecessary-beacon-update-for-6-GH.patch \
     file://mtk-0044-hostapd-mtk-Add-ACS-chanlist-info-in-get_config.patch \
+    file://mtk-0045-hostapd-mtk-add-log-in-extender-mode.patch \
     "