[rdkb][common][bsp][Refactor and sync wifi from openwrt]

[Description]
a05cc330 [MAC80211][WiFi6][mt76][rebase patches]
4bd6fb05 [MAC80211][WiFi6][mt76][Support spatial reuse debug commands]
f59fb1fe [MAC80211][WiFi7][misc][Add wifi-scripts packages]
52ac14cd [MAC80211][WiFi6][hostapd][Fix DFS radar trigger issue during first setup CAC]
7e33638a [MAC80211][WiFi6][Rebase Patches][Fix patch fail on mt76-2024-02-04]
b81d400b [MAC80211][Rebase Patches][Add support for WMM PBC configuration]
6e1f46b8 [MAC80211][WiFi6][mt76][Add support for WMM PBC configuration]
4a12d531 [mac80211][wifi6][mt76][Remove revert patch and add sanity check]
46c5e65d [mac80211][wifi6][mt76][Fix tx statistics]
d9b7c50d [MAC80211][WiFi6][mt76][Fix patch fail]
c8c49a13 [MAC80211][WiFi6][mt76][Add no_beacon vendor command for cert]
620200d9 [MAC80211][WiFi6][mt76][Remove redundant argument in add_beacon function]
f5fe56a6 [MAC80211][WiFi6][hostapd][New support for single BSS operations]
ff6e20a8 [MAC80211][WiFi6][hostapd][ACS: remove chan/freq list check when scan request and factor calculation]
3f25a0e5 [MAC80211][WiFi6][mt76][Fix bug in VoW DebugFS command]
33cb7faf [MAC80211][WiFi6][core][Sync wifi7 cert SQC fix to wifi6]
3a1c492a [MAC80211][WiFi6][core][Add support for scan dwell time customization]
7e7a47e4 [mac80211][wifi6][mt76][Fix patch fail]
5fc4c9d6 [MAC80211][misc][Fix external build fail of MAC80211]
b5d42444 [mac80211][wifi6][mt76][add support for realtime Rx rate updates]
638298f6 [mac80211][WiFi7][misc][Fix patch fail]
5c710bc2 [MAC80211][WiFi6][mt76][Add efuse content dump for cal free data verification]

[Release-log]

Change-Id: Ia86a987807efb6f1ef119e2e46232ce08afca96e
diff --git a/recipes-wifi/hostapd/files/common.uc b/recipes-wifi/hostapd/files/common.uc
index 4c33779..750e3ae 100644
--- a/recipes-wifi/hostapd/files/common.uc
+++ b/recipes-wifi/hostapd/files/common.uc
@@ -49,7 +49,7 @@
 {
 	let data = nl80211.request(nl80211.const.NL80211_CMD_GET_WIPHY, 0, { wiphy: phyidx });
 
-	return !data.software_iftypes.ap_vlan;
+	return !data.software_iftypes.monitor;
 }
 
 function phy_is_fullmac(phy)
diff --git a/recipes-wifi/hostapd/files/hostapd.uc b/recipes-wifi/hostapd/files/hostapd.uc
index 163d619..72209ea 100644
--- a/recipes-wifi/hostapd/files/hostapd.uc
+++ b/recipes-wifi/hostapd/files/hostapd.uc
@@ -2,9 +2,10 @@
 import { open, readfile } from "fs";
 import { wdev_create, wdev_remove, is_equal, vlist_new, phy_is_fullmac, phy_open } from "common";
 
-let ubus = libubus.connect();
+let ubus = libubus.connect(null, 60);
 
 hostapd.data.config = {};
+hostapd.data.pending_config = {};
 
 hostapd.data.file_fields = {
 	vlan_file: true,
@@ -132,12 +133,114 @@
 	let macaddr_list = [];
 	for (let i = 0; i < length(config.bss); i++)
 		push(macaddr_list, config.bss[i].bssid);
-	ubus.call("wpa_supplicant", "phy_set_macaddr_list", { phy: phy, macaddr: macaddr_list });
+	ubus.defer("wpa_supplicant", "phy_set_macaddr_list", { phy: phy, macaddr: macaddr_list });
 }
 
+function __iface_pending_next(pending, state, ret, data)
+{
+	let config = pending.config;
+	let phydev = pending.phydev;
+	let phy = pending.phy;
+	let bss = config.bss[0];
+
+	if (pending.defer)
+		pending.defer.abort();
+	delete pending.defer;
+	switch (state) {
+	case "init":
+		let macaddr_list = [];
+		for (let i = 0; i < length(config.bss); i++)
+			push(macaddr_list, config.bss[i].bssid);
+		pending.call("wpa_supplicant", "phy_set_macaddr_list", { phy: phy, macaddr: macaddr_list });
+		return "create_bss";
+	case "create_bss":
+		let err = wdev_create(phy, bss.ifname, { mode: "ap" });
+		if (err) {
+			hostapd.printf(`Failed to create ${bss.ifname} on phy ${phy}: ${err}`);
+			return null;
+		}
+
+		pending.call("wpa_supplicant", "phy_status", { phy: phy });
+		return "check_phy";
+	case "check_phy":
+		let phy_status = data;
+		if (phy_status && phy_status.state == "COMPLETED") {
+			if (iface_add(phy, config, phy_status))
+				return "done";
+
+			hostapd.printf(`Failed to bring up phy ${phy} ifname=${bss.ifname} with supplicant provided frequency`);
+		}
+		pending.call("wpa_supplicant", "phy_set_state", { phy: phy, stop: true });
+		return "wpas_stopped";
+	case "wpas_stopped":
+		if (!iface_add(phy, config))
+			hostapd.printf(`hostapd.add_iface failed for phy ${phy} ifname=${bss.ifname}`);
+		pending.call("wpa_supplicant", "phy_set_state", { phy: phy, stop: false });
+		return null;
+	case "done":
+	default:
+		delete hostapd.data.pending_config[phy];
+		break;
+	}
+}
+
+function iface_pending_next(ret, data)
+{
+	let pending = true;
+	let cfg = this;
+
+	while (pending) {
+		this.next_state = __iface_pending_next(cfg, this.next_state, ret, data);
+		if (!this.next_state) {
+			__iface_pending_next(cfg, "done");
+			return;
+		}
+		pending = !this.defer;
+	}
+}
+
+function iface_pending_abort()
+{
+	this.next_state = "done";
+	this.next();
+}
+
+function iface_pending_ubus_call(obj, method, arg)
+{
+	let ubus = hostapd.data.ubus;
+	let pending = this;
+	this.defer = ubus.defer(obj, method, arg, (ret, data) => { delete pending.defer; pending.next(ret, data) });
+}
+
+const iface_pending_proto = {
+	next: iface_pending_next,
+	call: iface_pending_ubus_call,
+	abort: iface_pending_abort,
+};
+
+function iface_pending_init(phydev, config)
+{
+	let phy = phydev.name;
+
+	let pending = proto({
+		next_state: "init",
+		phydev: phydev,
+		phy: phy,
+		config: config,
+		next: iface_pending_next,
+	}, iface_pending_proto);
+
+	hostapd.data.pending_config[phy] = pending;
+	pending.next();
+}
+
 function iface_restart(phydev, config, old_config)
 {
 	let phy = phydev.name;
+	let pending = hostapd.data.pending_config[phy];
+
+	if (pending)
+		pending.abort();
 
 	hostapd.remove_iface(phy);
 	iface_remove(old_config);
@@ -155,26 +258,7 @@
 			bss.bssid = phydev.macaddr_next();
 	}
 
-	iface_update_supplicant_macaddr(phy, config);
-
-	let bss = config.bss[0];
-	let err = wdev_create(phy, bss.ifname, { mode: "ap" });
-	if (err)
-		hostapd.printf(`Failed to create ${bss.ifname} on phy ${phy}: ${err}`);
-
-	let ubus = hostapd.data.ubus;
-	let phy_status = ubus.call("wpa_supplicant", "phy_status", { phy: phy });
-	if (phy_status && phy_status.state == "COMPLETED") {
-		if (iface_add(phy, config, phy_status))
-			return;
-
-		hostapd.printf(`Failed to bring up phy ${phy} ifname=${bss.ifname} with supplicant provided frequency`);
-	}
-
-	ubus.call("wpa_supplicant", "phy_set_state", { phy: phy, stop: true });
-	if (!iface_add(phy, config))
-		hostapd.printf(`hostapd.add_iface failed for phy ${phy} ifname=${bss.ifname}`);
-	ubus.call("wpa_supplicant", "phy_set_state", { phy: phy, stop: false });
+	iface_pending_init(phydev, config);
 }
 
 function array_to_obj(arr, key, start)
@@ -279,6 +363,9 @@
 	if (is_equal(old_config.bss, config.bss))
 		return true;
 
+	if (hostapd.data.pending_config[phy])
+		return false;
+
 	if (!old_config.bss || !old_config.bss[0])
 		return false;
 
diff --git a/recipes-wifi/hostapd/files/openwrt_script/hostapd.sh b/recipes-wifi/hostapd/files/openwrt_script/hostapd.sh
index 28bd210..763702e 100644
--- a/recipes-wifi/hostapd/files/openwrt_script/hostapd.sh
+++ b/recipes-wifi/hostapd/files/openwrt_script/hostapd.sh
@@ -43,21 +43,21 @@
 	case "$auth_type" in
 		psk|eap)
 			append wpa_key_mgmt "WPA-$auth_type_l"
-			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}"
+			[ "${wpa:-2}" -ge 2 ] && [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}"
 			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type_l}-SHA256"
 		;;
 		eap192)
 			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
 			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP-SHA384"
 		;;
-		eap-eap192)
-			append wpa_key_mgmt "WPA-EAP-SUITE-B-192"
+		eap-eap2)
 			append wpa_key_mgmt "WPA-EAP"
-			[ "${ieee80211r:-0}" -gt 0 ] && {
-				append wpa_key_mgmt "FT-EAP-SHA384"
-				append wpa_key_mgmt "FT-EAP"
-			}
-			[ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-EAP-SHA256"
+			append wpa_key_mgmt "WPA-EAP-SHA256"
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+		;;
+		eap2)
+			[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP"
+			append wpa_key_mgmt "WPA-EAP-SHA256"
 		;;
 		sae)
 			append wpa_key_mgmt "SAE"
@@ -77,6 +77,10 @@
 
 	[ "$fils" -gt 0 ] && {
 		case "$auth_type" in
+			eap192)
+				append wpa_key_mgmt FILS-SHA384
+				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA384
+			;;
 			eap*)
 				append wpa_key_mgmt FILS-SHA256
 				[ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt FT-FILS-SHA256
@@ -121,6 +125,7 @@
 	config_add_array hostapd_options
 
 	config_add_int airtime_mode
+	config_add_int mbssid
 
 	hostapd_add_log_config
 }
@@ -133,7 +138,8 @@
 
 	json_get_vars country country3 country_ie beacon_int:100 doth require_mode legacy_rates \
 		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density \
-		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc
+		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc \
+		mbssid:0
 
 	hostapd_set_log_options base_cfg
 
@@ -234,6 +240,7 @@
 	[ -n "$rts_threshold" ] && append base_cfg "rts_threshold=$rts_threshold" "$N"
 	[ "$airtime_mode" -gt 0 ] && append base_cfg "airtime_mode=$airtime_mode" "$N"
 	[ -n "$maxassoc" ] && append base_cfg "iface_max_num_sta=$maxassoc" "$N"
+	[ "$mbssid" -gt 0 ] && [ "$mbssid" -le 2 ] && append base_cfg "mbssid=$mbssid" "$N"
 
 	json_get_values opts hostapd_options
 	for val in $opts; do
@@ -625,8 +632,7 @@
 		[ -n "$wpa_strict_rekey" ] && append bss_conf "wpa_strict_rekey=$wpa_strict_rekey" "$N"
 	}
 
-	set_default nasid "${macaddr//\:}"
-	append bss_conf "nas_identifier=$nasid" "$N"
+	[ -n "$nasid" ] && append bss_conf "nas_identifier=$nasid" "$N"
 
 	[ -n "$acct_interval" ] && \
 		append bss_conf "radius_acct_interim_interval=$acct_interval" "$N"
@@ -636,12 +642,12 @@
 	[ -n "$ocv" ] && append bss_conf "ocv=$ocv" "$N"
 
 	case "$auth_type" in
-		sae|owe|eap192|eap-eap192)
+		sae|owe|eap2|eap192)
 			set_default ieee80211w 2
 			set_default sae_require_mfp 1
 			set_default sae_pwe 2
 		;;
-		psk-sae)
+		psk-sae|eap-eap2)
 			set_default ieee80211w 1
 			set_default sae_require_mfp 1
 			set_default sae_pwe 2
@@ -692,7 +698,7 @@
 			vlan_possible=1
 			wps_possible=1
 		;;
-		eap|eap192|eap-eap192)
+		eap|eap2|eap-eap2|eap192)
 			json_get_vars \
 				auth_server auth_secret auth_port \
 				dae_client dae_secret dae_port \
@@ -864,8 +870,9 @@
 	[ "$bss_transition" -eq "1" ] && append bss_conf "bss_transition=1" "$N"
 	[ "$mbo" -eq 1 ] && append bss_conf "mbo=1" "$N"
 
-	json_get_vars ieee80211k rrm_neighbor_report rrm_beacon_report
+	json_get_vars ieee80211k rrm_neighbor_report rrm_beacon_report rnr
 	set_default ieee80211k 0
+	set_default rnr 0
 	if [ "$ieee80211k" -eq "1" ]; then
 		set_default rrm_neighbor_report 1
 		set_default rrm_beacon_report 1
@@ -876,6 +883,7 @@
 
 	[ "$rrm_neighbor_report" -eq "1" ] && append bss_conf "rrm_neighbor_report=1" "$N"
 	[ "$rrm_beacon_report" -eq "1" ] && append bss_conf "rrm_beacon_report=1" "$N"
+	[ "$rnr" -eq "1" ] && append bss_conf "rnr=1" "$N"
 
 	json_get_vars ftm_responder stationary_ap lci civic
 	set_default ftm_responder 0
@@ -889,10 +897,21 @@
 		}
 	fi
 
+	json_get_vars ieee80211r
+	set_default ieee80211r 0
 	if [ "$wpa" -ge "1" ]; then
-		json_get_vars ieee80211r
-		set_default ieee80211r 0
+		if [ "$fils" -gt 0 ]; then
+			json_get_vars fils_realm
+			set_default fils_realm "$(echo "$ssid" | md5sum | head -c 8)"
+		fi
 
+		append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
+
+		hostapd_append_wpa_key_mgmt
+		[ -n "$wpa_key_mgmt" ] && append bss_conf "wpa_key_mgmt=$wpa_key_mgmt" "$N"
+	fi
+
+	if [ "$wpa" -ge "2" ]; then
 		if [ "$ieee80211r" -gt "0" ]; then
 			json_get_vars mobility_domain ft_psk_generate_local ft_over_ds reassociation_deadline
 
@@ -901,7 +920,7 @@
 			set_default reassociation_deadline 1000
 
 			case "$auth_type" in
-				psk|sae|psk-sae)
+				psk)
 					set_default ft_psk_generate_local 1
 				;;
 				*)
@@ -924,6 +943,10 @@
 				set_default pmk_r1_push 0
 
 				[ -n "$r0kh" -a -n "$r1kh" ] || {
+					if [ -z "$auth_secret" -a -z "$key" ]; then
+						wireless_setup_vif_failed FT_KEY_CANT_BE_DERIVED
+						return 1
+					fi
 					ft_key=`echo -n "$mobility_domain/${auth_secret:-${key}}" | md5sum | awk '{print $1}'`
 
 					set_default r0kh "ff:ff:ff:ff:ff:ff,*,$ft_key"
@@ -942,18 +965,7 @@
 				done
 			fi
 		fi
-		if [ "$fils" -gt 0 ]; then
-			json_get_vars fils_realm
-			set_default fils_realm "$(echo "$ssid" | md5sum | head -c 8)"
-		fi
-
-		append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
-
-		hostapd_append_wpa_key_mgmt
-		[ -n "$wpa_key_mgmt" ] && append bss_conf "wpa_key_mgmt=$wpa_key_mgmt" "$N"
-	fi
 
-	if [ "$wpa" -ge "2" ]; then
 		if [ -n "$network_bridge" -a "$rsn_preauth" = 1 ]; then
 			set_default auth_cache 1
 			append bss_conf "rsn_preauth=1" "$N"
@@ -1156,9 +1168,6 @@
 		append bss_conf "$val" "$N"
 	done
 
-	bss_md5sum="$(echo $bss_conf | md5sum | cut -d" " -f1)"
-	append bss_conf "config_id=$bss_md5sum" "$N"
-
 	append "$var" "$bss_conf" "$N"
 	return 0
 }
@@ -1300,7 +1309,7 @@
 		default_disabled
 
 	case "$auth_type" in
-		sae|owe|eap192|eap-eap192)
+		sae|owe|eap2|eap192)
 			set_default ieee80211w 2
 		;;
 		psk-sae)
@@ -1383,7 +1392,7 @@
 			fi
 			append network_data "$passphrase" "$N$T"
 		;;
-		eap|eap192|eap-eap192)
+		eap|eap2|eap192)
 			hostapd_append_wpa_key_mgmt
 			key_mgmt="$wpa_key_mgmt"
 
@@ -1587,30 +1596,3 @@
 	fi
 	return 0
 }
-
-wpa_supplicant_run() {
-	local ifname="$1"
-	local hostapd_ctrl="$2"
-
-	_wpa_supplicant_common "$ifname"
-
-	ubus wait_for wpa_supplicant
-	local supplicant_res="$(ubus call wpa_supplicant config_add "{ \
-		\"driver\": \"${_w_driver:-wext}\", \"ctrl\": \"$_rpath\", \
-		\"iface\": \"$ifname\", \"config\": \"$_config\" \
-		${network_bridge:+, \"bridge\": \"$network_bridge\"} \
-		${hostapd_ctrl:+, \"hostapd_ctrl\": \"$hostapd_ctrl\"} \
-		}")"
-
-	ret="$?"
-
-	[ "$ret" != 0 -o -z "$supplicant_res" ] && wireless_setup_vif_failed WPA_SUPPLICANT_FAILED
-
-	wireless_add_process "$(jsonfilter -s "$supplicant_res" -l 1 -e @.pid)" "/usr/sbin/wpa_supplicant" 1 1
-
-	return $ret
-}
-
-hostapd_common_cleanup() {
-	killall meshd-nl80211
-}
diff --git a/recipes-wifi/hostapd/files/openwrt_script/mac80211.sh b/recipes-wifi/hostapd/files/openwrt_script/mac80211.sh
index ed28052..e24a2a6 100644
--- a/recipes-wifi/hostapd/files/openwrt_script/mac80211.sh
+++ b/recipes-wifi/hostapd/files/openwrt_script/mac80211.sh
@@ -1,1321 +1,217 @@
 #!/bin/sh
-. /lib/netifd/netifd-wireless.sh
-. /lib/netifd/hostapd.sh
-. /lib/functions/system.sh
 
-init_wireless_driver "$@"
+append DRIVERS "mac80211"
 
-MP_CONFIG_INT="mesh_retry_timeout mesh_confirm_timeout mesh_holding_timeout mesh_max_peer_links
-	       mesh_max_retries mesh_ttl mesh_element_ttl mesh_hwmp_max_preq_retries
-	       mesh_path_refresh_time mesh_min_discovery_timeout mesh_hwmp_active_path_timeout
-	       mesh_hwmp_preq_min_interval mesh_hwmp_net_diameter_traversal_time mesh_hwmp_rootmode
-	       mesh_hwmp_rann_interval mesh_gate_announcements mesh_sync_offset_max_neighor
-	       mesh_rssi_threshold mesh_hwmp_active_path_to_root_timeout mesh_hwmp_root_interval
-	       mesh_hwmp_confirmation_interval mesh_awake_window mesh_plink_timeout"
-MP_CONFIG_BOOL="mesh_auto_open_plinks mesh_fwding"
-MP_CONFIG_STRING="mesh_power_mode"
-
-NEWAPLIST=
-OLDAPLIST=
-NEWSPLIST=
-OLDSPLIST=
-NEWUMLIST=
-OLDUMLIST=
-
-drv_mac80211_init_device_config() {
-	hostapd_common_add_device_config
-
-	config_add_string path phy 'macaddr:macaddr'
-	config_add_string tx_burst
-	config_add_string distance
-	config_add_int beacon_int chanbw frag rts
-	config_add_int rxantenna txantenna antenna_gain txpower min_tx_power
-	config_add_boolean noscan ht_coex acs_exclude_dfs background_radar
-	config_add_array ht_capab
-	config_add_array channels
-	config_add_array scan_list
-	config_add_boolean \
-		rxldpc \
-		short_gi_80 \
-		short_gi_160 \
-		tx_stbc_2by1 \
-		su_beamformer \
-		su_beamformee \
-		mu_beamformer \
-		mu_beamformee \
-		he_su_beamformer \
-		he_su_beamformee \
-		he_mu_beamformer \
-		vht_txop_ps \
-		htc_vht \
-		rx_antenna_pattern \
-		tx_antenna_pattern \
-		he_spr_sr_control \
-		he_spr_psr_enabled \
-		he_bss_color_enabled \
-		he_twt_required
-	config_add_int \
-		beamformer_antennas \
-		beamformee_antennas \
-		vht_max_a_mpdu_len_exp \
-		vht_max_mpdu \
-		vht_link_adapt \
-		vht160 \
-		rx_stbc \
-		tx_stbc \
-		he_bss_color \
-		he_spr_non_srg_obss_pd_max_offset
-	config_add_boolean \
-		ldpc \
-		greenfield \
-		short_gi_20 \
-		short_gi_40 \
-		max_amsdu \
-		dsss_cck_40
-}
-
-drv_mac80211_init_iface_config() {
-	hostapd_common_add_bss_config
-
-	config_add_string 'macaddr:macaddr' ifname
-
-	config_add_boolean wds powersave enable
-	config_add_string wds_bridge
-	config_add_int maxassoc
-	config_add_int max_listen_int
-	config_add_int dtim_period
-	config_add_int start_disabled
-
-	# mesh
-	config_add_string mesh_id
-	config_add_int $MP_CONFIG_INT
-	config_add_boolean $MP_CONFIG_BOOL
-	config_add_string $MP_CONFIG_STRING
-}
-
-mac80211_add_capabilities() {
-	local __var="$1"; shift
-	local __mask="$1"; shift
-	local __out= oifs
-
-	oifs="$IFS"
-	IFS=:
-	for capab in "$@"; do
-		set -- $capab
-
-		[ "$(($4))" -gt 0 ] || continue
-		[ "$(($__mask & $2))" -eq "$((${3:-$2}))" ] || continue
-		__out="$__out[$1]"
-	done
-	IFS="$oifs"
-
-	export -n -- "$__var=$__out"
-}
-
-mac80211_add_he_capabilities() {
-	local __out= oifs
-
-	oifs="$IFS"
-	IFS=:
-	for capab in "$@"; do
-		set -- $capab
-		[ "$(($4))" -gt 0 ] || continue
-		[ "$(((0x$2) & $3))" -gt 0 ] || {
-			eval "$1=0"
-			continue
-		}
-		append base_cfg "$1=1" "$N"
-	done
-	IFS="$oifs"
-}
-
-mac80211_hostapd_setup_base() {
-	local phy="$1"
-
-	json_select config
-
-	[ "$auto_channel" -gt 0 ] && channel=acs_survey
-
-	[ "$auto_channel" -gt 0 ] && json_get_vars acs_exclude_dfs
-	[ -n "$acs_exclude_dfs" ] && [ "$acs_exclude_dfs" -gt 0 ] &&
-		append base_cfg "acs_exclude_dfs=1" "$N"
-
-	json_get_vars noscan ht_coex min_tx_power:0 tx_burst
-	json_get_values ht_capab_list ht_capab
-	json_get_values channel_list channels
-
-	[ "$auto_channel" = 0 ] && [ -z "$channel_list" ] && \
-		channel_list="$channel"
-
-	[ "$min_tx_power" -gt 0 ] && append base_cfg "min_tx_power=$min_tx_power"
-
-	set_default noscan 0
-
-	[ "$noscan" -gt 0 ] && hostapd_noscan=1
-	[ "$tx_burst" = 0 ] && tx_burst=
-
-	chan_ofs=0
-	[ "$band" = "6g" ] && chan_ofs=1
-
-	ieee80211n=1
-	ht_capab=
-	case "$htmode" in
-		VHT20|HT20|HE20) ;;
-		HT40*|VHT40|VHT80|VHT160|HE40|HE80|HE160)
-			case "$hwmode" in
-				a)
-					case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
-						1) ht_capab="[HT40+]";;
-						0) ht_capab="[HT40-]";;
-					esac
-				;;
-				*)
-					case "$htmode" in
-						HT40+) ht_capab="[HT40+]";;
-						HT40-) ht_capab="[HT40-]";;
-						*)
-							if [ "$channel" -lt 7 ]; then
-								ht_capab="[HT40+]"
-							else
-								ht_capab="[HT40-]"
-							fi
-						;;
-					esac
-				;;
-			esac
-			[ "$auto_channel" -gt 0 ] && ht_capab="[HT40+]"
-		;;
-		*) ieee80211n= ;;
-	esac
-
-	[ -n "$ieee80211n" ] && {
-		append base_cfg "ieee80211n=1" "$N"
-
-		set_default ht_coex 0
-		append base_cfg "ht_coex=$ht_coex" "$N"
-
-		json_get_vars \
-			ldpc:1 \
-			greenfield:0 \
-			short_gi_20:1 \
-			short_gi_40:1 \
-			tx_stbc:1 \
-			rx_stbc:3 \
-			max_amsdu:1 \
-			dsss_cck_40:1
-
-		ht_cap_mask=0
-		for cap in $(iw phy "$phy" info | grep 'Capabilities:' | cut -d: -f2); do
-			ht_cap_mask="$(($ht_cap_mask | $cap))"
-		done
-
-		cap_rx_stbc=$((($ht_cap_mask >> 8) & 3))
-		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
-		ht_cap_mask="$(( ($ht_cap_mask & ~(0x300)) | ($cap_rx_stbc << 8) ))"
-
-		mac80211_add_capabilities ht_capab_flags $ht_cap_mask \
-			LDPC:0x1::$ldpc \
-			GF:0x10::$greenfield \
-			SHORT-GI-20:0x20::$short_gi_20 \
-			SHORT-GI-40:0x40::$short_gi_40 \
-			TX-STBC:0x80::$tx_stbc \
-			RX-STBC1:0x300:0x100:1 \
-			RX-STBC12:0x300:0x200:1 \
-			RX-STBC123:0x300:0x300:1 \
-			MAX-AMSDU-7935:0x800::$max_amsdu \
-			DSSS_CCK-40:0x1000::$dsss_cck_40
-
-		ht_capab="$ht_capab$ht_capab_flags"
-		[ -n "$ht_capab" ] && append base_cfg "ht_capab=$ht_capab" "$N"
-	}
-
-	# 802.11ac
-	enable_ac=0
-	vht_oper_chwidth=0
-	vht_center_seg0=
-
-	idx="$channel"
-	case "$htmode" in
-		VHT20|HE20) enable_ac=1;;
-		VHT40|HE40)
-			case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
-				1) idx=$(($channel + 2));;
-				0) idx=$(($channel - 2));;
-			esac
-			enable_ac=1
-			vht_center_seg0=$idx
-		;;
-		VHT80|HE80)
-			case "$(( (($channel / 4) + $chan_ofs) % 4 ))" in
-				1) idx=$(($channel + 6));;
-				2) idx=$(($channel + 2));;
-				3) idx=$(($channel - 2));;
-				0) idx=$(($channel - 6));;
-			esac
-			enable_ac=1
-			vht_oper_chwidth=1
-			vht_center_seg0=$idx
-		;;
-		VHT160|HE160)
-			if [ "$band" = "6g" ]; then
-				case "$channel" in
-					1|5|9|13|17|21|25|29) idx=15;;
-					33|37|41|45|49|53|57|61) idx=47;;
-					65|69|73|77|81|85|89|93) idx=79;;
-					97|101|105|109|113|117|121|125) idx=111;;
-					129|133|137|141|145|149|153|157) idx=143;;
-					161|165|169|173|177|181|185|189) idx=175;;
-					193|197|201|205|209|213|217|221) idx=207;;
-				esac
-			else
-				case "$channel" in
-					36|40|44|48|52|56|60|64) idx=50;;
-					100|104|108|112|116|120|124|128) idx=114;;
-				esac
-			fi
-			enable_ac=1
-			vht_oper_chwidth=2
-			vht_center_seg0=$idx
-		;;
-	esac
-	[ "$band" = "5g" ] && {
-		json_get_vars background_radar:0
-
-		[ "$background_radar" -eq 1 ] && append base_cfg "enable_background_radar=1" "$N"
-	}
-	[ "$band" = "6g" ] && {
-		op_class=
-		case "$htmode" in
-			HE20) op_class=131;;
-			HE*) op_class=$((132 + $vht_oper_chwidth))
-		esac
-		[ -n "$op_class" ] && append base_cfg "op_class=$op_class" "$N"
-	}
-	[ "$hwmode" = "a" ] || enable_ac=0
-
-	if [ "$enable_ac" != "0" ]; then
-		json_get_vars \
-			rxldpc:1 \
-			short_gi_80:1 \
-			short_gi_160:1 \
-			tx_stbc_2by1:1 \
-			su_beamformer:1 \
-			su_beamformee:1 \
-			mu_beamformer:1 \
-			mu_beamformee:1 \
-			vht_txop_ps:1 \
-			htc_vht:1 \
-			beamformee_antennas:4 \
-			beamformer_antennas:4 \
-			rx_antenna_pattern:1 \
-			tx_antenna_pattern:1 \
-			vht_max_a_mpdu_len_exp:7 \
-			vht_max_mpdu:11454 \
-			rx_stbc:4 \
-			vht_link_adapt:3 \
-			vht160:2
-
-		set_default tx_burst 2.0
-		append base_cfg "ieee80211ac=1" "$N"
-		vht_cap=0
-		for cap in $(iw phy "$phy" info | awk -F "[()]" '/VHT Capabilities/ { print $2 }'); do
-			vht_cap="$(($vht_cap | $cap))"
-		done
-
-		append base_cfg "vht_oper_chwidth=$vht_oper_chwidth" "$N"
-		append base_cfg "vht_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
-
-		cap_rx_stbc=$((($vht_cap >> 8) & 7))
-		[ "$rx_stbc" -lt "$cap_rx_stbc" ] && cap_rx_stbc="$rx_stbc"
-		vht_cap="$(( ($vht_cap & ~(0x700)) | ($cap_rx_stbc << 8) ))"
-
-		mac80211_add_capabilities vht_capab $vht_cap \
-			RXLDPC:0x10::$rxldpc \
-			SHORT-GI-80:0x20::$short_gi_80 \
-			SHORT-GI-160:0x40::$short_gi_160 \
-			TX-STBC-2BY1:0x80::$tx_stbc_2by1 \
-			SU-BEAMFORMER:0x800::$su_beamformer \
-			SU-BEAMFORMEE:0x1000::$su_beamformee \
-			MU-BEAMFORMER:0x80000::$mu_beamformer \
-			MU-BEAMFORMEE:0x100000::$mu_beamformee \
-			VHT-TXOP-PS:0x200000::$vht_txop_ps \
-			HTC-VHT:0x400000::$htc_vht \
-			RX-ANTENNA-PATTERN:0x10000000::$rx_antenna_pattern \
-			TX-ANTENNA-PATTERN:0x20000000::$tx_antenna_pattern \
-			RX-STBC-1:0x700:0x100:1 \
-			RX-STBC-12:0x700:0x200:1 \
-			RX-STBC-123:0x700:0x300:1 \
-			RX-STBC-1234:0x700:0x400:1 \
-
-		[ "$(($vht_cap & 0x800))" -gt 0 -a "$su_beamformer" -gt 0 ] && {
-			cap_ant="$(( ( ($vht_cap >> 16) & 3 ) + 1 ))"
-			[ "$cap_ant" -gt "$beamformer_antennas" ] && cap_ant="$beamformer_antennas"
-			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[SOUNDING-DIMENSION-$cap_ant]"
-		}
-
-		[ "$(($vht_cap & 0x1000))" -gt 0 -a "$su_beamformee" -gt 0 ] && {
-			cap_ant="$(( ( ($vht_cap >> 13) & 3 ) + 1 ))"
-			[ "$cap_ant" -gt "$beamformee_antennas" ] && cap_ant="$beamformee_antennas"
-			[ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[BF-ANTENNA-$cap_ant]"
-		}
-
-		# supported Channel widths
-		vht160_hw=0
-		[ "$(($vht_cap & 12))" -eq 4 -a 1 -le "$vht160" ] && \
-			vht160_hw=1
-		[ "$(($vht_cap & 12))" -eq 8 -a 2 -le "$vht160" ] && \
-			vht160_hw=2
-		[ "$vht160_hw" = 1 ] && vht_capab="$vht_capab[VHT160]"
-		[ "$vht160_hw" = 2 ] && vht_capab="$vht_capab[VHT160-80PLUS80]"
-
-		# maximum MPDU length
-		vht_max_mpdu_hw=3895
-		[ "$(($vht_cap & 3))" -ge 1 -a 7991 -le "$vht_max_mpdu" ] && \
-			vht_max_mpdu_hw=7991
-		[ "$(($vht_cap & 3))" -ge 2 -a 11454 -le "$vht_max_mpdu" ] && \
-			vht_max_mpdu_hw=11454
-		[ "$vht_max_mpdu_hw" != 3895 ] && \
-			vht_capab="$vht_capab[MAX-MPDU-$vht_max_mpdu_hw]"
-
-		# maximum A-MPDU length exponent
-		vht_max_a_mpdu_len_exp_hw=0
-		[ "$(($vht_cap & 58720256))" -ge 8388608 -a 1 -le "$vht_max_a_mpdu_len_exp" ] && \
-			vht_max_a_mpdu_len_exp_hw=1
-		[ "$(($vht_cap & 58720256))" -ge 16777216 -a 2 -le "$vht_max_a_mpdu_len_exp" ] && \
-			vht_max_a_mpdu_len_exp_hw=2
-		[ "$(($vht_cap & 58720256))" -ge 25165824 -a 3 -le "$vht_max_a_mpdu_len_exp" ] && \
-			vht_max_a_mpdu_len_exp_hw=3
-		[ "$(($vht_cap & 58720256))" -ge 33554432 -a 4 -le "$vht_max_a_mpdu_len_exp" ] && \
-			vht_max_a_mpdu_len_exp_hw=4
-		[ "$(($vht_cap & 58720256))" -ge 41943040 -a 5 -le "$vht_max_a_mpdu_len_exp" ] && \
-			vht_max_a_mpdu_len_exp_hw=5
-		[ "$(($vht_cap & 58720256))" -ge 50331648 -a 6 -le "$vht_max_a_mpdu_len_exp" ] && \
-			vht_max_a_mpdu_len_exp_hw=6
-		[ "$(($vht_cap & 58720256))" -ge 58720256 -a 7 -le "$vht_max_a_mpdu_len_exp" ] && \
-			vht_max_a_mpdu_len_exp_hw=7
-		vht_capab="$vht_capab[MAX-A-MPDU-LEN-EXP$vht_max_a_mpdu_len_exp_hw]"
-
-		# whether or not the STA supports link adaptation using VHT variant
-		vht_link_adapt_hw=0
-		[ "$(($vht_cap & 201326592))" -ge 134217728 -a 2 -le "$vht_link_adapt" ] && \
-			vht_link_adapt_hw=2
-		[ "$(($vht_cap & 201326592))" -ge 201326592 -a 3 -le "$vht_link_adapt" ] && \
-			vht_link_adapt_hw=3
-		[ "$vht_link_adapt_hw" != 0 ] && \
-			vht_capab="$vht_capab[VHT-LINK-ADAPT-$vht_link_adapt_hw]"
-
-		[ -n "$vht_capab" ] && append base_cfg "vht_capab=$vht_capab" "$N"
-	fi
-
-	# 802.11ax
-	enable_ax=0
-	case "$htmode" in
-		HE*) enable_ax=1 ;;
-	esac
-
-	if [ "$enable_ax" != "0" ]; then
-		json_get_vars \
-			he_su_beamformer:1 \
-			he_su_beamformee:1 \
-			he_mu_beamformer:1 \
-			he_twt_required:0 \
-			he_spr_sr_control:3 \
-			he_spr_psr_enabled:0 \
-			he_spr_non_srg_obss_pd_max_offset:0 \
-			he_bss_color:128 \
-			he_bss_color_enabled:1
-
-		he_phy_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
-		he_phy_cap=${he_phy_cap:2}
-		he_mac_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
-		he_mac_cap=${he_mac_cap:2}
-
-		append base_cfg "ieee80211ax=1" "$N"
-		[ "$hwmode" = "a" ] && {
-			append base_cfg "he_oper_chwidth=$vht_oper_chwidth" "$N"
-			append base_cfg "he_oper_centr_freq_seg0_idx=$vht_center_seg0" "$N"
-		}
-
-		mac80211_add_he_capabilities \
-			he_su_beamformer:${he_phy_cap:6:2}:0x80:$he_su_beamformer \
-			he_su_beamformee:${he_phy_cap:8:2}:0x1:$he_su_beamformee \
-			he_mu_beamformer:${he_phy_cap:8:2}:0x2:$he_mu_beamformer \
-			he_spr_psr_enabled:${he_phy_cap:14:2}:0x1:$he_spr_psr_enabled \
-			he_twt_required:${he_mac_cap:0:2}:0x6:$he_twt_required
-
-		if [ "$he_bss_color_enabled" -gt 0 ]; then
-			append base_cfg "he_bss_color=$he_bss_color" "$N"
-			[ "$he_spr_non_srg_obss_pd_max_offset" -gt 0 ] && { \
-				append base_cfg "he_spr_non_srg_obss_pd_max_offset=$he_spr_non_srg_obss_pd_max_offset" "$N"
-				he_spr_sr_control=$((he_spr_sr_control | (1 << 2)))
-			}
-			[ "$he_spr_psr_enabled" -gt 0 ] || he_spr_sr_control=$((he_spr_sr_control | (1 << 0)))
-			append base_cfg "he_spr_sr_control=$he_spr_sr_control" "$N"
-		else
-			append base_cfg "he_bss_color_disabled=1" "$N"
-		fi
-
-
-		append base_cfg "he_default_pe_duration=4" "$N"
-		append base_cfg "he_rts_threshold=1023" "$N"
-		append base_cfg "he_mu_edca_qos_info_param_count=0" "$N"
-		append base_cfg "he_mu_edca_qos_info_q_ack=0" "$N"
-		append base_cfg "he_mu_edca_qos_info_queue_request=0" "$N"
-		append base_cfg "he_mu_edca_qos_info_txop_request=0" "$N"
-		append base_cfg "he_mu_edca_ac_be_aifsn=8" "$N"
-		append base_cfg "he_mu_edca_ac_be_aci=0" "$N"
-		append base_cfg "he_mu_edca_ac_be_ecwmin=9" "$N"
-		append base_cfg "he_mu_edca_ac_be_ecwmax=10" "$N"
-		append base_cfg "he_mu_edca_ac_be_timer=255" "$N"
-		append base_cfg "he_mu_edca_ac_bk_aifsn=15" "$N"
-		append base_cfg "he_mu_edca_ac_bk_aci=1" "$N"
-		append base_cfg "he_mu_edca_ac_bk_ecwmin=9" "$N"
-		append base_cfg "he_mu_edca_ac_bk_ecwmax=10" "$N"
-		append base_cfg "he_mu_edca_ac_bk_timer=255" "$N"
-		append base_cfg "he_mu_edca_ac_vi_ecwmin=5" "$N"
-		append base_cfg "he_mu_edca_ac_vi_ecwmax=7" "$N"
-		append base_cfg "he_mu_edca_ac_vi_aifsn=5" "$N"
-		append base_cfg "he_mu_edca_ac_vi_aci=2" "$N"
-		append base_cfg "he_mu_edca_ac_vi_timer=255" "$N"
-		append base_cfg "he_mu_edca_ac_vo_aifsn=5" "$N"
-		append base_cfg "he_mu_edca_ac_vo_aci=3" "$N"
-		append base_cfg "he_mu_edca_ac_vo_ecwmin=5" "$N"
-		append base_cfg "he_mu_edca_ac_vo_ecwmax=7" "$N"
-		append base_cfg "he_mu_edca_ac_vo_timer=255" "$N"
-	fi
-
-	hostapd_prepare_device_config "$hostapd_conf_file" nl80211
-	cat >> "$hostapd_conf_file" <<EOF
-${channel:+channel=$channel}
-${channel_list:+chanlist=$channel_list}
-${hostapd_noscan:+noscan=1}
-${tx_burst:+tx_queue_data2_burst=$tx_burst}
-$base_cfg
-
-EOF
-	json_select ..
-	radio_md5sum=$(md5sum $hostapd_conf_file | cut -d" " -f1)
-	echo "radio_config_id=${radio_md5sum}" >> $hostapd_conf_file
-}
-
-mac80211_hostapd_setup_bss() {
-	local phy="$1"
-	local ifname="$2"
+check_mac80211_device() {
+	local device="$1"
+	local path="$2"
 	local macaddr="$3"
-	local type="$4"
-
-	hostapd_cfg=
-	append hostapd_cfg "$type=$ifname" "$N"
-
-	hostapd_set_bss_options hostapd_cfg "$phy" "$vif" || return 1
-	json_get_vars wds wds_bridge dtim_period max_listen_int start_disabled
-
-	set_default wds 0
-	set_default start_disabled 0
-
-	[ "$wds" -gt 0 ] && {
-		append hostapd_cfg "wds_sta=1" "$N"
-		[ -n "$wds_bridge" ] && append hostapd_cfg "wds_bridge=$wds_bridge" "$N"
-	}
-	[ "$staidx" -gt 0 -o "$start_disabled" -eq 1 ] && append hostapd_cfg "start_disabled=1" "$N"
-
-	cat >> /var/run/hostapd-$phy.conf <<EOF
-$hostapd_cfg
-bssid=$macaddr
-${dtim_period:+dtim_period=$dtim_period}
-${max_listen_int:+max_listen_interval=$max_listen_int}
-EOF
-}
-
-mac80211_get_addr() {
-	local phy="$1"
-	local idx="$(($2 + 1))"
 
-	head -n $idx /sys/class/ieee80211/${phy}/addresses | tail -n1
-}
-
-mac80211_generate_mac() {
-	local phy="$1"
-	local id="${macidx:-0}"
-
-	local ref="$(cat /sys/class/ieee80211/${phy}/macaddress)"
-	local mask="$(cat /sys/class/ieee80211/${phy}/address_mask)"
-
-	[ "$mask" = "00:00:00:00:00:00" ] && {
-		mask="ff:ff:ff:ff:ff:ff";
-
-		[ "$(wc -l < /sys/class/ieee80211/${phy}/addresses)" -gt $id ] && {
-			addr="$(mac80211_get_addr "$phy" "$id")"
-			[ -n "$addr" ] && {
-				echo "$addr"
-				return
-			}
-		}
-	}
-
-	local oIFS="$IFS"; IFS=":"; set -- $mask; IFS="$oIFS"
-
-	local mask1=$1
-	local mask6=$6
-
-	local oIFS="$IFS"; IFS=":"; set -- $ref; IFS="$oIFS"
-
-	macidx=$(($id + 1))
-	[ "$((0x$mask1))" -gt 0 ] && {
-		b1="0x$1"
-		[ "$id" -gt 0 ] && \
-			b1=$(($b1 ^ ((($id - !($b1 & 2)) << 2)) | 0x2))
-		printf "%02x:%s:%s:%s:%s:%s" $b1 $2 $3 $4 $5 $6
-		return
-	}
-
-	[ "$((0x$mask6))" -lt 255 ] && {
-		printf "%s:%s:%s:%s:%s:%02x" $1 $2 $3 $4 $5 $(( 0x$6 ^ $id ))
-		return
-	}
-
-	off2=$(( (0x$6 + $id) / 0x100 ))
-	printf "%s:%s:%s:%s:%02x:%02x" \
-		$1 $2 $3 $4 \
-		$(( (0x$5 + $off2) % 0x100 )) \
-		$(( (0x$6 + $id) % 0x100 ))
-}
-
-get_board_phy_name() (
-	local path="$1"
-	local fallback_phy=""
-
-	__check_phy() {
-		local val="$1"
-		local key="$2"
-		local ref_path="$3"
-
-		json_select "$key"
-		json_get_values path
-		json_select ..
+	[ -n "$found" ] && return 0
 
-		[ "${ref_path%+*}" = "$path" ] && fallback_phy=$key
-		[ "$ref_path" = "$path" ] || return 0
-
-		echo "$key"
-		exit
-	}
-
-	json_load_file /etc/board.json
-	json_for_each_item __check_phy wlan "$path"
-	[ -n "$fallback_phy" ] && echo "${fallback_phy}.${path##*+}"
-)
-
-rename_board_phy_by_path() {
-	local path="$1"
-
-	local new_phy="$(get_board_phy_name "$path")"
-	[ -z "$new_phy" -o "$new_phy" = "$phy" ] && return
-
-	iw "$phy" set name "$new_phy" && phy="$new_phy"
-}
-
-rename_board_phy_by_name() (
-	local phy="$1"
-	local suffix="${phy##*.}"
-	[ "$suffix" = "$phy" ] && suffix=
-
-	json_load_file /etc/board.json
+	phy_path=
+	config_get phy "$device" phy
 	json_select wlan
-	json_select "${phy%.*}" || return 0
-	json_get_values path
-
-	prev_phy="$(iwinfo nl80211 phyname "path=$path${suffix:++$suffix}")"
-	[ -n "$prev_phy" ] || return 0
-
-	[ "$prev_phy" = "$phy" ] && return 0
-
-	iw "$prev_phy" set name "$phy"
-)
-
-find_phy() {
-	[ -n "$phy" ] && {
-		rename_board_phy_by_name "$phy"
-		[ -d /sys/class/ieee80211/$phy ] && return 0
-	}
-	[ -n "$path" ] && {
-		phy="$(iwinfo nl80211 phyname "path=$path")"
-		[ -n "$phy" ] && {
-			rename_board_phy_by_path "$path"
-			return 0
-		}
-	}
-	[ -n "$macaddr" ] && {
-		for phy in $(ls /sys/class/ieee80211 2>/dev/null); do
-			grep -i -q "$macaddr" "/sys/class/ieee80211/${phy}/macaddress" && {
-				path="$(iwinfo nl80211 path "$phy")"
-				rename_board_phy_by_path "$path"
-				return 0
-			}
-		done
-	}
-	return 1
-}
-
-mac80211_check_ap() {
-	has_ap=1
-}
-
-mac80211_iw_interface_add() {
-	local phy="$1"
-	local ifname="$2"
-	local type="$3"
-	local wdsflag="$4"
-	local rc
-	local oldifname
-
-	iw phy "$phy" interface add "$ifname" type "$type" $wdsflag >/dev/null 2>&1
-	rc="$?"
-
-	[ "$rc" = 233 ] && {
-		# Device might have just been deleted, give the kernel some time to finish cleaning it up
-		sleep 1
-
-		iw phy "$phy" interface add "$ifname" type "$type" $wdsflag >/dev/null 2>&1
-		rc="$?"
-	}
-
-	[ "$rc" = 233 ] && {
-		# Keep matching pre-existing interface
-		[ -d "/sys/class/ieee80211/${phy}/device/net/${ifname}" ] && \
-		case "$(iw dev $ifname info | grep "^\ttype" | cut -d' ' -f2- 2>/dev/null)" in
-			"AP")
-				[ "$type" = "__ap" ] && rc=0
-				;;
-			"IBSS")
-				[ "$type" = "adhoc" ] && rc=0
-				;;
-			"managed")
-				[ "$type" = "managed" ] && rc=0
-				;;
-			"mesh point")
-				[ "$type" = "mp" ] && rc=0
-				;;
-			"monitor")
-				[ "$type" = "monitor" ] && rc=0
-				;;
-		esac
-	}
-
-	[ "$rc" = 233 ] && {
-		iw dev "$ifname" del >/dev/null 2>&1
-		[ "$?" = 0 ] && {
-			sleep 1
-
-			iw phy "$phy" interface add "$ifname" type "$type" $wdsflag >/dev/null 2>&1
-			rc="$?"
-		}
-	}
-
-	[ "$rc" != 0 ] && {
-		# Device might not support virtual interfaces, so the interface never got deleted in the first place.
-		# Check if the interface already exists, and avoid failing in this case.
-		[ -d "/sys/class/ieee80211/${phy}/device/net/${ifname}" ] && rc=0
-	}
-
-	[ "$rc" != 0 ] && {
-		# Device doesn't support virtual interfaces and may have existing interface other than ifname.
-		oldifname="$(basename "/sys/class/ieee80211/${phy}/device/net"/* 2>/dev/null)"
-		[ "$oldifname" ] && ip link set "$oldifname" name "$ifname" 1>/dev/null 2>&1
-		rc="$?"
-	}
-
-	[ "$rc" != 0 ] && echo "Failed to create interface $ifname"
-	return $rc
-}
-
-mac80211_set_ifname() {
-	local phy="$1"
-	local prefix="$2"
-	eval "ifname=\"$phy-$prefix\${idx_$prefix:-0}\"; idx_$prefix=\$((\${idx_$prefix:-0 } + 1))"
-}
-
-mac80211_prepare_vif() {
-	json_select config
-
-	json_get_vars ifname mode ssid wds powersave macaddr enable wpa_psk_file vlan_file
-
-	[ -n "$ifname" ] || {
-		local prefix;
-
-		case "$mode" in
-		ap|sta|mesh) prefix=$mode;;
-		adhoc) prefix=ibss;;
-		monitor) prefix=mon;;
-		esac
-
-		mac80211_set_ifname "$phy" "$prefix"
-	}
-
-	set_default wds 0
-	set_default powersave 0
-
-	json_select ..
-
-	if [ -z "$macaddr" ]; then
-		macaddr="$(mac80211_generate_mac $phy)"
-		macidx="$(($macidx + 1))"
-	elif [ "$macaddr" = 'random' ]; then
-		macaddr="$(macaddr_random)"
-	fi
-
-	json_add_object data
-	json_add_string ifname "$ifname"
-	json_close_object
-
-	[ "$mode" == "ap" ] && {
-		[ -z "$wpa_psk_file" ] && hostapd_set_psk "$ifname"
-		[ -z "$vlan_file" ] && hostapd_set_vlan "$ifname"
-	}
-
-	json_select config
-
-	# It is far easier to delete and create the desired interface
-	case "$mode" in
-		adhoc)
-			mac80211_iw_interface_add "$phy" "$ifname" adhoc || return
+	[ -n "$phy" ] && case "$phy" in
+		phy*)
+			[ -d /sys/class/ieee80211/$phy ] && \
+				phy_path="$(iwinfo nl80211 path "$dev")"
 		;;
-		ap)
-			# Hostapd will handle recreating the interface and
-			# subsequent virtual APs belonging to the same PHY
-			if [ -n "$hostapd_ctrl" ]; then
-				type=bss
-			else
-				type=interface
+		*)
+			if json_is_a "$phy" object; then
+				json_select "$phy"
+				json_get_var phy_path path
+				json_select ..
+			elif json_is_a "${phy%.*}" object; then
+				json_select "${phy%.*}"
+				json_get_var phy_path path
+				json_select ..
+				phy_path="$phy_path+${phy##*.}"
 			fi
-
-			mac80211_hostapd_setup_bss "$phy" "$ifname" "$macaddr" "$type" || return
-
-			NEWAPLIST="${NEWAPLIST}$ifname "
-			[ -n "$hostapd_ctrl" ] || {
-				ap_ifname="${ifname}"
-				hostapd_ctrl="${hostapd_ctrl:-/var/run/hostapd/$ifname}"
-			}
-		;;
-		mesh)
-			mac80211_iw_interface_add "$phy" "$ifname" mp || return
-		;;
-		monitor)
-			mac80211_iw_interface_add "$phy" "$ifname" monitor || return
-		;;
-		sta)
-			local wdsflag=
-			[ "$enable" = 0 ] || staidx="$(($staidx + 1))"
-			[ "$wds" -gt 0 ] && wdsflag="4addr on"
-			mac80211_iw_interface_add "$phy" "$ifname" managed "$wdsflag" || return
-			if [ "$wds" -gt 0 ]; then
-				iw "$ifname" set 4addr on
-			else
-				iw "$ifname" set 4addr off
-			fi
-			[ "$powersave" -gt 0 ] && powersave="on" || powersave="off"
-			iw "$ifname" set power_save "$powersave"
 		;;
 	esac
-
-	case "$mode" in
-		monitor|mesh)
-			[ "$auto_channel" -gt 0 ] || iw dev "$ifname" set channel "$channel" $iw_htmode
-		;;
-	esac
-
-	if [ "$mode" != "ap" ]; then
-		# ALL ap functionality will be passed to hostapd
-		# All interfaces must have unique mac addresses
-		# which can either be explicitly set in the device
-		# section, or automatically generated
-		ip link set dev "$ifname" address "$macaddr"
-	fi
-
 	json_select ..
-}
-
-mac80211_setup_supplicant() {
-	local enable=$1
-	local add_sp=0
-	local spobj="$(ubus -S list | grep wpa_supplicant.${ifname})"
-
-	[ "$enable" = 0 ] && {
-		ubus call wpa_supplicant.${phy} config_remove "{\"iface\":\"$ifname\"}"
-		ip link set dev "$ifname" down
-		iw dev "$ifname" del
+	[ -n "$phy_path" ] || config_get phy_path "$device" path
+	[ -n "$path" -a "$phy_path" = "$path" ] && {
+		found=1
 		return 0
 	}
 
-	wpa_supplicant_prepare_interface "$ifname" nl80211 || {
-		iw dev "$ifname" del
-		return 1
-	}
-	if [ "$mode" = "sta" ]; then
-		wpa_supplicant_add_network "$ifname"
-	else
-		wpa_supplicant_add_network "$ifname" "$freq" "$htmode" "$noscan"
-	fi
+	config_get dev_macaddr "$device" macaddr
 
-	NEWSPLIST="${NEWSPLIST}$ifname "
+	[ -n "$macaddr" -a "$dev_macaddr" = "$macaddr" ] && found=1
 
-	if [ "${NEWAPLIST%% *}" != "${OLDAPLIST%% *}" ]; then
-		[ "$spobj" ] && ubus call wpa_supplicant config_remove "{\"iface\":\"$ifname\"}"
-		add_sp=1
-	fi
-	[ -z "$spobj" ] && add_sp=1
-
-	NEW_MD5_SP=$(test -e "${_config}" && md5sum ${_config})
-	OLD_MD5_SP=$(uci -q -P /var/state get wireless._${phy}.md5_${ifname})
-	if [ "$add_sp" = "1" ]; then
-		wpa_supplicant_run "$ifname" "$hostapd_ctrl"
-	else
-		[ "${NEW_MD5_SP}" == "${OLD_MD5_SP}" ] || ubus call $spobj reload
-	fi
-	uci -q -P /var/state set wireless._${phy}.md5_${ifname}="${NEW_MD5_SP}"
 	return 0
 }
 
-mac80211_setup_supplicant_noctl() {
-	local enable=$1
-	local spobj="$(ubus -S list | grep wpa_supplicant.${ifname})"
-	wpa_supplicant_prepare_interface "$ifname" nl80211 || {
-		iw dev "$ifname" del
-		return 1
-	}
 
-	wpa_supplicant_add_network "$ifname" "$freq" "$htmode" "$noscan"
+__get_band_defaults() {
+	local phy="$1"
 
-	NEWSPLIST="${NEWSPLIST}$ifname "
-	[ "$enable" = 0 ] && {
-		ubus call wpa_supplicant config_remove "{\"iface\":\"$ifname\"}"
-		ip link set dev "$ifname" down
-		return 0
-	}
-	if [ -z "$spobj" ]; then
-		wpa_supplicant_run "$ifname"
-	else
-		ubus call $spobj reload
-	fi
+	( iw phy "$phy" info; echo ) | awk '
+BEGIN {
+        bands = ""
 }
 
-mac80211_prepare_iw_htmode() {
-	case "$htmode" in
-		VHT20|HT20) iw_htmode=HT20;;
-		HT40*|VHT40|VHT160)
-			case "$band" in
-				2g)
-					case "$htmode" in
-						HT40+) iw_htmode="HT40+";;
-						HT40-) iw_htmode="HT40-";;
-						*)
-							if [ "$channel" -lt 7 ]; then
-								iw_htmode="HT40+"
-							else
-								iw_htmode="HT40-"
-							fi
-						;;
-					esac
-				;;
-				*)
-					case "$(( ($channel / 4) % 2 ))" in
-						1) iw_htmode="HT40+" ;;
-						0) iw_htmode="HT40-";;
-					esac
-				;;
-			esac
-			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
-		;;
-		VHT80)
-			iw_htmode="80MHZ"
-		;;
-		NONE|NOHT)
-			iw_htmode="NOHT"
-		;;
-		*) iw_htmode="" ;;
-	esac
+($1 == "Band" || $1 == "") && band {
+        if (channel) {
+		mode="NOHT"
+		if (ht) mode="HT20"
+		if (vht && band != "1:") mode="VHT80"
+		if (he) mode="HE80"
+		if (he && band == "1:") mode="HE20"
+                sub("\\[", "", channel)
+                sub("\\]", "", channel)
+                bands = bands band channel ":" mode " "
+        }
+        band=""
 }
 
-mac80211_setup_adhoc() {
-	local enable=$1
-	json_get_vars bssid ssid key mcast_rate
-
-	NEWUMLIST="${NEWUMLIST}$ifname "
-
-	[ "$enable" = 0 ] && {
-		ip link set dev "$ifname" down
-		return 0
-	}
-
-	keyspec=
-	[ "$auth_type" = "wep" ] && {
-		set_default key 1
-		case "$key" in
-			[1234])
-				local idx
-				for idx in 1 2 3 4; do
-					json_get_var ikey "key$idx"
-
-					[ -n "$ikey" ] && {
-						ikey="$(($idx - 1)):$(prepare_key_wep "$ikey")"
-						[ $idx -eq $key ] && ikey="d:$ikey"
-						append keyspec "$ikey"
-					}
-				done
-			;;
-			*)
-				append keyspec "d:0:$(prepare_key_wep "$key")"
-			;;
-		esac
-	}
-
-	brstr=
-	for br in $basic_rate_list; do
-		wpa_supplicant_add_rate brstr "$br"
-	done
-
-	mcval=
-	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
-
-	iw dev "$ifname" set type ibss
-	iw dev "$ifname" ibss join "$ssid" $freq $iw_htmode fixed-freq $bssid \
-		beacon-interval $beacon_int \
-		${brstr:+basic-rates $brstr} \
-		${mcval:+mcast-rate $mcval} \
-		${keyspec:+keys $keyspec}
+$1 == "Band" {
+        band = $2
+        channel = ""
+	vht = ""
+	ht = ""
+	he = ""
 }
 
-mac80211_setup_mesh() {
-	local enable=$1
-	json_get_vars ssid mesh_id mcast_rate
-
-	NEWUMLIST="${NEWUMLIST}$ifname "
-
-	[ "$enable" = 0 ] && {
-		ip link set dev "$ifname" down
-		return 0
-	}
-
-	mcval=
-	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
-	[ -n "$mesh_id" ] && ssid="$mesh_id"
-
-	iw dev "$ifname" mesh join "$ssid" freq $freq $iw_htmode \
-		${mcval:+mcast-rate $mcval} \
-		beacon-interval $beacon_int
+$0 ~ "Capabilities:" {
+	ht=1
 }
 
-mac80211_setup_vif() {
-	local name="$1"
-	local failed
-	local action=up
-
-	json_select data
-	json_get_vars ifname
-	json_select ..
-
-	json_select config
-	json_get_vars mode
-	json_get_var vif_txpower
-	json_get_var vif_enable enable 1
-
-	[ "$vif_enable" = 1 ] || action=down
-	if [ "$mode" != "ap" ] || [ "$ifname" = "$ap_ifname" ]; then
-		ip link set dev "$ifname" "$action" || {
-			wireless_setup_vif_failed IFUP_ERROR
-			json_select ..
-			return
-		}
-		[ -z "$vif_txpower" ] || iw dev "$ifname" set txpower fixed "${vif_txpower%%.*}00"
-	fi
-
-	case "$mode" in
-		mesh)
-			wireless_vif_parse_encryption
-			[ -z "$htmode" ] && htmode="NOHT";
-			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ] || chan_is_dfs "$phy" "$channel"; then
-				mac80211_setup_supplicant $vif_enable || failed=1
-			else
-				mac80211_setup_mesh $vif_enable
-			fi
-			for var in $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING; do
-				json_get_var mp_val "$var"
-				[ -n "$mp_val" ] && iw dev "$ifname" set mesh_param "$var" "$mp_val"
-			done
-		;;
-		adhoc)
-			wireless_vif_parse_encryption
-			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ]; then
-				mac80211_setup_supplicant_noctl $vif_enable || failed=1
-			else
-				mac80211_setup_adhoc $vif_enable
-			fi
-		;;
-		sta)
-			mac80211_setup_supplicant $vif_enable || failed=1
-		;;
-	esac
-
-	json_select ..
-	[ -n "$failed" ] || wireless_add_vif "$name" "$ifname"
+$0 ~ "VHT Capabilities" {
+	vht=1
 }
 
-get_freq() {
-	local phy="$1"
-	local channel="$2"
-	local band="$3"
-
-	case "$band" in
-		2g) band="1:";;
-		5g) band="2:";;
-		60g) band="3:";;
-		6g) band="4:";;
-	esac
-
-	iw "$phy" info | awk -v band="$band" -v channel="[$channel]" '
-
-$1 ~ /Band/ {
-	band_match = band == $2
+$0 ~ "HE Iftypes" {
+	he=1
 }
 
-band_match && $3 == "MHz" && $4 == channel {
-	print $2
-	exit
-}
-'
+$1 == "*" && $3 == "MHz" && $0 !~ /disabled/ && band && !channel {
+        channel = $4
 }
 
+END {
+        print bands
+}'
+}
 
-chan_is_dfs() {
+get_band_defaults() {
 	local phy="$1"
-	local chan="$2"
-	iw "$phy" info | grep -E -m1 "(\* ${chan:-....} MHz${chan:+|\\[$chan\\]})" | grep -q "MHz.*radar detection"
-	return $!
-}
 
-mac80211_vap_cleanup() {
-	local service="$1"
-	local vaps="$2"
+	for c in $(__get_band_defaults "$phy"); do
+		local band="${c%%:*}"
+		c="${c#*:}"
+		local chan="${c%%:*}"
+		c="${c#*:}"
+		local mode="${c%%:*}"
 
-	for wdev in $vaps; do
-		[ "$service" != "none" ] && ubus call ${service} config_remove "{\"iface\":\"$wdev\"}"
-		ip link set dev "$wdev" down 2>/dev/null
-		iw dev "$wdev" del
-	done
-}
+		case "$band" in
+			1) band=2g;;
+			2) band=5g;;
+			3) band=60g;;
+			4) band=6g;;
+			*) band="";;
+		esac
 
-mac80211_interface_cleanup() {
-	local phy="$1"
-	local primary_ap=$(uci -q -P /var/state get wireless._${phy}.aplist)
-	primary_ap=${primary_ap%% *}
+		[ -n "$band" ] || continue
+		[ -n "$mode_band" -a "$band" = "6g" ] && return
 
-	mac80211_vap_cleanup hostapd "${primary_ap}"
-	mac80211_vap_cleanup wpa_supplicant "$(uci -q -P /var/state get wireless._${phy}.splist)"
-	mac80211_vap_cleanup none "$(uci -q -P /var/state get wireless._${phy}.umlist)"
+		mode_band="$band"
+		channel="$chan"
+		htmode="$mode"
+	done
 }
 
-mac80211_set_noscan() {
-	hostapd_noscan=1
+check_devidx() {
+	case "$1" in
+	radio[0-9]*)
+		local idx="${1#radio}"
+		[ "$devidx" -ge "${1#radio}" ] && devidx=$((idx + 1))
+		;;
+	esac
 }
 
-drv_mac80211_cleanup() {
-	hostapd_common_cleanup
-}
+check_board_phy() {
+	local name="$2"
 
-drv_mac80211_setup() {
-	json_select config
-	json_get_vars \
-		phy macaddr path \
-		country chanbw distance \
-		txpower antenna_gain \
-		rxantenna txantenna \
-		frag rts beacon_int:100 htmode
-	json_get_values basic_rate_list basic_rate
-	json_get_values scan_list scan_list
+	json_select "$name"
+	json_get_var phy_path path
 	json_select ..
 
-	find_phy || {
-		echo "Could not find PHY for device '$1'"
-		wireless_set_retry 0
-		return 1
-	}
-
-	wireless_set_data phy="$phy"
-	[ -z "$(uci -q -P /var/state show wireless._${phy})" ] && uci -q -P /var/state set wireless._${phy}=phy
-
-	OLDAPLIST=$(uci -q -P /var/state get wireless._${phy}.aplist)
-	OLDSPLIST=$(uci -q -P /var/state get wireless._${phy}.splist)
-	OLDUMLIST=$(uci -q -P /var/state get wireless._${phy}.umlist)
-
-	local wdev
-	local cwdev
-	local found
-
-	for wdev in $(list_phy_interfaces "$phy"); do
-		found=0
-		for cwdev in $OLDAPLIST $OLDSPLIST $OLDUMLIST; do
-			if [ "$wdev" = "$cwdev" ]; then
-				found=1
-				break
-			fi
-		done
-		if [ "$found" = "0" ]; then
-			ip link set dev "$wdev" down
-			iw dev "$wdev" del
-		fi
-	done
-
-	# convert channel to frequency
-	[ "$auto_channel" -gt 0 ] || freq="$(get_freq "$phy" "$channel" "$band")"
-
-	[ -n "$country" ] && {
-		iw reg get | grep -q "^country $country:" || {
-			iw reg set "$country"
-			sleep 1
-		}
-	}
-
-	hostapd_conf_file="/var/run/hostapd-$phy.conf"
-
-	no_ap=1
-	macidx=0
-	staidx=0
-
-	[ -n "$chanbw" ] && {
-		for file in /sys/kernel/debug/ieee80211/$phy/ath9k*/chanbw /sys/kernel/debug/ieee80211/$phy/ath5k/bwmode; do
-			[ -f "$file" ] && echo "$chanbw" > "$file"
-		done
-	}
-
-	set_default rxantenna 0xffffffff
-	set_default txantenna 0xffffffff
-	set_default distance 0
-	set_default antenna_gain 0
-
-	[ "$txantenna" = "all" ] && txantenna=0xffffffff
-	[ "$rxantenna" = "all" ] && rxantenna=0xffffffff
-
-	iw phy "$phy" set antenna $txantenna $rxantenna >/dev/null 2>&1
-	iw phy "$phy" set antenna_gain $antenna_gain >/dev/null 2>&1
-	iw phy "$phy" set distance "$distance" >/dev/null 2>&1
-
-	if [ -n "$txpower" ]; then
-		iw phy "$phy" set txpower fixed "${txpower%%.*}00"
-	else
-		iw phy "$phy" set txpower auto
+	if [ "$path" = "$phy_path" ]; then
+		board_dev="$name"
+	elif [ "${path%+*}" = "$phy_path" ]; then
+		fallback_board_dev="$name.${path#*+}"
 	fi
+}
 
-	[ -n "$frag" ] && iw phy "$phy" set frag "${frag%%.*}"
-	[ -n "$rts" ] && iw phy "$phy" set rts "${rts%%.*}"
+detect_mac80211() {
+	devidx=0
+	config_load wireless
+	config_foreach check_devidx wifi-device
 
-	has_ap=
-	hostapd_ctrl=
-	ap_ifname=
-	hostapd_noscan=
-	for_each_interface "ap" mac80211_check_ap
+	json_load_file /etc/board.json
 
-	rm -f "$hostapd_conf_file"
+	for _dev in /sys/class/ieee80211/*; do
+		[ -e "$_dev" ] || continue
 
-	for_each_interface "sta adhoc mesh" mac80211_set_noscan
-	[ -n "$has_ap" ] && mac80211_hostapd_setup_base "$phy"
+		dev="${_dev##*/}"
 
-	mac80211_prepare_iw_htmode
-	for_each_interface "sta adhoc mesh monitor" mac80211_prepare_vif
-	NEWAPLIST=
-	for_each_interface "ap" mac80211_prepare_vif
-	NEW_MD5=$(test -e "${hostapd_conf_file}" && md5sum ${hostapd_conf_file})
-	OLD_MD5=$(uci -q -P /var/state get wireless._${phy}.md5)
-	if [ "${NEWAPLIST}" != "${OLDAPLIST}" ]; then
-		mac80211_vap_cleanup hostapd "${OLDAPLIST}"
-	fi
-	[ -n "${NEWAPLIST}" ] && mac80211_iw_interface_add "$phy" "${NEWAPLIST%% *}" __ap
-	local add_ap=0
-	local primary_ap=${NEWAPLIST%% *}
-	[ -n "$hostapd_ctrl" ] && {
-		local no_reload=1
-		if [ -n "$(ubus list | grep hostapd.$primary_ap)" ]; then
-			no_reload=0
-			[ "${NEW_MD5}" = "${OLD_MD5}" ] || {
-				ubus call hostapd.$primary_ap reload
-				no_reload=$?
-				if [ "$no_reload" != "0" ]; then
-					mac80211_vap_cleanup hostapd "${OLDAPLIST}"
-					mac80211_vap_cleanup wpa_supplicant "$(uci -q -P /var/state get wireless._${phy}.splist)"
-					mac80211_vap_cleanup none "$(uci -q -P /var/state get wireless._${phy}.umlist)"
-					sleep 2
-					mac80211_iw_interface_add "$phy" "${NEWAPLIST%% *}" __ap
-					for_each_interface "sta adhoc mesh monitor" mac80211_prepare_vif
-				fi
-			}
-		fi
-		if [ "$no_reload" != "0" ]; then
-			add_ap=1
-			ubus wait_for hostapd
-			local hostapd_res="$(ubus call hostapd config_add "{\"iface\":\"$primary_ap\", \"config\":\"${hostapd_conf_file}\"}")"
-			ret="$?"
-			[ "$ret" != 0 -o -z "$hostapd_res" ] && {
-				wireless_setup_failed HOSTAPD_START_FAILED
-				return
-			}
-			wireless_add_process "$(jsonfilter -s "$hostapd_res" -l 1 -e @.pid)" "/usr/sbin/hostapd" 1 1
-		fi
-	}
-	uci -q -P /var/state set wireless._${phy}.aplist="${NEWAPLIST}"
-	uci -q -P /var/state set wireless._${phy}.md5="${NEW_MD5}"
+		mode_band=""
+		channel=""
+		htmode=""
+		ht_capab=""
 
-	[ "${add_ap}" = 1 ] && sleep 1
-	for_each_interface "ap" mac80211_setup_vif
+		get_band_defaults "$dev"
 
-	NEWSPLIST=
-	NEWUMLIST=
+		path="$(iwinfo nl80211 path "$dev")"
+		macaddr="$(cat /sys/class/ieee80211/${dev}/macaddress)"
 
-	for_each_interface "sta adhoc mesh monitor" mac80211_setup_vif
+		# work around phy rename related race condition
+		[ -n "$path" -o -n "$macaddr" ] || continue
 
-	uci -q -P /var/state set wireless._${phy}.splist="${NEWSPLIST}"
-	uci -q -P /var/state set wireless._${phy}.umlist="${NEWUMLIST}"
+		board_dev=
+		fallback_board_dev=
+		json_for_each_item check_board_phy wlan
+		[ -n "$board_dev" ] || board_dev="$fallback_board_dev"
+		[ -n "$board_dev" ] && dev="$board_dev"
 
-	local foundvap
-	local dropvap=""
-	for oldvap in $OLDSPLIST; do
-		foundvap=0
-		for newvap in $NEWSPLIST; do
-			[ "$oldvap" = "$newvap" ] && foundvap=1
-		done
-		[ "$foundvap" = "0" ] && dropvap="$dropvap $oldvap"
-	done
-	[ -n "$dropvap" ] && mac80211_vap_cleanup wpa_supplicant "$dropvap"
-	wireless_set_up
-}
+		found=
+		config_foreach check_mac80211_device wifi-device "$path" "$macaddr"
+		[ -n "$found" ] && continue
 
-_list_phy_interfaces() {
-	local phy="$1"
-	if [ -d "/sys/class/ieee80211/${phy}/device/net" ]; then
-		ls "/sys/class/ieee80211/${phy}/device/net" 2>/dev/null;
-	else
-		ls "/sys/class/ieee80211/${phy}/device" 2>/dev/null | grep net: | sed -e 's,net:,,g'
-	fi
-}
+		name="radio${devidx}"
+		devidx=$(($devidx + 1))
+		case "$dev" in
+			phy*)
+				if [ -n "$path" ]; then
+					dev_id="set wireless.${name}.path='$path'"
+				else
+					dev_id="set wireless.${name}.macaddr='$macaddr'"
+				fi
+				;;
+			*)
+				dev_id="set wireless.${name}.phy='$dev'"
+				;;
+		esac
 
-list_phy_interfaces() {
-	local phy="$1"
+		uci -q batch <<-EOF
+			set wireless.${name}=wifi-device
+			set wireless.${name}.type=mac80211
+			${dev_id}
+			set wireless.${name}.channel=${channel}
+			set wireless.${name}.band=${mode_band}
+			set wireless.${name}.htmode=$htmode
+			set wireless.${name}.disabled=1
 
-	for dev in $(_list_phy_interfaces "$phy"); do
-		readlink "/sys/class/net/${dev}/phy80211" | grep -q "/${phy}\$" || continue
-		echo "$dev"
+			set wireless.default_${name}=wifi-iface
+			set wireless.default_${name}.device=${name}
+			set wireless.default_${name}.network=lan
+			set wireless.default_${name}.mode=ap
+			set wireless.default_${name}.ssid=OpenWrt
+			set wireless.default_${name}.encryption=none
+EOF
+		uci -q commit wireless
 	done
 }
-
-drv_mac80211_teardown() {
-	json_select data
-	json_get_vars phy
-	json_select ..
-	[ -n "$phy" ] || {
-		echo "Bug: PHY is undefined for device '$1'"
-		return 1
-	}
-
-	mac80211_interface_cleanup "$phy"
-	uci -q -P /var/state revert wireless._${phy}
-}
-
-add_driver mac80211
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/993-2023-10-28-ACS-Fix-typo-in-bw_40-frequency-array.patch b/recipes-wifi/hostapd/files/patches-2.10.3/993-2023-10-28-ACS-Fix-typo-in-bw_40-frequency-array.patch
new file mode 100644
index 0000000..948c51b
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/993-2023-10-28-ACS-Fix-typo-in-bw_40-frequency-array.patch
@@ -0,0 +1,25 @@
+From 7a733993211ad46cf3032038c1e7e6bdc2322336 Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Tue, 5 Sep 2023 09:43:25 +0800
+Subject: [PATCH] ACS: Fix typo in bw_40 frequency array
+
+The range for the 5 GHz channel 118 was encoded with an incorrect
+channel number.
+
+Fixes: ed8e13decc71 (ACS: Extract bw40/80/160 freqs out of acs_usable_bwXXX_chan())
+Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com>
+---
+ src/ap/acs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -256,7 +256,7 @@ struct bw_item {
+ static const struct bw_item bw_40[] = {
+ 	{ 5180, 5200, 38 }, { 5220, 5240, 46 }, { 5260, 5280, 54 },
+ 	{ 5300, 5320, 62 }, { 5500, 5520, 102 }, { 5540, 5560, 110 },
+-	{ 5580, 5600, 110 }, { 5620, 5640, 126}, { 5660, 5680, 134 },
++	{ 5580, 5600, 118 }, { 5620, 5640, 126 }, { 5660, 5680, 134 },
+ 	{ 5700, 5720, 142 }, { 5745, 5765, 151 }, { 5785, 5805, 159 },
+ 	{ 5825, 5845, 167 }, { 5865, 5885, 175 },
+ 	{ 5955, 5975, 3 }, { 5995, 6015, 11 }, { 6035, 6055, 19 },
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
index 8ad0077..325e353 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
@@ -62,6 +62,7 @@
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://991-Fix-OpenWrt-13156.patch \
     file://992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch \
+    file://993-2023-10-28-ACS-Fix-typo-in-bw_40-frequency-array.patch \
     file://mtk-0001-mtk-hostapd-Add-neighbor-report-and-BSS-Termination-.patch \
     file://mtk-0002-mtk-hostapd-print-sae-groups-by-hostapd-ctrl.patch \
     file://mtk-0003-mtk-hostapd-add-support-for-runtime-set-in-band-disc.patch \
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0047-hostapd-mtk-add-support-for-channel-switching-to-dfs.patch b/recipes-wifi/hostapd/files/patches/mtk-0047-hostapd-mtk-add-support-for-channel-switching-to-dfs.patch
index 82b66f4..4e24ba6 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0047-hostapd-mtk-add-support-for-channel-switching-to-dfs.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0047-hostapd-mtk-add-support-for-channel-switching-to-dfs.patch
@@ -1,19 +1,19 @@
-From 018d87d5b9b53b3e630032bf2cb7e6eaeae09d71 Mon Sep 17 00:00:00 2001
+From 22adaf9edb6e4e60dbe5c7cc8366c08b8141571f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 15 Nov 2023 15:06:00 +0800
-Subject: [PATCH 47/49] hostapd: mtk: add support for channel switching to dfs
- with csa sent
+Subject: [PATCH] hostapd: mtk: add support for channel switching to dfs with
+ csa sent
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  hostapd/ctrl_iface.c | 26 ++------------------------
  src/ap/beacon.c      |  5 +++++
- src/ap/dfs.c         | 16 ++++++++++++----
+ src/ap/dfs.c         | 18 ++++++++++++++----
  src/ap/ieee802_11.c  |  5 +++++
- 4 files changed, 24 insertions(+), 28 deletions(-)
+ 4 files changed, 26 insertions(+), 28 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index b521a08..0afa6a2 100644
+index b0117e5..96b593a 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -2747,7 +2747,6 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
@@ -73,7 +73,7 @@
  
  	if (ieee802_11_build_ap_params(hapd, &params) < 0)
 diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 80d3605..012050c 100644
+index 80d3605..d490032 100644
 --- a/src/ap/dfs.c
 +++ b/src/ap/dfs.c
 @@ -1255,10 +1255,10 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
@@ -90,21 +90,23 @@
  
  			/*
  			 * When background radar is enabled but the CAC completion
-@@ -1272,6 +1272,13 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -1272,6 +1272,15 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
  	} else if (hostapd_dfs_is_background_event(iface, freq)) {
  		iface->radar_background.cac_started = 0;
  		hostpad_dfs_update_background_chain(iface);
 +	} else {
 +		int i;
 +
-+		iface->cac_started = 0;
++		/* If interface is already setup, clear cac_started flag to avoid re-setup */
++		if (iface->state == HAPD_IFACE_ENABLED)
++			iface->cac_started = 0;
 +		/* Clear all CSA flags once channel switch to DFS channel fails */
 +		for (i = 0; i < iface->num_bss; i++)
 +			iface->bss[i]->csa_in_progress = 0;
  	}
  
  	return 0;
-@@ -1646,7 +1653,8 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+@@ -1646,7 +1655,8 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
  	} else {
  		/* This is called when the driver indicates that an offloaded
  		 * DFS has started CAC. */
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0050-hostapd-mtk-add-support-for-removeing-the-main-BSS.patch b/recipes-wifi/hostapd/files/patches/mtk-0050-hostapd-mtk-add-support-for-removeing-the-main-BSS.patch
new file mode 100644
index 0000000..d6f13f1
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0050-hostapd-mtk-add-support-for-removeing-the-main-BSS.patch
@@ -0,0 +1,284 @@
+From cc04411d78f2569cc235e0f5620b3476091a1af1 Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Thu, 14 Dec 2023 14:42:58 +0800
+Subject: [PATCH 1/2] hostapd: mtk: add support for removeing the main BSS
+
+The first hostapd_data/i802_bss are important to hostapd since many
+operations/events are directly operated on the first BSS.
+(such as iface->bss[0], drv->first_bss, etc)
+
+To remove the main BSS, the 1st and 2nd hostapd_data/i802_bss are
+switched, then the new 2nd hostapd_data/i802_bss are removed as it is
+done to remove BSS other than the first one.
+
+This patch add the new command to remove the BSS (including the first
+one):
+$ hostapd_cli -i global raw REMOVE_BSS <ifname>
+
+Note that if the command is used in OpenWrt, an additional step is
+needed:
+update the "aplist" in /var/state/wireless according to the removed ifname
+Therefore the "wifi" command can work normally.
+
+Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+---
+ hostapd/ctrl_iface.c         | 14 ++++++
+ src/ap/ap_drv_ops.h          | 10 +++++
+ src/ap/hostapd.c             | 85 +++++++++++++++++++++++++++++++++++-
+ src/ap/hostapd.h             |  1 +
+ src/drivers/driver.h         |  2 +
+ src/drivers/driver_nl80211.c | 43 ++++++++++++++++++
+ 6 files changed, 153 insertions(+), 2 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 6552bc4..650af3b 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -5028,6 +5028,17 @@ static int hostapd_ctrl_iface_add(struct hapd_interfaces *interfaces,
+ }
+ 
+ 
++static int hostapd_ctrl_bss_remove(struct hapd_interfaces *interfaces,
++				   char *buf)
++{
++	if (hostapd_remove_bss(interfaces, buf) < 0) {
++		wpa_printf(MSG_ERROR, "Removing interface %s failed", buf);
++		return -1;
++	}
++	return 0;
++}
++
++
+ static int hostapd_ctrl_iface_remove(struct hapd_interfaces *interfaces,
+ 				     char *buf)
+ {
+@@ -5444,6 +5455,9 @@ static void hostapd_global_ctrl_iface_receive(int sock, void *eloop_ctx,
+ 	} else if (os_strncmp(buf, "REMOVE ", 7) == 0) {
+ 		if (hostapd_ctrl_iface_remove(interfaces, buf + 7) < 0)
+ 			reply_len = -1;
++	} else if (os_strncmp(buf, "REMOVE_BSS ", 11) == 0) {
++		if (hostapd_ctrl_bss_remove(interfaces, buf + 11) < 0)
++			reply_len = -1;
+ 	} else if (os_strcmp(buf, "ATTACH") == 0) {
+ 		if (hostapd_global_ctrl_iface_attach(interfaces, &from,
+ 						     fromlen, NULL))
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 2a89b99..95db664 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -310,6 +310,16 @@ static inline const char * hostapd_drv_get_radio_name(struct hostapd_data *hapd)
+ 	return hapd->driver->get_radio_name(hapd->drv_priv);
+ }
+ 
++static inline int hostapd_drv_move_bss_to_first(struct hostapd_data *hapd,
++						const char *ifname)
++{
++	if (hapd->driver == NULL || hapd->driver->move_bss_to_first == NULL ||
++	    hapd->drv_priv == NULL)
++		return -1;
++
++	return hapd->driver->move_bss_to_first(hapd->drv_priv, ifname);
++}
++
+ static inline int hostapd_drv_switch_channel(struct hostapd_data *hapd,
+ 					     struct csa_settings *settings)
+ {
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 250c168..7f58354 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -3297,7 +3297,35 @@ fail:
+ }
+ 
+ 
+-static int hostapd_remove_bss(struct hostapd_iface *iface, unsigned int idx)
++int hostapd_move_bss_to_first(struct hostapd_iface *iface, int idx)
++{
++	struct hostapd_data *target_hapd, *first_hapd;
++
++	if (idx == 0 || idx >= iface->num_bss)
++		return -1;
++
++	target_hapd = iface->bss[idx];
++	first_hapd = iface->bss[0];
++	if (hostapd_drv_move_bss_to_first(first_hapd, target_hapd->conf->iface))
++		return -1;
++
++	iface->bss[0] = target_hapd;
++	iface->bss[idx] = first_hapd;
++	iface->conf->bss[0] = iface->bss[0]->conf;
++	iface->conf->bss[idx] = iface->bss[idx]->conf;
++
++	first_hapd->interface_added = 1;
++	target_hapd->interface_added = 0;
++
++	if (idx == iface->num_bss - 1)
++		iface->conf->last_bss = iface->bss[idx]->conf;
++
++	return 0;
++}
++
++
++static int hostapd_remove_bss_by_idx(struct hostapd_iface *iface,
++				     unsigned int idx)
+ {
+ 	size_t i;
+ 
+@@ -3331,6 +3359,59 @@ static int hostapd_remove_bss(struct hostapd_iface *iface, unsigned int idx)
+ }
+ 
+ 
++int hostapd_remove_bss(struct hapd_interfaces *interfaces, char *buf)
++{
++	struct hostapd_iface *hapd_iface;
++	size_t i, j, k = 0;
++	int ret;
++
++	for (i = 0; i < interfaces->count; i++) {
++		hapd_iface = interfaces->iface[i];
++		if (hapd_iface == NULL)
++			return -1;
++
++		if (!os_strcmp(hapd_iface->conf->bss[0]->iface, buf)) {
++			if (hapd_iface->conf->num_bss == 1) {
++				wpa_printf(MSG_INFO, "Remove interface '%s'", buf);
++				hapd_iface->driver_ap_teardown =
++					!!(hapd_iface->drv_flags &
++					   WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT);
++
++				hostapd_interface_deinit_free(hapd_iface);
++				k = i;
++				while (k < (interfaces->count - 1)) {
++					interfaces->iface[k] =
++						interfaces->iface[k + 1];
++					k++;
++				}
++				interfaces->count--;
++				return 0;
++			} else {
++				wpa_printf(MSG_INFO, "Switch interface to %s",
++					   hapd_iface->bss[1]->conf->iface);
++
++				ret = hostapd_move_bss_to_first(hapd_iface, 1);
++				if (ret < 0) {
++					wpa_printf(MSG_ERROR,
++						   "Interface switch failed");
++					return ret;
++				}
++			}
++		}
++
++		for (j = 0; j < hapd_iface->conf->num_bss; j++) {
++			if (!os_strcmp(hapd_iface->conf->bss[j]->iface, buf)) {
++				hapd_iface->driver_ap_teardown =
++					!(hapd_iface->drv_flags &
++					  WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT);
++				return hostapd_remove_bss_by_idx(hapd_iface, j);
++			}
++		}
++	}
++	return -1;
++}
++
++
+ int hostapd_remove_iface(struct hapd_interfaces *interfaces, char *buf)
+ {
+ 	struct hostapd_iface *hapd_iface;
+@@ -3362,7 +3443,7 @@ int hostapd_remove_iface(struct hapd_interfaces *interfaces, char *buf)
+ 				hapd_iface->driver_ap_teardown =
+ 					!(hapd_iface->drv_flags &
+ 					  WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT);
+-				return hostapd_remove_bss(hapd_iface, j);
++				return hostapd_remove_bss_by_idx(hapd_iface, j);
+ 			}
+ 		}
+ 	}
+diff --git a/src/ap/hostapd.h b/src/ap/hostapd.h
+index 3b51050..824a24a 100644
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -701,6 +701,7 @@ void hostapd_bss_deinit_no_free(struct hostapd_data *hapd);
+ void hostapd_free_hapd_data(struct hostapd_data *hapd);
+ void hostapd_cleanup_iface_partial(struct hostapd_iface *iface);
+ int hostapd_add_iface(struct hapd_interfaces *ifaces, char *buf);
++int hostapd_remove_bss(struct hapd_interfaces *ifaces, char *buf);
+ int hostapd_remove_iface(struct hapd_interfaces *ifaces, char *buf);
+ void hostapd_channel_list_updated(struct hostapd_iface *iface, int initiator);
+ void hostapd_set_state(struct hostapd_iface *iface, enum hostapd_iface_state s);
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 01281a1..ab19794 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -3185,6 +3185,8 @@ struct wpa_driver_ops {
+ 	 */
+ 	void (*hapd_deinit)(void *priv);
+ 
++	int (*move_bss_to_first)(void *priv, const char *ifname);
++
+ 	/**
+ 	 * set_ieee8021x - Enable/disable IEEE 802.1X support (AP only)
+ 	 * @priv: Private driver interface data
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index e744a18..cef502f 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -7986,6 +7986,48 @@ static void i802_deinit(void *priv)
+ 	wpa_driver_nl80211_deinit(bss);
+ }
+ 
++static int i802_move_bss_to_first(void *priv, const char *ifname)
++{
++	struct i802_bss *bss = priv;
++	struct i802_bss *first_bss, *target_bss, *prev_bss, *tmp_bss;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++
++	if (!os_strcmp(bss->ifname, ifname)) {
++		wpa_printf(MSG_ERROR, "nl80211: BSS is already the first one");
++		return -1;
++	}
++
++	prev_bss = drv->first_bss;
++	target_bss = drv->first_bss->next;
++	while (target_bss) {
++		if (!os_strcmp(target_bss->ifname, ifname))
++			break;
++
++		prev_bss = target_bss;
++		target_bss = target_bss->next;
++	}
++
++	if (!target_bss) {
++		wpa_printf(MSG_ERROR, "nl80211: Failed to find the target BSS");
++		return -1;
++	}
++
++	first_bss = drv->first_bss;
++	drv->first_bss = target_bss;
++	prev_bss->next = first_bss;
++
++	tmp_bss = first_bss->next;
++	first_bss->next = target_bss->next;
++	target_bss->next = tmp_bss;
++
++	memcpy(drv->perm_addr, drv->first_bss->addr, ETH_ALEN);
++	drv->ifindex = if_nametoindex(drv->first_bss->ifname);
++	drv->ctx = drv->first_bss->ctx;
++
++	first_bss->added_if = 1;
++	target_bss->added_if = 0;
++	return 0;
++}
+ 
+ static enum nl80211_iftype wpa_driver_nl80211_if_type(
+ 	enum wpa_driver_if_type type)
+@@ -13433,6 +13475,7 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.sta_set_airtime_weight = driver_nl80211_sta_set_airtime_weight,
+ 	.hapd_init = i802_init,
+ 	.hapd_deinit = i802_deinit,
++	.move_bss_to_first = i802_move_bss_to_first,
+ 	.set_wds_sta = i802_set_wds_sta,
+ 	.get_seqnum = i802_get_seqnum,
+ 	.flush = i802_flush,
+-- 
+2.25.1
+
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0051-hostapd-mtk-add-support-for-enable-disable-single-BS.patch b/recipes-wifi/hostapd/files/patches/mtk-0051-hostapd-mtk-add-support-for-enable-disable-single-BS.patch
new file mode 100644
index 0000000..dd9795a
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0051-hostapd-mtk-add-support-for-enable-disable-single-BS.patch
@@ -0,0 +1,248 @@
+From be968a6aeea80dca7661e59e0ab5db32341cadb8 Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Mon, 18 Dec 2023 11:35:34 +0800
+Subject: [PATCH 2/2] hostapd: mtk: add support for enable/disable single BSS
+
+Enabling or disabling single BSS mean that the beacon of the BSS is
+enabled or disabled.
+
+When the BSS is disabled, the following statements are true:
+1. the events or packets from the driver are all ignored.
+2. Per radio functions (ex. channel switch, color change) will not
+   execute for the BSS, but are finished by other enabling BSS(es).
+   The changed parameters take effect when the BSS is enabled again.
+3. Enabling the BSS will not reload the configuration. In other word,
+   if the configuration changes during the BSS disabling, the BSS needs
+   to be removed and added again, not just be enabled.
+
+This patch add new commands to enable/disable single BSS:
+$ hostapd_cli -i <ifname> enable_bss
+$ hostapd_cli -i <ifname> disable_bss
+
+Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+---
+ hostapd/ctrl_iface.c               | 26 ++++++++++++++++++++
+ hostapd/hostapd_cli.c              | 18 ++++++++++++++
+ src/ap/hostapd.c                   | 39 ++++++++++++++++++++++++++++++
+ src/ap/hostapd.h                   |  2 ++
+ src/drivers/driver_nl80211.c       | 11 +++++++++
+ src/drivers/driver_nl80211_event.c |  6 +++++
+ 6 files changed, 102 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 650af3b..a980c0b 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1590,6 +1590,16 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
+ }
+ 
+ 
++static int hostapd_ctrl_iface_enable_bss(struct hostapd_data *hapd)
++{
++	if (hostapd_enable_bss(hapd) < 0) {
++		wpa_printf(MSG_ERROR, "Enabling of BSS failed");
++		return -1;
++	}
++	return 0;
++}
++
++
+ static int hostapd_ctrl_iface_enable(struct hostapd_iface *iface)
+ {
+ 	if (hostapd_enable_iface(iface) < 0) {
+@@ -1610,6 +1620,16 @@ static int hostapd_ctrl_iface_reload(struct hostapd_iface *iface)
+ }
+ 
+ 
++static int hostapd_ctrl_iface_disable_bss(struct hostapd_data *hapd)
++{
++	if (hostapd_disable_bss(hapd) < 0) {
++		wpa_printf(MSG_ERROR, "Disabling of BSS failed");
++		return -1;
++	}
++	return 0;
++}
++
++
+ static int hostapd_ctrl_iface_disable(struct hostapd_iface *iface)
+ {
+ 	if (hostapd_disable_iface(iface) < 0) {
+@@ -4196,6 +4216,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "GET ", 4) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get(hapd, buf + 4, reply,
+ 						   reply_size);
++	} else if (os_strncmp(buf, "ENABLE_BSS", 10) == 0) {
++		if (hostapd_ctrl_iface_enable_bss(hapd))
++			reply_len = -1;
+ 	} else if (os_strncmp(buf, "ENABLE", 6) == 0) {
+ 		if (hostapd_ctrl_iface_enable(hapd->iface))
+ 			reply_len = -1;
+@@ -4205,6 +4228,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "RELOAD", 6) == 0) {
+ 		if (hostapd_ctrl_iface_reload(hapd->iface))
+ 			reply_len = -1;
++	} else if (os_strncmp(buf, "DISABLE_BSS", 11) == 0) {
++		if (hostapd_ctrl_iface_disable_bss(hapd))
++			reply_len = -1;
+ 	} else if (os_strncmp(buf, "DISABLE", 7) == 0) {
+ 		if (hostapd_ctrl_iface_disable(hapd->iface))
+ 			reply_len = -1;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0c4a176..c8f0566 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1215,6 +1215,13 @@ static int hostapd_cli_cmd_enable(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_enable_bss(struct wpa_ctrl *ctrl, int argc,
++				      char *argv[])
++{
++	return wpa_ctrl_command(ctrl, "ENABLE_BSS");
++}
++
++
+ static int hostapd_cli_cmd_reload(struct wpa_ctrl *ctrl, int argc,
+ 				      char *argv[])
+ {
+@@ -1229,6 +1236,13 @@ static int hostapd_cli_cmd_disable(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_disable_bss(struct wpa_ctrl *ctrl, int argc,
++				       char *argv[])
++{
++	return wpa_ctrl_command(ctrl, "DISABLE_BSS");
++}
++
++
+ static int hostapd_cli_cmd_update_beacon(struct wpa_ctrl *ctrl, int argc,
+ 				      char *argv[])
+ {
+@@ -1731,10 +1745,14 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ 	  "  = send vendor driver command" },
+ 	{ "enable", hostapd_cli_cmd_enable, NULL,
+ 	  "= enable hostapd on current interface" },
++	{ "enable_bss", hostapd_cli_cmd_enable_bss, NULL,
++	  "= enable hostapd on current BSS" },
+ 	{ "reload", hostapd_cli_cmd_reload, NULL,
+ 	  "= reload configuration for current interface" },
+ 	{ "disable", hostapd_cli_cmd_disable, NULL,
+ 	  "= disable hostapd on current interface" },
++	{ "disable_bss", hostapd_cli_cmd_disable_bss, NULL,
++	  "= disable hostapd on current BSS" },
+ 	{ "update_beacon", hostapd_cli_cmd_update_beacon, NULL,
+ 	  "= update Beacon frame contents\n"},
+ 	{ "erp_flush", hostapd_cli_cmd_erp_flush, NULL,
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 7f58354..8b4fc4e 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -3297,6 +3297,42 @@ fail:
+ }
+ 
+ 
++int hostapd_enable_bss(struct hostapd_data *hapd)
++{
++	if (hapd->beacon_set_done)
++		return 0;
++
++	if (hapd->conf->bss_load_update_period && bss_load_update_init(hapd)) {
++		wpa_printf(MSG_ERROR, "BSS Load initialization failed");
++		return -1;
++	}
++	return ieee802_11_set_beacon(hapd);
++}
++
++
++int hostapd_disable_bss(struct hostapd_data *hapd)
++{
++	struct hostapd_iface *iface = hapd->iface;
++	int i, remain_bss = 0;
++
++	if (!hapd->beacon_set_done)
++		return 0;
++
++	for (i = 0; i < iface->num_bss; i++)
++		remain_bss += iface->bss[i]->beacon_set_done ? 1 : 0;
++
++	if (remain_bss == 1) {
++		wpa_printf(MSG_ERROR, "Cannot disable last BSS");
++		return -1;
++	}
++
++	hapd->beacon_set_done = 0;
++	bss_load_update_deinit(hapd);
++	hostapd_bss_deinit_no_free(hapd);
++	return hostapd_drv_stop_ap(hapd);
++}
++
++
+ int hostapd_move_bss_to_first(struct hostapd_iface *iface, int idx)
+ {
+ 	struct hostapd_data *target_hapd, *first_hapd;
+@@ -3905,6 +3941,9 @@ int hostapd_switch_channel(struct hostapd_data *hapd,
+ {
+ 	int ret;
+ 
++	if (!hapd->beacon_set_done)
++		return 0;
++
+ 	if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA)) {
+ 		wpa_printf(MSG_INFO, "CSA is not supported");
+ 		return -1;
+diff --git a/src/ap/hostapd.h b/src/ap/hostapd.h
+index 824a24a..88ff1ca 100644
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -701,6 +701,8 @@ void hostapd_bss_deinit_no_free(struct hostapd_data *hapd);
+ void hostapd_free_hapd_data(struct hostapd_data *hapd);
+ void hostapd_cleanup_iface_partial(struct hostapd_iface *iface);
+ int hostapd_add_iface(struct hapd_interfaces *ifaces, char *buf);
++int hostapd_enable_bss(struct hostapd_data *hapd);
++int hostapd_disable_bss(struct hostapd_data *hapd);
+ int hostapd_remove_bss(struct hapd_interfaces *ifaces, char *buf);
+ int hostapd_remove_iface(struct hapd_interfaces *ifaces, char *buf);
+ void hostapd_channel_list_updated(struct hostapd_iface *iface, int initiator);
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index cef502f..8e8e194 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4693,6 +4693,17 @@ static int wpa_driver_nl80211_set_ap(void *priv,
+ 	wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
+ 	wpa_printf(MSG_DEBUG, "nl80211: ssid=%s",
+ 		   wpa_ssid_txt(params->ssid, params->ssid_len));
++
++	if (!beacon_set) {
++		/* update wdev->preset_chandef in MAC80211 */
++		ret = nl80211_set_channel(bss, params->freq, 1);
++		if (ret) {
++			wpa_printf(MSG_ERROR,
++				   "nl80211: Frequency set failed: %d (%s)",
++				   ret, strerror(-ret));
++		}
++	}
++
+ 	if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
+ 	    nla_put(msg, NL80211_ATTR_BEACON_HEAD, params->head_len,
+ 		    params->head) ||
+diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
+index 585d207..6600c9c 100644
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -1094,6 +1094,12 @@ static void mlme_event(struct i802_bss *bss,
+ 		return;
+ 	}
+ 
++	if (is_ap_interface(drv->nlmode) && !bss->beacon_set) {
++		wpa_printf(MSG_DEBUG,
++			   "nl80211: drop BSS Event due to disabled BSS");
++		return;
++	}
++
+ 	if (frame == NULL) {
+ 		wpa_printf(MSG_DEBUG,
+ 			   "nl80211: MLME event %d (%s) without frame data",
+-- 
+2.25.1
+
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch b/recipes-wifi/hostapd/files/patches/mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch
new file mode 100644
index 0000000..1099ef2
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch
@@ -0,0 +1,44 @@
+From 7f442586bbff0c7b6aca157237b442291b90116b Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Tue, 23 Jan 2024 10:52:57 +0800
+Subject: [PATCH] hostapd: mtk: ACS: remove chan/freq list check when scan
+ request and factor calculation
+
+Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+---
+ src/ap/acs.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+diff --git a/src/ap/acs.c b/src/ap/acs.c
+index e4871921f..089d9c5f4 100644
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -590,12 +590,6 @@ static void acs_survey_mode_interference_factor(
+ 		    iface->conf->acs_exclude_dfs)
+ 			continue;
+ 
+-		if (!is_in_chanlist(iface, chan))
+-			continue;
+-
+-		if (!is_in_freqlist(iface, chan))
+-			continue;
+-
+ 		if (chan->max_tx_power < iface->conf->min_tx_power)
+ 			continue;
+ 
+@@ -1327,12 +1321,6 @@ static int * acs_request_scan_add_freqs(struct hostapd_iface *iface,
+ 		     iface->conf->acs_exclude_dfs))
+ 			continue;
+ 
+-		if (!is_in_chanlist(iface, chan))
+-			continue;
+-
+-		if (!is_in_freqlist(iface, chan))
+-			continue;
+-
+ 		if (chan->max_tx_power < iface->conf->min_tx_power)
+ 			continue;
+ 
+-- 
+2.25.1
+
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch b/recipes-wifi/hostapd/files/patches/mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch
new file mode 100644
index 0000000..e99e2a3
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch
@@ -0,0 +1,240 @@
+From e621aacd1eb69668a8e9176b4cd09125394d2fb8 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Date: Wed, 24 Jan 2024 15:15:26 +0800
+Subject: [PATCH] hostapd: mtk: add no_beacon vendor command for cert
+
+Add the vendor command to disable/enable beacon
+
+[Usage]
+hostapd_cli -i <interface> no_beacon <value>
+ <value>
+ 0: enable beacon
+ 1: disable beacon
+---
+ hostapd/ctrl_iface.c              | 18 +++++++++++++++++
+ hostapd/hostapd_cli.c             |  7 +++++++
+ src/ap/ap_drv_ops.c               |  7 +++++++
+ src/ap/ap_drv_ops.h               |  1 +
+ src/common/mtk_vendor.h           | 12 +++++++++++
+ src/drivers/driver.h              |  7 +++++++
+ src/drivers/driver_nl80211.c      | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |  1 +
+ src/drivers/driver_nl80211_capa.c |  3 +++
+ 9 files changed, 89 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bacf14c..c662417 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -4034,6 +4034,22 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
+ 	return os_snprintf(buf, buflen, "OK\n");
+ }
+ 
++static int
++hostapd_ctrl_iface_disable_beacon(struct hostapd_data *hapd, char *value,
++				  char *buf, size_t buflen)
++{
++	int disable_beacon = atoi(value);
++
++	if (disable_beacon < 0) {
++		wpa_printf(MSG_ERROR, "Invalid value for beacon ctrl");
++		return -1;
++	}
++
++	if (hostapd_drv_beacon_ctrl(hapd, !disable_beacon) == 0)
++		return os_snprintf(buf, buflen, "OK\n");
++	else
++		return -1;
++}
+ 
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+@@ -4615,6 +4631,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 							reply, reply_size);
+ 	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
+ 		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
++	} else if (os_strncmp(buf, "NO_BEACON ", 10) == 0) {
++		reply_len = hostapd_ctrl_iface_disable_beacon(hapd, buf + 10, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0c4a176..60e963a 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1393,6 +1393,11 @@ static int hostapd_cli_cmd_get_mu(struct wpa_ctrl *ctrl, int argc,
+ 	return hostapd_cli_cmd(ctrl, "GET_MU", 0, NULL, NULL);
+ }
+ 
++static int hostapd_cli_cmd_disable_beacon(struct wpa_ctrl *ctrl, int argc,
++					  char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "NO_BEACON", 1, argc, argv);
++}
+ 
+ #ifdef CONFIG_DPP
+ 
+@@ -1762,6 +1767,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ 		"<value> [0-15] bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0)"},
+ 	{ "get_mu", hostapd_cli_cmd_get_mu, NULL,
+ 		" = show mu onoff value in 0-15 bitmap"},
++	{ "no_beacon", hostapd_cli_cmd_disable_beacon, NULL,
++		"<value> 0: Enable beacon, 1: Disable beacon"},
+ #ifdef CONFIG_DPP
+ 	{ "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
+ 	  "report a scanned DPP URI from a QR Code" },
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index a060f5c..b1f7c92 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1143,3 +1143,10 @@ int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_
+ 		return 0;
+ 	return hapd->driver->amnt_dump(hapd->drv_priv, amnt_idx, amnt_dump_buf);
+ }
++
++int hostapd_drv_beacon_ctrl(struct hostapd_data *hapd, u8 beacon_mode)
++{
++		if (!hapd->driver || !hapd->driver->beacon_ctrl)
++			return 0;
++		return hapd->driver->beacon_ctrl(hapd->drv_priv, beacon_mode);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5f11a57..c5fdb00 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -158,6 +158,7 @@ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type);
+ 
+ int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac);
+ int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf);
++int hostapd_drv_beacon_ctrl(struct hostapd_data *hapd, u8 beacon_mode);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 21e735f..c7ed8e8 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -16,6 +16,7 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
+ 	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ 	MTK_NL80211_VENDOR_SUBCMD_BSS_COLOR_CTRL = 0xca,
++	MTK_NL80211_VENDOR_SUBCMD_BEACON_CTRL = 0xcd,
+ 	MTK_NL80211_VENDOR_SUBCMD_TXPOWER_CTRL = 0xce,
+ };
+ 
+@@ -253,6 +254,17 @@ enum mtk_vendor_attr_txpower_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_TXPOWER_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_beacon_ctrl {
++	MTK_VENDOR_ATTR_BEACON_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_BEACON_CTRL_MODE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_BEACON_CTRL,
++	MTK_VENDOR_ATTR_BEACON_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_BEACON_CTRL - 1
++};
++
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 0e3934e..f420464 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4749,6 +4749,13 @@ struct wpa_driver_ops {
+ 	 int (*mu_ctrl)(void *priv, u8 mode, u8 val);
+ 	 int (*mu_dump)(void *priv, u8 *mu_onoff);
+ 
++	/**
++	* beacon_ctrl - ctrl on off for beacon
++	* @priv: Private driver interface data
++	*
++	*/
++	int (*beacon_ctrl)(void *priv, u8 beacon_mode);
++
+ 	/**
+ 	 * three_wire_ctrl - set three_wire_ctrl mode
+ 	 * @priv: Private driver interface data
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index c8720bb..a1ce671 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12565,6 +12565,38 @@ static int nl80211_mu_dump(void *priv, u8 *mu_onoff)
+ }
+ #endif /* CONFIG_IEEE80211AX */
+ 
++static int nl80211_beacon_ctrl(void *priv, u8 beacon_mode)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_beacon_ctrl_vendor_cmd_avail) {
++		wpa_printf(MSG_ERROR,
++			   "nl80211: Driver does not support setting beacon control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_BEACON_CTRL) ||
++		!(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++		nla_put_u8(msg, MTK_VENDOR_ATTR_BEACON_CTRL_MODE, beacon_mode)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++
++	nla_nest_end(msg, data);
++
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++
++	if (ret)
++		wpa_printf(MSG_ERROR, "Failed to set beacon_ctrl. ret=%d (%s)", ret, strerror(-ret));
++
++	return ret;
++}
+ 
+ #ifdef CONFIG_DPP
+ static int nl80211_dpp_listen(void *priv, bool enable)
+@@ -13586,6 +13618,7 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.set_4addr_mode = nl80211_set_4addr_mode,
+ 	.mu_ctrl = nl80211_mu_ctrl,
+ 	.mu_dump = nl80211_mu_dump,
++	.beacon_ctrl = nl80211_beacon_ctrl,
+ #ifdef CONFIG_DPP
+ 	.dpp_listen = nl80211_dpp_listen,
+ #endif /* CONFIG_DPP */
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 640fdc5..53cf2be 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -190,6 +190,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int mtk_rfeatures_vendor_cmd_avail:1;
+ 	unsigned int mtk_amnt_vendor_cmd_avail:1;
+ 	unsigned int mtk_txpower_vendor_cmd_avail:1;
++	unsigned int mtk_beacon_ctrl_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 004c452..d13a64c 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1103,6 +1103,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_TXPOWER_CTRL:
+ 					drv->mtk_txpower_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_BEACON_CTRL :
++					drv->mtk_beacon_ctrl_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/patches.inc b/recipes-wifi/hostapd/files/patches/patches.inc
index 5268b34..73393d2 100644
--- a/recipes-wifi/hostapd/files/patches/patches.inc
+++ b/recipes-wifi/hostapd/files/patches/patches.inc
@@ -116,5 +116,9 @@
     file://mtk-0048-hostapd-mtk-add-support-for-channel-switching-with-c.patch \
     file://mtk-0049-hostapd-mtk-Add-DFS-offchan-channel-switch.patch \
     file://mtk-0050-hostapd-mtk-Add-txpower-vendor-command.patch \
+    file://mtk-0050-hostapd-mtk-add-support-for-removeing-the-main-BSS.patch \
     file://mtk-0051-hostapd-mtk-Update-Wide-Bandwidth-Channel-Switch-element.patch \
+    file://mtk-0051-hostapd-mtk-add-support-for-enable-disable-single-BS.patch \
+    file://mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch \
+    file://mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch \
     "
diff --git a/recipes-wifi/hostapd/files/wifi-detect.uc b/recipes-wifi/hostapd/files/wifi-detect.uc
new file mode 100644
index 0000000..5f37588
--- /dev/null
+++ b/recipes-wifi/hostapd/files/wifi-detect.uc
@@ -0,0 +1,155 @@
+#!/usr/bin/env ucode
+'use strict';
+import { readfile, writefile, realpath, glob, basename, unlink, open, rename } from "fs";
+import { is_equal } from "/usr/share/hostap/common.uc";
+let nl = require("nl80211");
+
+let board_file = "/etc/board.json";
+let prev_board_data = json(readfile(board_file));
+let board_data = json(readfile(board_file));
+
+function phy_idx(name) {
+	return +rtrim(readfile(`/sys/class/ieee80211/${name}/index`));
+}
+
+function phy_path(name) {
+	let devpath = realpath(`/sys/class/ieee80211/${name}/device`);
+
+	devpath = replace(devpath, /^\/sys\/devices\//, "");
+	if (match(devpath, /^platform\/.*\/pci/))
+		devpath = replace(devpath, /^platform\//, "");
+	let dev_phys = map(glob(`/sys/class/ieee80211/${name}/device/ieee80211/*`), basename);
+	sort(dev_phys, (a, b) => phy_idx(a) - phy_idx(b));
+
+	let ofs = index(dev_phys, name);
+	if (ofs > 0)
+		devpath += `+${ofs}`;
+
+	return devpath;
+}
+
+function cleanup() {
+	let wlan = board_data.wlan;
+
+	for (let name in wlan)
+		if (substr(name, 0, 3) == "phy")
+			delete wlan[name];
+		else
+			delete wlan[name].info;
+}
+
+function wiphy_get_entry(phy, path) {
+	board_data.wlan ??= {};
+
+	let wlan = board_data.wlan;
+	for (let name in wlan)
+		if (wlan[name].path == path)
+			return wlan[name];
+
+	wlan[phy] = {
+		path: path
+	};
+
+	return wlan[phy];
+}
+
+function wiphy_detect() {
+	let phys = nl.request(nl.const.NL80211_CMD_GET_WIPHY, nl.const.NLM_F_DUMP, { split_wiphy_dump: true });
+	if (!phys)
+		return;
+
+	for (let phy in phys) {
+		let name = phy.wiphy_name;
+		let path = phy_path(name);
+		let info = {
+			antenna_rx: phy.wiphy_antenna_avail_rx,
+			antenna_tx: phy.wiphy_antenna_avail_tx,
+			bands: {},
+		};
+
+		let bands = info.bands;
+		for (let band in phy.wiphy_bands) {
+			if (!band || !band.freqs)
+				continue;
+			let freq = band.freqs[0].freq;
+			let band_info = {};
+			let band_name;
+			if (freq > 50000)
+				band_name = "60G";
+			else if (freq > 5900)
+				band_name = "6G";
+			else if (freq > 4000)
+				band_name = "5G";
+			else
+				band_name = "2G";
+			bands[band_name] = band_info;
+			if (band.ht_capa > 0)
+				band_info.ht = true;
+			if (band.vht_capa > 0)
+				band_info.vht = true;
+			let he_phy_cap = 0;
+
+			for (let ift in band.iftype_data) {
+				if (!ift.he_cap_phy)
+					continue;
+
+				band_info.he = true;
+				he_phy_cap |= ift.he_cap_phy[0];
+				/* TODO: EHT */
+			}
+
+			if (band_name != "2G" &&
+			    (he_phy_cap & 0x18) || ((band.vht_capa >> 2) & 0x3))
+				band_info.max_width = 160;
+			else if (band_name != "2G" &&
+			         (he_phy_cap & 4) || band.vht_capa > 0)
+				band_info.max_width = 80;
+			else if ((band.ht_capa & 0x2) || (he_phy_cap & 0x2))
+				band_info.max_width = 40;
+			else
+				band_info.max_width = 20;
+
+			let modes = band_info.modes = [ "NOHT" ];
+			if (band_info.ht)
+				push(modes, "HT20");
+			if (band_info.vht)
+				push(modes, "VHT20");
+			if (band_info.he)
+				push(modes, "HE20");
+			if (band.ht_capa & 0x2) {
+				push(modes, "HT40");
+				if (band_info.vht)
+					push(modes, "VHT40")
+			}
+			if (he_phy_cap & 0x2)
+				push(modes, "HE40");
+
+			if (band_name == "2G")
+				continue;
+			if (band_info.vht)
+				push(modes, "VHT80");
+			if (he_phy_cap & 4)
+				push(modes, "HE80");
+			if ((band.vht_capa >> 2) & 0x3)
+				push(modes, "VHT160");
+			if (he_phy_cap & 0x18)
+				push(modes, "HE160");
+		}
+
+		let entry = wiphy_get_entry(name, path);
+		entry.info = info;
+	}
+}
+
+cleanup();
+wiphy_detect();
+if (!is_equal(prev_board_data, board_data)) {
+	let new_file = board_file + ".new";
+	unlink(new_file);
+	let f = open(new_file, "wx");
+	if (!f)
+		exit(1);
+	f.write(sprintf("%.J\n", board_data));
+	f.close();
+	rename(new_file, board_file);
+}
diff --git a/recipes-wifi/iwinfo/iwinfo_git.bb b/recipes-wifi/iwinfo/iwinfo_git.bb
index 997971b..5c17d85 100644
--- a/recipes-wifi/iwinfo/iwinfo_git.bb
+++ b/recipes-wifi/iwinfo/iwinfo_git.bb
@@ -8,7 +8,7 @@
 SECTION = "base"
 DEPENDS += "uci lua ubus libnl-tiny"
 
-SRCREV = "ca79f64154b107f192ec3c1ba631816cb8b07922"
+SRCREV = "a34977c0760c93480491c8eb94da656b57d7f4cc"
 
 SRC_URI = "git://git.openwrt.org/project/iwinfo.git;branch=master \
            file://0002-fix-order-of-linker-cmdline-to-help-linking.patch \
diff --git a/recipes-wifi/libubox/libubox_git.bbappend b/recipes-wifi/libubox/libubox_git.bbappend
index ad9df96..ed6a08c 100644
--- a/recipes-wifi/libubox/libubox_git.bbappend
+++ b/recipes-wifi/libubox/libubox_git.bbappend
@@ -1,6 +1,6 @@
 SRC_URI_remove = "file://0001-blobmsg-fix-array-out-of-bounds-GCC-10-warning.patch"
 
 wifi6_ver = "b14c4688612c05c78ce984d7bde633bce8703b1e"
-wifi7_ver = "ca3f6d0cdb1e588283c42d039779ceab303ceef2"
+wifi7_ver = "c1be505732e6d254464973bdeacb955214c76c46"
 
 SRCREV = "${@bb.utils.contains('DISTRO_FEATURES', 'wifi_eht', '${wifi7_ver}', '${wifi6_ver}', d)}"
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0026-mac80211-mtk-Add-cert-mode-for-ba-timeout-workaround.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0026-mac80211-mtk-Add-cert-mode-for-ba-timeout-workaround.patch
new file mode 100644
index 0000000..38b3979
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0026-mac80211-mtk-Add-cert-mode-for-ba-timeout-workaround.patch
@@ -0,0 +1,134 @@
+From 6fbc3d0df8f7d36a735c62ce54cbb39140e58f17 Mon Sep 17 00:00:00 2001
+From: Allen Ye <allen.ye@mediatek.com>
+Date: Mon, 22 Jan 2024 15:47:23 +0800
+Subject: [PATCH] mac80211: mtk: Add cert mode for disable ba timeout and fix
+ SMPS cap check
+
+Signed-off-by: Allen Ye <allen.ye@mediatek.com>
+---
+ include/net/mac80211.h |  7 ++++++
+ net/mac80211/agg-tx.c  |  5 ++++-
+ net/mac80211/debugfs.c | 49 ++++++++++++++++++++++++++++++++++++++++++
+ net/mac80211/rx.c      |  3 ++-
+ 4 files changed, 62 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 41d57e7..415dcfe 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -2654,8 +2654,15 @@ struct ieee80211_hw {
+ 	u8 tx_sk_pacing_shift;
+ 	u8 weight_multiplier;
+ 	u32 max_mtu;
++	bool cert_mode;
+ };
+ 
++static inline bool ieee80211_is_cert_mode(struct ieee80211_hw *hw)
++{
++	return hw->cert_mode;
++}
++
++
+ static inline bool _ieee80211_hw_check(struct ieee80211_hw *hw,
+ 				       enum ieee80211_hw_flags flg)
+ {
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index ad0c0d6..6ea3676 100644
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -1052,7 +1052,10 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
+ 		tid_tx->timeout =
+ 			le16_to_cpu(mgmt->u.action.u.addba_resp.timeout);
+ 
+-		if (tid_tx->timeout) {
++		/* In the case of certification env, testbed STA cannot accept frequent DelBA.
++		 * Therefore, we remove the session timer check here to avoid crashing testbed STA.
++		 */
++		if (tid_tx->timeout && !ieee80211_is_cert_mode(&local->hw)) {
+ 			mod_timer(&tid_tx->session_timer,
+ 				  TU_TO_EXP_TIME(tid_tx->timeout));
+ 			tid_tx->last_tx = jiffies;
+diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
+index 46f6c82..7a4ce05 100644
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -440,6 +440,54 @@ static const struct file_operations reset_ops = {
+ };
+ #endif
+ 
++static ssize_t cert_mode_read(struct file *file,
++			      char __user *user_buf,
++			      size_t count,
++			      loff_t *ppos)
++{
++	struct ieee80211_local *local = file->private_data;
++	char buf[32];
++	int len = 0;
++
++	len = scnprintf(buf, sizeof(buf), "cert_mode: %d\n",
++			local->hw.cert_mode);
++
++	return simple_read_from_buffer(user_buf, count, ppos,
++					buf, len);
++}
++
++static ssize_t cert_mode_write(struct file *file,
++			       const char __user *user_buf,
++			       size_t count,
++			       loff_t *ppos)
++{
++	struct ieee80211_local *local = file->private_data;
++	char buf[16];
++
++	if (count >= sizeof(buf))
++		return -EINVAL;
++
++	if (copy_from_user(buf, user_buf, count))
++		return -EFAULT;
++
++	if (count && buf[count - 1] == '\n')
++		buf[count - 1] = '\0';
++	else
++		buf[count] = '\0';
++
++	if (kstrtobool(buf, &local->hw.cert_mode))
++		return -EINVAL;
++
++	return count;
++}
++
++static const struct file_operations cert_mode_ops = {
++	.write = cert_mode_write,
++	.read = cert_mode_read,
++	.open = simple_open,
++	.llseek = noop_llseek,
++};
++
+ static const char *hw_flag_names[] = {
+ #define FLAG(F)	[IEEE80211_HW_##F] = #F
+ 	FLAG(HAS_RATE_CONTROL),
+@@ -670,6 +718,7 @@ void debugfs_hw_add(struct ieee80211_local *local)
+ 	debugfs_create_u32("aql_threshold", 0600,
+ 			   phyd, &local->aql_threshold);
+ 
++	DEBUGFS_ADD_MODE(cert_mode, 0644);
+ 	statsd = debugfs_create_dir("statistics", phyd);
+ 
+ 	/* if the dir failed, don't put all the other things into the root! */
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index a9fcc7a..de2dc66 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3366,7 +3366,8 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
+ 	switch (mgmt->u.action.category) {
+ 	case WLAN_CATEGORY_HT:
+ 		/* reject HT action frames from stations not supporting HT */
+-		if (!rx->sta->sta.ht_cap.ht_supported)
++		if (!rx->sta->sta.ht_cap.ht_supported &&
++		    !rx->sta->sta.he_cap.has_he)
+ 			goto invalid;
+ 
+ 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0026-mac80211-mtk-add-support-for-scan-dwell-time-customi.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0026-mac80211-mtk-add-support-for-scan-dwell-time-customi.patch
new file mode 100644
index 0000000..6448a62
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0026-mac80211-mtk-add-support-for-scan-dwell-time-customi.patch
@@ -0,0 +1,41 @@
+From 81d34af3b2198f7c7e94e3d843035efd7294de20 Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Thu, 18 Jan 2024 17:35:05 +0800
+Subject: [PATCH] mac80211: mtk: add support for scan dwell time customization
+
+Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+---
+ net/mac80211/scan.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index e692a24..9d53f1a 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -683,7 +683,10 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
+ 	 * After sending probe requests, wait for probe responses
+ 	 * on the channel.
+ 	 */
+-	*next_delay = IEEE80211_CHANNEL_TIME;
++	*next_delay = msecs_to_jiffies(scan_req->duration) >
++		      IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME ?
++		      msecs_to_jiffies(scan_req->duration) - IEEE80211_PROBE_DELAY :
++		      IEEE80211_CHANNEL_TIME;
+ 	local->next_scan_state = SCAN_DECISION;
+ }
+ 
+@@ -1011,7 +1014,10 @@ set_channel:
+ 	 */
+ 	if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)) ||
+ 	    !scan_req->n_ssids) {
+-		*next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
++		*next_delay = msecs_to_jiffies(scan_req->duration) >
++			      IEEE80211_PASSIVE_CHANNEL_TIME ?
++			      msecs_to_jiffies(scan_req->duration) :
++			      IEEE80211_PASSIVE_CHANNEL_TIME;
+ 		local->next_scan_state = SCAN_DECISION;
+ 		if (scan_req->n_ssids)
+ 			set_bit(SCAN_BEACON_WAIT, &local->scanning);
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
index d5b5832..b9c45d2 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
@@ -82,6 +82,8 @@
     file://mtk-0024-mac80211-mtk-ACS-channel-time-is-reset-by-ch_restore.patch \
     file://mtk-0024-mac80211-mtk-add-DFS-CAC-countdown-in-CSA-flow.patch \
     file://mtk-0025-mac80211-mtk-send-deauth-frame-if-CAC-is-required-du.patch \
+    file://mtk-0026-mac80211-mtk-Add-cert-mode-for-ba-timeout-workaround.patch \
+    file://mtk-0026-mac80211-mtk-add-support-for-scan-dwell-time-customi.patch \
     file://mtk-9900-mac80211-mtk-mask-kernel-version-limitation-and-fill.patch \
     file://mtk-9901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
     file://mtk-9902-mac80211-mtk-add-support-for-letting-drivers-registe.patch \
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
index 427cc70..6d8b29c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
@@ -1,7 +1,7 @@
-From 79c8a28d435df3a9b0da8145675ea8d70a4de463 Mon Sep 17 00:00:00 2001
+From ed4d404869179bbebeab820a6271772f198d91fa Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 19 Sep 2023 11:21:23 +0800
-Subject: [PATCH 01/25] mtk: Revert "wifi: mt76: mt7996: fill txd by host
+Subject: [PATCH 01/15] mtk: Revert "wifi: mt76: mt7996: fill txd by host
  driver"
 
 This reverts commit 325a0c4931990d553487024c4f76c776492bdcc2.
@@ -10,10 +10,10 @@
  1 file changed, 9 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 53258488..db06a982 100644
+index 0384fb05..3af537b6 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -937,8 +937,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -938,8 +938,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		return id;
  
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
@@ -27,7 +27,7 @@
  
  	txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
  	for (i = 0; i < nbuf; i++) {
-@@ -955,8 +958,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -956,8 +959,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	}
  	txp->fw.nbuf = nbuf;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch
index f7e8cb0..26f782f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch
@@ -1,7 +1,7 @@
-From b7325781bb79f1ffa9d3f5a9ea9f79a59aa92e41 Mon Sep 17 00:00:00 2001
+From eefba7039b4edc74c78d70877a59dbb3a4c35ef9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 24 Aug 2023 18:38:11 +0800
-Subject: [PATCH 02/25] mtk: wifi: mt76: connac: use peer address for station
+Subject: [PATCH 02/15] mtk: wifi: mt76: connac: use peer address for station
  BMC entry
 
 Set peer address and aid for the BMC wtbl of station interface. For some
@@ -16,10 +16,10 @@
  2 files changed, 11 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 96494ba2..0d05404f 100644
+index 7602f979..1c910d9d 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -389,7 +389,14 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -392,7 +392,14 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  
  	if (!sta) {
  		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
@@ -36,10 +36,10 @@
  	}
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 51deea84..be914ced 100644
+index 2bf8e8a8..37e40f1d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -595,6 +595,9 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -598,6 +598,9 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
  	    (changed & BSS_CHANGED_ASSOC && vif->cfg.assoc) ||
  	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch
index dde3572..33c78b6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch
@@ -1,7 +1,7 @@
-From 70f582db962c977a71d3d618081f894c0e658046 Mon Sep 17 00:00:00 2001
+From aa6060100ddbf2bad579b2765e34740ea70f8752 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 5 Sep 2023 17:31:49 +0800
-Subject: [PATCH 03/25] mtk: wifi: mt76: mt7996: disable rx header translation
+Subject: [PATCH 03/15] mtk: wifi: mt76: mt7996: disable rx header translation
  for BMC entry
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 5 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3c729b56..5a2e2d12 100644
+index 1356ac14..7f412d6c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1769,10 +1769,10 @@ mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1778,10 +1778,10 @@ mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	else
  		hdr_trans->from_ds = true;
  
@@ -26,7 +26,7 @@
  	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
  	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
  		hdr_trans->to_ds = true;
-@@ -2145,6 +2145,9 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2154,6 +2154,9 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	if (!enable)
  		goto out;
  
@@ -36,7 +36,7 @@
  	/* tag order is in accordance with firmware dependency. */
  	if (sta) {
  		/* starec hdrt mode */
-@@ -2169,8 +2172,6 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2178,8 +2181,6 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		mt7996_mcu_sta_muru_tlv(dev, skb, vif, sta);
  		/* starec bfee */
  		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-check-txs-format-before-getting-skb-by.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-check-txs-format-before-getting-skb-by.patch
deleted file mode 100644
index 930622b..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-check-txs-format-before-getting-skb-by.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 87a3fa3c38e1b840cebe5f3b088a0ff67e5920f0 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Thu, 7 Dec 2023 11:17:56 +0800
-Subject: [PATCH 04/25] mtk: wifi: mt76: check txs format before getting skb by
- pid
-
-The PPDU TxS does not include the error bit so it cannot use to report
-status to mac80211.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt76_connac3_mac.h | 5 +++++
- mt7996/mac.c       | 6 ++++--
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/mt76_connac3_mac.h b/mt76_connac3_mac.h
-index 83dcd964..8cfd479a 100644
---- a/mt76_connac3_mac.h
-+++ b/mt76_connac3_mac.h
-@@ -18,6 +18,11 @@ enum {
- 	MT_LMAC_PSMP0,
- };
- 
-+enum {
-+	MT_TXS_MPDU_FMT = 0,
-+	MT_TXS_PPDU_FMT = 2,
-+};
-+
- #define MT_CT_PARSE_LEN			72
- #define MT_CT_DMA_BUF_NUM		2
- 
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index db06a982..ff7e0753 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -1193,14 +1193,16 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
- 	struct ieee80211_tx_info *info;
- 	struct sk_buff_head list;
- 	struct rate_info rate = {};
--	struct sk_buff *skb;
-+	struct sk_buff *skb = NULL;
- 	bool cck = false;
- 	u32 txrate, txs, mode, stbc;
- 
- 	txs = le32_to_cpu(txs_data[0]);
- 
- 	mt76_tx_status_lock(mdev, &list);
--	skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
-+
-+	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == MT_TXS_MPDU_FMT)
-+		skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
- 
- 	if (skb) {
- 		info = IEEE80211_SKB_CB(skb);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-init-rcpi-to-use-better-init-mc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-mt7996-set-RCPI-value-in-rate-control-.patch
similarity index 65%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-init-rcpi-to-use-better-init-mc.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-mt7996-set-RCPI-value-in-rate-control-.patch
index 79499c0..8f05075 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-init-rcpi-to-use-better-init-mc.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-mt7996-set-RCPI-value-in-rate-control-.patch
@@ -1,19 +1,23 @@
-From c59e5d1ee99fbe46418efb2eacb6755db54b8e57 Mon Sep 17 00:00:00 2001
+From 4c5eea6f2ddb3d0e47d7e3877989013b0554dae4 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Nov 2023 20:15:39 +0800
-Subject: [PATCH 13/25] mtk: wifi: mt76: mt7996: init rcpi to use better init
- mcs
+Subject: [PATCH 04/15] mtk: wifi: mt76: mt7996: set RCPI value in rate control
+ command
+
+Set RCPI values in mt7996_mcu_sta_rate_ctrl_tlv(), which can make the
+FW rate control be initialized with a better MCS selection table.
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/mcu.c | 3 +++
  1 file changed, 3 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8c756b31..48a1e822 100644
+index 7f412d6c..0f1905f2 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1981,6 +1981,7 @@ static void
+@@ -1968,6 +1968,7 @@ static void
  mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
  {
@@ -21,7 +25,7 @@
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt76_phy *mphy = mvif->phy->mt76;
  	struct cfg80211_chan_def *chandef = &mphy->chandef;
-@@ -2078,6 +2079,8 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2065,6 +2066,8 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  	ra->sta_cap = cpu_to_le32(cap);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-enable-ser-query.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-enable-ser-query.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-enable-ser-query.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-enable-ser-query.patch
index 630a637..8a136ae 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-enable-ser-query.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-enable-ser-query.patch
@@ -1,7 +1,7 @@
-From ca4d4dc688f96320065b35c9b473e378dddef56b Mon Sep 17 00:00:00 2001
+From 3874c792c9987f38c91a10db6a9edf3c97ef3bc2 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Oct 2023 20:19:41 +0800
-Subject: [PATCH 12/25] mtk: wifi: mt76: mt7996: enable ser query
+Subject: [PATCH 05/15] mtk: wifi: mt76: mt7996: enable ser query
 
 Do not return -EINVAL when action is UNI_CMD_SER_QUERY for user
 to dump SER information from FW.
@@ -12,10 +12,10 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 98ea9c20..8c756b31 100644
+index 0f1905f2..0c1dd93f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3852,6 +3852,8 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
+@@ -3842,6 +3842,8 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
  	};
  
  	switch (action) {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-fix-some-twt-issues.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-fix-some-twt-issues.patch
deleted file mode 100644
index 63f5b88..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-fix-some-twt-issues.patch
+++ /dev/null
@@ -1,129 +0,0 @@
-From 651d207a15f2bc281edf3c92236b88853fc41006 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 8 Nov 2023 10:17:10 +0800
-Subject: [PATCH 05/25] mtk: wifi: mt76: mt7996: fix some twt issues
-
-1. Reject twt flows with the same parameters to prevent potential issues
-causing by duplicated establishment.
-2. mt7996 can support 16 twt stations so modify the table_mask to u16.
-3. The minimum twt duration supported by mt7996 is 64 according to hardware
-design. Reply station with TWT_SETUP_CMD_DICTATE if the min_twt_dur smaller
-than 64.
-4. Fix possible unaligned pointer.
-5. Remove TWT_CONTROL_WAKE_DUR_UNIT flag because mt7996 does not support it.
-
----
- mt7996/mac.c    | 53 +++++++++++++++++++++++++++++++++++++++++--------
- mt7996/mt7996.h |  3 ++-
- 2 files changed, 47 insertions(+), 9 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index ff7e0753..e6583427 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -2534,6 +2534,34 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
- 	return 0;
- }
- 
-+static bool
-+mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
-+			   struct ieee80211_twt_params *twt_agrt)
-+{
-+	u16 type = le16_to_cpu(twt_agrt->req_type);
-+	u8 exp;
-+	int i;
-+
-+	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, type);
-+	for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) {
-+		struct mt7996_twt_flow *f;
-+
-+		if (!(msta->twt.flowid_mask & BIT(i)))
-+			continue;
-+
-+		f = &msta->twt.flow[i];
-+		if (f->duration == twt_agrt->min_twt_dur &&
-+		    f->mantissa == twt_agrt->mantissa &&
-+		    f->exp == exp &&
-+		    f->protection == !!(type & IEEE80211_TWT_REQTYPE_PROTECTION) &&
-+		    f->flowtype == !!(type & IEEE80211_TWT_REQTYPE_FLOWTYPE) &&
-+		    f->trigger == !!(type & IEEE80211_TWT_REQTYPE_TRIGGER))
-+			return true;
-+	}
-+
-+	return false;
-+}
-+
- void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- 			      struct ieee80211_sta *sta,
- 			      struct ieee80211_twt_setup *twt)
-@@ -2545,8 +2573,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- 	enum ieee80211_twt_setup_cmd sta_setup_cmd;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_twt_flow *flow;
--	int flowid, table_id;
--	u8 exp;
-+	u8 flowid, table_id, exp;
- 
- 	if (mt7996_mac_check_twt_req(twt))
- 		goto out;
-@@ -2559,9 +2586,19 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- 	if (hweight8(msta->twt.flowid_mask) == ARRAY_SIZE(msta->twt.flow))
- 		goto unlock;
- 
-+	if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) {
-+		setup_cmd = TWT_SETUP_CMD_DICTATE;
-+		twt_agrt->min_twt_dur = MT7996_MIN_TWT_DUR;
-+		goto unlock;
-+	}
-+
-+	if (mt7996_mac_twt_param_equal(msta, twt_agrt))
-+		goto unlock;
-+
- 	flowid = ffs(~msta->twt.flowid_mask) - 1;
--	le16p_replace_bits(&twt_agrt->req_type, flowid,
--			   IEEE80211_TWT_REQTYPE_FLOWID);
-+	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID);
-+	twt_agrt->req_type |= le16_encode_bits(flowid,
-+					       IEEE80211_TWT_REQTYPE_FLOWID);
- 
- 	table_id = ffs(~dev->twt.table_mask) - 1;
- 	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
-@@ -2608,10 +2645,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- unlock:
- 	mutex_unlock(&dev->mt76.mutex);
- out:
--	le16p_replace_bits(&twt_agrt->req_type, setup_cmd,
--			   IEEE80211_TWT_REQTYPE_SETUP_CMD);
--	twt->control = (twt->control & IEEE80211_TWT_CONTROL_WAKE_DUR_UNIT) |
--		       (twt->control & IEEE80211_TWT_CONTROL_RX_DISABLED);
-+	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_SETUP_CMD);
-+	twt_agrt->req_type |=
-+		le16_encode_bits(setup_cmd, IEEE80211_TWT_REQTYPE_SETUP_CMD);
-+	twt->control = twt->control & IEEE80211_TWT_CONTROL_RX_DISABLED;
- }
- 
- void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index bc73bcb4..8154ad37 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -53,6 +53,7 @@
- 
- #define MT7996_MAX_TWT_AGRT		16
- #define MT7996_MAX_STA_TWT_AGRT		8
-+#define MT7996_MIN_TWT_DUR		64
- #define MT7996_MAX_QUEUE		(__MT_RXQ_MAX +	__MT_MCUQ_MAX + 3)
- 
- /* NOTE: used to map mt76_rates. idx may change if firmware expands table */
-@@ -320,7 +321,7 @@ struct mt7996_dev {
- 	struct rchan *relay_fwlog;
- 
- 	struct {
--		u8 table_mask;
-+		u16 table_mask;
- 		u8 n_agrt;
- 	} twt;
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
index f8bff26..382c4b3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
@@ -1,7 +1,7 @@
-From 73aed7092e7da26eaf17b1e29bdb94222e073e94 Mon Sep 17 00:00:00 2001
+From fdaf32684efac76b6e942db0e0748c4b488413a8 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 17 Nov 2023 11:01:04 +0800
-Subject: [PATCH 14/25] mtk: wifi: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
+Subject: [PATCH 06/15] mtk: wifi: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
 
 According to sta capability to decide to enable/disable wed pao when create ppe entry.
 without this patch, TGax HE-4.51.1_24G will test fail
@@ -12,7 +12,7 @@
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 6e88420e..4db8899c 100644
+index 37e40f1d..625f87b4 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1447,7 +1447,12 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-disable-AMSDU-for-non-data-fram.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-disable-AMSDU-for-non-data-fram.patch
deleted file mode 100644
index 0fe3af0..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-disable-AMSDU-for-non-data-fram.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From abd4da501a5b6d4159f8ef3dbcfc9f646ecc8a40 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 6 Nov 2023 20:17:16 +0800
-Subject: [PATCH 06/25] mtk: wifi: mt76: mt7996: disable AMSDU for non-data
- frames
-
-Mgmt. frames with amsdu may lead to unexpected errors.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/mac.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index e6583427..19b34066 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -732,6 +732,9 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
- 	      FIELD_PREP(MT_TXD2_SUB_TYPE, fc_stype);
- 
- 	txwi[2] |= cpu_to_le32(val);
-+
-+	if (wcid->amsdu)
-+		txwi[3] |= cpu_to_le32(MT_TXD3_HW_AMSDU);
- }
- 
- static void
-@@ -862,8 +865,6 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
- 		val |= MT_TXD3_PROTECT_FRAME;
- 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
- 		val |= MT_TXD3_NO_ACK;
--	if (wcid->amsdu)
--		val |= MT_TXD3_HW_AMSDU;
- 
- 	txwi[3] = cpu_to_le32(val);
- 	txwi[4] = 0;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
index 2e1869a..d25deff 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
@@ -1,7 +1,7 @@
-From db3119c60343e526a18e668a3b600c9c5feaa825 Mon Sep 17 00:00:00 2001
+From 524436a89b8cfc3bb45d1962280ab8d70cd7472e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 20 Jul 2023 17:27:22 +0800
-Subject: [PATCH 16/25] mtk: wifi: mt76: mt7996: add eagle default bin of
+Subject: [PATCH 07/15] mtk: wifi: mt76: mt7996: add eagle default bin of
  different sku variants
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -25,7 +25,7 @@
  	case 0x7992:
  		return MT7992_EEPROM_DEFAULT;
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 1c464e2f..1b8a1bf6 100644
+index 9aa97e4a..274863dc 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -897,6 +897,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
@@ -40,7 +40,7 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8154ad37..eab96139 100644
+index 36d1f247..b6df2167 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -40,6 +40,7 @@
@@ -72,7 +72,7 @@
  	u16 chainmask;
  	u8 chainshift[__MT_MAX_BAND];
  	u32 hif_idx;
-@@ -399,6 +407,23 @@ mt7996_phy3(struct mt7996_dev *dev)
+@@ -398,6 +406,23 @@ mt7996_phy3(struct mt7996_dev *dev)
  	return __mt7996_phy(dev, MT_BAND2);
  }
  
@@ -96,7 +96,7 @@
  static inline bool
  mt7996_band_valid(struct mt7996_dev *dev, u8 band)
  {
-@@ -406,8 +431,7 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
+@@ -405,8 +430,7 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
  		return band <= MT_BAND1;
  
  	/* tri-band support */
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-fix-incorrect-interpretation-of.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-fix-incorrect-interpretation-of.patch
deleted file mode 100644
index 73f4337..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-fix-incorrect-interpretation-of.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 27ad6ee9498d3293dca55d04af1fba221460d74c Mon Sep 17 00:00:00 2001
-From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Date: Mon, 4 Dec 2023 15:39:00 +0800
-Subject: [PATCH 07/25] mtk: wifi: mt76: mt7996: fix incorrect interpretation
- of EHT MCS and NSS capabilities
-
-The EHT-MCS Map (20 MHz-Only Non-AP STA) subfield of the Supported EHT-MCS And NSS Set field in the EHT Capabilities element is not present for AP. Therefore, STA should not parse the subfield.
-Moreover, AP should parse the subfield only if STA is 20 MHz-Only, which is confirmed by checking the Supported Channel Width Set subfield in the HE Capabilities element.
-
-Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
----
- mt7996/mcu.c | 33 +++++++++++++++++++++++++++++----
- 1 file changed, 29 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 5a2e2d12..8c033030 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1237,9 +1237,32 @@ mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 	he_6g->capa = sta->deflink.he_6ghz_capa.capa;
- }
- 
-+static bool
-+mt7996_mcu_sta_only_20mhz(struct ieee80211_sta *sta)
-+{
-+	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	u8 bw = sta->deflink.he_cap.he_cap_elem.phy_cap_info[0];
-+	u8 band_idx = msta->vif->mt76.band_idx;
-+
-+	if (band_idx == MT_BAND0) {
-+		if (!(bw & IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G))
-+			return true;
-+	} else {
-+		if (!(bw & (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
-+		            IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
-+		            IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)))
-+			return true;
-+	}
-+
-+	return false;
-+}
-+
- static void
- mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- {
-+	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct ieee80211_vif *vif = container_of((void *)msta->vif,
-+	                                         struct ieee80211_vif, drv_priv);
- 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
- 	struct ieee80211_eht_cap_elem_fixed *elem;
- 	struct sta_rec_eht *eht;
-@@ -1259,11 +1282,13 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
- 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
- 
--	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_20)
-+	if (vif->type != NL80211_IFTYPE_STATION && mt7996_mcu_sta_only_20mhz(sta))
- 		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
--	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
--	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
--	memcpy(eht->mcs_map_bw320, &mcs_map->bw._320, sizeof(eht->mcs_map_bw320));
-+	else {
-+		memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
-+		memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
-+		memcpy(eht->mcs_map_bw320, &mcs_map->bw._320, sizeof(eht->mcs_map_bw320));
-+	}
- }
- 
- static void
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7992-add-TLV-sanity-check.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7992-add-TLV-sanity-check.patch
deleted file mode 100644
index 31badbe..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7992-add-TLV-sanity-check.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 6bef1f8c48baa71a2c7b4bc22e30915fe0651b92 Mon Sep 17 00:00:00 2001
-From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Date: Thu, 9 Nov 2023 10:35:13 +0800
-Subject: [PATCH 08/25] mtk: wifi: mt76: mt7992: add TLV sanity check
-
-If TLV involves beacon content, its length might not be 4-byte aligned.
-Therefore, 4-byte alignment check and padding, if necessary, are performed before sending TLV to FW.
-
-Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
----
- mt7996/mcu.c | 14 +++++---------
- mt7996/mcu.h |  4 ++--
- 2 files changed, 7 insertions(+), 11 deletions(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8c033030..071a9ec2 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -732,13 +732,10 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)
- static struct tlv *
- mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
- {
--	struct tlv *ptlv, tlv = {
--		.tag = cpu_to_le16(tag),
--		.len = cpu_to_le16(len),
--	};
-+	struct tlv *ptlv = skb_put(skb, len);
- 
--	ptlv = skb_put(skb, len);
--	memcpy(ptlv, &tlv, sizeof(tlv));
-+	ptlv->tag = cpu_to_le16(tag);
-+	ptlv->len = cpu_to_le16(len);
- 
- 	return ptlv;
- }
-@@ -2536,7 +2533,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
- 	info = IEEE80211_SKB_CB(skb);
- 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->mt76->band_idx);
- 
--	len = sizeof(*bcn) + MT_TXD_SIZE + skb->len;
-+	len = ALIGN(sizeof(*bcn) + MT_TXD_SIZE + skb->len, 4);
- 	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_CONTENT, len);
- 	bcn = (struct bss_bcn_content_tlv *)tlv;
- 	bcn->enable = en;
-@@ -2605,8 +2602,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
- 	info->band = band;
- 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->mt76->band_idx);
- 
--	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
--
-+	len = ALIGN(sizeof(*discov) + MT_TXD_SIZE + skb->len, 4);
- 	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_OFFLOAD, len);
- 
- 	discov = (struct bss_inband_discovery_tlv *)tlv;
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 3e013b20..a9ba63d1 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -800,10 +800,10 @@ enum {
- 					 sizeof(struct sta_rec_hdr_trans) +	\
- 					 sizeof(struct tlv))
- 
--#define MT7996_MAX_BEACON_SIZE		1342
-+#define MT7996_MAX_BEACON_SIZE		1338
- #define MT7996_BEACON_UPDATE_SIZE	(sizeof(struct bss_req_hdr) +		\
- 					 sizeof(struct bss_bcn_content_tlv) +	\
--					 MT_TXD_SIZE +				\
-+					 4 + MT_TXD_SIZE +			\
- 					 sizeof(struct bss_bcn_cntdwn_tlv) +	\
- 					 sizeof(struct bss_bcn_mbss_tlv))
- #define MT7996_MAX_BSS_OFFLOAD_SIZE	(MT7996_MAX_BEACON_SIZE +		\
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
index dddfb1e..83ffab0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
@@ -1,7 +1,7 @@
-From 43d2e883f22101832564f6170fcdceb0efd7aa69 Mon Sep 17 00:00:00 2001
+From 5b98ee4acf66ca727a3e467133379636aed407ff Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 21 Jul 2023 10:41:28 +0800
-Subject: [PATCH 17/25] mtk: wifi: mt76: mt7996: add kite fw & default bin for
+Subject: [PATCH 08/15] mtk: wifi: mt76: mt7996: add kite fw & default bin for
  different sku variants
 
 Add fem type (2i5i, 2i5e, 2e5e, ...)
@@ -117,7 +117,7 @@
  #define MT_EE_WIFI_CONF1_TX_PATH_BAND0		GENMASK(5, 3)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 1b8a1bf6..5db85939 100644
+index 274863dc..0e3cdc05 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -882,6 +882,65 @@ out:
@@ -187,7 +187,7 @@
  {
  	int ret, idx;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 48a1e822..8a3b9f81 100644
+index 0c1dd93f..41f7b4b2 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -14,7 +14,12 @@
@@ -205,7 +205,7 @@
  	case 0x7990:						\
  	default:						\
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index eab96139..c34cb76b 100644
+index b6df2167..7e5ec212 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -39,9 +39,24 @@
@@ -267,7 +267,7 @@
  
  	u16 chainmask;
  	u8 chainshift[__MT_MAX_BAND];
-@@ -407,23 +436,6 @@ mt7996_phy3(struct mt7996_dev *dev)
+@@ -406,23 +435,6 @@ mt7996_phy3(struct mt7996_dev *dev)
  	return __mt7996_phy(dev, MT_BAND2);
  }
  
@@ -291,7 +291,7 @@
  static inline bool
  mt7996_band_valid(struct mt7996_dev *dev, u8 band)
  {
-@@ -462,6 +474,7 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
+@@ -461,6 +473,7 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
  			  int n_desc, int ring_base, struct mtk_wed_device *wed);
  void mt7996_init_txpower(struct mt7996_phy *phy);
  int mt7996_txbf_init(struct mt7996_dev *dev);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0020-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0020-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
index fd06410..12cfd7f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0020-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
@@ -1,7 +1,7 @@
-From da3d42e039ac3a62fda4f262811ff369df15e609 Mon Sep 17 00:00:00 2001
+From 7b1549ea7bd2b6015a6a3594c2a6b7327e27d0a3 Mon Sep 17 00:00:00 2001
 From: "fancy.liu" <fancy.liu@mediatek.com>
 Date: Tue, 14 Nov 2023 10:13:24 +0800
-Subject: [PATCH 20/25] mtk: wifi: mt76: mt7996: ACS channel time too long on
+Subject: [PATCH 09/15] mtk: wifi: mt76: mt7996: ACS channel time too long on
  duty channel
 
 Step and issue:
@@ -43,7 +43,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index cc9e9ff1..6c5b4f55 100644
+index b603d40c..6e8ac6f4 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -928,6 +928,7 @@ void mt76_set_channel(struct mt76_phy *phy)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-fix-HE-beamformer-phy-cap-for-s.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-fix-HE-beamformer-phy-cap-for-s.patch
deleted file mode 100644
index 9d38428..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-fix-HE-beamformer-phy-cap-for-s.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From cf403f86913aa78ea951d0dc11b89409f257c01b Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Thu, 23 Nov 2023 20:06:26 +0800
-Subject: [PATCH 09/25] mtk: wifi: mt76: mt7996: fix HE beamformer phy cap for
- station vif
-
-Without this commit, station mode will not set all needed bit in HE Phy
-capabilities IE as 1.
-
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7996/init.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 1a9aa48c..50dcce9f 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -1011,11 +1011,12 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy,
- 	/* the maximum cap is 4 x 3, (Nr, Nc) = (3, 2) */
- 	elem->phy_cap_info[7] |= min_t(int, sts - 1, 2) << 3;
- 
--	if (vif != NL80211_IFTYPE_AP)
-+	if (!(vif == NL80211_IFTYPE_AP || vif == NL80211_IFTYPE_STATION))
- 		return;
- 
- 	elem->phy_cap_info[3] |= IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
--	elem->phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
-+	if (vif == NL80211_IFTYPE_AP)
-+		elem->phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
- 
- 	c = FIELD_PREP(IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
- 		       sts - 1) |
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0021-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0021-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
index 0ce194a..0afefb2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0021-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
@@ -1,7 +1,7 @@
-From f0ec3acdda2dd199e0eddcf0c5ae2dd8b305b547 Mon Sep 17 00:00:00 2001
+From 956274f340ff76472207679a71f0a9ae3f8db0b8 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 26 Oct 2023 10:08:10 +0800
-Subject: [PATCH 21/25] mtk: wifi: mt76: mt7996: Fixed null pointer dereference
+Subject: [PATCH 10/15] mtk: wifi: mt76: mt7996: Fixed null pointer dereference
  issue
 
 Without this patch, when the station is still in Authentication stage and
@@ -17,7 +17,7 @@
  1 file changed, 7 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 4db8899c..9fbd87d5 100644
+index 625f87b4..ad2c6a9d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1063,9 +1063,16 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-Let-MAC80211-handles-GCMP-IGTK.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-Let-MAC80211-handles-GCMP-IGTK.patch
deleted file mode 100644
index 891bf4c..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-Let-MAC80211-handles-GCMP-IGTK.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From e154e95bd733a456c5551ae89ef5673d57941b2a Mon Sep 17 00:00:00 2001
-From: Michael-CY Lee <michael-cy.lee@mediatek.com>
-Date: Fri, 8 Dec 2023 16:23:37 +0800
-Subject: [PATCH 10/25] mtk: wifi: mt76: mt7996: Let MAC80211 handles GCMP IGTK
-
-Because the FW does not support IGTK in GCMP mode, mt76 returns "not
-support" to mac80211, and mac80211 will handle the integrity calculation
-and validation.
-
----
- mt7996/main.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index be914ced..6e88420e 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -350,9 +350,12 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	case WLAN_CIPHER_SUITE_GCMP:
- 	case WLAN_CIPHER_SUITE_GCMP_256:
- 	case WLAN_CIPHER_SUITE_SMS4:
-+		break;
- 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
- 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
--		break;
-+		if (key->keyidx == 6 || key->keyidx == 7)
-+			break;
-+		fallthrough;
- 	case WLAN_CIPHER_SUITE_WEP40:
- 	case WLAN_CIPHER_SUITE_WEP104:
- 	default:
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
index 937cee2..3261f00 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
@@ -1,7 +1,7 @@
-From 947abea1e4134b5a3f00feba7276b194089f13d0 Mon Sep 17 00:00:00 2001
+From d9933bb4c54345dc9e3edc03f93324fcca813fe9 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Oct 2023 11:06:19 +0800
-Subject: [PATCH 22/25] mtk: wifi: mt76: add sanity check to prevent kernel
+Subject: [PATCH 11/15] mtk: wifi: mt76: add sanity check to prevent kernel
  crash
 
 wcid may not be initialized when mac80211 calls mt76.tx and it would lead to
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-mt7996-fix-efuse-read-issue.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-mt7996-fix-efuse-read-issue.patch
deleted file mode 100644
index 9b2fbb8..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-mt7996-fix-efuse-read-issue.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 68cbc6f4aa32410876f18d54f053b4f928b4b981 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Wed, 29 Nov 2023 10:55:15 +0800
-Subject: [PATCH 11/25] mtk: wifi: mt76: mt7996: fix efuse read issue
-
-The efuse data starts at 48 bytes instead of 64 bytes in the returned
-skb.
-This patch should be upstreamed.
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/mcu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 071a9ec2..98ea9c20 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -3561,7 +3561,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
- 		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
- 		u8 *buf = (u8 *)dev->mt76.eeprom.data + addr;
- 
--		skb_pull(skb, 64);
-+		skb_pull(skb, 48);
- 		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
- 	}
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0023-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0023-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
index c8ffc65..246cded 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0023-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
@@ -1,7 +1,7 @@
-From b78ba04740ae976f2a6ce9703c97430667be170a Mon Sep 17 00:00:00 2001
+From 1570914f0f8b2b6c5d6de86b71fed6ef5edc355e Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:16:50 +0800
-Subject: [PATCH 23/25] mtk: wifi: mt76: mt7996: add firmware WA's coredump.
+Subject: [PATCH 12/15] mtk: wifi: mt76: mt7996: add firmware WA's coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -428,10 +428,10 @@
  	return NULL;
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 19b34066..adbfd23f 100644
+index 3af537b6..f35b17b6 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2001,28 +2001,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2002,28 +2002,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
  }
  
  /* firmware coredump */
@@ -464,7 +464,7 @@
  	if (!mem_region || !crash_data->memdump_buf_len) {
  		mutex_unlock(&dev->dump_mutex);
  		goto skip_memdump;
-@@ -2032,6 +2029,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2033,6 +2030,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	buf_len = crash_data->memdump_buf_len;
  
  	/* dumping memory content... */
@@ -474,7 +474,7 @@
  	memset(buf, 0, buf_len);
  	for (i = 0; i < num; i++) {
  		if (mem_region->len > buf_len) {
-@@ -2048,6 +2048,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2049,6 +2049,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
  		mt7996_memcpy_fromio(dev, buf, mem_region->start,
  				     mem_region->len);
  
@@ -482,7 +482,7 @@
  		hdr->start = mem_region->start;
  		hdr->len = mem_region->len;
  
-@@ -2064,8 +2065,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2065,8 +2066,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	mutex_unlock(&dev->dump_mutex);
  
  skip_memdump:
@@ -506,10 +506,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8a3b9f81..475a5e18 100644
+index 41f7b4b2..9a03a2b2 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2697,6 +2697,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
+@@ -2684,6 +2684,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
  
  	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
@@ -518,7 +518,7 @@
  
  	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
  		struct mt7996_patch_sec *sec;
-@@ -2823,6 +2825,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
+@@ -2810,6 +2812,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
  	}
  
  	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0024-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0024-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
index eb45ff1..334c5be 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0024-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
@@ -1,7 +1,7 @@
-From 5fd32e152d666b1385953a42193ca0063dc78a10 Mon Sep 17 00:00:00 2001
+From 63f17f147216ccb96e163af01e407925b50f8187 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 22 Sep 2023 10:32:37 +0800
-Subject: [PATCH 24/25] mtk: wifi: mt76: mt7996: add preamble puncture support
+Subject: [PATCH 13/15] mtk: wifi: mt76: mt7996: add preamble puncture support
  for mt7996
 
 Add support configure preamble puncture feature through mcu commands.
@@ -15,10 +15,10 @@
  4 files changed, 37 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 84e77fa0..823b3626 100644
+index 2a4aa796..8402097d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1259,6 +1259,7 @@ enum {
+@@ -1263,6 +1263,7 @@ enum {
  	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
@@ -27,10 +27,10 @@
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 475a5e18..deabdb1f 100644
+index 9a03a2b2..52e4f0d1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4534,3 +4534,33 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4522,3 +4522,33 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WM_UNI_CMD(TXPOWER), true);
  }
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0025-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0025-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
index 1705e22..21427b5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0025-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
@@ -1,7 +1,7 @@
-From b6fa1060af0c2a8f2d950481fd3d962ba9bcbf41 Mon Sep 17 00:00:00 2001
+From d832255d8d7810670d39bc578dd0e04e798d304e Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Wed, 3 Jan 2024 15:21:44 +0800
-Subject: [PATCH 25/25] mtk: wifi: mt76: mt7996: enable hw cso module
+Subject: [PATCH 14/15] mtk: wifi: mt76: mt7996: enable hw cso module
 
 The cso module needs to be enabled. The cso mudule can help identify if the traffic
 is TCP traffic. This can assist the firmware in adjusting algorithms to
@@ -14,7 +14,7 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 823b3626..d3c05894 100644
+index 8402097d..482782f7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -610,6 +610,12 @@ struct sta_rec_ra_fixed {
@@ -39,10 +39,10 @@
  					 MT76_CONNAC_WTBL_UPDATE_MAX_SIZE)
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index deabdb1f..46ee93c0 100644
+index 52e4f0d1..42fcbd8f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1766,6 +1766,19 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1753,6 +1753,19 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
  }
  
@@ -62,7 +62,7 @@
  static void
  mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -2177,6 +2190,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2164,6 +2177,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  
  	/* starec hdr trans */
  	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch
new file mode 100644
index 0000000..47700b8
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch
@@ -0,0 +1,38 @@
+From 9af475ad49a4b79ebb4589bdf993d6d8bbff5dfc Mon Sep 17 00:00:00 2001
+From: "Henry.Yen" <henry.yen@mediatek.com>
+Date: Tue, 16 Jan 2024 11:30:02 +0800
+Subject: [PATCH 15/15] mtk: wifi: mt76: mt7996: add sanity check for NAPI
+ schedule
+
+Add sanity check for NAPI schedule.
+
+It's observed that host driver might occasionally receive
+interrupts from unexpected Rx ring, whose Rx NAPI hasn't been
+prepared yet. Under such situation, __napi_poll crash issue
+would occur, so we add sanity check to prevent it.
+
+If without this patch, we might encounter kernel crash issue
+especially in WED-on & RRO-on software path.
+
+Signed-off-by: Henry.Yen <henry.yen@mediatek.com>
+
+---
+ mt7996/mmio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7996/mmio.c b/mt7996/mmio.c
+index 341fa089..fd4d41d9 100644
+--- a/mt7996/mmio.c
++++ b/mt7996/mmio.c
+@@ -560,7 +560,7 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
+ 		napi_schedule(&dev->mt76.tx_napi);
+ 
+ 	for (i = 0; i < __MT_RXQ_MAX; i++) {
+-		if ((intr & MT_INT_RX(i)))
++		if ((intr & MT_INT_RX(i)) && dev->mt76.napi[i].poll)
+ 			napi_schedule(&dev->mt76.napi[i]);
+ 	}
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-remove-TxS-queue-setting.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-remove-TxS-queue-setting.patch
deleted file mode 100644
index 42575e9..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-remove-TxS-queue-setting.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From bc44fe965f13651643513532a746aca9ed04362b Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 22 Dec 2023 17:01:36 +0800
-Subject: [PATCH 15/25] mtk: wifi: mt76: mt7996: remove TxS queue setting
-
-Remove TxS queue setting which is set by FW.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/init.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 50dcce9f..1c464e2f 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -506,11 +506,6 @@ void mt7996_mac_init(struct mt7996_dev *dev)
- 		mt76_rmw_field(dev, i, MT_LED_GPIO_SEL_MASK, 4);
- 	}
- 
--	/* txs report queue */
--	mt76_rmw_field(dev, MT_DMA_TCRF1(0), MT_DMA_TCRF1_QIDX, 0);
--	mt76_rmw_field(dev, MT_DMA_TCRF1(1), MT_DMA_TCRF1_QIDX, 6);
--	mt76_rmw_field(dev, MT_DMA_TCRF1(2), MT_DMA_TCRF1_QIDX, 0);
--
- 	/* rro module init */
- 	if (is_mt7996(&dev->mt76))
- 		mt7996_mcu_set_rro(dev, UNI_RRO_SET_PLATFORM_TYPE, 2);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0018-mtk-wifi-mt76-mt7996-add-lock-for-indirect-register-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0018-mtk-wifi-mt76-mt7996-add-lock-for-indirect-register-.patch
deleted file mode 100644
index df69921..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0018-mtk-wifi-mt76-mt7996-add-lock-for-indirect-register-.patch
+++ /dev/null
@@ -1,169 +0,0 @@
-From 6c7a12a76766fba5030fcbc363dcdd9bb15f95b4 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 3 Jul 2023 22:38:43 +0800
-Subject: [PATCH 18/25] mtk: wifi: mt76: mt7996: add lock for indirect register
- access
-
-Some races were observed during indirect register access, fix this
-by adding reg_lock and reworking l1/l2 remap flow.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt7996/mmio.c   | 69 +++++++++++++++++++++++++++++++++----------------
- mt7996/mt7996.h |  3 +--
- 2 files changed, 48 insertions(+), 24 deletions(-)
-
-diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index c50d89a4..d3d34f04 100644
---- a/mt7996/mmio.c
-+++ b/mt7996/mmio.c
-@@ -140,7 +140,6 @@ static u32 mt7996_reg_map_l1(struct mt7996_dev *dev, u32 addr)
- 	u32 offset = FIELD_GET(MT_HIF_REMAP_L1_OFFSET, addr);
- 	u32 base = FIELD_GET(MT_HIF_REMAP_L1_BASE, addr);
- 
--	dev->reg_l1_backup = dev->bus_ops->rr(&dev->mt76, MT_HIF_REMAP_L1);
- 	dev->bus_ops->rmw(&dev->mt76, MT_HIF_REMAP_L1,
- 			  MT_HIF_REMAP_L1_MASK,
- 			  FIELD_PREP(MT_HIF_REMAP_L1_MASK, base));
-@@ -155,7 +154,6 @@ static u32 mt7996_reg_map_l2(struct mt7996_dev *dev, u32 addr)
- 	u32 offset = FIELD_GET(MT_HIF_REMAP_L2_OFFSET, addr);
- 	u32 base = FIELD_GET(MT_HIF_REMAP_L2_BASE, addr);
- 
--	dev->reg_l2_backup = dev->bus_ops->rr(&dev->mt76, MT_HIF_REMAP_L2);
- 	dev->bus_ops->rmw(&dev->mt76, MT_HIF_REMAP_L2,
- 			  MT_HIF_REMAP_L2_MASK,
- 			  FIELD_PREP(MT_HIF_REMAP_L2_MASK, base));
-@@ -165,26 +163,10 @@ static u32 mt7996_reg_map_l2(struct mt7996_dev *dev, u32 addr)
- 	return MT_HIF_REMAP_BASE_L2 + offset;
- }
- 
--static void mt7996_reg_remap_restore(struct mt7996_dev *dev)
--{
--	/* remap to ori status */
--	if (unlikely(dev->reg_l1_backup)) {
--		dev->bus_ops->wr(&dev->mt76, MT_HIF_REMAP_L1, dev->reg_l1_backup);
--		dev->reg_l1_backup = 0;
--	}
--
--	if (dev->reg_l2_backup) {
--		dev->bus_ops->wr(&dev->mt76, MT_HIF_REMAP_L2, dev->reg_l2_backup);
--		dev->reg_l2_backup = 0;
--	}
--}
--
- static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr)
- {
- 	int i;
- 
--	mt7996_reg_remap_restore(dev);
--
- 	if (addr < 0x100000)
- 		return addr;
- 
-@@ -201,6 +183,11 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr)
- 		return dev->reg.map[i].mapped + ofs;
- 	}
- 
-+	return 0;
-+}
-+
-+static u32 __mt7996_reg_remap_addr(struct mt7996_dev *dev, u32 addr)
-+{
- 	if ((addr >= MT_INFRA_BASE && addr < MT_WFSYS0_PHY_START) ||
- 	    (addr >= MT_WFSYS0_PHY_START && addr < MT_WFSYS1_PHY_START) ||
- 	    (addr >= MT_WFSYS1_PHY_START && addr <= MT_WFSYS1_PHY_END))
-@@ -225,28 +212,65 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
- {
- 	u32 addr = __mt7996_reg_addr(dev, offset);
- 
--	memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
-+	unsigned long flags;
-+
-+	if (addr) {
-+		memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
-+		return;
-+	}
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	memcpy_fromio(buf, dev->mt76.mmio.regs +
-+			   __mt7996_reg_remap_addr(dev, offset), len);
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
- }
- 
- static u32 mt7996_rr(struct mt76_dev *mdev, u32 offset)
- {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	u32 addr = __mt7996_reg_addr(dev, offset), val;
-+	unsigned long flags;
-+
-+	if (addr)
-+		return dev->bus_ops->rr(mdev, addr);
- 
--	return dev->bus_ops->rr(mdev, __mt7996_reg_addr(dev, offset));
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	val = dev->bus_ops->rr(mdev, __mt7996_reg_remap_addr(dev, offset));
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
-+
-+	return val;
- }
- 
- static void mt7996_wr(struct mt76_dev *mdev, u32 offset, u32 val)
- {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	u32 addr = __mt7996_reg_addr(dev, offset);
-+	unsigned long flags;
- 
--	dev->bus_ops->wr(mdev, __mt7996_reg_addr(dev, offset), val);
-+	if (addr) {
-+		dev->bus_ops->wr(mdev, addr, val);
-+		return;
-+	}
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	dev->bus_ops->wr(mdev, __mt7996_reg_remap_addr(dev, offset), val);
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
- }
- 
- static u32 mt7996_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
- {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	u32 addr = __mt7996_reg_addr(dev, offset);
-+	unsigned long flags;
-+
-+	if (addr)
-+		return dev->bus_ops->rmw(mdev, addr, mask, val);
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	val = dev->bus_ops->rmw(mdev, __mt7996_reg_remap_addr(dev, offset), mask, val);
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
- 
--	return dev->bus_ops->rmw(mdev, __mt7996_reg_addr(dev, offset), mask, val);
-+	return val;
- }
- 
- #ifdef CONFIG_NET_MEDIATEK_SOC_WED
-@@ -421,6 +445,7 @@ static int mt7996_mmio_init(struct mt76_dev *mdev,
- 
- 	dev = container_of(mdev, struct mt7996_dev, mt76);
- 	mt76_mmio_init(&dev->mt76, mem_base);
-+	spin_lock_init(&dev->reg_lock);
- 
- 	switch (device_id) {
- 	case 0x7990:
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c34cb76b..7e5ec212 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -362,8 +362,7 @@ struct mt7996_dev {
- 		u8 n_agrt;
- 	} twt;
- 
--	u32 reg_l1_backup;
--	u32 reg_l2_backup;
-+	spinlock_t reg_lock;
- 
- 	u8 wtbl_size_group;
- };
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0019-mtk-wifi-mt76-connac-set-correct-muar_idx-for-connac.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0019-mtk-wifi-mt76-connac-set-correct-muar_idx-for-connac.patch
deleted file mode 100644
index 90af1e3..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0019-mtk-wifi-mt76-connac-set-correct-muar_idx-for-connac.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 72e254cac7eac0e0e822b6c12148f0208688d131 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 16 Feb 2023 13:53:14 +0800
-Subject: [PATCH 19/25] mtk: wifi: mt76: connac: set correct muar_idx for
- connac3 chipset
-
-Set the muar_idx to 0xe for the hw bcast/mcast station entry of connac3
-chipset.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt76_connac.h     | 5 +++++
- mt76_connac_mcu.c | 3 +++
- 2 files changed, 8 insertions(+)
-
-diff --git a/mt76_connac.h b/mt76_connac.h
-index fdde3d70..b1ec8d46 100644
---- a/mt76_connac.h
-+++ b/mt76_connac.h
-@@ -250,6 +250,11 @@ static inline bool is_connac_v1(struct mt76_dev *dev)
- 	return is_mt7615(dev) || is_mt7663(dev) || is_mt7622(dev);
- }
- 
-+static inline bool is_connac_v3(struct mt76_dev *dev)
-+{
-+	return is_mt7996(dev);
-+}
-+
- static inline bool is_mt76_fw_txp(struct mt76_dev *dev)
- {
- 	switch (mt76_chip(dev)) {
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 0d05404f..8dd61f86 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -283,6 +283,9 @@ __mt76_connac_mcu_alloc_sta_req(struct mt76_dev *dev, struct mt76_vif *mvif,
- 	};
- 	struct sk_buff *skb;
- 
-+	if (is_connac_v3(dev) && !wcid->sta)
-+		hdr.muar_idx = 0xe;
-+
- 	mt76_connac_mcu_get_wlan_idx(dev, wcid, &hdr.wlan_idx_lo,
- 				     &hdr.wlan_idx_hi);
- 	skb = mt76_mcu_msg_alloc(dev, NULL, len);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0026-mtk-wifi-mt76-mt7996-fix-HIF_TXD_V2_1-value.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0026-mtk-wifi-mt76-mt7996-fix-HIF_TXD_V2_1-value.patch
deleted file mode 100644
index 6f56bd7..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0026-mtk-wifi-mt76-mt7996-fix-HIF_TXD_V2_1-value.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From d65f2368dd8a59c378384c620732c3b9735752e6 Mon Sep 17 00:00:00 2001
-From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Date: Thu, 11 Jan 2024 17:32:26 +0800
-Subject: [PATCH] mtk: wifi: mt76: mt7996: fix HIF_TXD_V2_1 value
-
-Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/init.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 193904bc..90f3a417 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -499,7 +499,7 @@ static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
- 
- void mt7996_mac_init(struct mt7996_dev *dev)
- {
--#define HIF_TXD_V2_1	4
-+#define HIF_TXD_V2_1	0x21
- 	int i;
- 
- 	mt76_clear(dev, MT_MDP_DCR2, MT_MDP_DCR2_RX_TRANS_SHORT);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0999-mtk-wifi-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mtk-wifi-mt76-mt7996-for-build-pass.patch
index 5ddea83..53cc471 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0999-mtk-wifi-mt76-mt7996-for-build-pass.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mtk-wifi-mt76-mt7996-for-build-pass.patch
@@ -1,4 +1,4 @@
-From 2b2dc33d94447570f8dbadb46e08f6ede2d67d72 Mon Sep 17 00:00:00 2001
+From 237f3f6f819983ed6fec2a108df2f645c0319fb6 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 3 Nov 2022 00:27:17 +0800
 Subject: [PATCH 0999/1044] mtk: wifi: mt76: mt7996: for build pass
@@ -33,10 +33,10 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 00230f10..12f0e2fd 100644
+index 72a7bd5a..4cf2afdf 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -960,7 +960,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -882,7 +882,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		    !(dev->drv->rx_check(dev, data, len)))
  			goto free_frag;
  
@@ -91,7 +91,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 8dd61f86..52237583 100644
+index 1c910d9d..fccca36d 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -115,10 +115,10 @@
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 483ad81b..8e29ab06 100644
+index 73e633d0..759a58e8 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
-@@ -640,8 +640,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -641,8 +641,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  	if (ret < 0)
  		return ret;
  
@@ -142,7 +142,7 @@
  		dev->has_eht = !(cap & MODE_HE_ONLY);
  		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 46ee93c0..ae78141e 100644
+index 42fcbd8f..7a76d602 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5,6 +5,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch
index a2d872f..7409632 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch
@@ -1,4 +1,4 @@
-From 1f2ab08e04fe3c68b0791da1de2b4e891dff1cb2 Mon Sep 17 00:00:00 2001
+From 1c9c6a9220ce579ec5e12808c934cc28ae25325d Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Mar 2023 14:02:32 +0800
 Subject: [PATCH 1000/1044] mtk: wifi: mt76: mt7996: add debug tool
@@ -52,10 +52,10 @@
  create mode 100644 mt7996/mtk_mcu.h
 
 diff --git a/mt76.h b/mt76.h
-index d2ead585..de0021e4 100644
+index 1f249581..5c50681a 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -393,6 +393,8 @@ struct mt76_txwi_cache {
+@@ -394,6 +394,8 @@ struct mt76_txwi_cache {
  		struct sk_buff *skb;
  		void *ptr;
  	};
@@ -280,7 +280,7 @@
  	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
  	hdr.len = *(__le16 *)data;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index adbfd23f..ce6759e0 100644
+index f35b17b6..89a03122 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -936,6 +936,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -2950,7 +2950,7 @@
 +static int mt7996_dump_version(struct seq_file *s, void *data)
 +{
 +	struct mt7996_dev *dev = dev_get_drvdata(s->private);
-+	seq_printf(s, "Version: 3.3.15.0\n");
++	seq_printf(s, "Version: 3.3.16.0\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch
index ceab96d..ec7d653 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch
@@ -1,4 +1,4 @@
-From e0e7443107c89385d66e9247888abd01c51b8845 Mon Sep 17 00:00:00 2001
+From 4aa0ffd5f06256ed4b2c128d7e975e7ede6702af Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 28 Nov 2023 16:01:33 +0800
 Subject: [PATCH 1001/1044] mtk: wifi: mt76: mt7996: support record muru algo
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
index 8d9cb0c..9a30233 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
@@ -1,4 +1,4 @@
-From ce7f8d1d0b181442e5a03b5f8aa9920491a8e0d5 Mon Sep 17 00:00:00 2001
+From 5329ba85c01100c8baa328e237844d2ab1309e27 Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Thu, 8 Jun 2023 17:32:33 +0800
 Subject: [PATCH 1002/1044] mtk: wifi: mt76: mt7996: add check for hostapd
@@ -15,7 +15,7 @@
  1 file changed, 9 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ae78141e..388b593d 100644
+index 7a76d602..35233c71 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1182,7 +1182,8 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
@@ -40,7 +40,7 @@
  	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
  	switch (sta->deflink.bandwidth) {
  	case IEEE80211_STA_RX_BW_160:
-@@ -2121,7 +2127,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2108,7 +2114,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
@@ -49,7 +49,7 @@
  
  	/* sta_rec_ra accommodates BW, NSS and only MCS range format
  	 * i.e 0-{7,8,9} for VHT.
-@@ -2209,7 +2215,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2196,7 +2202,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		/* starec amsdu */
  		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
  		/* starec he */
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mtk-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mtk-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
index 6d653aa..5b346a1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mtk-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mtk-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
@@ -1,4 +1,4 @@
-From f1c4924fab3b775e09aa413dc300e478864ee76a Mon Sep 17 00:00:00 2001
+From 4ac4b9bc83dca1474bbe1cf189c4436e1adc993a Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 28 Dec 2022 22:24:25 +0800
 Subject: [PATCH 1003/1044] mtk: wifi: mt76: testmode: add atenl support in
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
index 0bde2c2..bc4a5b8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
@@ -1,4 +1,4 @@
-From 06208f297f532c17779277a8dec486f466631791 Mon Sep 17 00:00:00 2001
+From 6b770050b396997a04c5055fdb397dcb15164b3d Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 11:59:16 +0800
 Subject: [PATCH 1004/1044] mtk: wifi: mt76: testmode: add basic testmode
@@ -63,7 +63,7 @@
  
  out_put_node:
 diff --git a/mac80211.c b/mac80211.c
-index 6c5b4f55..d31cf9ff 100644
+index 6e8ac6f4..fea19e19 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -846,7 +846,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -77,10 +77,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index de0021e4..7951b90e 100644
+index 5c50681a..ea051c03 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -694,14 +694,21 @@ struct mt76_testmode_ops {
+@@ -695,14 +695,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -102,7 +102,7 @@
  	u32 tx_count;
  	u16 tx_mpdu_len;
  
-@@ -711,6 +718,7 @@ struct mt76_testmode_data {
+@@ -712,6 +719,7 @@ struct mt76_testmode_data {
  	u8 tx_rate_sgi;
  	u8 tx_rate_ldpc;
  	u8 tx_rate_stbc;
@@ -110,7 +110,7 @@
  	u8 tx_ltf;
  
  	u8 tx_antenna_mask;
-@@ -720,6 +728,9 @@ struct mt76_testmode_data {
+@@ -721,6 +729,9 @@ struct mt76_testmode_data {
  	u32 tx_time;
  	u32 tx_ipg;
  
@@ -120,7 +120,7 @@
  	u32 freq_offset;
  
  	u8 tx_power[4];
-@@ -734,7 +745,16 @@ struct mt76_testmode_data {
+@@ -735,7 +746,16 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -137,7 +137,7 @@
  };
  
  struct mt76_vif {
-@@ -1423,6 +1443,22 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
+@@ -1439,6 +1459,22 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
  int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
  
@@ -161,10 +161,10 @@
  {
  #ifdef CONFIG_NL80211_TESTMODE
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index d3c05894..4796c255 100644
+index 482782f7..2e148011 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1262,12 +1262,14 @@ enum {
+@@ -1266,12 +1266,14 @@ enum {
  	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
  	MCU_UNI_CMD_RA = 0x2f,
  	MCU_UNI_CMD_MURU = 0x31,
@@ -280,7 +280,7 @@
  	MT_EE_RATE_DELTA_2G =	0x1400,
  	MT_EE_RATE_DELTA_5G =	0x147d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5db85939..42e7071c 100644
+index 0e3cdc05..d4d1a60b 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -966,6 +966,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
@@ -306,7 +306,7 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index ce6759e0..924b05e4 100644
+index 89a03122..9a9d33e6 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -685,7 +685,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -320,7 +320,7 @@
  
  	if (!status->wcid || !ieee80211_is_data_qos(fc) || hw_aggr)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 9fbd87d5..2a93e8c2 100644
+index ad2c6a9d..40b5cee3 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -23,6 +23,18 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
@@ -385,10 +385,10 @@
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  #endif
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 388b593d..6c89d711 100644
+index 35233c71..f1a3fb42 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2873,8 +2873,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2860,8 +2860,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  {
  	int ret;
  
@@ -403,7 +403,7 @@
  	if (ret)
  		return ret;
  
-@@ -3565,17 +3569,9 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+@@ -3552,17 +3556,9 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
  				 &req, sizeof(req), true);
  }
  
@@ -423,7 +423,7 @@
  		.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.addr = cpu_to_le32(round_down(offset,
-@@ -3584,6 +3580,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
+@@ -3571,6 +3567,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
  	struct sk_buff *skb;
  	bool valid;
  	int ret;
@@ -431,7 +431,7 @@
  
  	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
  					MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
-@@ -3594,7 +3591,9 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
+@@ -3581,7 +3578,9 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
  	valid = le32_to_cpu(*(__le32 *)(skb->data + 16));
  	if (valid) {
  		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
@@ -442,7 +442,7 @@
  
  		skb_pull(skb, 48);
  		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
-@@ -4586,3 +4585,37 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, bool auto_mode,
+@@ -4574,3 +4573,37 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, bool auto_mode,
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(PP),
  				 &req, sizeof(req), false);
  }
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
index 127c63b..0bc75af 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
@@ -1,4 +1,4 @@
-From 2a4f1ada373d5bd9999807d7906f44bee9c7dc21 Mon Sep 17 00:00:00 2001
+From 191480cad9ab8d8ed9e4be9129d3d30f2e638e5c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:27:24 +0800
 Subject: [PATCH 1005/1044] mtk: wifi: mt76: testmode: add testmode
@@ -21,7 +21,7 @@
  12 files changed, 632 insertions(+), 23 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index d31cf9ff..87dcc8a3 100644
+index fea19e19..e7d02d15 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -7,27 +7,6 @@
@@ -53,7 +53,7 @@
  	CHAN2G(1, 2412),
  	CHAN2G(2, 2417),
 diff --git a/mt76.h b/mt76.h
-index 7951b90e..b0897ac2 100644
+index ea051c03..1e0488e5 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -18,6 +18,27 @@
@@ -84,7 +84,7 @@
  #define MT_MCU_RING_SIZE	32
  #define MT_RX_BUF_SIZE		2048
  #define MT_SKB_HEAD_LEN		256
-@@ -697,6 +718,7 @@ struct mt76_testmode_ops {
+@@ -698,6 +719,7 @@ struct mt76_testmode_ops {
  	void (*reset_rx_stats)(struct mt76_phy *phy);
  	void (*tx_stop)(struct mt76_phy *phy);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -93,10 +93,10 @@
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4796c255..e4783433 100644
+index 2e148011..54310413 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1038,8 +1038,10 @@ enum {
+@@ -1042,8 +1042,10 @@ enum {
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
  	MCU_UNI_EVENT_ROC = 0x27,
  	MCU_UNI_EVENT_TX_DONE = 0x2d,
@@ -257,7 +257,7 @@
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(5, 3)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6c89d711..151f3788 100644
+index f1a3fb42..30500fbe 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -712,6 +712,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
index bae90bf..f6bbdba 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
@@ -1,4 +1,4 @@
-From 9ce66350f74d9addf51f8c5742ef5adde6deaf45 Mon Sep 17 00:00:00 2001
+From 40875afae4052332ce5178b59643b3b2191f050b Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 8 May 2023 09:03:50 +0800
 Subject: [PATCH 1006/1044] mtk: wifi: mt76: mt7996: enable SCS feature for
@@ -20,10 +20,10 @@
  8 files changed, 148 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e4783433..23310c4f 100644
+index 54310413..4a3ea0b7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1257,6 +1257,7 @@ enum {
+@@ -1261,6 +1261,7 @@ enum {
  	MCU_UNI_CMD_GET_STAT_INFO = 0x23,
  	MCU_UNI_CMD_SNIFFER = 0x24,
  	MCU_UNI_CMD_SR = 0x25,
@@ -32,7 +32,7 @@
  	MCU_UNI_CMD_SET_DBDC_PARMS = 0x28,
  	MCU_UNI_CMD_TXPOWER = 0x2b,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 42e7071c..23b7e5f8 100644
+index d4d1a60b..23a9b88b 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -1374,6 +1374,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
@@ -44,10 +44,10 @@
  	INIT_LIST_HEAD(&dev->twt_list);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 924b05e4..e307ddc3 100644
+index 9a9d33e6..8013ffd1 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1798,6 +1798,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1799,6 +1799,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  		cancel_delayed_work_sync(&phy2->mt76->mac_work);
  	if (phy3)
  		cancel_delayed_work_sync(&phy3->mt76->mac_work);
@@ -55,7 +55,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  	for (i = 0; i < 10; i++) {
-@@ -1833,6 +1834,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1834,6 +1835,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  		ieee80211_queue_delayed_work(phy3->mt76->hw,
  					     &phy3->mt76->mac_work,
  					     MT7996_WATCHDOG_TIME);
@@ -64,7 +64,7 @@
  
  void mt7996_mac_reset_work(struct work_struct *work)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2a93e8c2..97f1ef8c 100644
+index 40b5cee3..ffb1f81b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -73,11 +73,17 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -94,10 +94,10 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 151f3788..af4d2023 100644
+index 30500fbe..5ccf462f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4624,3 +4624,108 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
+@@ -4612,3 +4612,108 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TXPOWER),
  				 &req, sizeof(req), false);
  }
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mtk-wifi-mt76-mt7996-add-txpower-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mtk-wifi-mt76-mt7996-add-txpower-support.patch
index 4a17bc3..09b7700 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mtk-wifi-mt76-mt7996-add-txpower-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mtk-wifi-mt76-mt7996-add-txpower-support.patch
@@ -1,4 +1,4 @@
-From b02c3175d355a3cf35924ad866e92013d62dbc66 Mon Sep 17 00:00:00 2001
+From 7b23bb7c06080cbfdf33d01ec3dd921d8c0f1bae Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Mar 2023 23:35:30 +0800
 Subject: [PATCH 1007/1044] mtk: wifi: mt76: mt7996: add txpower support
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mtk-wifi-mt76-mt7996-add-single-sku.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mtk-wifi-mt76-mt7996-add-single-sku.patch
index 34ce9fd..de46c86 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mtk-wifi-mt76-mt7996-add-single-sku.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mtk-wifi-mt76-mt7996-add-single-sku.patch
@@ -1,4 +1,4 @@
-From de616f497d5c3b731ae7916afa60003c8c3a96f9 Mon Sep 17 00:00:00 2001
+From baf4f49f59a8991e0e5bfd634b792ece5d7dca77 Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Mon, 10 Jul 2023 19:56:16 +0800
 Subject: [PATCH 1008/1044] mtk: wifi: mt76: mt7996: add single sku
@@ -103,10 +103,10 @@
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
  
 diff --git a/mt76.h b/mt76.h
-index b0897ac2..19c445b5 100644
+index 1e0488e5..9aa56ac6 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1053,6 +1053,14 @@ struct mt76_power_limits {
+@@ -1054,6 +1054,14 @@ struct mt76_power_limits {
  	s8 eht[16][16];
  };
  
@@ -121,7 +121,7 @@
  struct mt76_ethtool_worker_info {
  	u64 *data;
  	int idx;
-@@ -1655,6 +1663,7 @@ mt76_find_channel_node(struct device_node *np, struct ieee80211_channel *chan);
+@@ -1664,6 +1672,7 @@ mt76_find_channel_node(struct device_node *np, struct ieee80211_channel *chan);
  s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  			      struct ieee80211_channel *chan,
  			      struct mt76_power_limits *dest,
@@ -130,7 +130,7 @@
  
  static inline bool mt76_queue_is_wed_tx_free(struct mt76_queue *q)
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 52237583..6cb47699 100644
+index fccca36d..58a46ed2 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -2150,7 +2150,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
@@ -143,7 +143,7 @@
  			tx_power_tlv.last_msg = ch_list[idx] == last_ch;
  			sku_tlbv.channel = ch_list[idx];
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 23b7e5f8..188d4f1f 100644
+index 23a9b88b..5f937b26 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -295,6 +295,7 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
@@ -163,7 +163,7 @@
  		target_power += nss_delta;
  		target_power = DIV_ROUND_UP(target_power, 2);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 97f1ef8c..9481fc5c 100644
+index ffb1f81b..ecfc3dcf 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -77,6 +77,15 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -183,10 +183,10 @@
  
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index af4d2023..19b5a173 100644
+index 5ccf462f..fed80421 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4506,6 +4506,7 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
+@@ -4493,6 +4493,7 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
  int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  {
  #define TX_POWER_LIMIT_TABLE_RATE	0
@@ -194,7 +194,7 @@
  	struct mt7996_dev *dev = phy->dev;
  	struct mt76_phy *mphy = phy->mt76;
  	struct ieee80211_hw *hw = mphy->hw;
-@@ -4519,22 +4520,23 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4506,22 +4507,23 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  		u8 band_idx;
  	} __packed req = {
  		.tag = cpu_to_le16(UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL),
@@ -222,7 +222,7 @@
  	if (!skb)
  		return -ENOMEM;
  
-@@ -4557,6 +4559,37 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4545,6 +4547,37 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  	/* eht */
  	skb_put_data(skb, &la.eht[0], sizeof(la.eht));
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
index 5283a49..59b874e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
@@ -1,4 +1,4 @@
-From 5def24c68db8d0ff5e0a3ef799c4e1b670dfcb46 Mon Sep 17 00:00:00 2001
+From 547691d38f2c8984fed244b23f61a650f19d5d74 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:36:34 +0800
 Subject: [PATCH 1009/1044] mtk: wifi: mt76: mt7996: add binfile mode support
@@ -61,10 +61,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 19c445b5..1eb5a52b 100644
+index 9aa56ac6..e1b0560b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -948,6 +948,8 @@ struct mt76_dev {
+@@ -949,6 +949,8 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -73,7 +73,7 @@
  };
  
  /* per-phy stats.  */
-@@ -1204,6 +1206,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
+@@ -1220,6 +1222,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int len);
  int mt76_get_of_data_from_nvmem(struct mt76_dev *dev, void *eep,
  				const char *cell_name, int len);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1010-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1010-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
index 7330ae5..9d2272e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1010-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1010-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
@@ -1,4 +1,4 @@
-From 516fdeb45c9a8c2b8af89e6edab766a4d828e8db Mon Sep 17 00:00:00 2001
+From 9ce2a5ed55883339f0ea8e0edb5c18752963b367 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 12:12:51 +0800
 Subject: [PATCH 1010/1044] mtk: wifi: mt76: mt7996: add normal mode
@@ -16,10 +16,10 @@
  7 files changed, 188 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 23310c4f..6a1ee3e2 100644
+index 4a3ea0b7..3c82c05d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1273,6 +1273,7 @@ enum {
+@@ -1277,6 +1277,7 @@ enum {
  	MCU_UNI_CMD_PP = 0x38,
  	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
@@ -56,7 +56,7 @@
  
  #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 188d4f1f..2d8d0f42 100644
+index 5f937b26..c135da9c 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -984,6 +984,12 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
@@ -73,7 +73,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7996_WTBL_STA);
  	if (idx)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 9481fc5c..ae9484c3 100644
+index ecfc3dcf..07a14917 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -321,6 +321,12 @@ int mt7996_set_channel(struct mt7996_phy *phy)
@@ -90,10 +90,10 @@
  		mt7996_tm_update_channel(phy);
  		goto out;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 19b5a173..da01f111 100644
+index fed80421..5712b8a7 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3639,6 +3639,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
+@@ -3626,6 +3626,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
  	return 0;
  }
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1011-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1011-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
index 3a98782..bfdd434 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1011-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1011-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
@@ -1,4 +1,4 @@
-From aafd916aa93ef1400c25ea0783a7082f867cda5b Mon Sep 17 00:00:00 2001
+From 979b974ca118fd6819db0814162d8f0dcfede653 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 22 Mar 2023 11:19:52 +0800
 Subject: [PATCH 1011/1044] mtk: wifi: mt76: testmode: add testmode ZWDFS
@@ -15,10 +15,10 @@
  6 files changed, 326 insertions(+), 12 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 1eb5a52b..46fbc87e 100644
+index e1b0560b..b0211879 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -777,6 +777,14 @@ struct mt76_testmode_data {
+@@ -778,6 +778,14 @@ struct mt76_testmode_data {
  	} cfg;
  
  	u8 aid;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1012-mtk-wifi-mt76-mt7996-add-mu-vendor-command-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1012-mtk-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
index 3a679cc..d4cbd2c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1012-mtk-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1012-mtk-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
@@ -1,4 +1,4 @@
-From c00796c518d5b534f77ebe2a479103dffb3488e1 Mon Sep 17 00:00:00 2001
+From 093bc6129886e3675d396d5a7be3e57c8b29c559 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 13 Dec 2022 15:17:43 +0800
 Subject: [PATCH 1012/1044] mtk: wifi: mt76: mt7996: add mu vendor command
@@ -42,7 +42,7 @@
  mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
  mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2d8d0f42..49884cd4 100644
+index c135da9c..fba61c01 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -368,6 +368,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -76,10 +76,10 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index da01f111..4ed4c8a4 100644
+index 5712b8a7..e74f7b00 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1383,6 +1383,8 @@ static void
+@@ -1370,6 +1370,8 @@ static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
  {
@@ -88,7 +88,7 @@
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
-@@ -1394,11 +1396,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1381,11 +1383,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
  
  	muru = (struct sta_rec_muru *)tlv;
@@ -108,7 +108,7 @@
  
  	if (sta->deflink.vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
-@@ -4928,3 +4933,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -4916,3 +4921,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(SCS),
  				 &req, sizeof(req), false);
  }
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1013-mtk-wifi-mt76-mt7996-Add-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1013-mtk-wifi-mt76-mt7996-Add-air-monitor-support.patch
index 3ff2783..cad1eb5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1013-mtk-wifi-mt76-mt7996-Add-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1013-mtk-wifi-mt76-mt7996-Add-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From fd83f2c255bf85eb8ce41a876f83d3d97713fb53 Mon Sep 17 00:00:00 2001
+From a2cf1f53e11e0311a84949214de98fad1bad9546 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 26 Apr 2023 04:40:05 +0800
 Subject: [PATCH 1013/1044] mtk: wifi: mt76: mt7996: Add air monitor support
@@ -13,10 +13,10 @@
  6 files changed, 445 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6a1ee3e2..5f41fc16 100644
+index 3c82c05d..062268d6 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1247,6 +1247,7 @@ enum {
+@@ -1251,6 +1251,7 @@ enum {
  	MCU_UNI_CMD_REG_ACCESS = 0x0d,
  	MCU_UNI_CMD_CHIP_CONFIG = 0x0e,
  	MCU_UNI_CMD_POWER_CTRL = 0x0f,
@@ -25,7 +25,7 @@
  	MCU_UNI_CMD_SER = 0x13,
  	MCU_UNI_CMD_TWT = 0x14,
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index e307ddc3..f7dc8db4 100644
+index 8013ffd1..c266dc14 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -679,6 +679,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -40,7 +40,7 @@
  		status->flag |= RX_FLAG_8023;
  		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index ae9484c3..2042edd6 100644
+index 07a14917..478ca7ce 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -737,6 +737,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1014-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1014-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
index 16358b9..0a47d0c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1014-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1014-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
@@ -1,4 +1,4 @@
-From b855419db0dcd3ed7442cbbf79fd105922711ea5 Mon Sep 17 00:00:00 2001
+From f93b91f5cb564270421034ff9dbc71864646dd10 Mon Sep 17 00:00:00 2001
 From: mtk23510 <rudra.shahi@mediatek.com>
 Date: Fri, 24 Mar 2023 19:18:53 +0800
 Subject: [PATCH 1014/1044] mtk: wifi: mt76: mt7996: add driver support for
@@ -10,7 +10,7 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 49884cd4..142a0f63 100644
+index fba61c01..1498787f 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -391,6 +391,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1015-mtk-wifi-mt76-mt7996-add-vendor-cmd-to-get-available.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1015-mtk-wifi-mt76-mt7996-add-vendor-cmd-to-get-available.patch
index 33746ea..c239d77 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1015-mtk-wifi-mt76-mt7996-add-vendor-cmd-to-get-available.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1015-mtk-wifi-mt76-mt7996-add-vendor-cmd-to-get-available.patch
@@ -1,4 +1,4 @@
-From e9a571385e98dff38a1e0e74a39f93c744b7e02a Mon Sep 17 00:00:00 2001
+From ac974ea7fc0eb73d41a5063e273fb3b1ea971112 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Wed, 3 May 2023 05:08:07 +0800
 Subject: [PATCH 1015/1044] mtk: wifi: mt76: mt7996: add vendor cmd to get
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1016-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1016-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
index c8d3d5f..7b2a54a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1016-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1016-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
@@ -1,4 +1,4 @@
-From f1eae676ca9604151b987f09549228a166b8c632 Mon Sep 17 00:00:00 2001
+From 9b1cb9cdfb8ae18820908362a909d854c226e1ce Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:56:07 +0800
 Subject: [PATCH 1016/1044] mtk: wifi: mt76: mt7996: add debugfs for fw
@@ -65,10 +65,10 @@
  	desc += scnprintf(buff + desc, bufsz - desc,
  			  "\nlet's dump firmware SER statistics...\n");
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index f7dc8db4..b92d7fe9 100644
+index c266dc14..75657786 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2083,15 +2083,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2084,15 +2084,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	struct mt7996_dev *dev;
  
  	dev = container_of(work, struct mt7996_dev, dump_work);
@@ -108,7 +108,7 @@
  void mt7996_reset(struct mt7996_dev *dev)
  {
  	if (!dev->recovery.hw_init_done)
-@@ -2109,6 +2130,7 @@ void mt7996_reset(struct mt7996_dev *dev)
+@@ -2110,6 +2131,7 @@ void mt7996_reset(struct mt7996_dev *dev)
  
  		mt7996_irq_disable(dev, MT_INT_MCU_CMD);
  		queue_work(dev->mt76.wq, &dev->dump_work);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1017-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1017-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
index 93f4afc..7fd7681 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1017-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1017-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
@@ -1,4 +1,4 @@
-From e7a7f2af86f895894445ced1d97e8fc09be4b30f Mon Sep 17 00:00:00 2001
+From 07a550ff7fbfb8702d7c6adfa0c7fd4ade9bf15b Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Mon, 25 Dec 2023 15:17:49 +0800
 Subject: [PATCH 1017/1044] mtk: wifi: mt76: mt7996: Add mt7992 coredump
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1018-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1018-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
index aeeba0c..ecc86a8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1018-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1018-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
@@ -1,4 +1,4 @@
-From 0d2c482270a6d32d669fd5441a40f6c5f34e99e7 Mon Sep 17 00:00:00 2001
+From 0e74220e04acc1fb9c10d469e3b287d61a9ae4d6 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 6 Jun 2023 16:57:10 +0800
 Subject: [PATCH 1018/1044] mtk: wifi: mt76: mt7996: add support for runtime
@@ -17,10 +17,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 4ed4c8a4..78571034 100644
+index e74f7b00..60b1b62c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2615,8 +2615,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2602,8 +2602,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	if (IS_ERR(rskb))
  		return PTR_ERR(rskb);
  
@@ -30,7 +30,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2651,7 +2650,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2638,7 +2637,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1019-mtk-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-en.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1019-mtk-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-en.patch
index 8f6c8d8..597728e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1019-mtk-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-en.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1019-mtk-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-en.patch
@@ -1,4 +1,4 @@
-From 1f6dd2ec077acc13bc87b8f518a4d96d400786a6 Mon Sep 17 00:00:00 2001
+From 6c3c803dedac7513e8e166fcd2fa0fb9b253fa34 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Thu, 8 Jun 2023 20:21:04 +0800
 Subject: [PATCH 1019/1044] mtk: wifi: mt76: mt7996: add vendor subcmd EDCCA
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1020-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1020-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
index eb14c0e..cdba899 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1020-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1020-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
@@ -1,4 +1,4 @@
-From f9396e523e0f10df265a7c22b7f4ebf37d6b3f0d Mon Sep 17 00:00:00 2001
+From f8bfd93b55c37abf0d210bbeab633a6a9877a7a6 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 10 Jul 2023 11:47:29 +0800
 Subject: [PATCH 1020/1044] mtk: wifi: mt76: mt7996: add support spatial reuse
@@ -27,10 +27,10 @@
  7 files changed, 270 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5f41fc16..63c2ef10 100644
+index 062268d6..9edb580c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1036,6 +1036,7 @@ enum {
+@@ -1040,6 +1040,7 @@ enum {
  	MCU_UNI_EVENT_BSS_BEACON_LOSS = 0x0c,
  	MCU_UNI_EVENT_SCAN_DONE = 0x0e,
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
@@ -39,7 +39,7 @@
  	MCU_UNI_EVENT_TX_DONE = 0x2d,
  	MCU_UNI_EVENT_BF = 0x33,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2042edd6..c1776aeb 100644
+index 478ca7ce..9ca37e1e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -6,6 +6,9 @@
@@ -63,7 +63,7 @@
  					   !dev->dbg.sku_disable);
  #else
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 78571034..7781c149 100644
+index 60b1b62c..03bab7c3 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -712,6 +712,14 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1021-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1021-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
index ee0fe4e..16e9195 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1021-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1021-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
@@ -1,4 +1,4 @@
-From a3ffaab9ec8b6e38ca624bf92cc52fae318783d5 Mon Sep 17 00:00:00 2001
+From 14177254874d5d9ad7b1e2a04a53481f90d89dc9 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 1 Aug 2023 16:02:28 +0800
 Subject: [PATCH 1021/1044] mtk: wifi: mt76: mt7996: Establish BA in VO queue
@@ -8,7 +8,7 @@
  1 file changed, 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index b92d7fe9..618c1f40 100644
+index 75657786..b3762728 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1032,8 +1032,6 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1022-mtk-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-w.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1022-mtk-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-w.patch
index e66e0ac..045f81b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1022-mtk-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-w.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1022-mtk-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-w.patch
@@ -1,4 +1,4 @@
-From 4bb174a32af42be0c3f23f302bb829a10b1dfb85 Mon Sep 17 00:00:00 2001
+From 6abdd9bb051eb9791465c19f5e0c0631627a4a86 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 5 Jul 2023 10:00:17 +0800
 Subject: [PATCH 1022/1044] mtk: wifi: mt76: mt7996: add eagle iFEM HWITS ZWDFS
@@ -16,7 +16,7 @@
  3 files changed, 68 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index c1776aeb..17b29aef 100644
+index 9ca37e1e..99bc975e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1431,6 +1431,62 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
@@ -119,7 +119,7 @@
  		goto out;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7781c149..fff5a826 100644
+index 03bab7c3..17ff251a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -369,12 +369,14 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1023-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1023-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
index 57bd776..9ccd366 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1023-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1023-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
@@ -1,4 +1,4 @@
-From f3ed6cebb20914e0f0417f180fb0bff1fd1a73e2 Mon Sep 17 00:00:00 2001
+From a7339ec6678cf02b9efae478bfa82d72612bf404 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Sat, 12 Aug 2023 04:17:22 +0800
 Subject: [PATCH 1023/1044] mtk: wifi: mt76: mt7996: report tx and rx byte to
@@ -9,7 +9,7 @@
  1 file changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index fff5a826..5c695669 100644
+index 17ff251a..9a3d0f3c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -522,6 +522,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1024-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1024-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
index 77d4d6f..17aa675 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1024-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1024-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
@@ -1,4 +1,4 @@
-From 9932a8833f86351759e9a985cae1a3c86a1d0b1d Mon Sep 17 00:00:00 2001
+From 7144f4b79987def2a64949b44c0f7250062a6d77 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Sep 2023 00:52:46 +0800
 Subject: [PATCH 1024/1044] mtk: wifi: mt76: mt7996: support dup wtbl
@@ -11,7 +11,7 @@
  3 files changed, 25 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 142a0f63..91aff836 100644
+index 1498787f..30879ec3 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -675,6 +675,7 @@ static void mt7996_init_work(struct work_struct *work)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1025-mtk-wifi-mt76-mt7996-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1025-mtk-wifi-mt76-mt7996-add-ibf-control-vendor-cmd.patch
index 477c786..e70b156 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1025-mtk-wifi-mt76-mt7996-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1025-mtk-wifi-mt76-mt7996-add-ibf-control-vendor-cmd.patch
@@ -1,4 +1,4 @@
-From f5758611be21fa63b3414e0746ddb5fb8b7a6700 Mon Sep 17 00:00:00 2001
+From 3826a1e88d7c7a979550040d1bcacd4358491ad2 Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Fri, 22 Sep 2023 09:54:49 +0800
 Subject: [PATCH 1025/1044] mtk: wifi: mt76: mt7996: add ibf control vendor cmd
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1026-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1026-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
index 8127bcb..401bbf1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1026-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1026-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
@@ -1,4 +1,4 @@
-From c5b9ecebf45799539185e75478fc0cd796d88746 Mon Sep 17 00:00:00 2001
+From a9b56c1678204b1f67af27517a95ddfaa8c99618 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Nov 2023 11:10:10 +0800
 Subject: [PATCH 1026/1044] mtk: wifi: mt76: try more times when send message
@@ -12,10 +12,10 @@
  3 files changed, 62 insertions(+), 59 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 12f0e2fd..be8e2aaa 100644
+index 4cf2afdf..e4758e80 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -506,9 +506,12 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -504,9 +504,12 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
  {
  	struct mt76_queue_buf buf = {};
  	dma_addr_t addr;
@@ -29,7 +29,7 @@
  
  	if (q->queued + 1 >= q->ndesc - 1)
  		goto error;
-@@ -530,7 +533,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -528,7 +531,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
  
  error:
  	dev_kfree_skb(skb);
@@ -131,10 +131,10 @@
  
  	return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 618c1f40..96627a58 100644
+index b3762728..7efe7db5 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1662,18 +1662,6 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+@@ -1663,18 +1663,6 @@ mt7996_mac_restart(struct mt7996_dev *dev)
  			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
  	}
  
@@ -153,7 +153,7 @@
  	/* lock/unlock all queues to ensure that no tx is pending */
  	mt76_txq_schedule_all(&dev->mphy);
  	if (phy2)
-@@ -1787,13 +1775,24 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1788,13 +1776,24 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  	phy3 = mt7996_phy3(dev);
  	dev->recovery.hw_full_reset = true;
  
@@ -179,7 +179,7 @@
  	cancel_work_sync(&dev->wed_rro.work);
  	cancel_delayed_work_sync(&dev->mphy.mac_work);
  	if (phy2)
-@@ -1896,16 +1895,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1897,16 +1896,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
  	wake_up(&dev->mt76.mcu.wait);
  
@@ -196,7 +196,7 @@
  	mt76_worker_disable(&dev->mt76.tx_worker);
  	mt76_for_each_q_rx(&dev->mt76, i) {
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
-@@ -1916,8 +1905,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1917,8 +1906,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	}
  	napi_disable(&dev->mt76.tx_napi);
  
@@ -205,7 +205,7 @@
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7996_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
-@@ -1990,20 +1977,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1991,20 +1978,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (phy3)
  		ieee80211_wake_queues(phy3->mt76->hw);
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1027-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1027-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
index ce1378f..f4cfee6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1027-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1027-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
@@ -1,4 +1,4 @@
-From 0637936c479920fdd7e2b7539d17f30c5146a346 Mon Sep 17 00:00:00 2001
+From 8efecbd24fb7bdcaed27b5608607e6eec71a6b91 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 21 Nov 2023 09:55:46 +0800
 Subject: [PATCH 1027/1044] mtk: wifi: mt76: mt7996: add SER overlap handle
@@ -26,10 +26,10 @@
  
  		ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb_tmp, cmd, &seq);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 96627a58..22d7dc6d 100644
+index 7efe7db5..dc806892 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1876,6 +1876,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1877,6 +1877,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -37,7 +37,7 @@
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
-@@ -1893,6 +1894,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1894,6 +1895,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  	set_bit(MT76_RESET, &dev->mphy.state);
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
@@ -48,7 +48,7 @@
  	wake_up(&dev->mt76.mcu.wait);
  
  	mt76_worker_disable(&dev->mt76.tx_worker);
-@@ -2107,6 +2112,9 @@ void mt7996_reset(struct mt7996_dev *dev)
+@@ -2108,6 +2113,9 @@ void mt7996_reset(struct mt7996_dev *dev)
  		return;
  	}
  
@@ -59,7 +59,7 @@
  	wake_up(&dev->reset_wait);
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 5c695669..eda6c506 100644
+index 9a3d0f3c..d381e586 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -246,6 +246,14 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1028-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1028-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
index d19d3cd..32a88fd 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1028-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1028-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
@@ -1,4 +1,4 @@
-From 34597329f87f553c3f19212067f7a0c7c0265cd5 Mon Sep 17 00:00:00 2001
+From 44b06188cdb7f5f859049e85d00cf8d1ca9441cb Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Jul 2023 16:36:36 +0800
 Subject: [PATCH 1028/1044] mtk: wifi: mt76: mt7996: kite default 1-pcie
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1029-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1029-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
index 95e3b35..fdefbb3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1029-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1029-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
@@ -1,4 +1,4 @@
-From 97f4660009bcee136694bc1fdf376d0ffd8dc103 Mon Sep 17 00:00:00 2001
+From 92db3705c71472d0b822f9aa650ca893b55a5aaf Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 28 Apr 2023 10:39:58 +0800
 Subject: [PATCH 1029/1044] mtk: wifi: mt76: mt7996: add debugfs knob for
@@ -72,7 +72,7 @@
  	spin_lock_init(&tid->lock);
  
 diff --git a/mac80211.c b/mac80211.c
-index 87dcc8a3..45791f6e 100644
+index e7d02d15..ae040ec4 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -784,6 +784,7 @@ static void mt76_rx_release_amsdu(struct mt76_phy *phy, enum mt76_rxq_id q)
@@ -131,10 +131,10 @@
  		napi_gro_receive(napi, skb);
  	}
 diff --git a/mt76.h b/mt76.h
-index 46fbc87e..9e8848f7 100644
+index b0211879..6ace1a05 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -422,6 +422,7 @@ struct mt76_rx_tid {
+@@ -423,6 +423,7 @@ struct mt76_rx_tid {
  	struct rcu_head rcu_head;
  
  	struct mt76_dev *dev;
@@ -142,7 +142,7 @@
  
  	spinlock_t lock;
  	struct delayed_work reorder_work;
-@@ -853,6 +854,19 @@ struct mt76_phy {
+@@ -854,6 +855,19 @@ struct mt76_phy {
  		bool al;
  		u8 pin;
  	} leds;
@@ -162,7 +162,7 @@
  };
  
  struct mt76_dev {
-@@ -958,6 +972,7 @@ struct mt76_dev {
+@@ -959,6 +973,7 @@ struct mt76_dev {
  	};
  
  	const char *bin_file_name;
@@ -171,7 +171,7 @@
  
  /* per-phy stats.  */
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 22d7dc6d..73c66e57 100644
+index dc806892..34dea859 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -469,8 +469,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -204,7 +204,7 @@
  
  	if (FIELD_GET(MT_RXD2_NORMAL_SEC_MODE, rxd2) != 0 &&
  	    !(rxd1 & (MT_RXD1_NORMAL_CLM | MT_RXD1_NORMAL_CM))) {
-@@ -1414,8 +1420,10 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1415,8 +1421,10 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info)
  {
  	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
@@ -215,7 +215,7 @@
  	enum rx_pkt_type type;
  
  	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
-@@ -1457,6 +1465,10 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1458,6 +1466,10 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		}
  		fallthrough;
  	default:
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1030-mtk-wifi-mt76-mt7996-add-three-wire-pta-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1030-mtk-wifi-mt76-mt7996-add-three-wire-pta-support.patch
index 16ea061..cf53d31 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1030-mtk-wifi-mt76-mt7996-add-three-wire-pta-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1030-mtk-wifi-mt76-mt7996-add-three-wire-pta-support.patch
@@ -1,4 +1,4 @@
-From 6c341942f4c70345db030e578526c431baf05d5c Mon Sep 17 00:00:00 2001
+From aba1fe485ce5352728380c6cf90ea2ce06bf003a Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 24 Oct 2023 15:59:18 +0800
 Subject: [PATCH 1030/1044] mtk: wifi: mt76: mt7996: add three wire pta support
@@ -13,10 +13,10 @@
  3 files changed, 62 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 63c2ef10..06c8b960 100644
+index 9edb580c..a59e5a0b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1281,6 +1281,7 @@ enum {
+@@ -1285,6 +1285,7 @@ enum {
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
  	MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
  	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1031-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1031-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
index ef74d6b..36c36ff 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1031-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1031-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
@@ -1,4 +1,4 @@
-From 00fd52c040117f402328d7e4138df14ef71524a1 Mon Sep 17 00:00:00 2001
+From 6c67be2cf87c3b74eb4b972b06c89becc4ce09b5 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 3 Jan 2023 09:42:07 +0800
 Subject: [PATCH 1031/1044] mtk: wifi: mt76: mt7996: support BF/MIMO debug
@@ -25,7 +25,7 @@
  6 files changed, 1102 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index eda6c506..9f8616ea 100644
+index d381e586..da0d572c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -741,6 +741,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1032-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1032-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
index 2a74748..781203d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1032-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1032-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
@@ -1,4 +1,4 @@
-From 89b3bd70258ed3f943c61e88288ef6f63160a579 Mon Sep 17 00:00:00 2001
+From bab0b9fcdba8bf3e0bdd1ade984df4548c5c51eb Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 13 Jun 2023 14:49:02 +0800
 Subject: [PATCH 1032/1044] mtk: wifi: mt76: mt7996: add build the following
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1033-mtk-wifi-mt76-mt7996-add-cert-patch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1033-mtk-wifi-mt76-mt7996-add-cert-patch.patch
index 0ba5aa8..9b8a517 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1033-mtk-wifi-mt76-mt7996-add-cert-patch.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1033-mtk-wifi-mt76-mt7996-add-cert-patch.patch
@@ -1,4 +1,4 @@
-From 9c5efd0e6b30c6ceab6e0f5a0f9056cea9844785 Mon Sep 17 00:00:00 2001
+From 8d59fe0a6cddf4eacda469e0caffa698425fab77 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 14 Aug 2023 13:36:58 +0800
 Subject: [PATCH 1033/1044] mtk: wifi: mt76: mt7996: add cert patch
@@ -23,7 +23,7 @@
  9 files changed, 778 insertions(+), 7 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 73c66e57..27e5fb71 100644
+index 34dea859..9af94d05 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -10,6 +10,7 @@
@@ -34,7 +34,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -2272,6 +2273,14 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
+@@ -2273,6 +2274,14 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
  	}
  }
  
@@ -50,7 +50,7 @@
  {
  	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 17b29aef..f4d50ec1 100644
+index 99bc975e..4a5697a3 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -588,6 +588,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -113,10 +113,10 @@
  
  void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9f8616ea..7bd1221b 100644
+index da0d572c..371fd2e7 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1359,6 +1359,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1346,6 +1346,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
@@ -127,7 +127,7 @@
  
  	/* For 6G band, this tlv is necessary to let hw work normally */
  	if (!sta->deflink.he_6ghz_capa.capa && !sta->deflink.vht_cap.vht_supported)
-@@ -1370,6 +1374,9 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1357,6 +1361,9 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
  	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
  	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
@@ -137,7 +137,7 @@
  }
  
  static void
-@@ -4460,6 +4467,27 @@ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
+@@ -4447,6 +4454,27 @@ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
  				 &req, sizeof(req), true);
  }
  
@@ -165,7 +165,7 @@
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
  {
  	struct {
-@@ -4974,6 +5002,18 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -4962,6 +4990,18 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
  
  	switch (mode) {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1034-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1034-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
index 6cd784f..4486e40 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1034-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1034-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
@@ -1,4 +1,4 @@
-From cc8ecb9fe62c4689899d79d8c710c2756a2bf131 Mon Sep 17 00:00:00 2001
+From 044b8e77dbc476e9db82b4fe571ae71b37aef769 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 6 Apr 2023 16:40:28 +0800
 Subject: [PATCH 1034/1044] mtk: wifi: mt76: testmode: add testmode bf support
@@ -32,10 +32,10 @@
  14 files changed, 1354 insertions(+), 59 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 9e8848f7..2a7b0ed9 100644
+index 6ace1a05..7d9ee018 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -751,6 +751,11 @@ struct mt76_testmode_data {
+@@ -752,6 +752,11 @@ struct mt76_testmode_data {
  	u32 tx_time;
  	u32 tx_ipg;
  
@@ -48,7 +48,7 @@
  	bool ebf;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 06c8b960..2cdd5b9c 100644
+index a59e5a0b..266ee711 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -488,7 +488,8 @@ struct sta_rec_bf {
@@ -61,7 +61,7 @@
  } __packed;
  
  struct sta_rec_bfee {
-@@ -1274,6 +1275,7 @@ enum {
+@@ -1278,6 +1279,7 @@ enum {
  	MCU_UNI_CMD_VOW = 0x37,
  	MCU_UNI_CMD_PP = 0x38,
  	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
@@ -70,7 +70,7 @@
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
  	MCU_UNI_CMD_RRO = 0x57,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7bd1221b..5b5ddafb 100644
+index 371fd2e7..1729bb46 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1067,7 +1067,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
@@ -87,7 +87,7 @@
  		return 0;
  	}
  
-@@ -4118,7 +4123,6 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
+@@ -4105,7 +4110,6 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
  int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
  {
  #define MT7996_BF_MAX_SIZE	sizeof(union bf_tag_tlv)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1035-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1035-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
index 9ab0aa1..19e614d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1035-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1035-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
@@ -1,4 +1,4 @@
-From 57a5dbbde09c23122671c936872b1f6fa41dcb9c Mon Sep 17 00:00:00 2001
+From f3c4b779c6d74afff2532ffc36d9a85d58ec560d Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 22 Sep 2023 12:33:06 +0800
 Subject: [PATCH 1035/1044] mtk: wifi: mt76: mt7996: add zwdfs cert mode
@@ -13,10 +13,10 @@
  5 files changed, 100 insertions(+), 12 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 5b5ddafb..69718654 100644
+index 1729bb46..f3faa42e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4516,18 +4516,7 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
+@@ -4503,18 +4503,7 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
  int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val)
  {
@@ -36,7 +36,7 @@
  		.tag = cpu_to_le16(UNI_RDD_CTRL_PARM),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.ctrl = cmd,
-@@ -4540,6 +4529,37 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
+@@ -4527,6 +4516,37 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  				 &req, sizeof(req), true);
  }
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1036-mtk-wifi-mt76-testmode-add-channel-68-96.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1036-mtk-wifi-mt76-testmode-add-channel-68-96.patch
index 8e62a9f..16d8c0d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1036-mtk-wifi-mt76-testmode-add-channel-68-96.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1036-mtk-wifi-mt76-testmode-add-channel-68-96.patch
@@ -1,4 +1,4 @@
-From 5fcaa5849033b9d2712f05796a6187d4dca7d9d1 Mon Sep 17 00:00:00 2001
+From 0f71e327905eedf26c651a683e9e9b8f27344d84 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 11 Sep 2023 14:43:07 +0800
 Subject: [PATCH 1036/1044] mtk: wifi: mt76: testmode: add channel 68 & 96
@@ -24,7 +24,7 @@
  6 files changed, 82 insertions(+), 9 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 45791f6e..f74f6e85 100644
+index ae040ec4..f7cd47f9 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -35,6 +35,15 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -138,10 +138,10 @@
  extern const u32 dpd_5g_bw160_ch_num;
  extern const struct ieee80211_channel dpd_6g_ch_list_bw160[];
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 69718654..528cbd55 100644
+index f3faa42e..cb185ff9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3790,7 +3790,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3777,7 +3777,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  		chan_list_size = mphy->sband_5g.sband.n_channels;
  		base_offset += dpd_size_2g;
  		if (bw == NL80211_CHAN_WIDTH_160) {
@@ -151,7 +151,7 @@
  			per_chan_size = DPD_PER_CH_GT_BW20_SIZE;
  			cal_id = RF_DPD_FLAT_5G_MEM_CAL;
  			chan_list = dpd_5g_ch_list_bw160;
-@@ -3799,6 +3800,9 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3786,6 +3787,9 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  			/* apply (center channel - 2)'s dpd cal data for bw 40/80 channels */
  			channel -= 2;
  		}
@@ -161,7 +161,7 @@
  		break;
  	case NL80211_BAND_6GHZ:
  		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
-@@ -3838,6 +3842,10 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3825,6 +3829,10 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	if (idx == chan_list_size)
  		return -EINVAL;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1037-mtk-wifi-mt76-mt7996-support-enable-disable-pp-featu.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1037-mtk-wifi-mt76-mt7996-support-enable-disable-pp-featu.patch
index 7490f63..f663f2f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1037-mtk-wifi-mt76-mt7996-support-enable-disable-pp-featu.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1037-mtk-wifi-mt76-mt7996-support-enable-disable-pp-featu.patch
@@ -1,4 +1,4 @@
-From 0f6012b3256bebe0483d70b669d4f3164900ac5f Mon Sep 17 00:00:00 2001
+From 0b7c164634820842ce1d64057328d3eca657e4bd Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 25 Sep 2023 19:20:49 +0800
 Subject: [PATCH 1037/1044] mtk: wifi: mt76: mt7996: support enable/disable pp
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1038-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1038-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
index e34ed82..a02940e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1038-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1038-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
@@ -1,4 +1,4 @@
-From ffcb108d99e2a14c8099cd766c89e59a83d44617 Mon Sep 17 00:00:00 2001
+From de9931f5a5ad72925811312b069170ef0ab5e763 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 12 Oct 2023 16:17:33 +0800
 Subject: [PATCH 1038/1044] mtk: wifi: mt76: testmode: add kite testmode
@@ -211,10 +211,10 @@
  #define RF_DPD_FLAT_CAL				BIT(28)
  #define RF_PRE_CAL				BIT(29)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 528cbd55..708ec0a8 100644
+index cb185ff9..dde2a505 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3759,13 +3759,11 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3746,13 +3746,11 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	enum nl80211_chan_width bw = chandef->width;
  	const struct ieee80211_channel *chan_list;
  	u32 cal_id, chan_list_size, base_offset = 0, offs = MT_EE_DO_PRE_CAL;
@@ -230,7 +230,7 @@
  
  	switch (band) {
  	case NL80211_BAND_2GHZ:
-@@ -3781,27 +3779,35 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3768,27 +3766,35 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  			return 0;
  		cal_id = RF_DPD_FLAT_CAL;
  		chan_list = dpd_2g_ch_list_bw20;
@@ -272,7 +272,7 @@
  			return 0;
  		break;
  	case NL80211_BAND_6GHZ:
-@@ -3809,20 +3815,27 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3796,20 +3802,27 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  		cal_id = RF_DPD_FLAT_6G_CAL;
  		chan_list = mphy->sband_6g.sband.channels;
  		chan_list_size = mphy->sband_6g.sband.n_channels;
@@ -305,7 +305,7 @@
  		} else if (bw > NL80211_CHAN_WIDTH_20) {
  			/* apply (center channel - 2)'s dpd cal data for bw 40/80 channels */
  			channel -= 2;
-@@ -3842,9 +3855,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3829,9 +3842,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	if (idx == chan_list_size)
  		return -EINVAL;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1039-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1039-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
index c01a89d..cd75989 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1039-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1039-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
@@ -1,4 +1,4 @@
-From b25ddbf220a6f2098d8983877a0992ea481c6768 Mon Sep 17 00:00:00 2001
+From 9a9ccfab916669ad514ca41f84b8e76462ec9070 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Tue, 14 Nov 2023 11:27:06 +0800
 Subject: [PATCH 1039/1044] mtk: wifi: mt76: mt7996: assign DEAUTH to ALTX
@@ -10,7 +10,7 @@
  1 file changed, 10 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 27e5fb71..408a59c5 100644
+index 9af94d05..31ec6f89 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -753,6 +753,8 @@ static void
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1040-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1040-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
index 7eb6958..d348572 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1040-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1040-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
@@ -1,4 +1,4 @@
-From f2db711c2a2766369d6d948ddb7aa6bf043f42e4 Mon Sep 17 00:00:00 2001
+From 139cc10423d9b2c5e5528bf45a12a54bbe265c20 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Nov 2023 22:42:09 +0800
 Subject: [PATCH 1040/1044] mtk: wifi: mt76: mt7996: add no_beacon vendor
@@ -21,10 +21,10 @@
  4 files changed, 65 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 708ec0a8..ccb99c23 100644
+index dde2a505..2bcee895 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5067,4 +5067,15 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5055,4 +5055,15 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		break;
  	}
  }
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1041-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1041-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
index 8d5a86b..003aa07 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1041-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1041-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
@@ -1,4 +1,4 @@
-From ff7edd501bafec382f5e4a4b6abb791bef3cd0c9 Mon Sep 17 00:00:00 2001
+From 7de1a3bf90d697b5b7672c605fab6cd789128b5e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Nov 2023 09:49:08 +0800
 Subject: [PATCH 1041/1044] mtk: wifi: mt76: mt7996: add adie efuse merge
@@ -6,13 +6,74 @@
 
 Merge adie-dependent parameters in efuse into eeprom after FT.
 Note that Eagle BE14000 is not considered yet.
+Add efuse dump command.
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/eeprom.c | 145 ++++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/mcu.c    |   6 +-
- 2 files changed, 149 insertions(+), 2 deletions(-)
+ mt7996/debugfs.c |  41 ++++++++++++++
+ mt7996/eeprom.c  | 145 +++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mcu.c     |   6 +-
+ 3 files changed, 190 insertions(+), 2 deletions(-)
 
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index 67c6bd09..bc6b5aa6 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -862,6 +862,46 @@ mt7996_rf_regval_set(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7996_rf_regval_get,
+ 			 mt7996_rf_regval_set, "0x%08llx\n");
+ 
++static ssize_t
++mt7996_efuse_get(struct file *file, char __user *user_buf,
++		 size_t count, loff_t *ppos)
++{
++	struct mt7996_dev *dev = file->private_data;
++	struct mt76_dev *mdev = &dev->mt76;
++	u8 *buff = mdev->otp.data;
++	int i;
++	ssize_t ret;
++	u32 block_num;
++
++	mdev->otp.size = MT7996_EEPROM_SIZE;
++	if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_SKU_444)
++		mdev->otp.size += 3 * MT_EE_CAL_UNIT;
++
++	if (!mdev->otp.data) {
++		mdev->otp.data = devm_kzalloc(mdev->dev, mdev->otp.size, GFP_KERNEL);
++		if (!mdev->otp.data)
++			return -ENOMEM;
++
++		block_num = DIV_ROUND_UP(mdev->otp.size, MT7996_EEPROM_BLOCK_SIZE);
++		for (i = 0; i < block_num; i++) {
++			buff = mdev->otp.data + i * MT7996_EEPROM_BLOCK_SIZE;
++			ret = mt7996_mcu_get_eeprom(dev, i * MT7996_EEPROM_BLOCK_SIZE, buff);
++			if (ret)
++				continue;
++		}
++	}
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, mdev->otp.data, mdev->otp.size);
++
++	return ret;
++}
++
++static const struct file_operations mt7996_efuse_ops = {
++	.read = mt7996_efuse_get,
++	.open = simple_open,
++	.llseek = default_llseek,
++};
++
+ int mt7996_init_debugfs(struct mt7996_phy *phy)
+ {
+ 	struct mt7996_dev *dev = phy->dev;
+@@ -888,6 +928,7 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
+ 				    mt7996_twt_stats);
+ 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
++	debugfs_create_file("otp", 0400, dir, dev, &mt7996_efuse_ops);
+ 
+ 	if (phy->mt76->cap.has_5ghz) {
+ 		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
 index 39e65010..45cbd03d 100644
 --- a/mt7996/eeprom.c
@@ -177,10 +238,10 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ccb99c23..6b026c73 100644
+index 2bcee895..264c6651 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3630,7 +3630,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
+@@ -3617,7 +3617,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
  	};
  	struct sk_buff *skb;
  	bool valid;
@@ -189,7 +250,7 @@
  	u8 *buf = read_buf;
  
  	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
-@@ -3648,11 +3648,13 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
+@@ -3635,11 +3635,13 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
  
  		skb_pull(skb, 48);
  		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1042-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1042-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
index 70fae1f..8e04a22 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1042-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1042-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
@@ -1,4 +1,4 @@
-From 3119a4b51528b7e52f301ee87286f2caa2439513 Mon Sep 17 00:00:00 2001
+From 44bfda573b977afdb916becfc8a2fa0a8d34192a Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 5 Dec 2023 16:48:33 +0800
 Subject: [PATCH 1042/1044] mtk: wifi: mt7996: add Eagle 2adie TBTC (BE14000)
@@ -85,7 +85,7 @@
  static const u32 mt7992_prek_rev[] = {
  	[GROUP_SIZE_2G] =			4 * MT_EE_CAL_UNIT,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 91aff836..f2258541 100644
+index 30879ec3..ec90cdc7 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -905,6 +905,12 @@ int mt7996_get_chip_sku(struct mt7996_dev *dev)
@@ -102,7 +102,7 @@
  		if (adie_comb <= 1)
  			dev->chip_sku = MT7996_SKU_444;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6b026c73..1232bc70 100644
+index 264c6651..ff811357 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -23,6 +23,11 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1043-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1043-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
index f1e5209..5683b3a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1043-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1043-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
@@ -1,4 +1,4 @@
-From c0969da768d20a041dd505bb57afe74abef989a5 Mon Sep 17 00:00:00 2001
+From fb955a0f6fbe7b30d12a1a143b9866178443ee8d Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 22 Dec 2023 17:27:10 +0800
 Subject: [PATCH 1043/1044] mtk: wifi: mt76: mt7996: add background radar hw
@@ -12,7 +12,7 @@
  3 files changed, 29 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 67c6bd09..cceabf00 100644
+index bc6b5aa6..ecaa2345 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -257,6 +257,11 @@ mt7996_rdd_monitor(struct seq_file *s, void *data)
@@ -28,7 +28,7 @@
  		ret = -EINVAL;
  		goto out;
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f2258541..00063e72 100644
+index ec90cdc7..20415e3c 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -393,9 +393,10 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1044-mtk-wifi-mt76-mt7996-support-disable-muru-debug-info.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1044-mtk-wifi-mt76-mt7996-support-disable-muru-debug-info.patch
index e730237..fe4e3cf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1044-mtk-wifi-mt76-mt7996-support-disable-muru-debug-info.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1044-mtk-wifi-mt76-mt7996-support-disable-muru-debug-info.patch
@@ -1,4 +1,4 @@
-From d330b76bc26aadb42a30eed71e3dd739fc795352 Mon Sep 17 00:00:00 2001
+From 258008a28975b79d35e2572028653aef82490255 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 22 Dec 2023 10:53:00 +0800
 Subject: [PATCH 1044/1044] mtk: wifi: mt76: mt7996: support disable muru debug
@@ -28,7 +28,7 @@
  2 files changed, 30 insertions(+)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index cceabf00..cdd284b7 100644
+index ecaa2345..a97706f5 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -463,6 +463,9 @@ mt7996_fw_debug_muru_set(void *data)
@@ -41,9 +41,9 @@
  	for (debug = DEBUG_BSRP_STATUS; debug <= DEBUG_MEC_UPDATE_AMSDU; debug++) {
  		ret = mt7996_mcu_muru_dbg_info(dev, debug,
  					       dev->fw_debug_bin & BIT(0));
-@@ -867,6 +870,30 @@ mt7996_rf_regval_set(void *data, u64 val)
- DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7996_rf_regval_get,
- 			 mt7996_rf_regval_set, "0x%08llx\n");
+@@ -907,6 +910,30 @@ static const struct file_operations mt7996_efuse_ops = {
+ 	.llseek = default_llseek,
+ };
  
 +static int
 +mt7996_fw_debug_muru_disable_set(void *data, u64 val)
@@ -72,7 +72,7 @@
  int mt7996_init_debugfs(struct mt7996_phy *phy)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -902,6 +929,8 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
+@@ -943,6 +970,8 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
  		debugfs_create_devm_seqfile(dev->mt76.dev, "rdd_monitor", dir,
  					    mt7996_rdd_monitor);
  	}
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2000-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2000-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
index 498703a..c6773a9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2000-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2000-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
@@ -1,21 +1,21 @@
-From 1d0368d0a7e2ebd6d5616d662aa35b9f24dfe515 Mon Sep 17 00:00:00 2001
+From a394aa81005b628630f4593661613682d514df36 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 19:49:22 +0800
-Subject: [PATCH 2000/2028] mtk: wifi: mt76: revert page_poll for kernel 5.4
+Subject: [PATCH 2000/2032] mtk: wifi: mt76: revert page_poll for kernel 5.4
 
 This reverts commit e8c10835cf062c577ddf426913788c39d30b4bd7.
 
 ---
- dma.c         | 86 +++++++++++++++++++++++++--------------------------
- mac80211.c    | 57 ----------------------------------
- mmio.c        | 52 ++++++++++++++++++++-----------
- mt76.h        | 22 +------------
- mt7915/main.c | 26 ++++++----------
- usb.c         | 43 +++++++++++++-------------
- 6 files changed, 110 insertions(+), 176 deletions(-)
+ dma.c         | 75 ++++++++++++++++++++++++++-------------------------
+ mac80211.c    | 57 ---------------------------------------
+ mt76.h        | 22 +--------------
+ mt7915/main.c | 26 +++++++-----------
+ usb.c         | 43 ++++++++++++++---------------
+ wed.c         | 50 ++++++++++++++++++++++------------
+ 6 files changed, 104 insertions(+), 169 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index be8e2aaa..028c2fd5 100644
+index e4758e80..d076faa1 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -178,7 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
@@ -27,7 +27,7 @@
  		kfree(t);
  	}
  	local_bh_enable();
-@@ -452,9 +452,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -450,9 +450,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		if (!t)
  			return NULL;
  
@@ -40,7 +40,7 @@
  
  		buf = t->ptr;
  		t->dma_addr = 0;
-@@ -464,9 +464,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -462,9 +462,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		if (drop)
  			*drop |= !!(buf1 & MT_DMA_CTL_WO_DROP);
  	} else {
@@ -53,13 +53,8 @@
  	}
  
  done:
-@@ -636,11 +636,11 @@ free_skb:
- }
- 
- static int
--mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
--		 bool allow_direct)
-+mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -637,7 +637,8 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+ 		     bool allow_direct)
  {
  	int len = SKB_WITH_OVERHEAD(q->buf_size);
 -	int frames = 0;
@@ -68,7 +63,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -649,28 +649,29 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -646,28 +647,29 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  
  	while (q->queued < q->ndesc - 1) {
  		struct mt76_queue_buf qbuf = {};
@@ -108,25 +103,7 @@
  			break;
  		}
  		frames++;
-@@ -714,7 +715,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
- 		/* WED txfree queue needs ring to be initialized before setup */
- 		q->flags = 0;
- 		mt76_dma_queue_reset(dev, q);
--		mt76_dma_rx_fill(dev, q, false);
-+		mt76_dma_rx_fill(dev, q);
- 
- 		ret = mtk_wed_device_txfree_ring_setup(q->wed, q->regs);
- 		if (!ret)
-@@ -743,7 +744,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
- 	case MT76_WED_RRO_Q_IND:
- 		q->flags &= ~MT_QFLAG_WED;
- 		mt76_dma_queue_reset(dev, q);
--		mt76_dma_rx_fill(dev, q, false);
-+		mt76_dma_rx_fill(dev, q);
- 		mtk_wed_device_ind_rx_ring_setup(q->wed, q->regs);
- 		break;
- 	default:
-@@ -799,10 +800,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -721,10 +723,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -134,10 +111,10 @@
 -	if (ret)
 -		return ret;
 -
- 	ret = mt76_dma_wed_setup(dev, q, false);
+ 	ret = mt76_wed_dma_setup(dev, q, false);
  	if (ret)
  		return ret;
-@@ -821,6 +818,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -743,6 +741,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -145,7 +122,7 @@
  	void *buf;
  	bool more;
  
-@@ -836,7 +834,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -758,7 +757,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  			break;
  
  		if (!mt76_queue_is_wed_rro(q))
@@ -154,7 +131,7 @@
  	} while (1);
  
  	spin_lock_bh(&q->lock);
-@@ -846,6 +844,16 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -768,6 +767,16 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	}
  
  	spin_unlock_bh(&q->lock);
@@ -171,9 +148,9 @@
  }
  
  static void
-@@ -868,15 +876,10 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -790,15 +799,10 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  	/* reset WED rx queues */
- 	mt76_dma_wed_setup(dev, q, true);
+ 	mt76_wed_dma_setup(dev, q, true);
  
 -	if (mt76_queue_is_wed_tx_free(q))
 -		return;
@@ -186,12 +163,12 @@
 -	mt76_dma_rx_fill(dev, q, false);
 +	if (!mt76_queue_is_wed_tx_free(q)) {
 +		mt76_dma_sync_idx(dev, q);
-+		mt76_dma_rx_fill(dev, q);
++		mt76_dma_rx_fill(dev, q, false);
 +	}
  }
  
  static void
-@@ -893,7 +896,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -815,7 +819,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
  	} else {
@@ -200,7 +177,7 @@
  	}
  
  	if (more)
-@@ -968,7 +971,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -890,7 +894,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  			goto free_frag;
  
  		skb_reserve(skb, q->buf_offset);
@@ -208,7 +185,7 @@
  
  		*(u32 *)skb->cb = info;
  
-@@ -984,10 +986,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -906,7 +909,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		continue;
  
  free_frag:
@@ -216,21 +193,8 @@
 +		skb_free_frag(data);
  	}
  
--	mt76_dma_rx_fill(dev, q, true);
-+	mt76_dma_rx_fill(dev, q);
- 	return done;
- }
- 
-@@ -1032,7 +1034,7 @@ mt76_dma_init(struct mt76_dev *dev,
- 
- 	mt76_for_each_q_rx(dev, i) {
- 		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
--		mt76_dma_rx_fill(dev, &dev->q_rx[i], false);
-+		mt76_dma_rx_fill(dev, &dev->q_rx[i]);
- 		napi_enable(&dev->napi[i]);
- 	}
- 
-@@ -1101,8 +1103,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+ 	mt76_dma_rx_fill(dev, q, true);
+@@ -1009,8 +1012,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  		netif_napi_del(&dev->napi[i]);
  		mt76_dma_rx_cleanup(dev, q);
@@ -240,7 +204,7 @@
  
  	if (mtk_wed_device_active(&dev->mmio.wed))
 diff --git a/mac80211.c b/mac80211.c
-index f74f6e85..885577fc 100644
+index f7cd47f9..380a74e4 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -321,109 +285,11 @@
  enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
  {
  	struct ieee80211_hw *hw = phy->hw;
-diff --git a/mmio.c b/mmio.c
-index c3e0e23e..6c28e27b 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -89,8 +89,12 @@ EXPORT_SYMBOL_GPL(mt76_set_irq_mask);
- void mt76_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- {
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
-+	u32 length;
- 	int i;
- 
-+	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
-+				sizeof(struct skb_shared_info));
-+
- 	for (i = 0; i < dev->rx_token_size; i++) {
- 		struct mt76_txwi_cache *t;
- 
-@@ -98,7 +102,9 @@ void mt76_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- 		if (!t || !t->ptr)
- 			continue;
- 
--		mt76_put_page_pool_buf(t->ptr, false);
-+		dma_unmap_single(dev->dma_dev, t->dma_addr,
-+				 wed->wlan.rx_size, DMA_FROM_DEVICE);
-+		__free_pages(virt_to_page(t->ptr), get_order(length));
- 		t->ptr = NULL;
- 
- 		mt76_put_rxwi(dev, t);
-@@ -112,33 +118,45 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- {
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
- 	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
--	struct mt76_queue *q = &dev->q_rx[MT_RXQ_MAIN];
--	int i, len = SKB_WITH_OVERHEAD(q->buf_size);
--	struct mt76_txwi_cache *t = NULL;
-+	u32 length;
-+	int i;
-+
-+	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
-+				sizeof(struct skb_shared_info));
- 
- 	for (i = 0; i < size; i++) {
--		enum dma_data_direction dir;
-+		struct mt76_txwi_cache *t = mt76_get_rxwi(dev);
- 		dma_addr_t addr;
--		u32 offset;
-+		struct page *page;
- 		int token;
--		void *buf;
-+		void *ptr;
- 
--		t = mt76_get_rxwi(dev);
- 		if (!t)
- 			goto unmap;
- 
--		buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
--		if (!buf)
--			goto unmap;
-+		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
-+		if (!page) {
-+			mt76_put_rxwi(dev, t);
-+ 			goto unmap;
-+		}
- 
--		addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
--		dir = page_pool_get_dma_dir(q->page_pool);
--		dma_sync_single_for_device(dev->dma_dev, addr, len, dir);
-+		addr = dma_map_single(dev->dma_dev, ptr,
-+					  wed->wlan.rx_size,
-+					  DMA_TO_DEVICE);
-+
-+		if (unlikely(dma_mapping_error(dev->dev, addr))) {
-+			skb_free_frag(ptr);
-+			mt76_put_rxwi(dev, t);
-+			goto unmap;
-+		}
- 
- 		desc->buf0 = cpu_to_le32(addr);
--		token = mt76_rx_token_consume(dev, buf, t, addr);
-+		token = mt76_rx_token_consume(dev, ptr, t, addr);
- 		if (token < 0) {
--			mt76_put_page_pool_buf(buf, false);
-+			dma_unmap_single(dev->dma_dev, addr,
-+					 wed->wlan.rx_size, DMA_TO_DEVICE);
-+			__free_pages(page, get_order(length));
-+			mt76_put_rxwi(dev, t);
- 			goto unmap;
- 		}
- 
-@@ -153,8 +171,6 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 	return 0;
- 
- unmap:
--	if (t)
--		mt76_put_rxwi(dev, t);
- 	mt76_mmio_wed_release_rx_buf(wed);
- 
- 	return -ENOMEM;
 diff --git a/mt76.h b/mt76.h
-index 2a7b0ed9..e7b798b2 100644
+index 7d9ee018..ce4e87b4 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -245,7 +245,7 @@ struct mt76_queue {
+@@ -246,7 +246,7 @@ struct mt76_queue {
  
  	dma_addr_t desc_dma;
  	struct sk_buff *rx_head;
@@ -432,7 +298,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1592,7 +1592,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1601,7 +1601,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -440,7 +306,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1738,25 +1737,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1747,25 +1746,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
@@ -467,7 +333,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index df2d4279..a6768512 100644
+index 3709d18d..75a55955 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1398,22 +1398,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
@@ -525,7 +391,7 @@
  
  static void
 diff --git a/usb.c b/usb.c
-index 5e5c7bf5..3e281715 100644
+index 1b25f2e5..46831a27 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
@@ -658,6 +524,103 @@
  }
  
  static void mt76u_free_rx(struct mt76_dev *dev)
+diff --git a/wed.c b/wed.c
+index f89e4537..8eca4d81 100644
+--- a/wed.c
++++ b/wed.c
+@@ -9,8 +9,12 @@
+ void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
+ {
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
++	u32 length;
+ 	int i;
+ 
++	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
++				sizeof(struct skb_shared_info));
++
+ 	for (i = 0; i < dev->rx_token_size; i++) {
+ 		struct mt76_txwi_cache *t;
+ 
+@@ -18,7 +22,9 @@ void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
+ 		if (!t || !t->ptr)
+ 			continue;
+ 
+-		mt76_put_page_pool_buf(t->ptr, false);
++		dma_unmap_single(dev->dma_dev, t->dma_addr,
++				 wed->wlan.rx_size, DMA_FROM_DEVICE);
++		__free_pages(virt_to_page(t->ptr), get_order(length));
+ 		t->ptr = NULL;
+ 
+ 		mt76_put_rxwi(dev, t);
+@@ -33,33 +39,45 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ {
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ 	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
+-	struct mt76_queue *q = &dev->q_rx[MT_RXQ_MAIN];
+-	int i, len = SKB_WITH_OVERHEAD(q->buf_size);
+-	struct mt76_txwi_cache *t = NULL;
++	u32 length;
++	int i;
++
++	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
++				sizeof(struct skb_shared_info));
+ 
+ 	for (i = 0; i < size; i++) {
+-		enum dma_data_direction dir;
++		struct mt76_txwi_cache *t = mt76_get_rxwi(dev);
+ 		dma_addr_t addr;
+-		u32 offset;
++		struct page *page;
+ 		int token;
+-		void *buf;
++		void *ptr;
+ 
+-		t = mt76_get_rxwi(dev);
+ 		if (!t)
+ 			goto unmap;
+ 
+-		buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
+-		if (!buf)
++		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
++		if (!page) {
++			mt76_put_rxwi(dev, t);
+ 			goto unmap;
++		}
+ 
+-		addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
+-		dir = page_pool_get_dma_dir(q->page_pool);
+-		dma_sync_single_for_device(dev->dma_dev, addr, len, dir);
++		addr = dma_map_single(dev->dma_dev, ptr,
++					  wed->wlan.rx_size,
++					  DMA_TO_DEVICE);
++
++		if (unlikely(dma_mapping_error(dev->dev, addr))) {
++			skb_free_frag(ptr);
++			mt76_put_rxwi(dev, t);
++			goto unmap;
++		}
+ 
+ 		desc->buf0 = cpu_to_le32(addr);
+-		token = mt76_rx_token_consume(dev, buf, t, addr);
++		token = mt76_rx_token_consume(dev, ptr, t, addr);
+ 		if (token < 0) {
+-			mt76_put_page_pool_buf(buf, false);
++			dma_unmap_single(dev->dma_dev, addr,
++					 wed->wlan.rx_size, DMA_TO_DEVICE);
++			__free_pages(page, get_order(length));
++			mt76_put_rxwi(dev, t);
+ 			goto unmap;
+ 		}
+ 
+@@ -74,8 +92,6 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 	return 0;
+ 
+ unmap:
+-	if (t)
+-		mt76_put_rxwi(dev, t);
+ 	mt76_wed_release_rx_buf(wed);
+ 
+ 	return -ENOMEM;
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2001-mtk-wifi-mt76-rework-wed-rx-flow.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2001-mtk-wifi-mt76-rework-wed-rx-flow.patch
index 5fcc869..f413ca1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2001-mtk-wifi-mt76-rework-wed-rx-flow.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2001-mtk-wifi-mt76-rework-wed-rx-flow.patch
@@ -1,21 +1,21 @@
-From 13cfb73b1070b1c2beb7cac43a18bba1ab364f14 Mon Sep 17 00:00:00 2001
+From 2b103fe6990bafb386d6f036068ad35713903817 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 13:37:23 +0800
-Subject: [PATCH 2001/2028] mtk: wifi: mt76: rework wed rx flow
+Subject: [PATCH 2001/2032] mtk: wifi: mt76: rework wed rx flow
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
  dma.c           | 125 +++++++++++++++++++++++++++++++-----------------
  mac80211.c      |   2 +-
- mmio.c          |  57 ++++++++++++++--------
  mt76.h          |  25 ++++++----
  mt7915/mmio.c   |   3 +-
  mt7915/mt7915.h |   1 +
  tx.c            |  16 +++----
+ wed.c           |  57 ++++++++++++++--------
  7 files changed, 144 insertions(+), 85 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 028c2fd5..16cb23b4 100644
+index d076faa1..f4ecd117 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -64,17 +64,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -127,7 +127,7 @@
  	}
  	local_bh_enable();
  }
-@@ -227,10 +227,10 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -225,10 +225,10 @@ void mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
  
  static int
  mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
@@ -140,7 +140,7 @@
  	struct mt76_desc *desc;
  	int idx = q->head;
  	u32 buf1 = 0, ctrl;
-@@ -251,13 +251,15 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -249,13 +249,15 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  #endif
  
  	if (mt76_queue_is_wed_rx(q)) {
@@ -161,7 +161,7 @@
  			return -ENOMEM;
  		}
  
-@@ -273,7 +275,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -271,7 +273,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  done:
  	entry->dma_addr[0] = buf->addr;
  	entry->dma_len[0] = buf->len;
@@ -170,7 +170,7 @@
  	entry->buf = data;
  	entry->wcid = 0xffff;
  	entry->skip_buf1 = true;
-@@ -422,7 +424,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
+@@ -420,7 +422,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
  
  static void *
  mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -179,7 +179,7 @@
  {
  	struct mt76_queue_entry *e = &q->entry[idx];
  	struct mt76_desc *desc = &q->desc[idx];
-@@ -447,20 +449,53 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -445,20 +447,53 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  	if (mt76_queue_is_wed_rx(q)) {
  		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN, buf1);
@@ -240,7 +240,7 @@
  		if (drop)
  			*drop |= !!(buf1 & MT_DMA_CTL_WO_DROP);
  	} else {
-@@ -497,7 +532,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+@@ -495,7 +530,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
  	q->tail = (q->tail + 1) % q->ndesc;
  	q->queued--;
  
@@ -249,7 +249,7 @@
  }
  
  static int
-@@ -668,7 +703,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -666,7 +701,7 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  done:
  		qbuf.len = len - offset;
  		qbuf.skip_unmap = false;
@@ -259,7 +259,7 @@
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
 diff --git a/mac80211.c b/mac80211.c
-index 885577fc..ff5f4853 100644
+index 380a74e4..91e771d3 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -595,7 +595,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -278,115 +278,8 @@
  
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
-diff --git a/mmio.c b/mmio.c
-index 6c28e27b..b792a7bd 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -89,28 +89,45 @@ EXPORT_SYMBOL_GPL(mt76_set_irq_mask);
- void mt76_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- {
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
--	u32 length;
-+	struct page *page;
- 	int i;
- 
--	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
--				sizeof(struct skb_shared_info));
--
- 	for (i = 0; i < dev->rx_token_size; i++) {
--		struct mt76_txwi_cache *t;
-+		struct mt76_rxwi_cache *r;
- 
--		t = mt76_rx_token_release(dev, i);
--		if (!t || !t->ptr)
-+		r = mt76_rx_token_release(dev, i);
-+		if (!r || !r->ptr)
- 			continue;
- 
--		dma_unmap_single(dev->dma_dev, t->dma_addr,
-+		dma_unmap_single(dev->dma_dev, r->dma_addr,
- 				 wed->wlan.rx_size, DMA_FROM_DEVICE);
--		__free_pages(virt_to_page(t->ptr), get_order(length));
--		t->ptr = NULL;
-+		skb_free_frag(r->ptr);
-+		r->ptr = NULL;
- 
--		mt76_put_rxwi(dev, t);
-+		mt76_put_rxwi(dev, r);
- 	}
- 
- 	mt76_free_pending_rxwi(dev);
-+
-+	mt76_for_each_q_rx(dev, i) {
-+		struct mt76_queue *q = &dev->q_rx[i];
-+
-+		if (mt76_queue_is_wed_rx(q)) {
-+			if (!q->rx_page.va)
-+				continue;
-+
-+			page = virt_to_page(q->rx_page.va);
-+			__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
-+			memset(&q->rx_page, 0, sizeof(q->rx_page));
-+		}
-+	}
-+
-+	if (!wed->rx_buf_ring.rx_page.va)
-+		return;
-+
-+	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
-+	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
-+	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
- }
- EXPORT_SYMBOL_GPL(mt76_mmio_wed_release_rx_buf);
- 
-@@ -125,18 +142,18 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 				sizeof(struct skb_shared_info));
- 
- 	for (i = 0; i < size; i++) {
--		struct mt76_txwi_cache *t = mt76_get_rxwi(dev);
-+		struct mt76_rxwi_cache *r = mt76_get_rxwi(dev);
- 		dma_addr_t addr;
- 		struct page *page;
- 		int token;
- 		void *ptr;
- 
--		if (!t)
-+		if (!r)
- 			goto unmap;
- 
--		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
--		if (!page) {
--			mt76_put_rxwi(dev, t);
-+		ptr = page_frag_alloc(&wed->rx_buf_ring.rx_page, length, GFP_ATOMIC);
-+		if (!ptr) {
-+			mt76_put_rxwi(dev, r);
-  			goto unmap;
- 		}
- 
-@@ -146,17 +163,17 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 
- 		if (unlikely(dma_mapping_error(dev->dev, addr))) {
- 			skb_free_frag(ptr);
--			mt76_put_rxwi(dev, t);
-+			mt76_put_rxwi(dev, r);
- 			goto unmap;
- 		}
- 
- 		desc->buf0 = cpu_to_le32(addr);
--		token = mt76_rx_token_consume(dev, ptr, t, addr);
-+		token = mt76_rx_token_consume(dev, ptr, r, addr);
- 		if (token < 0) {
- 			dma_unmap_single(dev->dma_dev, addr,
- 					 wed->wlan.rx_size, DMA_TO_DEVICE);
--			__free_pages(page, get_order(length));
--			mt76_put_rxwi(dev, t);
-+			skb_free_frag(ptr);
-+			mt76_put_rxwi(dev, r);
- 			goto unmap;
- 		}
- 
 diff --git a/mt76.h b/mt76.h
-index e7b798b2..17b39179 100644
+index ce4e87b4..59cf6a16 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -200,6 +200,7 @@ struct mt76_queue_entry {
@@ -397,7 +290,7 @@
  		struct urb *urb;
  		int buf_sz;
  	};
-@@ -410,12 +411,16 @@ struct mt76_txwi_cache {
+@@ -411,12 +412,16 @@ struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
  
@@ -419,7 +312,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -503,6 +508,7 @@ struct mt76_driver_ops {
+@@ -504,6 +509,7 @@ struct mt76_driver_ops {
  	u16 txwi_size;
  	u16 token_size;
  	u8 mcs_rates;
@@ -427,7 +320,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  
-@@ -880,7 +886,6 @@ struct mt76_dev {
+@@ -881,7 +887,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -435,7 +328,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1547,8 +1552,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1563,8 +1568,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -446,7 +339,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1734,9 +1739,9 @@ struct mt76_txwi_cache *
+@@ -1743,9 +1748,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -459,19 +352,19 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index aff4f21e..9657636e 100644
+index 6004d64f..5938bd9f 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -680,7 +680,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -714,7 +714,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.reset = mt7915_mmio_wed_reset;
- 	wed->wlan.reset_complete = mt76_mmio_wed_reset_complete;
+ 	wed->wlan.reset_complete = mt76_wed_reset_complete;
  
 -	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
 +	dev->mt76.rx_token_size += wed->wlan.rx_npkt;
  
  	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -886,6 +886,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -921,6 +921,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  				SURVEY_INFO_TIME_RX |
  				SURVEY_INFO_TIME_BSS_RX,
  		.token_size = MT7915_TOKEN_SIZE,
@@ -480,7 +373,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4727d9c7..ec224b46 100644
+index 6e79bc65..e5a86759 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,6 +62,7 @@
@@ -536,6 +429,113 @@
 +	return r;
  }
  EXPORT_SYMBOL_GPL(mt76_rx_token_release);
+diff --git a/wed.c b/wed.c
+index 8eca4d81..0a0b5c05 100644
+--- a/wed.c
++++ b/wed.c
+@@ -9,28 +9,45 @@
+ void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
+ {
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+-	u32 length;
++	struct page *page;
+ 	int i;
+ 
+-	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
+-				sizeof(struct skb_shared_info));
+-
+ 	for (i = 0; i < dev->rx_token_size; i++) {
+-		struct mt76_txwi_cache *t;
++		struct mt76_rxwi_cache *r;
+ 
+-		t = mt76_rx_token_release(dev, i);
+-		if (!t || !t->ptr)
++		r = mt76_rx_token_release(dev, i);
++		if (!r || !r->ptr)
+ 			continue;
+ 
+-		dma_unmap_single(dev->dma_dev, t->dma_addr,
++		dma_unmap_single(dev->dma_dev, r->dma_addr,
+ 				 wed->wlan.rx_size, DMA_FROM_DEVICE);
+-		__free_pages(virt_to_page(t->ptr), get_order(length));
+-		t->ptr = NULL;
++		skb_free_frag(r->ptr);
++		r->ptr = NULL;
+ 
+-		mt76_put_rxwi(dev, t);
++		mt76_put_rxwi(dev, r);
+ 	}
+ 
+ 	mt76_free_pending_rxwi(dev);
++
++	mt76_for_each_q_rx(dev, i) {
++		struct mt76_queue *q = &dev->q_rx[i];
++
++		if (mt76_queue_is_wed_rx(q)) {
++			if (!q->rx_page.va)
++				continue;
++
++			page = virt_to_page(q->rx_page.va);
++			__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++			memset(&q->rx_page, 0, sizeof(q->rx_page));
++		}
++	}
++
++	if (!wed->rx_buf_ring.rx_page.va)
++		return;
++
++	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
++	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
++	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
+ }
+ EXPORT_SYMBOL_GPL(mt76_wed_release_rx_buf);
+ 
+@@ -46,18 +63,18 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 				sizeof(struct skb_shared_info));
+ 
+ 	for (i = 0; i < size; i++) {
+-		struct mt76_txwi_cache *t = mt76_get_rxwi(dev);
++		struct mt76_rxwi_cache *r = mt76_get_rxwi(dev);
+ 		dma_addr_t addr;
+ 		struct page *page;
+ 		int token;
+ 		void *ptr;
+ 
+-		if (!t)
++		if (!r)
+ 			goto unmap;
+ 
+-		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
+-		if (!page) {
+-			mt76_put_rxwi(dev, t);
++		ptr = page_frag_alloc(&wed->rx_buf_ring.rx_page, length, GFP_ATOMIC);
++		if (!ptr) {
++			mt76_put_rxwi(dev, r);
+ 			goto unmap;
+ 		}
+ 
+@@ -67,17 +84,17 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 
+ 		if (unlikely(dma_mapping_error(dev->dev, addr))) {
+ 			skb_free_frag(ptr);
+-			mt76_put_rxwi(dev, t);
++			mt76_put_rxwi(dev, r);
+ 			goto unmap;
+ 		}
+ 
+ 		desc->buf0 = cpu_to_le32(addr);
+-		token = mt76_rx_token_consume(dev, ptr, t, addr);
++		token = mt76_rx_token_consume(dev, ptr, r, addr);
+ 		if (token < 0) {
+ 			dma_unmap_single(dev->dma_dev, addr,
+ 					 wed->wlan.rx_size, DMA_TO_DEVICE);
+-			__free_pages(page, get_order(length));
+-			mt76_put_rxwi(dev, t);
++			skb_free_frag(ptr);
++			mt76_put_rxwi(dev, r);
+ 			goto unmap;
+ 		}
+ 
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2002-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2002-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
index 5d80a5a..1ad01a8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2002-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2002-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
@@ -1,7 +1,7 @@
-From b718316b79f5b7f7a361ca9a6ac4c6eb9c67d75a Mon Sep 17 00:00:00 2001
+From 7d98801b7316b08f29d6dac3f2459ae45196850e Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Apr 2023 17:13:41 +0800
-Subject: [PATCH 2002/2028] mtk: wifi: mt76: wed: change wed token init size to
+Subject: [PATCH 2002/2032] mtk: wifi: mt76: wed: change wed token init size to
  adapt wed3.0
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2003-mtk-wifi-mt76-add-random-early-drop-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2003-mtk-wifi-mt76-add-random-early-drop-support.patch
index 5df456d..997ccd6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2003-mtk-wifi-mt76-add-random-early-drop-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2003-mtk-wifi-mt76-add-random-early-drop-support.patch
@@ -1,7 +1,7 @@
-From 6b324ee1a5c9293c2027ac231ee4ac829e0bc766 Mon Sep 17 00:00:00 2001
+From 5bf8bbd55bc552022024ea5461bd4f30e0fddab4 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 19 Apr 2023 18:32:41 +0800
-Subject: [PATCH 2003/2028] mtk: wifi: mt76: add random early drop support
+Subject: [PATCH 2003/2032] mtk: wifi: mt76: add random early drop support
 
 ---
  mt7996/debugfs.c     |  1 +
@@ -15,7 +15,7 @@
  8 files changed, 167 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index cdd284b7..21bb2c5d 100644
+index a97706f5..37b36dce 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -629,6 +629,7 @@ mt7996_tx_stats_show(struct seq_file *file, void *data)
@@ -27,7 +27,7 @@
  	mt7996_txbf_stat_read_phy(phy, file);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 408a59c5..a9d8f7dd 100644
+index 31ec6f89..26bed9e2 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1176,6 +1176,13 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
@@ -45,10 +45,10 @@
  		}
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1232bc70..97874bb4 100644
+index ff811357..c969e4d9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3155,8 +3155,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
+@@ -3142,8 +3142,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -59,7 +59,7 @@
  }
  
  int mt7996_mcu_init(struct mt7996_dev *dev)
-@@ -3188,6 +3188,83 @@ out:
+@@ -3175,6 +3175,83 @@ out:
  	skb_queue_purge(&dev->mt76.mcu.res_q);
  }
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2004-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2004-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
index ffaf5b9..9bc1587 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2004-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2004-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
@@ -1,7 +1,7 @@
-From 411816e1b90c216347406bc3f1c57d2affa0dee4 Mon Sep 17 00:00:00 2001
+From dca83d64aecd90492867a471db310b618b00ae0c Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 18 May 2023 15:01:47 +0800
-Subject: [PATCH 2004/2028] mtk: wifi: mt76: mt7996: reset addr_elem when
+Subject: [PATCH 2004/2032] mtk: wifi: mt76: mt7996: reset addr_elem when
  delete ba
 
 The old addr element info may be used when the signature is not equel to
@@ -20,10 +20,10 @@
  2 files changed, 47 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 17b39179..2ce1e84e 100644
+index 59cf6a16..1080384b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -438,6 +438,7 @@ struct mt76_rx_tid {
+@@ -439,6 +439,7 @@ struct mt76_rx_tid {
  	u16 nframes;
  
  	u8 num;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2005-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2005-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
index 4232013..33076e2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2005-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2005-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
@@ -1,7 +1,7 @@
-From 2754f1c8c5d3aad42f25b86b63f322f5b6862857 Mon Sep 17 00:00:00 2001
+From 662e607bf3bbc4d5c433116d183cd5ca150525c8 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 6 Oct 2023 14:01:41 +0800
-Subject: [PATCH 2005/2028] mtk: wifi: mt76 : wed : change pcie0 R5 to pcie1 to
+Subject: [PATCH 2005/2032] mtk: wifi: mt76 : wed : change pcie0 R5 to pcie1 to
  get 6G ICS
 
 ---
@@ -11,10 +11,10 @@
  3 files changed, 10 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 8e29ab06..40ab65f8 100644
+index 759a58e8..5d85e9ea 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
-@@ -537,6 +537,10 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -538,6 +538,10 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  	if (mt7996_band_valid(dev, MT_BAND2)) {
  		/* rx data queue for mt7996 band2 */
  		rx_base = MT_RXQ_RING_BASE(MT_RXQ_BAND2) + hif1_ofs;
@@ -26,7 +26,7 @@
  				       MT_RXQ_ID(MT_RXQ_BAND2),
  				       MT7996_RX_RING_SIZE,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 00063e72..d908c795 100644
+index 20415e3c..aedf4edc 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -638,10 +638,8 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
@@ -43,10 +43,10 @@
  
  	return 0;
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index d3d34f04..4814897c 100644
+index fd4d41d9..12250f9e 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
-@@ -532,12 +532,15 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
+@@ -527,12 +527,15 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
  					       dev->mt76.mmio.irqmask);
  		if (intr1 & MT_INT_RX_TXFREE_EXT)
  			napi_schedule(&dev->mt76.napi[MT_RXQ_TXFREE_BAND2]);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2006-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2006-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
index 3755b92..0eb3342 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2006-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2006-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
@@ -1,7 +1,7 @@
-From d3fd0f1eb8faa1dae61798758b62d027dd7ad958 Mon Sep 17 00:00:00 2001
+From 9d1fde2b172d48638556f5c326792f3de6d85973 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Tue, 23 May 2023 12:06:29 +0800
-Subject: [PATCH 2006/2028] mtk: wifi: mt76: add SER support for wed3.0
+Subject: [PATCH 2006/2032] mtk: wifi: mt76: add SER support for wed3.0
 
 ---
  dma.c         | 5 +++--
@@ -9,26 +9,26 @@
  2 files changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 16cb23b4..dfce79fa 100644
+index f4ecd117..89ae929f 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -910,8 +910,9 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -833,8 +833,9 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  
  	/* reset WED rx queues */
- 	mt76_dma_wed_setup(dev, q, true);
+ 	mt76_wed_dma_setup(dev, q, true);
 -
 -	if (!mt76_queue_is_wed_tx_free(q)) {
 +	if (!mt76_queue_is_wed_tx_free(q) &&
 +	    !(mt76_queue_is_wed_rro(q) &&
 +	    mtk_wed_device_active(&dev->mmio.wed))) {
  		mt76_dma_sync_idx(dev, q);
- 		mt76_dma_rx_fill(dev, q);
+ 		mt76_dma_rx_fill(dev, q, false);
  	}
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 4814897c..488f5103 100644
+index 12250f9e..e033a785 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
-@@ -302,6 +302,7 @@ out:
+@@ -297,6 +297,7 @@ out:
  
  	return ret;
  }
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2007-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2007-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
index b722dea..f99c32b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2007-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2007-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
@@ -1,7 +1,7 @@
-From 66913f29a6f44a588926788f393eb887d2997bfd Mon Sep 17 00:00:00 2001
+From 3fd9079da8481df27e2ce65a99e3638bae6c7a33 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Jul 2023 10:55:09 +0800
-Subject: [PATCH 2007/2028] mtk: wifi: mt76: mt7915: wed: find rx token by
+Subject: [PATCH 2007/2032] mtk: wifi: mt76: mt7915: wed: find rx token by
  physical address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -14,10 +14,10 @@
  1 file changed, 25 insertions(+), 2 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index dfce79fa..69333769 100644
+index 89ae929f..6bfcee1a 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -448,9 +448,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -446,9 +446,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  	mt76_dma_should_drop_buf(drop, ctrl, buf1, desc_info);
  
  	if (mt76_queue_is_wed_rx(q)) {
@@ -51,7 +51,7 @@
  		if (!r)
  			return NULL;
  
-@@ -978,7 +1001,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -901,7 +924,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		if (!data)
  			break;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2008-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2008-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
index 0e40b9d..6108b6b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2008-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2008-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
@@ -1,19 +1,19 @@
-From 0a1fef8b518288d0fed1df86a95fdf04fc611db8 Mon Sep 17 00:00:00 2001
+From da80c597a654bba39a056543c9fdcf71f28a4a68 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 20 Jul 2023 10:25:50 +0800
-Subject: [PATCH 2008/2028] mtk: wifi: mt76: mt7996: add dma mask limitation
+Subject: [PATCH 2008/2032] mtk: wifi: mt76: mt7996: add dma mask limitation
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
- dma.c  | 4 ++--
- mmio.c | 4 ++--
+ dma.c | 4 ++--
+ wed.c | 4 ++--
  2 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 69333769..5bff27dd 100644
+index 6bfcee1a..6a30adcc 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -490,7 +490,7 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -488,7 +488,7 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		} else {
  			struct mt76_queue_buf qbuf;
  
@@ -22,7 +22,7 @@
  			if (!buf)
  				return NULL;
  
-@@ -712,7 +712,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -710,7 +710,7 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  		if (mt76_queue_is_wed_rro_ind(q))
  			goto done;
  
@@ -31,11 +31,11 @@
  		if (!buf)
  			break;
  
-diff --git a/mmio.c b/mmio.c
-index b792a7bd..269fd932 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -144,14 +144,14 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+diff --git a/wed.c b/wed.c
+index 0a0b5c05..1c6d53c8 100644
+--- a/wed.c
++++ b/wed.c
+@@ -65,14 +65,14 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  	for (i = 0; i < size; i++) {
  		struct mt76_rxwi_cache *r = mt76_get_rxwi(dev);
  		dma_addr_t addr;
@@ -51,7 +51,7 @@
 +				      GFP_ATOMIC | GFP_DMA32);
  		if (!ptr) {
  			mt76_put_rxwi(dev, r);
-  			goto unmap;
+ 			goto unmap;
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2009-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2009-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
index 9986fb0..0fd2a0d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2009-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2009-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
@@ -1,7 +1,7 @@
-From 41bbf8a772f11e565ea2a6ee7b3fd26e43f315a3 Mon Sep 17 00:00:00 2001
+From 4ea30536b63156f7ab2a12d1831ca13950fe51b5 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Fri, 18 Aug 2023 10:17:08 +0800
-Subject: [PATCH 2009/2028] mtk: wifi: mt76: mt7996: add per bss statistic info
+Subject: [PATCH 2009/2032] mtk: wifi: mt76: mt7996: add per bss statistic info
 
 Whenever WED is enabled, unicast traffic might run through HW path.
 As a result, we need to count them using WM event.
@@ -22,7 +22,7 @@
  3 files changed, 37 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index d908c795..19a7cd10 100644
+index aedf4edc..518f70e4 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -390,6 +390,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -34,7 +34,7 @@
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f4d50ec1..3d6cc25a 100644
+index 4a5697a3..4880807e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -251,6 +251,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -46,7 +46,7 @@
  
  	mt7996_mac_wtbl_update(dev, idx,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 97874bb4..9076020e 100644
+index c969e4d9..5d19d6fc 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -521,6 +521,27 @@ mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rat
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2010-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2010-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
index 58fb493..f887c55 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2010-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2010-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
@@ -1,7 +1,7 @@
-From 1861ed32781234084364c8b77fcd8aa7a220654c Mon Sep 17 00:00:00 2001
+From 63d8c717443332fe21313e30e2301c5c9d8a4eb9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 26 Oct 2023 17:27:43 +0800
-Subject: [PATCH 2010/2028] mtk: wifi: mt76: mt7996: do not report netdev stats
+Subject: [PATCH 2010/2032] mtk: wifi: mt76: mt7996: do not report netdev stats
  on monitor vif
 
 This fixes the following NULL pointer crash when enabling monitor mode:
@@ -19,7 +19,7 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9076020e..8bb29e3a 100644
+index 5d19d6fc..ea22aa41 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -537,6 +537,9 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2011-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2011-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
index 2b0c138..7d267fe 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2011-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2011-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
@@ -1,7 +1,7 @@
-From 3e5f0df52e16d5dfab197af0e8768b906fa611a5 Mon Sep 17 00:00:00 2001
+From aff85911d271637879c9cd0a60f159bcc63594a3 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Mon, 11 Sep 2023 16:35:15 +0800
-Subject: [PATCH 2011/2028] mtk: wifi: mt76: mt7996: add support for HW-ATF
+Subject: [PATCH 2011/2032] mtk: wifi: mt76: mt7996: add support for HW-ATF
 
 ---
  mt7996/debugfs.c |  90 ++++++++++++++++
@@ -13,10 +13,10 @@
  6 files changed, 475 insertions(+), 26 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 21bb2c5d..ed55afa0 100644
+index 37b36dce..c4adee9a 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -895,6 +895,91 @@ DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_muru_disable,
+@@ -935,6 +935,91 @@ DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_muru_disable,
  			 mt7996_fw_debug_muru_disable_get,
  			 mt7996_fw_debug_muru_disable_set, "%lld\n");
  
@@ -108,10 +108,10 @@
  int mt7996_init_debugfs(struct mt7996_phy *phy)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -921,6 +1006,11 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
+@@ -962,6 +1047,11 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
  				    mt7996_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
+ 	debugfs_create_file("otp", 0400, dir, dev, &mt7996_efuse_ops);
 +	debugfs_create_devm_seqfile(dev->mt76.dev, "vow_info", dir,
 +	                            mt7996_vow_info_read);
 +	debugfs_create_file("atf_enable", 0600, dir, phy, &fops_atf_enable);
@@ -121,7 +121,7 @@
  	if (phy->mt76->cap.has_5ghz) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 19a7cd10..d2cd2221 100644
+index 518f70e4..b902bcc5 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -562,6 +562,37 @@ int mt7996_txbf_init(struct mt7996_dev *dev)
@@ -189,7 +189,7 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a9d8f7dd..d51f4129 100644
+index 26bed9e2..339c92bb 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -103,6 +103,7 @@ static void mt7996_mac_sta_poll(struct mt7996_dev *dev)
@@ -220,10 +220,10 @@
  
  		/* get signal strength of resp frames (CTS/BA/ACK) */
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8bb29e3a..c7f9e308 100644
+index ea22aa41..6aa37d44 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2233,34 +2233,37 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2220,34 +2220,37 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  }
  
  static int
@@ -285,7 +285,7 @@
  }
  
  int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-@@ -2316,7 +2319,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2303,7 +2306,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
  	}
  
@@ -294,7 +294,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -5152,6 +5155,218 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -5140,6 +5143,218 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  				 &req, sizeof(req), false);
  }
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2012-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2012-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
index 5dd51c1..0f3c078 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2012-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2012-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
@@ -1,38 +1,39 @@
-From 14d56cbefbd6f72d82d18534da6dd445e6ddd266 Mon Sep 17 00:00:00 2001
+From 52dd48547a15ef9060f3f594660c846268b763e3 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 12 Oct 2023 10:04:54 +0800
-Subject: [PATCH 2012/2028] mtk: wifi: mt76: mt7996: wed: add SER0.5 support w/
+Subject: [PATCH 2012/2032] mtk: wifi: mt76: mt7996: wed: add SER0.5 support w/
  wed3.0
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
- dma.c           |  13 ++---
- dma.h           |   2 +-
+ dma.c           |   9 ++--
+ dma.h           |   4 +-
  mt76.h          |  14 ++++--
  mt792x_dma.c    |   6 +--
  mt7996/dma.c    |  20 ++++++--
  mt7996/init.c   | 127 +++++++++++++++++++++++++++++++-----------------
  mt7996/mac.c    |  25 ++++++++++
  mt7996/mt7996.h |   1 +
- 8 files changed, 145 insertions(+), 63 deletions(-)
+ wed.c           |   4 +-
+ 9 files changed, 146 insertions(+), 64 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 5bff27dd..5ddb6be9 100644
+index 6a30adcc..a5225db5 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -220,9 +220,9 @@ __mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -218,9 +218,9 @@ void __mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q,
+ 	mt76_dma_sync_idx(dev, q);
  }
  
- static void
--mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
-+mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+-void mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
++void mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  {
 -	__mt76_dma_queue_reset(dev, q, true);
 +	__mt76_dma_queue_reset(dev, q, reset);
  }
  
  static int
-@@ -542,7 +542,8 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+@@ -540,7 +540,8 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
  	if (!q->queued)
  		return NULL;
  
@@ -42,25 +43,7 @@
  		return NULL;
  
  	if (!mt76_queue_is_wed_rro_ind(q)) {
-@@ -772,7 +773,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
- 	case MT76_WED_Q_TXFREE:
- 		/* WED txfree queue needs ring to be initialized before setup */
- 		q->flags = 0;
--		mt76_dma_queue_reset(dev, q);
-+		mt76_dma_queue_reset(dev, q, true);
- 		mt76_dma_rx_fill(dev, q);
- 
- 		ret = mtk_wed_device_txfree_ring_setup(q->wed, q->regs);
-@@ -801,7 +802,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
- 		break;
- 	case MT76_WED_RRO_Q_IND:
- 		q->flags &= ~MT_QFLAG_WED;
--		mt76_dma_queue_reset(dev, q);
-+		mt76_dma_queue_reset(dev, q, true);
- 		mt76_dma_rx_fill(dev, q);
- 		mtk_wed_device_ind_rx_ring_setup(q->wed, q->regs);
- 		break;
-@@ -868,7 +869,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -791,7 +792,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  			return 0;
  	}
  
@@ -70,32 +53,38 @@
  	return 0;
  }
 diff --git a/dma.h b/dma.h
-index c479cc63..b7e63bd5 100644
+index 1de5a2b2..3a8c2e55 100644
 --- a/dma.h
 +++ b/dma.h
-@@ -85,7 +85,7 @@ void mt76_dma_wed_reset(struct mt76_dev *dev);
+@@ -83,12 +83,12 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+ 		     bool allow_direct);
+ void __mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q,
+ 			    bool reset_idx);
+-void mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q);
++void mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
+ 
  static inline void
  mt76_dma_reset_tx_queue(struct mt76_dev *dev, struct mt76_queue *q)
  {
 -	dev->queue_ops->reset_q(dev, q);
 +	dev->queue_ops->reset_q(dev, q, true);
  	if (mtk_wed_device_active(&dev->mmio.wed))
- 		mt76_dma_wed_setup(dev, q, true);
+ 		mt76_wed_dma_setup(dev, q, true);
  }
 diff --git a/mt76.h b/mt76.h
-index 2ce1e84e..cf88eafa 100644
+index 1080384b..fbf66407 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -295,7 +295,7 @@ struct mt76_queue_ops {
+@@ -296,7 +296,7 @@ struct mt76_queue_ops {
  
  	void (*kick)(struct mt76_dev *dev, struct mt76_queue *q);
  
 -	void (*reset_q)(struct mt76_dev *dev, struct mt76_queue *q);
-+	void (*reset_q)(struct mt76_dev *dev, struct mt76_queue *q,  bool reset);
++	void (*reset_q)(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
  };
  
  enum mt76_phy_type {
-@@ -1722,8 +1722,13 @@ static inline bool mt76_queue_is_wed_rro_ind(struct mt76_queue *q)
+@@ -1731,8 +1731,13 @@ static inline bool mt76_queue_is_wed_rro_ind(struct mt76_queue *q)
  static inline bool mt76_queue_is_wed_rro_data(struct mt76_queue *q)
  {
  	return mt76_queue_is_wed_rro(q) &&
@@ -111,7 +100,7 @@
  }
  
  static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
-@@ -1732,7 +1737,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
+@@ -1741,7 +1746,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
  		return false;
  
  	return FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX ||
@@ -122,10 +111,10 @@
  }
  
 diff --git a/mt792x_dma.c b/mt792x_dma.c
-index 488326ce..8811351c 100644
+index 5cc2d59b..c224bcc8 100644
 --- a/mt792x_dma.c
 +++ b/mt792x_dma.c
-@@ -172,13 +172,13 @@ mt792x_dma_reset(struct mt792x_dev *dev, bool force)
+@@ -181,13 +181,13 @@ mt792x_dma_reset(struct mt792x_dev *dev, bool force)
  
  	/* reset hw queues */
  	for (i = 0; i < __MT_TXQ_MAX; i++)
@@ -143,10 +132,10 @@
  	mt76_tx_status_check(&dev->mt76, true);
  
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 40ab65f8..8df119d0 100644
+index 5d85e9ea..d9e1b17f 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
-@@ -710,21 +710,31 @@ void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
+@@ -711,21 +711,31 @@ void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
  	}
  
  	for (i = 0; i < __MT_MCUQ_MAX; i++)
@@ -184,7 +173,7 @@
  	mt7996_dma_enable(dev, !force);
  }
 diff --git a/mt7996/init.c b/mt7996/init.c
-index d2cd2221..32f2db33 100644
+index b902bcc5..a9720120 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -724,11 +724,91 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
@@ -334,10 +323,10 @@
  #else
  	return 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d51f4129..19e66256 100644
+index 339c92bb..53049672 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1755,6 +1755,31 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+@@ -1756,6 +1756,31 @@ mt7996_mac_restart(struct mt7996_dev *dev)
  	if (ret)
  		goto out;
  
@@ -381,6 +370,28 @@
  irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
  u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
+diff --git a/wed.c b/wed.c
+index 1c6d53c8..61a6badf 100644
+--- a/wed.c
++++ b/wed.c
+@@ -155,7 +155,7 @@ int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+ 	case MT76_WED_Q_TXFREE:
+ 		/* WED txfree queue needs ring to be initialized before setup */
+ 		q->flags = 0;
+-		mt76_dma_queue_reset(dev, q);
++		mt76_dma_queue_reset(dev, q, true);
+ 		mt76_dma_rx_fill(dev, q, false);
+ 
+ 		ret = mtk_wed_device_txfree_ring_setup(q->wed, q->regs);
+@@ -184,7 +184,7 @@ int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+ 		break;
+ 	case MT76_WED_RRO_Q_IND:
+ 		q->flags &= ~MT_QFLAG_WED;
+-		mt76_dma_queue_reset(dev, q);
++		mt76_dma_queue_reset(dev, q, true);
+ 		mt76_dma_rx_fill(dev, q, false);
+ 		mtk_wed_device_ind_rx_ring_setup(q->wed, q->regs);
+ 		break;
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2013-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2013-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
index dae855a..1ab2408 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2013-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2013-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
@@ -1,7 +1,7 @@
-From 5fcb64a1ec7d90bdecd63ebcdb5676c4616d20cd Mon Sep 17 00:00:00 2001
+From f6a39ce81cf18154d27f027afe243e988f98deba Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 6 Oct 2023 20:59:42 +0800
-Subject: [PATCH 2013/2028] mtk: wifi: mt76: mt7996: support backaward
+Subject: [PATCH 2013/2032] mtk: wifi: mt76: mt7996: support backaward
  compatiable
 
 revert upstream wed trigger mode to polling mode
@@ -16,7 +16,6 @@
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
- mmio.c          |  2 +-
  mt7996/dma.c    |  2 +-
  mt7996/mac.c    |  2 +-
  mt7996/main.c   |  6 +++---
@@ -24,26 +23,14 @@
  mt7996/mmio.c   | 20 +++++++++++---------
  mt7996/mt7996.h |  1 +
  mt7996/pci.c    | 17 +++++++++--------
+ wed.c           |  2 +-
  8 files changed, 28 insertions(+), 24 deletions(-)
 
-diff --git a/mmio.c b/mmio.c
-index 269fd932..117da4d1 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -134,7 +134,7 @@ EXPORT_SYMBOL_GPL(mt76_mmio_wed_release_rx_buf);
- u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- {
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
--	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
-+	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
- 	u32 length;
- 	int i;
- 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 8df119d0..773bab71 100644
+index d9e1b17f..eac5b9ed 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
-@@ -431,7 +431,7 @@ int mt7996_dma_rro_init(struct mt7996_dev *dev)
+@@ -432,7 +432,7 @@ int mt7996_dma_rro_init(struct mt7996_dev *dev)
  	irq_mask = mdev->mmio.irqmask | MT_INT_RRO_RX_DONE |
  		   MT_INT_TX_DONE_BAND2;
  	mt76_wr(dev, MT_INT_MASK_CSR, irq_mask);
@@ -53,10 +40,10 @@
  
  	return 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 19e66256..8171a43d 100644
+index 53049672..4b51f388 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1998,7 +1998,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1999,7 +1999,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
  
@@ -66,7 +53,7 @@
  		mt7996_irq_enable(dev, wed_irq_mask);
  		mt7996_irq_disable(dev, 0);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3d6cc25a..73bf5eea 100644
+index 4880807e..becfe20a 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1601,10 +1601,10 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -84,10 +71,10 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c7f9e308..0fe713d6 100644
+index 6aa37d44..3a816713 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3262,7 +3262,7 @@ static int mt7996_mcu_wa_red_config(struct mt7996_dev *dev)
+@@ -3249,7 +3249,7 @@ static int mt7996_mcu_wa_red_config(struct mt7996_dev *dev)
  
  	if (!mtk_wed_device_active(&dev->mt76.mmio.wed))
  		req.token_per_src[RED_TOKEN_SRC_CNT - 1] =
@@ -97,7 +84,7 @@
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET),
  				 &req, sizeof(req), false);
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 488f5103..69d16dad 100644
+index e033a785..e32d3848 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -14,7 +14,7 @@
@@ -109,7 +96,7 @@
  module_param(wed_enable, bool, 0644);
  
  static const struct __base mt7996_reg_base[] = {
-@@ -352,14 +352,14 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -347,14 +347,14 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  		}
  
  		wed->wlan.wpdma_rx_glo = wed->wlan.phy_base + hif1_ofs + MT_WFDMA0_GLO_CFG;
@@ -127,7 +114,7 @@
  		wed->wlan.wpdma_int = wed->wlan.phy_base + MT_INT_SOURCE_CSR;
  		wed->wlan.wpdma_mask = wed->wlan.phy_base + MT_INT_MASK_CSR;
  		wed->wlan.wpdma_tx = wed->wlan.phy_base + MT_TXQ_RING_BASE(0) +
-@@ -367,7 +367,7 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -362,7 +362,7 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  
  		wed->wlan.wpdma_rx_glo = wed->wlan.phy_base + MT_WFDMA0_GLO_CFG;
  
@@ -136,7 +123,7 @@
  				     MT_RXQ_RING_BASE(MT7996_RXQ_BAND0) +
  				     MT7996_RXQ_BAND0 * MT_RING_SIZE;
  
-@@ -409,11 +409,11 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -404,11 +404,11 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  		dev->mt76.rx_token_size = MT7996_TOKEN_SIZE + wed->wlan.rx_npkt;
  	}
  
@@ -151,8 +138,8 @@
 +	wed->wlan.max_amsdu_len = 1536;
  
  	wed->wlan.init_buf = mt7996_wed_init_buf;
- 	wed->wlan.init_rx_buf = mt76_mmio_wed_init_rx_buf;
-@@ -431,6 +431,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+ 	wed->wlan.init_rx_buf = mt76_wed_init_rx_buf;
+@@ -426,6 +426,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
  
@@ -218,6 +205,19 @@
  	if (dev->hif2) {
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2))
  			mtk_wed_device_detach(&dev->mt76.mmio.wed_hif2);
+diff --git a/wed.c b/wed.c
+index 61a6badf..53dc7474 100644
+--- a/wed.c
++++ b/wed.c
+@@ -55,7 +55,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_release_rx_buf);
+ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ {
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+-	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
++	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
+ 	u32 length;
+ 	int i;
+ 
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2014-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2014-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
index f2e75f8..381dd86 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2014-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2014-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
@@ -1,7 +1,7 @@
-From e38f980034dbfe7b9345347035e6e4042c5deadd Mon Sep 17 00:00:00 2001
+From 8e485ad97007c39c041751c51dbcc3a6f342b654 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 8 Sep 2023 11:57:39 +0800
-Subject: [PATCH 2014/2028] mtk: wifi: mt76: mt7996: wed: add wed support for
+Subject: [PATCH 2014/2032] mtk: wifi: mt76: mt7996: wed: add wed support for
  mt7992
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
@@ -20,7 +20,7 @@
  7 files changed, 142 insertions(+), 48 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 773bab71..4c92f13b 100644
+index eac5b9ed..bdb9f585 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -77,18 +77,23 @@ static void mt7996_dma_config(struct mt7996_dev *dev)
@@ -75,7 +75,7 @@
  		mt76_wr(dev, MT_RXQ_BAND1_CTRL(MT_RXQ_MSDU_PAGE_BAND0) + ofs,
  			PREFETCH(0x4));
  		mt76_wr(dev, MT_RXQ_BAND1_CTRL(MT_RXQ_MSDU_PAGE_BAND1) + ofs,
-@@ -360,12 +370,16 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+@@ -361,12 +371,16 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  		 * so, redirect pcie0 rx ring3 interrupt to pcie1
  		 */
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
@@ -95,7 +95,7 @@
  	}
  
  	mt7996_dma_start(dev, reset, true);
-@@ -400,7 +414,7 @@ int mt7996_dma_rro_init(struct mt7996_dev *dev)
+@@ -401,7 +415,7 @@ int mt7996_dma_rro_init(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -104,7 +104,7 @@
  		/* rx msdu page queue for band1 */
  		mdev->q_rx[MT_RXQ_MSDU_PAGE_BAND1].flags =
  			MT_WED_RRO_Q_MSDU_PG(1) | MT_QFLAG_WED_RRO_EN;
-@@ -521,7 +535,9 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -522,7 +536,9 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  		return ret;
  
  	/* tx free notify event from WA for band0 */
@@ -115,7 +115,7 @@
  		dev->mt76.q_rx[MT_RXQ_MAIN_WA].flags = MT_WED_Q_TXFREE;
  		dev->mt76.q_rx[MT_RXQ_MAIN_WA].wed = wed;
  	}
-@@ -567,6 +583,11 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -568,6 +584,11 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  	} else if (mt7996_band_valid(dev, MT_BAND1)) {
  		/* rx data queue for mt7992 band1 */
  		rx_base = MT_RXQ_RING_BASE(MT_RXQ_BAND1) + hif1_ofs;
@@ -127,7 +127,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
  				       MT_RXQ_ID(MT_RXQ_BAND1),
  				       MT7996_RX_RING_SIZE,
-@@ -600,17 +621,29 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -601,17 +622,29 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  		if (ret)
  			return ret;
  
@@ -168,7 +168,7 @@
  		if (mt7996_band_valid(dev, MT_BAND2)) {
  			/* rx rro data queue for band2 */
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 32f2db33..12682c9b 100644
+index a9720120..7a9b9749 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -802,6 +802,7 @@ void mt7996_rro_hw_init(struct mt7996_dev *dev)
@@ -198,10 +198,10 @@
  				  MT7996_RRO_WINDOW_MAX_LEN * sizeof(*addr),
  				  &dev->wed_rro.session.phy_addr,
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8171a43d..751a960a 100644
+index 4b51f388..da7c387e 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1998,6 +1998,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1999,6 +1999,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
  
@@ -213,10 +213,10 @@
  					    true);
  		mt7996_irq_enable(dev, wed_irq_mask);
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 69d16dad..b5b97dcb 100644
+index e32d3848..b1600a97 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
-@@ -318,7 +318,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -313,7 +313,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  
  	dev->has_rro = true;
  
@@ -226,7 +226,7 @@
  
  	if (hif2)
  		wed = &dev->mt76.mmio.wed_hif2;
-@@ -353,8 +354,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -348,8 +349,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  
  		wed->wlan.wpdma_rx_glo = wed->wlan.phy_base + hif1_ofs + MT_WFDMA0_GLO_CFG;
  		wed->wlan.wpdma_rx[0] = wed->wlan.phy_base + hif1_ofs +
@@ -237,7 +237,7 @@
  
  		wed->wlan.chip_id = 0x7991;
  		wed->wlan.tx_tbit[0] = ffs(MT_INT_TX_DONE_BAND2) - 1;
-@@ -374,9 +375,19 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -369,9 +370,19 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  		wed->wlan.wpdma_rx_rro[0] = wed->wlan.phy_base +
  					    MT_RXQ_RING_BASE(MT7996_RXQ_RRO_BAND0) +
  					    MT7996_RXQ_RRO_BAND0 * MT_RING_SIZE;
@@ -260,7 +260,7 @@
  		wed->wlan.wpdma_rx_pg = wed->wlan.phy_base +
  					MT_RXQ_RING_BASE(MT7996_RXQ_MSDU_PG_BAND0) +
  					MT7996_RXQ_MSDU_PG_BAND0 * MT_RING_SIZE;
-@@ -386,10 +397,14 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -381,10 +392,14 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  		wed->wlan.rx_size = SKB_WITH_OVERHEAD(MT_RX_BUF_SIZE);
  
  		wed->wlan.rx_tbit[0] = ffs(MT_INT_RX_DONE_BAND0) - 1;
@@ -278,7 +278,7 @@
  
  		wed->wlan.rx_pg_tbit[0] = ffs(MT_INT_RX_DONE_MSDU_PG_BAND0) - 1;
  		wed->wlan.rx_pg_tbit[1] = ffs(MT_INT_RX_DONE_MSDU_PG_BAND1) - 1;
-@@ -397,14 +412,20 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -392,14 +407,20 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  
  		wed->wlan.tx_tbit[0] = ffs(MT_INT_TX_DONE_BAND0) - 1;
  		wed->wlan.tx_tbit[1] = ffs(MT_INT_TX_DONE_BAND1) - 1;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2015-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2015-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
index a4dfacc..824f4cd 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2015-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2015-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
@@ -1,7 +1,7 @@
-From f5e2909fcfb815fcc91530addcb7b36f052f5c15 Mon Sep 17 00:00:00 2001
+From ee0e35680a1a7d1acc84709e2045417df24899a6 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 13 Sep 2023 17:35:43 +0800
-Subject: [PATCH 2015/2028] mtk: wifi: mt76: mt7992: wed: add 2pcie one wed
+Subject: [PATCH 2015/2032] mtk: wifi: mt76: mt7992: wed: add 2pcie one wed
  support
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
@@ -14,10 +14,10 @@
  5 files changed, 39 insertions(+), 13 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 4c92f13b..80458b31 100644
+index bdb9f585..cf346845 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
-@@ -354,6 +354,13 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+@@ -355,6 +355,13 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  			 MT_WFDMA_HOST_CONFIG_PDMA_BAND |
  			 MT_WFDMA_HOST_CONFIG_BAND2_PCIE1);
  
@@ -31,7 +31,7 @@
  		/* AXI read outstanding number */
  		mt76_rmw(dev, MT_WFDMA_AXI_R2A_CTRL,
  			 MT_WFDMA_AXI_R2A_CTRL_OUTSTAND_MASK, 0x14);
-@@ -373,7 +380,8 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+@@ -374,7 +381,8 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
  		    dev->has_rro) {
  			u32 intr = is_mt7996(&dev->mt76) ?
  				   MT_WFDMA0_RX_INT_SEL_RING6 :
@@ -41,7 +41,7 @@
  			mt76_set(dev, MT_WFDMA0_RX_INT_PCIE_SEL + hif1_ofs,
  				 intr);
  		} else {
-@@ -629,10 +637,11 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+@@ -630,10 +638,11 @@ int mt7996_dma_init(struct mt7996_dev *dev)
  					       MT_RXQ_ID(MT_RXQ_RRO_BAND1),
  					       MT7996_RX_RING_SIZE,
  					       MT7996_RX_BUF_SIZE,
@@ -55,10 +55,10 @@
  			dev->mt76.q_rx[MT_RXQ_TXFREE_BAND0].wed = wed;
  
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index b5b97dcb..8faceb3b 100644
+index b1600a97..613b5185 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
-@@ -380,10 +380,10 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -375,10 +375,10 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  						    MT_RXQ_RING_BASE(MT7996_RXQ_RRO_BAND2) +
  						    MT7996_RXQ_RRO_BAND2 * MT_RING_SIZE;
  		} else {
@@ -71,7 +71,7 @@
  						MT_RXQ_RING_BASE(MT7996_RXQ_BAND1) +
  						MT7996_RXQ_BAND1 * MT_RING_SIZE;
  		}
-@@ -521,10 +521,9 @@ void mt7996_dual_hif_set_irq_mask(struct mt7996_dev *dev, bool write_reg,
+@@ -516,10 +516,9 @@ void mt7996_dual_hif_set_irq_mask(struct mt7996_dev *dev, bool write_reg,
  		if (mtk_wed_device_active(&mdev->mmio.wed)) {
  			mtk_wed_device_irq_set_mask(&mdev->mmio.wed,
  						    mdev->mmio.irqmask);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2016-mtk-wifi-mt76-mt7996-add-SER-state-log-for-debug.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2016-mtk-wifi-mt76-mt7996-add-SER-state-log-for-debug.patch
index a00645f..d88cf8c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2016-mtk-wifi-mt76-mt7996-add-SER-state-log-for-debug.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2016-mtk-wifi-mt76-mt7996-add-SER-state-log-for-debug.patch
@@ -1,7 +1,7 @@
-From 905b93728d4804e6b988e93c5a6ba3bf2810bba6 Mon Sep 17 00:00:00 2001
+From 0c5845f500c06a243402ed2d08fff924025b6c0b Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Nov 2023 16:37:23 +0800
-Subject: [PATCH 2016/2028] mtk: wifi: mt76: mt7996: add SER state log for
+Subject: [PATCH 2016/2032] mtk: wifi: mt76: mt7996: add SER state log for
  debug.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 751a960a..5ffc6018 100644
+index da7c387e..28b4d72b 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2158,6 +2158,9 @@ void mt7996_coredump(struct mt7996_dev *dev, u8 state)
+@@ -2159,6 +2159,9 @@ void mt7996_coredump(struct mt7996_dev *dev, u8 state)
  
  void mt7996_reset(struct mt7996_dev *dev)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2017-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2017-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
index 460e810..68a3863 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2017-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2017-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
@@ -1,7 +1,7 @@
-From 55ac95bb1f783c203750968bfe762d1e63f99321 Mon Sep 17 00:00:00 2001
+From 10f74d24c6e1616567693e8e86a57402101f7515 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Mon, 6 Nov 2023 10:16:34 +0800
-Subject: [PATCH 2017/2028] mtk: wifi: mt76: mt7996: Remove wed rro ring add
+Subject: [PATCH 2017/2032] mtk: wifi: mt76: mt7996: Remove wed rro ring add
  napi at init state
 
 without this patch. rro ring will add napi at initial state. once rro ring add napi, it will have chance to be used by host driver. if host driver accessed the ring data, it will cause some issue.
@@ -12,10 +12,10 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index 5ddb6be9..698f39c0 100644
+index a5225db5..385a3c81 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -1093,6 +1093,10 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -1016,6 +1016,10 @@ mt76_dma_init(struct mt76_dev *dev,
  	init_completion(&dev->mmio.wed_reset_complete);
  
  	mt76_for_each_q_rx(dev, i) {
@@ -24,7 +24,7 @@
 +			continue;
 +
  		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
- 		mt76_dma_rx_fill(dev, &dev->q_rx[i]);
+ 		mt76_dma_rx_fill(dev, &dev->q_rx[i], false);
  		napi_enable(&dev->napi[i]);
 -- 
 2.18.0
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2018-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2018-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
index 55185e7..62564d0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2018-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2018-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
@@ -1,7 +1,7 @@
-From 143eed20d01bab9d81fc60540214a87be38580b0 Mon Sep 17 00:00:00 2001
+From ea7a8b06c72f61a3a77c82a8919a4174a7b97f38 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 13:56:52 +0800
-Subject: [PATCH 2018/2028] mtk: wifi: mt76: mt7996: Remove wed_stop during L1
+Subject: [PATCH 2018/2032] mtk: wifi: mt76: mt7996: Remove wed_stop during L1
  SER
 
 Align logan L1 SER flow. During L1 SER, didn't need to close wed interrupt.
@@ -12,10 +12,10 @@
  1 file changed, 6 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 5ffc6018..0ebad4ac 100644
+index 28b4d72b..bc335fd3 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1941,12 +1941,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1942,12 +1942,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2019-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2019-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
index 08e99eb..5e3052e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2019-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2019-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
@@ -1,7 +1,7 @@
-From a91bffb95b75d3c9b0dc0fae4bccc1fd6ec302be Mon Sep 17 00:00:00 2001
+From b3d10fbe8c8faec735dc2f083debc7c3c802c043 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 15:51:04 +0800
-Subject: [PATCH 2019/2028] mtk: wifi: mt76: mt7996: Refactor rro del ba
+Subject: [PATCH 2019/2032] mtk: wifi: mt76: mt7996: Refactor rro del ba
  command format
 
 1. remove unused struct
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2020-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2020-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
index 3c45b21..0b6f565 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2020-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2020-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
@@ -1,7 +1,7 @@
-From 64db610443287b4e5b47ee9a7461562c16ae0e76 Mon Sep 17 00:00:00 2001
+From d71f046693ba8f6e80a0c349d9ef1b9e857a8c34 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Fri, 17 Nov 2023 18:08:06 +0800
-Subject: [PATCH 2020/2028] mtk: wifi: mt76: mt7996: get airtime and RSSI via
+Subject: [PATCH 2020/2032] mtk: wifi: mt76: mt7996: get airtime and RSSI via
  MCU commands
 
 Direct access to WTBL for airtime and RSSI may cause synchronization issue with FW.
@@ -23,10 +23,10 @@
  9 files changed, 361 insertions(+), 143 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index cf88eafa..942d9c11 100644
+index fbf66407..8db61815 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -324,11 +324,15 @@ struct mt76_sta_stats {
+@@ -325,11 +325,15 @@ struct mt76_sta_stats {
  	u32 tx_packets;		/* unit: MSDU */
  	u32 tx_retries;
  	u32 tx_failed;
@@ -42,7 +42,7 @@
  };
  
  enum mt76_wcid_flags {
-@@ -1312,6 +1316,22 @@ static inline int mt76_decr(int val, int size)
+@@ -1328,6 +1332,22 @@ static inline int mt76_decr(int val, int size)
  
  u8 mt76_ac_to_hwq(u8 ac);
  
@@ -66,10 +66,10 @@
  mtxq_to_txq(struct mt76_txq *mtxq)
  {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 2cdd5b9c..77c5b62f 100644
+index 266ee711..4f4b7b4f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1364,11 +1364,23 @@ enum {
+@@ -1368,11 +1368,23 @@ enum {
  	UNI_OFFLOAD_OFFLOAD_BMC_RPY_DETECT,
  };
  
@@ -95,10 +95,10 @@
  	UNI_ALL_STA_GI_MODE,
  	UNI_ALL_STA_TXRX_MSDU_COUNT,
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index ed55afa0..24191f75 100644
+index c4adee9a..5e9ab9ab 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -947,12 +947,11 @@ mt7996_airtime_read(struct seq_file *s, void *data)
+@@ -987,12 +987,11 @@ mt7996_airtime_read(struct seq_file *s, void *data)
  {
  	struct mt7996_dev *dev = dev_get_drvdata(s->private);
  	struct mt76_dev *mdev = &dev->mt76;
@@ -112,7 +112,7 @@
  	u16 i;
  
  	seq_printf(s, "VoW Airtime Information:\n");
-@@ -964,16 +963,16 @@ mt7996_airtime_read(struct seq_file *s, void *data)
+@@ -1004,16 +1003,16 @@ mt7996_airtime_read(struct seq_file *s, void *data)
  
  		msta = container_of(wcid, struct mt7996_sta, wcid);
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
@@ -137,7 +137,7 @@
  	rcu_read_unlock();
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0ebad4ac..bdf808fc 100644
+index bc335fd3..2e48ab8b 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -12,8 +12,6 @@
@@ -269,7 +269,7 @@
  	if (wake)
  		mt76_set_tx_blocked(&dev->mt76, false);
  
-@@ -2369,31 +2261,42 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2370,31 +2262,42 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  
  void mt7996_mac_work(struct work_struct *work)
  {
@@ -326,7 +326,7 @@
  	ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
  				     MT7996_WATCHDOG_TIME);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0fe713d6..62c073bd 100644
+index 3a816713..35a44fee 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -560,7 +560,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -373,7 +373,7 @@
  		default:
  			break;
  		}
-@@ -2252,8 +2271,6 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
+@@ -2239,8 +2258,6 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_VI] = VOW_DRR_QUANTUM_IDX1;
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
@@ -382,7 +382,7 @@
  
  	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
  	if (ret)
-@@ -4859,9 +4876,155 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
+@@ -4846,9 +4863,155 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
  				 sizeof(req), true);
  }
  
@@ -540,7 +540,7 @@
  	struct {
  		u8 _rsv[4];
  
-@@ -4872,7 +5035,7 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
+@@ -4859,7 +5022,7 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
  		.len = cpu_to_le16(sizeof(req) - 4),
  	};
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2021-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2021-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
index 78fcc32..6641bf6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2021-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2021-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
@@ -1,7 +1,7 @@
-From edbe4cad5b63d80c10ac7ae14010e7018e6b351a Mon Sep 17 00:00:00 2001
+From 5bb85ef54208f23c7b6ba8b9edd09f81a411c2aa Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 4 Jan 2024 09:47:00 +0800
-Subject: [PATCH 2021/2028] mtk: wifi: mt76: mt7996: add support for WMM PBC
+Subject: [PATCH 2021/2032] mtk: wifi: mt76: mt7996: add support for WMM PBC
  configuration
 
 Query per-AC-queue packet statistics from WA, and determine if multi-AC transmission is ongoing.
@@ -18,10 +18,10 @@
  6 files changed, 105 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 77c5b62f..7b4548dd 100644
+index 4f4b7b4f..b2b8f2a2 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1022,6 +1022,7 @@ enum {
+@@ -1026,6 +1026,7 @@ enum {
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
@@ -29,7 +29,7 @@
  	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
-@@ -1220,6 +1221,7 @@ enum {
+@@ -1224,6 +1225,7 @@ enum {
  	MCU_EXT_CMD_TXDPD_CAL = 0x60,
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
@@ -38,7 +38,7 @@
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
  	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 12682c9b..193904bc 100644
+index 7a9b9749..90f3a417 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -1493,6 +1493,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
@@ -51,10 +51,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bdf808fc..94c0cfab 100644
+index 2e48ab8b..471fb9c5 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2288,6 +2288,10 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2289,6 +2289,10 @@ void mt7996_mac_work(struct work_struct *work)
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
  				}
@@ -66,7 +66,7 @@
  			           test_bit(MT76_STATE_RUNNING, &mdev->phys[i]->state))
  				break;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 62c073bd..85d04525 100644
+index 35a44fee..1426e4b1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -666,6 +666,82 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index f21645b..f98488a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -3,29 +3,18 @@
     file://0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch \
     file://0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch \
     file://0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch \
-    file://0004-mtk-wifi-mt76-check-txs-format-before-getting-skb-by.patch \
-    file://0005-mtk-wifi-mt76-mt7996-fix-some-twt-issues.patch \
-    file://0006-mtk-wifi-mt76-mt7996-disable-AMSDU-for-non-data-fram.patch \
-    file://0007-mtk-wifi-mt76-mt7996-fix-incorrect-interpretation-of.patch \
-    file://0008-mtk-wifi-mt76-mt7992-add-TLV-sanity-check.patch \
-    file://0009-mtk-wifi-mt76-mt7996-fix-HE-beamformer-phy-cap-for-s.patch \
-    file://0010-mtk-wifi-mt76-mt7996-Let-MAC80211-handles-GCMP-IGTK.patch \
-    file://0011-mtk-wifi-mt76-mt7996-fix-efuse-read-issue.patch \
-    file://0012-mtk-wifi-mt76-mt7996-enable-ser-query.patch \
-    file://0013-mtk-wifi-mt76-mt7996-init-rcpi-to-use-better-init-mc.patch \
-    file://0014-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch \
-    file://0015-mtk-wifi-mt76-mt7996-remove-TxS-queue-setting.patch \
-    file://0016-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch \
-    file://0017-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch \
-    file://0018-mtk-wifi-mt76-mt7996-add-lock-for-indirect-register-.patch \
-    file://0019-mtk-wifi-mt76-connac-set-correct-muar_idx-for-connac.patch \
-    file://0020-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch \
-    file://0021-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch \
-    file://0022-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch \
-    file://0023-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch \
-    file://0024-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch \
-    file://0025-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch \
-    file://0026-mtk-wifi-mt76-mt7996-fix-HIF_TXD_V2_1-value.patch \
+    file://0004-mtk-wifi-mt76-mt7996-set-RCPI-value-in-rate-control-.patch \
+    file://0005-mtk-wifi-mt76-mt7996-enable-ser-query.patch \
+    file://0006-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch \
+    file://0007-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch \
+    file://0008-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch \
+    file://0009-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch \
+    file://0010-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch \
+    file://0011-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch \
+    file://0012-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch \
+    file://0013-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch \
+    file://0014-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch \
+    file://0015-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch \
     file://0999-mtk-wifi-mt76-mt7996-for-build-pass.patch \
     file://1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch \
     file://1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch \
diff --git a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
index 8f533b9..b5f59cb 100644
--- a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
@@ -1,7 +1,7 @@
-From 0833b8306d6614f28f9be5df2174667e486cdab7 Mon Sep 17 00:00:00 2001
+From 7904ac14dffdafe54e8007899140c01915e3acfe Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Thu, 18 May 2023 18:11:37 +0800
-Subject: [PATCH 01/76] wifi: mt76: fix incorrect HE TX GI report
+Subject: [PATCH 01/13] wifi: mt76: fix incorrect HE TX GI report
 
 Change GI reporting source from static capability to rate-tuning module.
 
@@ -17,10 +17,10 @@
  7 files changed, 282 insertions(+), 22 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index d2ead58..8f1f0a7 100644
+index 1f24958..6282cb6 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -276,12 +276,16 @@ struct mt76_queue_ops {
+@@ -277,12 +277,16 @@ struct mt76_queue_ops {
  	void (*reset_q)(struct mt76_dev *dev, struct mt76_queue *q);
  };
  
@@ -60,7 +60,7 @@
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7915_mac_work);
  	INIT_LIST_HEAD(&dev->sta_rc_list);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index b01edbe..c083f87 100644
+index e453611..9e1cfa6 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -173,15 +173,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -147,7 +147,7 @@
  out:
  	rcu_read_unlock();
  }
-@@ -1950,6 +1944,27 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -1947,6 +1941,27 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -175,7 +175,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2008,6 +2023,11 @@ void mt7915_mac_work(struct work_struct *work)
+@@ -2005,6 +2020,11 @@ void mt7915_mac_work(struct work_struct *work)
  			mt7915_mcu_muru_debug_get(phy);
  	}
  
@@ -188,7 +188,7 @@
  
  	mt76_tx_status_check(mphy->dev, false);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index df2d427..1949f9a 100644
+index 3709d18..3182fac 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -751,6 +751,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -466,7 +466,7 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4727d9c..5d14017 100644
+index 6e79bc6..44950ab 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -137,6 +137,7 @@ struct mt7915_sta {
@@ -488,7 +488,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -494,6 +499,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
+@@ -495,6 +500,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
  int mt7915_mcu_get_temperature(struct mt7915_phy *phy);
  int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state);
  int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
index cb104e3..eb82beb 100644
--- a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
@@ -1,7 +1,8 @@
-From 585c6bb0ad5ef459c62f68f4c5addf6a29c07eda Mon Sep 17 00:00:00 2001
+From b73a60b2d769526243aa640f63bd8c0d5774532a Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 22 May 2023 13:49:37 +0800
-Subject: [PATCH] wifi: mt76: mt7915: add pc stack dump for WM's coredump.
+Subject: [PATCH 02/13] wifi: mt76: mt7915: add pc stack dump for WM's
+ coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -15,7 +16,7 @@
  7 files changed, 207 insertions(+), 71 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 8f1f0a7..580891f 100644
+index 6282cb6..03116ff 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -27,6 +27,8 @@
@@ -40,7 +41,7 @@
  enum mt76_wed_type {
  	MT76_WED_Q_TX,
  	MT76_WED_Q_TXFREE,
-@@ -832,6 +840,9 @@ struct mt76_dev {
+@@ -833,6 +841,9 @@ struct mt76_dev {
  	struct device *dma_dev;
  
  	struct mt76_mcu mcu;
@@ -51,10 +52,10 @@
  	struct net_device napi_dev;
  	struct net_device tx_napi_dev;
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 96494ba..984cd4f 100644
+index 7602f97..fe5250c 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2930,6 +2930,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2933,6 +2933,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -64,7 +65,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -2959,6 +2962,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2962,6 +2965,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -74,7 +75,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -3029,6 +3035,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -3032,6 +3038,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
@@ -513,10 +514,10 @@
  	return NULL;
  }
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index c083f87..5c7e0e6 100644
+index 9e1cfa6..3fe1cf1 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1595,28 +1595,31 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1592,28 +1592,31 @@ void mt7915_mac_reset_work(struct work_struct *work)
  }
  
  /* firmware coredump */
@@ -554,7 +555,7 @@
  	if (!mem_region || !crash_data->memdump_buf_len) {
  		mutex_unlock(&dev->dump_mutex);
  		goto skip_memdump;
-@@ -1626,6 +1629,9 @@ void mt7915_mac_dump_work(struct work_struct *work)
+@@ -1623,6 +1626,9 @@ void mt7915_mac_dump_work(struct work_struct *work)
  	buf_len = crash_data->memdump_buf_len;
  
  	/* dumping memory content... */
@@ -564,7 +565,7 @@
  	memset(buf, 0, buf_len);
  	for (i = 0; i < num; i++) {
  		if (mem_region->len > buf_len) {
-@@ -1643,6 +1649,7 @@ void mt7915_mac_dump_work(struct work_struct *work)
+@@ -1640,6 +1646,7 @@ void mt7915_mac_dump_work(struct work_struct *work)
  		mt7915_memcpy_fromio(dev, buf, mem_region->start,
  				     mem_region->len);
  
@@ -572,7 +573,7 @@
  		hdr->start = mem_region->start;
  		hdr->len = mem_region->len;
  
-@@ -1659,8 +1666,18 @@ void mt7915_mac_dump_work(struct work_struct *work)
+@@ -1656,8 +1663,18 @@ void mt7915_mac_dump_work(struct work_struct *work)
  	mutex_unlock(&dev->dump_mutex);
  
  skip_memdump:
@@ -594,7 +595,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5d14017..4293385 100644
+index 44950ab..35458ec 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -286,7 +286,7 @@ struct mt7915_dev {
diff --git a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
index 7f167c5..9c2726d 100644
--- a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
@@ -1,7 +1,7 @@
-From bc0336844099fc23c44b0249a41562d4da675d00 Mon Sep 17 00:00:00 2001
+From 32760539d43987c27b13a9e54c36c05749b6795e Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 13 Jul 2023 15:50:00 +0800
-Subject: [PATCH 03/76] wifi: mt76: mt7915: move temperature margin check to
+Subject: [PATCH 03/13] wifi: mt76: mt7915: move temperature margin check to
  mt7915_thermal_temp_store()
 
 Originally, we would reduce the 10-degree margin to the restore
diff --git a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch
index e115e77..21ea48f 100644
--- a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch
@@ -1,7 +1,7 @@
-From dc05c83d0f280b199b2bfdebb33acce008b57609 Mon Sep 17 00:00:00 2001
+From ce03eceadfb532004d5343fd1d4c4a85350a51ca Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sat, 29 Jul 2023 04:53:47 +0800
-Subject: [PATCH 04/76] wifi: mt76: mt7915: fix txpower issues
+Subject: [PATCH 04/13] wifi: mt76: mt7915: fix txpower issues
 
 ---
  eeprom.c         |  2 +-
@@ -107,7 +107,7 @@
  	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_TPC_CTRL_STAT(band) :
  	      MT_WF_PHY_TPC_CTRL_STAT_MT7916(band);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1949f9a..4e0216e 100644
+index 3182fac..ed0f0cc 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1076,6 +1076,7 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
diff --git a/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch
rename to recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch
index ee83d2a..ae27d38 100644
--- a/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch
@@ -1,7 +1,7 @@
-From 5e5c03f7f7fe349d4d835bd6809bc40b32a9ec8a Mon Sep 17 00:00:00 2001
+From 0afe0c40fe92f282f72a66f85410b9d073b84494 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 26 Oct 2023 21:11:05 +0800
-Subject: [PATCH 08/76] wifi: mt76: mt7915: Fixed null pointer dereference
+Subject: [PATCH 05/13] wifi: mt76: mt7915: Fixed null pointer dereference
  issue
 
 Without this patch, when the station is still in Authentication stage and
@@ -17,7 +17,7 @@
  1 file changed, 7 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4e0216e..3cf459d 100644
+index ed0f0cc..f363a30 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1166,9 +1166,16 @@ static void mt7915_sta_rc_update(struct ieee80211_hw *hw,
diff --git a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-rework-mmio-access-flow.patch b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-rework-mmio-access-flow.patch
deleted file mode 100644
index eb2191d..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-rework-mmio-access-flow.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-From 7b50ef5c4c3768652f1c4bcdb14e8ee0639c8b7f Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 15 Aug 2023 17:28:30 +0800
-Subject: [PATCH 05/76] wifi: mt76: mt7915: rework mmio access flow
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/mmio.c   | 49 ++++++++++++++++++++++++++++++++++++++++++++-----
- mt7915/mt7915.h |  1 +
- 2 files changed, 45 insertions(+), 5 deletions(-)
-
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index aff4f21..bd9e01d 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -490,6 +490,11 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr)
- 		return dev->reg.map[i].maps + ofs;
- 	}
- 
-+	return 0;
-+}
-+
-+static u32 __mt7915_reg_remap_addr(struct mt7915_dev *dev, u32 addr)
-+{
- 	if ((addr >= MT_INFRA_BASE && addr < MT_WFSYS0_PHY_START) ||
- 	    (addr >= MT_WFSYS0_PHY_START && addr < MT_WFSYS1_PHY_START) ||
- 	    (addr >= MT_WFSYS1_PHY_START && addr <= MT_WFSYS1_PHY_END))
-@@ -513,32 +518,65 @@ void mt7915_memcpy_fromio(struct mt7915_dev *dev, void *buf, u32 offset,
- 			  size_t len)
- {
- 	u32 addr = __mt7915_reg_addr(dev, offset);
-+	unsigned long flags;
- 
--	memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
-+	if (addr) {
-+		memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
-+		return;
-+	}
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	memcpy_fromio(buf, dev->mt76.mmio.regs +
-+			   __mt7915_reg_remap_addr(dev, offset), len);
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
- }
- 
- static u32 mt7915_rr(struct mt76_dev *mdev, u32 offset)
- {
- 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
--	u32 addr = __mt7915_reg_addr(dev, offset);
-+	u32 addr = __mt7915_reg_addr(dev, offset), val;
-+	unsigned long flags;
- 
--	return dev->bus_ops->rr(mdev, addr);
-+	if (addr)
-+		return dev->bus_ops->rr(mdev, addr);
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	val = dev->bus_ops->rr(mdev, __mt7915_reg_remap_addr(dev, offset));
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
-+
-+	return val;
- }
- 
- static void mt7915_wr(struct mt76_dev *mdev, u32 offset, u32 val)
- {
- 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
- 	u32 addr = __mt7915_reg_addr(dev, offset);
-+	unsigned long flags;
- 
--	dev->bus_ops->wr(mdev, addr, val);
-+	if (addr) {
-+		dev->bus_ops->wr(mdev, addr, val);
-+		return;
-+	}
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	dev->bus_ops->wr(mdev, __mt7915_reg_remap_addr(dev, offset), val);
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
- }
- 
- static u32 mt7915_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
- {
- 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
- 	u32 addr = __mt7915_reg_addr(dev, offset);
-+	unsigned long flags;
-+
-+	if (addr)
-+		return dev->bus_ops->rmw(mdev, addr, mask, val);
-+
-+	spin_lock_irqsave(&dev->reg_lock, flags);
-+	val = dev->bus_ops->rmw(mdev, __mt7915_reg_remap_addr(dev, offset), mask, val);
-+	spin_unlock_irqrestore(&dev->reg_lock, flags);
- 
--	return dev->bus_ops->rmw(mdev, addr, mask, val);
-+	return val;
- }
- 
- #ifdef CONFIG_NET_MEDIATEK_SOC_WED
-@@ -707,6 +745,7 @@ static int mt7915_mmio_init(struct mt76_dev *mdev,
- 
- 	dev = container_of(mdev, struct mt7915_dev, mt76);
- 	mt76_mmio_init(&dev->mt76, mem_base);
-+	spin_lock_init(&dev->reg_lock);
- 
- 	switch (device_id) {
- 	case 0x7915:
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4293385..35458ec 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -292,6 +292,7 @@ struct mt7915_dev {
- 
- 	struct list_head sta_rc_list;
- 	struct list_head twt_list;
-+	spinlock_t reg_lock;
- 
- 	u32 hw_pattern;
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch
rename to recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch
index 785d3ff..93e73af 100644
--- a/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch
@@ -1,7 +1,7 @@
-From 3300d7dc7d506804664567b0039acebd4b351931 Mon Sep 17 00:00:00 2001
+From 9621cc0577f957c422cd8960bab5541d069b0fe1 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sat, 18 Nov 2023 07:36:45 +0800
-Subject: [PATCH 09/76] wifi: mt76: ACS channel time too long on duty channel
+Subject: [PATCH 06/13] wifi: mt76: ACS channel time too long on duty channel
 
 Issue:
 There's a chance that the channel time for duty channel is zero in ACS
@@ -26,7 +26,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index cc9e9ff..6c5b4f5 100644
+index b603d40..6e8ac6f 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -928,6 +928,7 @@ void mt76_set_channel(struct mt76_phy *phy)
diff --git a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch
deleted file mode 100644
index e2b475c..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From f03b72e7cfdeb48938b76550f911533fa6241837 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 6 Sep 2023 16:27:25 +0800
-Subject: [PATCH 06/76] wifi: mt76: disable HW AMSDU when using fixed rate
-
-When using fixed rate, HW uses txd DW9 to store tx arrivial time if VTA
-is ture. It would overwrite the msdu_id in txd and lead to token pending
-if amsdu is enable.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt76_connac_mac.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index c791464..630c640 100644
---- a/mt76_connac_mac.c
-+++ b/mt76_connac_mac.c
-@@ -544,7 +544,7 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- 	val = FIELD_PREP(MT_TXD5_PID, pid);
- 	if (pid >= MT_PACKET_ID_FIRST) {
- 		val |= MT_TXD5_TX_STATUS_HOST;
--		amsdu_en = amsdu_en && !is_mt7921(dev);
-+		amsdu_en = 0;
- 	}
- 
- 	txwi[5] = cpu_to_le32(val);
-@@ -579,6 +579,8 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- 				spe_idx = 24 + phy_idx;
- 			txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX, spe_idx));
- 		}
-+
-+		txwi[7] &= ~cpu_to_le32(MT_TXD7_HW_AMSDU);
- 	}
- }
- EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-new-chip-version-in-power-on-se.patch b/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-new-chip-version-in-power-on-se.patch
deleted file mode 100644
index f245ca5..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-new-chip-version-in-power-on-se.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 9811a44ffa3f54a904ee706c0a15638733781efa Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Tue, 17 Oct 2023 16:32:51 +0800
-Subject: [PATCH 07/76] wifi: mt76: mt7915: add new chip version in power on
- sequence
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/soc.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/mt7915/soc.c b/mt7915/soc.c
-index d8c80de..b2916b0 100644
---- a/mt7915/soc.c
-+++ b/mt7915/soc.c
-@@ -517,7 +517,8 @@ static int mt798x_wmac_adie_patch_7976(struct mt7915_dev *dev, u8 adie)
- 	if (ret)
- 		return ret;
- 
--	if (version == 0x8a00 || version == 0x8a10 || version == 0x8b00) {
-+	if (version == 0x8a00 || version == 0x8a10 ||
-+	    version == 0x8b00 || version == 0x8c10) {
- 		rg_xo_01 = 0x1d59080f;
- 		rg_xo_03 = 0x34c00fe0;
- 	} else {
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch b/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch
rename to recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch
index 0fc717d..360c308 100644
--- a/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch
@@ -1,8 +1,8 @@
-From 6a213f89194b5449a071b805ea32fba05e2a0673 Mon Sep 17 00:00:00 2001
+From d66d0f22529ac2b2f63f67a4251759f18e12ba83 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 16 Nov 2023 14:41:54 +0800
-Subject: [PATCH] wifi: mt76: mt7915: add post channel switch for DFS channel
- switching
+Subject: [PATCH 07/13] wifi: mt76: mt7915: add post channel switch for DFS
+ channel switching
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  1 file changed, 22 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index ec4e33f..e01d832 100644
+index f363a30..dfaee4c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -736,6 +736,27 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -41,7 +41,7 @@
  int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta)
  {
-@@ -1710,6 +1731,7 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1697,6 +1718,7 @@ const struct ieee80211_ops mt7915_ops = {
  	.get_txpower = mt76_get_txpower,
  	.set_sar_specs = mt7915_set_sar_specs,
  	.channel_switch_beacon = mt7915_channel_switch_beacon,
diff --git a/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-add-support-for-realtime-Rx-rate-up.patch b/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-add-support-for-realtime-Rx-rate-up.patch
new file mode 100644
index 0000000..6943e39
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-add-support-for-realtime-Rx-rate-up.patch
@@ -0,0 +1,53 @@
+From 81b15b74393bddb1f453300f85c37668ff98f8c7 Mon Sep 17 00:00:00 2001
+From: "Henry.Yen" <henry.yen@mediatek.com>
+Date: Mon, 8 Jan 2024 17:19:01 +0800
+Subject: [PATCH 08/13] wifi: mt76: mt7915: add support for realtime Rx rate
+ updates
+
+Add support for realtime Rx rate updates.
+
+Currently, Rx rate is updated according to packet-triggered RxV
+parsing flow, i.e., mt76_connac2_mac_fill_rx_rate(). However, whenever
+the session enters hardware acceleration, driver layer won't have
+any clue about what the current Rx rate is. So we make use of MCU
+CMD to obtain Rx rate instead.
+
+Signed-off-by: Henry.Yen <henry.yen@mediatek.com>
+---
+ mt76_connac.h | 6 ++++++
+ mt7915/main.c | 2 +-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/mt76_connac.h b/mt76_connac.h
+index 98d64d3..1be41d6 100644
+--- a/mt76_connac.h
++++ b/mt76_connac.h
+@@ -255,6 +255,12 @@ static inline bool is_connac_v1(struct mt76_dev *dev)
+ 	return is_mt7615(dev) || is_mt7663(dev) || is_mt7622(dev);
+ }
+ 
++static inline bool is_connac_v2(struct mt76_dev *dev)
++{
++	return is_mt7915(dev) || is_mt7916(dev) ||
++	       is_mt7981(dev) || is_mt7986(dev);
++}
++
+ static inline bool is_mt76_fw_txp(struct mt76_dev *dev)
+ {
+ 	switch (mt76_chip(dev)) {
+diff --git a/mt7915/main.c b/mt7915/main.c
+index dfaee4c..b84c666 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1114,7 +1114,7 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 	struct rate_info *txrate = &msta->wcid.rate;
+ 	struct rate_info rxrate = {};
+ 
+-	if (is_mt7915(&phy->dev->mt76) &&
++	if (is_connac_v2(&phy->dev->mt76) &&
+ 	    !mt7915_mcu_get_rx_rate(phy, vif, sta, &rxrate)) {
+ 		sinfo->rxrate = rxrate;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-remove-redundant-argument-in-add_be.patch b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-remove-redundant-argument-in-add_be.patch
new file mode 100644
index 0000000..0e98ed0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-remove-redundant-argument-in-add_be.patch
@@ -0,0 +1,82 @@
+From 3795a4938098deac1399d5ebc91cd57350c6260c Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Date: Wed, 24 Jan 2024 15:04:33 +0800
+Subject: [PATCH 09/13] wifi: mt76: mt7915: remove redundant argument in
+ add_beacon function
+
+Remove redundant argument "changed".
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ mt7915/mac.c    | 3 +--
+ mt7915/main.c   | 4 ++--
+ mt7915/mcu.c    | 3 +--
+ mt7915/mt7915.h | 2 +-
+ 4 files changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 3fe1cf1..3736853 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1278,8 +1278,7 @@ mt7915_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ 	case NL80211_IFTYPE_MESH_POINT:
+ 	case NL80211_IFTYPE_ADHOC:
+ 	case NL80211_IFTYPE_AP:
+-		mt7915_mcu_add_beacon(hw, vif, vif->bss_conf.enable_beacon,
+-				      BSS_CHANGED_BEACON_ENABLED);
++		mt7915_mcu_add_beacon(hw, vif, vif->bss_conf.enable_beacon);
+ 		break;
+ 	default:
+ 		break;
+diff --git a/mt7915/main.c b/mt7915/main.c
+index b84c666..1548c1f 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -659,7 +659,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+ 
+ 	if (changed & (BSS_CHANGED_BEACON |
+ 		       BSS_CHANGED_BEACON_ENABLED))
+-		mt7915_mcu_add_beacon(hw, vif, info->enable_beacon, changed);
++		mt7915_mcu_add_beacon(hw, vif, info->enable_beacon);
+ 
+ 	if (changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
+ 		       BSS_CHANGED_FILS_DISCOVERY))
+@@ -732,7 +732,7 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
+ 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+-	mt7915_mcu_add_beacon(hw, vif, true, BSS_CHANGED_BEACON);
++	mt7915_mcu_add_beacon(hw, vif, true);
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 6cd6ad1..7a2a537 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -1971,8 +1971,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
+ }
+ 
+-int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-			  int en, u32 changed)
++int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif, int en)
+ {
+ 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 35458ec..1b79733 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -457,7 +457,7 @@ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ int mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 				 u32 changed);
+ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-			  int enable, u32 changed);
++			  int enable);
+ int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 			    struct ieee80211_he_obss_pd *he_obss_pd);
+ int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-check-txs-format-before-getting-skb-by-pid.patch b/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-check-txs-format-before-getting-skb-by-pid.patch
deleted file mode 100644
index bf761ba..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-check-txs-format-before-getting-skb-by-pid.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 1313d834950f271d6b84dd71b89535e6e9af1095 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 8 Dec 2023 07:35:39 +0800
-Subject: [PATCH 10/76] wifi: mt76: check txs format before getting skb by pid
-
-The PPDU TxS does not include the error bit so it cannot use to report
-status to mac80211.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt76_connac2_mac.h | 5 +++++
- mt76_connac_mac.c  | 7 +++++--
- 2 files changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/mt76_connac2_mac.h b/mt76_connac2_mac.h
-index bd2a924..5f13211 100644
---- a/mt76_connac2_mac.h
-+++ b/mt76_connac2_mac.h
-@@ -32,6 +32,11 @@ enum {
- 	MT_LMAC_PSMP0,
- };
- 
-+enum {
-+	MT_TXS_MPDU_FMT = 0,
-+	MT_TXS_PPDU_FMT = 2,
-+};
-+
- #define MT_TX_FREE_MSDU_CNT		GENMASK(9, 0)
- #define MT_TX_FREE_WLAN_ID		GENMASK(23, 14)
- #define MT_TX_FREE_COUNT		GENMASK(12, 0)
-diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 630c640..31d2474 100644
---- a/mt76_connac_mac.c
-+++ b/mt76_connac_mac.c
-@@ -714,10 +714,13 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
- 				  int pid, __le32 *txs_data)
- {
- 	struct sk_buff_head list;
--	struct sk_buff *skb;
-+	struct sk_buff *skb = NULL;
- 
- 	mt76_tx_status_lock(dev, &list);
--	skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
-+
-+	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == MT_TXS_MPDU_FMT)
-+		skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
-+
- 	if (skb) {
- 		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-support-for-WMM-PBC-configurati.patch b/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-support-for-WMM-PBC-configurati.patch
new file mode 100644
index 0000000..5703972
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-support-for-WMM-PBC-configurati.patch
@@ -0,0 +1,243 @@
+From 70f2286427614e2da9e0caf6b90813d38bfadc63 Mon Sep 17 00:00:00 2001
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Date: Mon, 29 Jan 2024 11:28:41 +0800
+Subject: [PATCH 10/13] wifi: mt76: mt7915: add support for WMM PBC
+ configuration
+
+---
+ mt76_connac_mcu.h |  2 ++
+ mt7915/init.c     |  2 ++
+ mt7915/mac.c      | 14 ++++++++
+ mt7915/mcu.c      | 90 +++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/mcu.h      | 15 ++++++++
+ mt7915/mt7915.h   |  4 +++
+ 6 files changed, 127 insertions(+)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 2a4aa79..8d516e4 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1018,6 +1018,7 @@ enum {
+ 	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
+ 	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
+ 	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
++	MCU_EXT_EVENT_BSS_ACQ_PKT_CNT = 0x52,
+ 	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
+ 	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
+ 	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
+@@ -1213,6 +1214,7 @@ enum {
+ 	MCU_EXT_CMD_TXDPD_CAL = 0x60,
+ 	MCU_EXT_CMD_CAL_CACHE = 0x67,
+ 	MCU_EXT_CMD_RED_ENABLE = 0x68,
++	MCU_EXT_CMD_PKT_BUDGET_CTRL = 0x6c,
+ 	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
+ 	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
+ 	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
+diff --git a/mt7915/init.c b/mt7915/init.c
+index d5d9cbf..2fc1f3c 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -1217,6 +1217,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+ 	INIT_WORK(&dev->dump_work, mt7915_mac_dump_work);
+ 	mutex_init(&dev->dump_mutex);
+ 
++	INIT_WORK(&dev->wmm_pbc_work, mt7915_mcu_wmm_pbc_work);
++
+ 	dev->dbdc_support = mt7915_band_config(dev);
+ 
+ 	phy2 = mt7915_alloc_ext_phy(dev);
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 3736853..762159b 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -2027,6 +2027,8 @@ void mt7915_mac_work(struct work_struct *work)
+ 
+ 	mt76_update_survey(mphy);
+ 	if (++mphy->mac_work_count == 5) {
++		int i;
++
+ 		mphy->mac_work_count = 0;
+ 
+ 		mt7915_mac_update_stats(phy);
+@@ -2034,6 +2036,18 @@ void mt7915_mac_work(struct work_struct *work)
+ 
+ 		if (phy->dev->muru_debug)
+ 			mt7915_mcu_muru_debug_get(phy);
++
++		/* Update DEV-wise information only in
++		 * the MAC work of the first band running.
++		 */
++		for (i = MT_BAND0; i <= mphy->band_idx; ++i) {
++			if (i == mphy->band_idx) {
++				if (mt7915_mcu_wa_cmd(phy->dev, MCU_WA_PARAM_CMD(QUERY), MCU_WA_PARAM_BSS_ACQ_PKT_CNT,
++				                      BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL | BSS_ACQ_PKT_CNT_READ_CLR, 0))
++					dev_err(mphy->dev->dev, "Failed to query per-AC-queue packet counts.\n");
++			} else if (test_bit(MT76_STATE_RUNNING, &mphy->dev->phys[i]->state))
++				break;
++		}
+ 	}
+ 
+ 	if (++phy->stats_work_count == 10) {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 7a2a537..d101cbf 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -354,6 +354,93 @@ mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
+ 			mt7915_mcu_cca_finish, mphy->hw);
+ }
+ 
++void mt7915_mcu_wmm_pbc_work(struct work_struct *work)
++{
++#define WMM_PBC_QUEUE_NUM		5
++#define WMM_PBC_BSS_ALL			0xff
++#define WMM_PBC_WLAN_IDX_ALL		0xffff
++#define WMM_PBC_BOUND_DEFAULT		0xffff
++#define WMM_PBC_UP_BOUND_BAND0_VO	950
++#define WMM_PBC_UP_BOUND_BAND0_VI	950
++#define WMM_PBC_UP_BOUND_BAND0_BE	750
++#define WMM_PBC_UP_BOUND_BAND0_BK	450
++#define WMM_PBC_UP_BOUND_BAND1_VO	1900
++#define WMM_PBC_UP_BOUND_BAND1_VI	1900
++#define WMM_PBC_UP_BOUND_BAND1_BE	1500
++#define WMM_PBC_UP_BOUND_BAND1_BK	900
++#define WMM_PBC_UP_BOUND_MGMT		32
++	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, wmm_pbc_work);
++	struct {
++		u8 bss_idx;
++		u8 queue_num;
++		__le16 wlan_idx;
++		u8 __rsv[4];
++		struct {
++			__le16 low;
++			__le16 up;
++		} __packed bound[WMM_PBC_QUEUE_NUM * 2];
++	} __packed req = {
++		.bss_idx = WMM_PBC_BSS_ALL,
++		.queue_num = WMM_PBC_QUEUE_NUM * 2,
++		.wlan_idx = cpu_to_le16(WMM_PBC_WLAN_IDX_ALL),
++	};
++	int i;
++
++#define pbc_acq_up_bound_config(_band, _ac, _bound)									\
++	req.bound[_band * WMM_PBC_QUEUE_NUM + mt76_connac_lmac_mapping(_ac)].up = dev->wmm_pbc_enable			\
++	                                                                        ? cpu_to_le16(_bound)			\
++	                                                                        : cpu_to_le16(WMM_PBC_BOUND_DEFAULT)
++	pbc_acq_up_bound_config(MT_BAND0, IEEE80211_AC_VO, WMM_PBC_UP_BOUND_BAND0_VO);
++	pbc_acq_up_bound_config(MT_BAND0, IEEE80211_AC_VI, WMM_PBC_UP_BOUND_BAND0_VI);
++	pbc_acq_up_bound_config(MT_BAND0, IEEE80211_AC_BE, WMM_PBC_UP_BOUND_BAND0_BE);
++	pbc_acq_up_bound_config(MT_BAND0, IEEE80211_AC_BK, WMM_PBC_UP_BOUND_BAND0_BK);
++	req.bound[MT_BAND0 * WMM_PBC_QUEUE_NUM + 4].up = dev->wmm_pbc_enable
++	                                               ? cpu_to_le16(WMM_PBC_UP_BOUND_MGMT)
++	                                               : cpu_to_le16(WMM_PBC_BOUND_DEFAULT);
++	pbc_acq_up_bound_config(MT_BAND1, IEEE80211_AC_VO, WMM_PBC_UP_BOUND_BAND1_VO);
++	pbc_acq_up_bound_config(MT_BAND1, IEEE80211_AC_VI, WMM_PBC_UP_BOUND_BAND1_VI);
++	pbc_acq_up_bound_config(MT_BAND1, IEEE80211_AC_BE, WMM_PBC_UP_BOUND_BAND1_BE);
++	pbc_acq_up_bound_config(MT_BAND1, IEEE80211_AC_BK, WMM_PBC_UP_BOUND_BAND1_BK);
++	req.bound[MT_BAND1 * WMM_PBC_QUEUE_NUM + 4].up = dev->wmm_pbc_enable
++	                                               ? cpu_to_le16(WMM_PBC_UP_BOUND_MGMT)
++	                                               : cpu_to_le16(WMM_PBC_BOUND_DEFAULT);
++
++	for (i = 0; i < WMM_PBC_QUEUE_NUM * 2; ++i)
++		req.bound[i].low = cpu_to_le16(WMM_PBC_BOUND_DEFAULT);
++
++	if (mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(PKT_BUDGET_CTRL),
++	                      &req, sizeof(req), true))
++		dev_err(dev->mt76.dev, "Failed to configure WMM PBC.\n");
++}
++
++static void
++mt7915_mcu_rx_bss_acq_pkt_cnt(struct mt7915_dev *dev, struct sk_buff * skb)
++{
++	struct mt7915_mcu_bss_acq_pkt_cnt_event *event = (struct mt7915_mcu_bss_acq_pkt_cnt_event *)skb->data;
++	u32 bitmap = le32_to_cpu(event->bss_bitmap);
++	u64 sum[IEEE80211_NUM_ACS] = {0};
++	u8 ac_cnt = 0;
++	int i, j;
++
++	for (i = 0; (i < BSS_ACQ_PKT_CNT_BSS_NUM) && (bitmap & (1 << i)); ++i) {
++		for (j = IEEE80211_AC_VO; j < IEEE80211_NUM_ACS; ++j)
++			sum[j] += le32_to_cpu(event->bss[i].cnt[mt76_connac_lmac_mapping(j)]);
++	}
++
++	for (i = IEEE80211_AC_VO; i < IEEE80211_NUM_ACS; ++i) {
++		if (sum[i] > WMM_PKT_THRESHOLD)
++			++ac_cnt;
++	}
++
++	if (ac_cnt > 1 && !dev->wmm_pbc_enable) {
++		dev->wmm_pbc_enable = true;
++		queue_work(dev->mt76.wq, &dev->wmm_pbc_work);
++	} else if (ac_cnt <= 1 && dev->wmm_pbc_enable) {
++		dev->wmm_pbc_enable = false;
++		queue_work(dev->mt76.wq, &dev->wmm_pbc_work);
++	}
++}
++
+ static void
+ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ {
+@@ -376,6 +463,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	case MCU_EXT_EVENT_BCC_NOTIFY:
+ 		mt7915_mcu_rx_bcc_notify(dev, skb);
+ 		break;
++	case MCU_EXT_EVENT_BSS_ACQ_PKT_CNT:
++		mt7915_mcu_rx_bss_acq_pkt_cnt(dev, skb);
++		break;
+ 	default:
+ 		break;
+ 	}
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 8f36546..fa0847d 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -329,10 +329,25 @@ enum {
+ 	MCU_WA_PARAM_CMD_DEBUG,
+ };
+ 
++#define BSS_ACQ_PKT_CNT_BSS_NUM		24
++#define BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL	0x00ffffff
++#define BSS_ACQ_PKT_CNT_READ_CLR	BIT(31)
++#define WMM_PKT_THRESHOLD		50
++
++struct mt7915_mcu_bss_acq_pkt_cnt_event {
++	struct mt76_connac2_mcu_rxd rxd;
++
++	__le32 bss_bitmap;
++	struct {
++		__le32 cnt[IEEE80211_NUM_ACS];
++	} __packed bss[BSS_ACQ_PKT_CNT_BSS_NUM];
++} __packed;
++
+ enum {
+ 	MCU_WA_PARAM_PDMA_RX = 0x04,
+ 	MCU_WA_PARAM_CPU_UTIL = 0x0b,
+ 	MCU_WA_PARAM_RED = 0x0e,
++	MCU_WA_PARAM_BSS_ACQ_PKT_CNT = 0x12,
+ 	MCU_WA_PARAM_RED_SETTING = 0x40,
+ };
+ 
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 1b79733..874d531 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -322,6 +322,9 @@ struct mt7915_dev {
+ 	struct reset_control *rstc;
+ 	void __iomem *dcm;
+ 	void __iomem *sku;
++
++	bool wmm_pbc_enable;
++	struct work_struct wmm_pbc_work;
+ };
+ 
+ enum {
+@@ -512,6 +515,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_exit(struct mt7915_dev *dev);
++void mt7915_mcu_wmm_pbc_work(struct work_struct *work);
+ 
+ static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
+ {
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-mt7915-fix-mcu-command-format-for-mt7915-t.patch b/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-mt7915-fix-mcu-command-format-for-mt7915-t.patch
new file mode 100644
index 0000000..d93eeb9
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-mt7915-fix-mcu-command-format-for-mt7915-t.patch
@@ -0,0 +1,90 @@
+From 1b31fe5bd4d40dece68860263bb2cfb0817cb8a7 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 29 Jan 2024 10:38:35 +0800
+Subject: [PATCH 11/13] wifi: mt76: mt7915: fix mcu command format for mt7915
+ tx stats
+
+The mcu command format are different for mt7915 and mt7986.
+Fix the mt7915_mcu_wed_wa_tx_stats to support mt7915 and mt7986.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/mcu.c | 42 ++++++++++++++++++++++++++++++------------
+ 1 file changed, 30 insertions(+), 12 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index d101cbf..d443d50 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -4050,30 +4050,46 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
+ {
+ 	struct {
+ 		__le32 cmd;
+-		__le32 num;
+-		__le32 __rsv;
+-		__le16 wlan_idx;
+-	} req = {
++		__le32 arg0;
++		__le32 arg1;
++		__le16 arg2;
++	} __packed req = {
+ 		.cmd = cpu_to_le32(0x15),
+-		.num = cpu_to_le32(1),
+-		.wlan_idx = cpu_to_le16(wlan_idx),
+ 	};
+ 	struct mt7915_mcu_wa_tx_stat {
+-		__le16 wlan_idx;
+-		u8 __rsv[2];
++		union {
++			struct {
++				u8 wcid;
++				u8 __rsv[3];
++			} __packed mt7915_hdr;
++			struct {
++				u16 wcid;
++				u8 __rsv2[2];
++			} __packed mt7986_hdr;
++		} u;
+ 
+ 		/* tx_bytes is deprecated since WA byte counter uses u32,
+ 		 * which easily leads to overflow.
+ 		 */
+ 		__le32 tx_bytes;
+ 		__le32 tx_packets;
+-	} *res;
++	} __packed *res;
+ 	struct mt76_wcid *wcid;
+ 	struct sk_buff *skb;
+-	int ret;
++	int ret, len;
++	u16 ret_wcid;
++
++	if (is_mt7915(&dev->mt76)) {
++		req.arg0 = cpu_to_le32(wlan_idx);
++		len = sizeof(req) - sizeof(req.arg2);
++	} else {
++		req.arg0 = cpu_to_le32(1);
++		req.arg2 = cpu_to_le16(wlan_idx);
++		len = sizeof(req);
++	}
+ 
+ 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
+-					&req, sizeof(req), true, &skb);
++					&req, len, true, &skb);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -4082,7 +4098,9 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
+ 
+ 	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
+ 
+-	if (le16_to_cpu(res->wlan_idx) != wlan_idx) {
++	ret_wcid = is_mt7915(&dev->mt76) ? res->u.mt7915_hdr.wcid :
++					   le16_to_cpu(res->u.mt7986_hdr.wcid);
++	if (ret_wcid != wlan_idx) {
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch b/recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch
new file mode 100644
index 0000000..e7b587a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch
@@ -0,0 +1,44 @@
+From 430c4efd2a2ebc4fa486bdec220d3a9449192106 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 29 Jan 2024 11:02:06 +0800
+Subject: [PATCH 12/13] wifi: mt76: fix tx statistics about tx retry and tx
+ fail
+
+The tx retry and tx failed are reported by PPDU TxS.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt76_connac_mac.c | 3 ---
+ mt7915/mac.c      | 2 +-
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index b841bf6..630c640 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -716,9 +716,6 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 	struct sk_buff_head list;
+ 	struct sk_buff *skb;
+ 
+-	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == MT_TXS_PPDU_FMT)
+-		return false;
+-
+ 	mt76_tx_status_lock(dev, &list);
+ 	skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
+ 	if (skb) {
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 762159b..e819815 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1014,7 +1014,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 
+ 	msta = container_of(wcid, struct mt7915_sta, wcid);
+ 
+-	if (pid == MT_PACKET_ID_WED)
++	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == MT_TXS_PPDU_FMT)
+ 		mt76_connac2_mac_fill_txs(&dev->mt76, wcid, txs_data);
+ 	else
+ 		mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch b/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
similarity index 78%
copy from recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
copy to recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
index 937cee2..01f3496 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
@@ -1,8 +1,7 @@
-From 947abea1e4134b5a3f00feba7276b194089f13d0 Mon Sep 17 00:00:00 2001
+From 0cf61c8ee2d3cd4bd7c96b3ee09c968c01fcff35 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 30 Oct 2023 11:06:19 +0800
-Subject: [PATCH 22/25] mtk: wifi: mt76: add sanity check to prevent kernel
- crash
+Date: Mon, 29 Jan 2024 15:33:24 +0800
+Subject: [PATCH 13/13] wifi: mt76: add sanity check to prevent kernel crash
 
 wcid may not be initialized when mac80211 calls mt76.tx and it would lead to
 kernel crash.
@@ -13,7 +12,7 @@
  1 file changed, 8 insertions(+)
 
 diff --git a/tx.c b/tx.c
-index 1809b032..4596b367 100644
+index 1809b03..4596b36 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -345,6 +345,14 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
diff --git a/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch b/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
index 8ce34ae..5b84f2d 100644
--- a/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
@@ -1,25 +1,26 @@
-From f44a5ec67a8f6d1117284c4d6db718da4f0f2617 Mon Sep 17 00:00:00 2001
+From 1ee5da0c9bab77e2659c62bad6458458e5b7e079 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sat, 1 Apr 2023 08:18:17 +0800
-Subject: [PATCH 11/76] wifi: mt76: mt7915: build pass for Linux Kernel 5.4
+Subject: [PATCH 0999/1048] wifi: mt76: mt7915: build pass for Linux Kernel 5.4
  fixes
 
 ---
  debugfs.c         |  2 ++
- dma.c             | 77 ++++++++++++++++++++++++-----------------------
- eeprom.c          |  8 ++++-
- mac80211.c        | 57 -----------------------------------
+ dma.c             | 73 ++++++++++++++++++++++++-----------------------
+ dma.h             |  3 +-
+ eeprom.c          |  8 +++++-
+ mac80211.c        | 57 ------------------------------------
  mcu.c             |  1 +
- mmio.c            | 56 ++++++++++++++++++++++------------
  mt76.h            | 22 +-------------
  mt7615/mcu.c      |  1 +
  mt76_connac.h     |  2 --
- mt76_connac_mcu.c | 47 +----------------------------
+ mt76_connac_mcu.c | 47 +-----------------------------
  mt76_connac_mcu.h |  4 ---
- mt7915/main.c     | 25 ++++++---------
+ mt7915/main.c     | 25 +++++++---------
  mt7915/mcu.c      |  1 +
- usb.c             | 43 +++++++++++++-------------
- 14 files changed, 121 insertions(+), 225 deletions(-)
+ usb.c             | 43 ++++++++++++++--------------
+ wed.c             | 62 +++++++++++++++++++++++++---------------
+ 15 files changed, 123 insertions(+), 228 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
 index c4649ba..1c8328d 100644
@@ -37,7 +38,7 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 00230f1..9eb2b8f 100644
+index 72a7bd5..8240691 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -178,7 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
@@ -49,7 +50,7 @@
  		kfree(t);
  	}
  	local_bh_enable();
-@@ -452,9 +452,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -450,9 +450,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		if (!t)
  			return NULL;
  
@@ -62,7 +63,7 @@
  
  		buf = t->ptr;
  		t->dma_addr = 0;
-@@ -464,9 +464,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -462,9 +462,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		if (drop)
  			*drop |= !!(buf1 & MT_DMA_CTL_WO_DROP);
  	} else {
@@ -75,13 +76,13 @@
  	}
  
  done:
-@@ -633,11 +633,11 @@ free_skb:
+@@ -630,11 +630,11 @@ free_skb:
+ 	return ret;
  }
  
- static int
--mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
--		 bool allow_direct)
-+mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+-int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+-		     bool allow_direct)
++int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  {
  	int len = SKB_WITH_OVERHEAD(q->buf_size);
 -	int frames = 0;
@@ -90,7 +91,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -645,30 +645,30 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -642,30 +642,30 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  	spin_lock_bh(&q->lock);
  
  	while (q->queued < q->ndesc - 1) {
@@ -133,25 +134,7 @@
  		}
  		frames++;
  	}
-@@ -711,7 +711,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
- 		/* WED txfree queue needs ring to be initialized before setup */
- 		q->flags = 0;
- 		mt76_dma_queue_reset(dev, q);
--		mt76_dma_rx_fill(dev, q, false);
-+		mt76_dma_rx_fill(dev, q);
- 
- 		ret = mtk_wed_device_txfree_ring_setup(q->wed, q->regs);
- 		if (!ret)
-@@ -740,7 +740,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
- 	case MT76_WED_RRO_Q_IND:
- 		q->flags &= ~MT_QFLAG_WED;
- 		mt76_dma_queue_reset(dev, q);
--		mt76_dma_rx_fill(dev, q, false);
-+		mt76_dma_rx_fill(dev, q);
- 		mtk_wed_device_ind_rx_ring_setup(q->wed, q->regs);
- 		break;
- 	default:
-@@ -796,10 +796,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -718,10 +718,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -159,10 +142,10 @@
 -	if (ret)
 -		return ret;
 -
- 	ret = mt76_dma_wed_setup(dev, q, false);
+ 	ret = mt76_wed_dma_setup(dev, q, false);
  	if (ret)
  		return ret;
-@@ -818,6 +814,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -740,6 +736,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -170,7 +153,7 @@
  	void *buf;
  	bool more;
  
-@@ -833,7 +830,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -755,7 +752,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  			break;
  
  		if (!mt76_queue_is_wed_rro(q))
@@ -179,7 +162,7 @@
  	} while (1);
  
  	spin_lock_bh(&q->lock);
-@@ -843,6 +840,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -765,6 +762,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	}
  
  	spin_unlock_bh(&q->lock);
@@ -193,7 +176,7 @@
  }
  
  static void
-@@ -873,7 +877,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -795,7 +799,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  		return;
  
  	mt76_dma_sync_idx(dev, q);
@@ -202,7 +185,7 @@
  }
  
  static void
-@@ -890,7 +894,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -812,7 +816,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
  	} else {
@@ -211,7 +194,7 @@
  	}
  
  	if (more)
-@@ -960,12 +964,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -882,12 +886,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		    !(dev->drv->rx_check(dev, data, len)))
  			goto free_frag;
  
@@ -225,7 +208,7 @@
  
  		*(u32 *)skb->cb = info;
  
-@@ -981,10 +984,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -903,10 +906,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		continue;
  
  free_frag:
@@ -238,7 +221,7 @@
  	return done;
  }
  
-@@ -1029,7 +1032,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -951,7 +954,7 @@ mt76_dma_init(struct mt76_dev *dev,
  
  	mt76_for_each_q_rx(dev, i) {
  		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
@@ -247,7 +230,7 @@
  		napi_enable(&dev->napi[i]);
  	}
  
-@@ -1098,8 +1101,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -1006,8 +1009,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  		netif_napi_del(&dev->napi[i]);
  		mt76_dma_rx_cleanup(dev, q);
@@ -256,6 +239,20 @@
  	}
  
  	if (mtk_wed_device_active(&dev->mmio.wed))
+diff --git a/dma.h b/dma.h
+index 1de5a2b..619dc0f 100644
+--- a/dma.h
++++ b/dma.h
+@@ -79,8 +79,7 @@ enum mt76_dma_wed_ind_reason {
+ int mt76_dma_rx_poll(struct napi_struct *napi, int budget);
+ void mt76_dma_attach(struct mt76_dev *dev);
+ void mt76_dma_cleanup(struct mt76_dev *dev);
+-int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+-		     bool allow_direct);
++int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q);
+ void __mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q,
+ 			    bool reset_idx);
+ void mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q);
 diff --git a/eeprom.c b/eeprom.c
 index ecd09c0..a267397 100644
 --- a/eeprom.c
@@ -278,7 +275,7 @@
  	if (!is_valid_ether_addr(phy->macaddr)) {
  		eth_random_addr(phy->macaddr);
 diff --git a/mac80211.c b/mac80211.c
-index 6c5b4f5..259b448 100644
+index 6e8ac6f..b30a74e 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -371,117 +368,11 @@
  
  struct sk_buff *
  __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
-diff --git a/mmio.c b/mmio.c
-index c3e0e23..6e25a14 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -89,8 +89,12 @@ EXPORT_SYMBOL_GPL(mt76_set_irq_mask);
- void mt76_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- {
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
-+	u32 length;
- 	int i;
- 
-+	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
-+				sizeof(struct skb_shared_info));
-+
- 	for (i = 0; i < dev->rx_token_size; i++) {
- 		struct mt76_txwi_cache *t;
- 
-@@ -98,7 +102,9 @@ void mt76_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- 		if (!t || !t->ptr)
- 			continue;
- 
--		mt76_put_page_pool_buf(t->ptr, false);
-+		dma_unmap_single(dev->dma_dev, t->dma_addr,
-+				 wed->wlan.rx_size, DMA_FROM_DEVICE);
-+		__free_pages(virt_to_page(t->ptr), get_order(length));
- 		t->ptr = NULL;
- 
- 		mt76_put_rxwi(dev, t);
-@@ -112,39 +118,51 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- {
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
- 	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
--	struct mt76_queue *q = &dev->q_rx[MT_RXQ_MAIN];
--	int i, len = SKB_WITH_OVERHEAD(q->buf_size);
--	struct mt76_txwi_cache *t = NULL;
-+	u32 length;
-+	int i;
-+
-+	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
-+				sizeof(struct skb_shared_info));
- 
- 	for (i = 0; i < size; i++) {
--		enum dma_data_direction dir;
--		dma_addr_t addr;
--		u32 offset;
-+		struct mt76_txwi_cache *t = mt76_get_rxwi(dev);
-+		dma_addr_t phy_addr;
-+		struct page *page;
- 		int token;
--		void *buf;
-+		void *ptr;
- 
--		t = mt76_get_rxwi(dev);
- 		if (!t)
- 			goto unmap;
- 
--		buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
--		if (!buf)
-+		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
-+		if (!page) {
-+			mt76_put_rxwi(dev, t);
- 			goto unmap;
-+		}
- 
--		addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
--		dir = page_pool_get_dma_dir(q->page_pool);
--		dma_sync_single_for_device(dev->dma_dev, addr, len, dir);
-+		ptr = page_address(page);
-+		phy_addr = dma_map_single(dev->dma_dev, ptr,
-+					  wed->wlan.rx_size,
-+					  DMA_TO_DEVICE);
-+		if (unlikely(dma_mapping_error(dev->dev, phy_addr))) {
-+			__free_pages(page, get_order(length));
-+			mt76_put_rxwi(dev, t);
-+			goto unmap;
-+		}
- 
--		desc->buf0 = cpu_to_le32(addr);
--		token = mt76_rx_token_consume(dev, buf, t, addr);
-+		desc->buf0 = cpu_to_le32(phy_addr);
-+		token = mt76_rx_token_consume(dev, ptr, t, phy_addr);
- 		if (token < 0) {
--			mt76_put_page_pool_buf(buf, false);
-+			dma_unmap_single(dev->dma_dev, phy_addr,
-+					 wed->wlan.rx_size, DMA_TO_DEVICE);
-+			__free_pages(page, get_order(length));
-+			mt76_put_rxwi(dev, t);
- 			goto unmap;
- 		}
- 
- 		token = FIELD_PREP(MT_DMA_CTL_TOKEN, token);
- #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
--		token |= FIELD_PREP(MT_DMA_CTL_SDP0_H, addr >> 32);
-+		token |= FIELD_PREP(MT_DMA_CTL_SDP0_H, phy_addr >> 32);
- #endif
- 		desc->token |= cpu_to_le32(token);
- 		desc++;
-@@ -153,8 +171,6 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 	return 0;
- 
- unmap:
--	if (t)
--		mt76_put_rxwi(dev, t);
- 	mt76_mmio_wed_release_rx_buf(wed);
- 
- 	return -ENOMEM;
 diff --git a/mt76.h b/mt76.h
-index 580891f..c644647 100644
+index 03116ff..1c37031 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -232,7 +232,7 @@ struct mt76_queue {
+@@ -233,7 +233,7 @@ struct mt76_queue {
  
  	dma_addr_t desc_dma;
  	struct sk_buff *rx_head;
@@ -490,7 +381,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1508,7 +1508,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1517,7 +1517,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -498,7 +389,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1653,25 +1652,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1662,25 +1661,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
@@ -537,7 +428,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac.h b/mt76_connac.h
-index fdde3d7..6c8a453 100644
+index 1be41d6..e23a41c 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -56,7 +56,6 @@ enum {
@@ -548,7 +439,7 @@
  
  	CMD_HE_MCS_BW80 = 0,
  	CMD_HE_MCS_BW160,
-@@ -275,7 +274,6 @@ static inline u8 mt76_connac_chan_bw(struct cfg80211_chan_def *chandef)
+@@ -286,7 +285,6 @@ static inline u8 mt76_connac_chan_bw(struct cfg80211_chan_def *chandef)
  		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
  		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
  		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
@@ -557,7 +448,7 @@
  
  	if (chandef->width >= ARRAY_SIZE(width_to_bw))
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 91000b8..eea6831 100644
+index fe5250c..7692423 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -568,7 +459,7 @@
  
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
-@@ -1347,40 +1348,6 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1350,40 +1351,6 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  }
  EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
  
@@ -609,7 +500,7 @@
  const struct ieee80211_sta_he_cap *
  mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
  {
-@@ -1396,18 +1363,6 @@ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
+@@ -1399,18 +1366,6 @@ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
  }
  EXPORT_SYMBOL_GPL(mt76_connac_get_he_phy_cap);
  
@@ -629,10 +520,10 @@
  #define DEFAULT_HE_DURATION_RTS_THRES	1023
  static void
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 84e77fa..5308ddc 100644
+index 8d516e4..ea71d53 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1970,12 +1970,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val);
+@@ -1976,12 +1976,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val);
  
  const struct ieee80211_sta_he_cap *
  mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
@@ -646,10 +537,10 @@
  int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			    struct mt76_connac_sta_key_conf *sta_key_conf,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3cf459d..fea1fea 100644
+index 1548c1f..4e9a509 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1413,22 +1413,20 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1434,22 +1434,20 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
@@ -678,7 +569,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1456,7 +1454,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1477,7 +1475,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		.idx = mvif->mt76.idx,
  	};
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -687,7 +578,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1568,12 +1566,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1589,12 +1587,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -704,7 +595,7 @@
  
  static void
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6cd6ad1..ccd08ed 100644
+index d443d50..32b6096 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -716,7 +607,7 @@
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
 diff --git a/usb.c b/usb.c
-index 5e5c7bf..3e28171 100644
+index 1b25f2e..46831a2 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
@@ -849,6 +740,139 @@
  }
  
  static void mt76u_free_rx(struct mt76_dev *dev)
+diff --git a/wed.c b/wed.c
+index f89e453..f7a3f1b 100644
+--- a/wed.c
++++ b/wed.c
+@@ -9,8 +9,12 @@
+ void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
+ {
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
++	u32 length;
+ 	int i;
+ 
++	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
++				sizeof(struct skb_shared_info));
++
+ 	for (i = 0; i < dev->rx_token_size; i++) {
+ 		struct mt76_txwi_cache *t;
+ 
+@@ -18,7 +22,9 @@ void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
+ 		if (!t || !t->ptr)
+ 			continue;
+ 
+-		mt76_put_page_pool_buf(t->ptr, false);
++		dma_unmap_single(dev->dma_dev, t->dma_addr,
++				 wed->wlan.rx_size, DMA_FROM_DEVICE);
++		__free_pages(virt_to_page(t->ptr), get_order(length));
+ 		t->ptr = NULL;
+ 
+ 		mt76_put_rxwi(dev, t);
+@@ -33,39 +39,51 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ {
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ 	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
+-	struct mt76_queue *q = &dev->q_rx[MT_RXQ_MAIN];
+-	int i, len = SKB_WITH_OVERHEAD(q->buf_size);
+-	struct mt76_txwi_cache *t = NULL;
++	u32 length;
++	int i;
++
++	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
++				sizeof(struct skb_shared_info));
+ 
+ 	for (i = 0; i < size; i++) {
+-		enum dma_data_direction dir;
+-		dma_addr_t addr;
+-		u32 offset;
++		struct mt76_txwi_cache *t = mt76_get_rxwi(dev);
++		dma_addr_t phy_addr;
++		struct page *page;
+ 		int token;
+-		void *buf;
++		void *ptr;
+ 
+-		t = mt76_get_rxwi(dev);
+ 		if (!t)
+ 			goto unmap;
+ 
+-		buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
+-		if (!buf)
++		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
++		if (!page) {
++			mt76_put_rxwi(dev, t);
+ 			goto unmap;
++		}
+ 
+-		addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
+-		dir = page_pool_get_dma_dir(q->page_pool);
+-		dma_sync_single_for_device(dev->dma_dev, addr, len, dir);
++		ptr = page_address(page);
++		phy_addr = dma_map_single(dev->dma_dev, ptr,
++					  wed->wlan.rx_size,
++					  DMA_TO_DEVICE);
++		if (unlikely(dma_mapping_error(dev->dev, phy_addr))) {
++			__free_pages(page, get_order(length));
++			mt76_put_rxwi(dev, t);
++			goto unmap;
++		}
+ 
+-		desc->buf0 = cpu_to_le32(addr);
+-		token = mt76_rx_token_consume(dev, buf, t, addr);
++		desc->buf0 = cpu_to_le32(phy_addr);
++		token = mt76_rx_token_consume(dev, ptr, t, phy_addr);
+ 		if (token < 0) {
+-			mt76_put_page_pool_buf(buf, false);
++			dma_unmap_single(dev->dma_dev, phy_addr,
++					 wed->wlan.rx_size, DMA_TO_DEVICE);
++			__free_pages(page, get_order(length));
++			mt76_put_rxwi(dev, t);
+ 			goto unmap;
+ 		}
+ 
+ 		token = FIELD_PREP(MT_DMA_CTL_TOKEN, token);
+ #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+-		token |= FIELD_PREP(MT_DMA_CTL_SDP0_H, addr >> 32);
++		token |= FIELD_PREP(MT_DMA_CTL_SDP0_H, phy_addr >> 32);
+ #endif
+ 		desc->token |= cpu_to_le32(token);
+ 		desc++;
+@@ -74,8 +92,6 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 	return 0;
+ 
+ unmap:
+-	if (t)
+-		mt76_put_rxwi(dev, t);
+ 	mt76_wed_release_rx_buf(wed);
+ 
+ 	return -ENOMEM;
+@@ -123,7 +139,7 @@ int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+ 		/* WED txfree queue needs ring to be initialized before setup */
+ 		q->flags = 0;
+ 		mt76_dma_queue_reset(dev, q);
+-		mt76_dma_rx_fill(dev, q, false);
++		mt76_dma_rx_fill(dev, q);
+ 
+ 		ret = mtk_wed_device_txfree_ring_setup(q->wed, q->regs);
+ 		if (!ret)
+@@ -144,7 +160,7 @@ int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+ 		break;
+ 	case MT76_WED_RRO_Q_MSDU_PG:
+ 		q->flags &= ~MT_QFLAG_WED;
+-		__mt76_dma_queue_reset(dev, q, false);
++		__mt76_dma_queue_reset(dev, q);
+ 		mtk_wed_device_msdu_pg_rx_ring_setup(q->wed, ring, q->regs);
+ 		q->head = q->ndesc - 1;
+ 		q->queued = q->head;
+@@ -152,7 +168,7 @@ int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+ 	case MT76_WED_RRO_Q_IND:
+ 		q->flags &= ~MT_QFLAG_WED;
+ 		mt76_dma_queue_reset(dev, q);
+-		mt76_dma_rx_fill(dev, q, false);
++		mt76_dma_rx_fill(dev, q);
+ 		mtk_wed_device_ind_rx_ring_setup(q->wed, q->regs);
+ 		break;
+ 	default:
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
index 12aa0a4..25907fe 100644
--- a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
@@ -1,7 +1,8 @@
-From fc62783246a5f95bbb82928b8395ec695e0ca69c Mon Sep 17 00:00:00 2001
+From f1c639c9af8a46987ccdbb96c6327d801983101a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH] wifi: mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1000/1048] wifi: mt76: mt7915: add mtk internal debug tools
+ for mt76
 
 ---
  mt76_connac_mcu.h     |    6 +
@@ -22,10 +23,10 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5308ddc..d28ee91 100644
+index ea71d53..ae5bbc0 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1183,6 +1183,7 @@ enum {
+@@ -1188,6 +1188,7 @@ enum {
  	MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
  	MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_CMD_TXBF_ACTION = 0x1e,
@@ -33,7 +34,7 @@
  	MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
  	MCU_EXT_CMD_THERMAL_PROT = 0x23,
  	MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
-@@ -1206,6 +1207,11 @@ enum {
+@@ -1211,6 +1212,11 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
@@ -231,7 +232,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5c7e0e6..d7b7e78 100644
+index e819815..734d6ba 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -275,6 +275,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -270,7 +271,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index fea1fea..38ffd90 100644
+index 4e9a509..6e362fc 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -294,7 +295,7 @@
  	mt7915_mac_wtbl_update(dev, idx,
  			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ccd08ed..1cb462f 100644
+index 32b6096..6d704f7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -205,6 +205,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -309,7 +310,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -2297,7 +2302,10 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
+@@ -2386,7 +2391,10 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
  				 sizeof(req), false);
  }
  
@@ -321,7 +322,7 @@
  {
  #define RED_DISABLE		0
  #define RED_BY_WA_ENABLE	2
-@@ -3360,6 +3368,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3449,6 +3457,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -330,7 +331,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -4014,6 +4024,23 @@ out:
+@@ -4121,6 +4131,23 @@ out:
  	return ret;
  }
  
@@ -354,7 +355,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -4042,3 +4069,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -4149,3 +4176,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -378,10 +379,10 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 8f36546..dd3b506 100644
+index fa0847d..9ae0f07 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -333,6 +333,10 @@ enum {
+@@ -347,6 +347,10 @@ enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
  	MCU_WA_PARAM_RED = 0x0e,
@@ -389,11 +390,11 @@
 +	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
 +	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 +#endif
+ 	MCU_WA_PARAM_BSS_ACQ_PKT_CNT = 0x12,
  	MCU_WA_PARAM_RED_SETTING = 0x40,
  };
- 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 35458ec..887c4a5 100644
+index 874d531..1418d19 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -404,11 +405,10 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -322,6 +323,28 @@ struct mt7915_dev {
- 	struct reset_control *rstc;
+@@ -323,6 +324,28 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
-+
+ 
 +#ifdef MTK_DEBUG
 +	u16 wlan_idx;
 +	struct {
@@ -430,10 +430,11 @@
 +	} dbg;
 +	const struct mt7915_dbg_reg_desc *dbg_reg;
 +#endif
++
+ 	bool wmm_pbc_enable;
+ 	struct work_struct wmm_pbc_work;
  };
- 
- enum {
-@@ -601,4 +624,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -605,4 +628,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -1908,7 +1909,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..f3983da
+index 0000000..e626119
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,3743 @@
@@ -4836,7 +4837,7 @@
 +{
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	struct mt76_dev *mdev = NULL;
-+	seq_printf(s, "Version: 2.2.15.0\n");
++	seq_printf(s, "Version: 2.2.16.0\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
index 654e632..a30130d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,7 +1,7 @@
-From 799948d6f5dc16251034621b69a48bdf6f30a197 Mon Sep 17 00:00:00 2001
+From 9f9d74f327383dc5fb45b48274b64c6b44fdf306 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 13/76] wifi: mt76: mt7915: csi: implement csi support
+Subject: [PATCH 1001/1048] wifi: mt76: mt7915: csi: implement csi support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -18,10 +18,10 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index d28ee91..b31f19a 100644
+index ae5bbc0..81af870 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1017,6 +1017,7 @@ enum {
+@@ -1022,6 +1022,7 @@ enum {
  	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
@@ -29,7 +29,7 @@
  };
  
  /* unified event table */
-@@ -1228,6 +1229,7 @@ enum {
+@@ -1234,6 +1235,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -55,7 +55,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT798X_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index d5d9cbf..d4bf09c 100644
+index 2fc1f3c..ac9354e 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -696,6 +696,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
@@ -118,7 +118,7 @@
  	if (is_mt798x(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1233,6 +1265,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1235,6 +1267,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,10 +132,10 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 38ffd90..a4baa3d 100644
+index 6e362fc..6790e98 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -784,6 +784,10 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -805,6 +805,10 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy = msta->vif->phy;
  	int i;
  
@@ -147,7 +147,7 @@
  
  	mt7915_mac_wtbl_update(dev, msta->wcid.idx,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1cb462f..3202c4e 100644
+index 6d704f7..c6c40ca 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -40,6 +40,10 @@ static bool sr_scene_detect = true;
@@ -161,7 +161,7 @@
  static u8
  mt7915_mcu_get_sta_nss(u16 mcs_map)
  {
-@@ -379,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -466,6 +470,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_FW_LOG_2_HOST:
  		mt7915_mcu_rx_log_message(dev, skb);
  		break;
@@ -173,7 +173,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -4024,6 +4033,200 @@ out:
+@@ -4131,6 +4140,200 @@ out:
  	return ret;
  }
  
@@ -375,10 +375,10 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index dd3b506..09aa7ec 100644
+index 9ae0f07..f32d525 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -589,4 +589,78 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
+@@ -604,4 +604,78 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
  enum {
  	MCU_GET_TX_RATE = 4
  };
@@ -458,7 +458,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 887c4a5..475fcf7 100644
+index 1418d19..e4689d0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -195,6 +195,45 @@ struct mt7915_hif {
@@ -529,7 +529,7 @@
  };
  
  struct mt7915_dev {
-@@ -624,6 +678,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -628,6 +682,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
index 03e2bbf..a910d36 100644
--- a/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
@@ -1,7 +1,7 @@
-From 868bd53b53d3885f8ad99198528d7f6abd8ac109 Mon Sep 17 00:00:00 2001
+From 538bdc90a9e58e64b20719a2ef0d0cf1817a26c8 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 14/76] wifi: mt76: mt7915: air monitor support
+Subject: [PATCH 1002/1048] wifi: mt76: mt7915: air monitor support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b31f19a..b758679 100644
+index 81af870..4569113 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1229,6 +1229,8 @@ enum {
+@@ -1235,6 +1235,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,7 +26,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d7b7e78..c0a390d 100644
+index 734d6ba..5969e2e 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -524,6 +524,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -41,10 +41,10 @@
  		status->flag |= RX_FLAG_8023;
  		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index a4baa3d..7d15a40 100644
+index 6790e98..2c7287d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -773,6 +773,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -794,6 +794,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,7 +55,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 475fcf7..8c83b9f 100644
+index e4689d0..18a6899 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -232,6 +232,33 @@ struct csi_data {
@@ -101,7 +101,7 @@
  #endif
  };
  
-@@ -682,6 +711,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -686,6 +715,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr, u32 sta_interval);
diff --git a/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch b/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
index b3646c3..0ddb540 100644
--- a/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
@@ -1,7 +1,7 @@
-From f0393af40ecc847516a78740eee53956ae8a4f13 Mon Sep 17 00:00:00 2001
+From fda54b36ad78d5aeee5a1fb19463bfb9afd367e3 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 4 Apr 2023 02:23:57 +0800
-Subject: [PATCH] wifi: mt76: mt7915: add support for muru_onoff via
+Subject: [PATCH 1003/1048] wifi: mt76: mt7915: add support for muru_onoff via
 
 ---
  mt7915/init.c        |  1 +
@@ -12,7 +12,7 @@
  5 files changed, 50 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 46d9499..974dd34 100644
+index ac9354e..132be2e 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -363,6 +363,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
@@ -24,10 +24,10 @@
  	hw->sta_data_size = sizeof(struct mt7915_sta);
  	hw->vif_data_size = sizeof(struct mt7915_vif);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d43b597..8c84b24 100644
+index c6c40ca..8b48604 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -875,6 +875,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -965,6 +965,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
@@ -35,7 +35,7 @@
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -886,13 +887,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -976,13 +977,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  
  	muru = (struct sta_rec_muru *)tlv;
  
@@ -57,10 +57,10 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 67eac5c..84c52d9 100644
+index f32d525..f44146e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -666,4 +666,10 @@ struct csi_data {
+@@ -678,4 +678,10 @@ enum CSI_CHAIN_TYPE {
  };
  #endif
  
@@ -72,10 +72,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6192e81..e45e2fb 100644
+index 18a6899..fc845f4 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -252,6 +252,8 @@ struct mt7915_phy {
+@@ -289,6 +289,8 @@ struct mt7915_phy {
  	u32 rx_ampdu_ts;
  	u32 ampdu_ref;
  
@@ -85,10 +85,10 @@
  	struct mt76_channel_state state_ts;
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index d7bbc59..803cabc 100644
+index e626119..9e6ea86 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2556,6 +2556,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
+@@ -2554,6 +2554,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -127,7 +127,7 @@
  static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -3552,6 +3584,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3673,6 +3705,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
index a0f9cf2..b72e0a5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From 5b5f463212f00b4489d1c23f8e1a88f59c7cc7df Mon Sep 17 00:00:00 2001
+From 3762477275edee40bf82914235756597a7978166 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 16/76] wifi: mt76: mt7915: certification patches
+Subject: [PATCH 1004/1048] wifi: mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -16,10 +16,10 @@
  9 files changed, 955 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b758679..c4f5a64 100644
+index 4569113..36054bd 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1231,6 +1231,7 @@ enum {
+@@ -1237,6 +1237,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index c0a390d..2168387 100644
+index 5969e2e..a5e9ce4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -2000,6 +2001,21 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+@@ -1996,6 +1997,21 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
  	spin_unlock_bh(&phy->stats_lock);
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2022,6 +2038,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -2018,6 +2034,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3b33659..76d1cd7 100644
+index 2c7287d..1e9a3a6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -748,6 +748,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -769,6 +769,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -776,7 +779,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -797,7 +800,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -107,10 +107,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8c84b24..63a1292 100644
+index 8b48604..a9bba17 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4139,6 +4139,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -4338,6 +4338,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -584,10 +584,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 84c52d9..7b7c2d1 100644
+index f44146e..eef2fc0 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -471,10 +471,14 @@ enum {
+@@ -486,10 +486,14 @@ enum {
  	RATE_PARAM_FIXED = 3,
  	RATE_PARAM_MMPS_UPDATE = 5,
  	RATE_PARAM_FIXED_HE_LTF = 7,
@@ -603,7 +603,7 @@
  };
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -486,6 +490,9 @@ enum {
+@@ -501,6 +505,9 @@ enum {
  #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
  #define RATE_CFG_HE_LTF			GENMASK(31, 28)
  
@@ -613,7 +613,7 @@
  enum {
  	TX_POWER_LIMIT_ENABLE,
  	TX_POWER_LIMIT_TABLE = 0x4,
-@@ -671,5 +678,203 @@ struct csi_data {
+@@ -683,5 +690,203 @@ enum CSI_CHAIN_TYPE {
  #define OFDMA_UL                       BIT(1)
  #define MUMIMO_DL                      BIT(2)
  #define MUMIMO_UL                      BIT(3)
@@ -818,10 +818,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e45e2fb..ab3c8f7 100644
+index fc845f4..eee4df8 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -672,6 +672,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -714,6 +714,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -840,12 +840,12 @@
 +void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val);
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
- 			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
+ 		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr, u32 sta_interval);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 803cabc..587497b 100644
+index 9e6ea86..e3f4508 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2562,7 +2562,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+@@ -2560,7 +2560,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
  
  	*val = phy->muru_onoff;
  
@@ -855,7 +855,7 @@
  		    !!(phy->muru_onoff & MUMIMO_UL),
  		    !!(phy->muru_onoff & MUMIMO_DL),
  		    !!(phy->muru_onoff & OFDMA_UL),
-@@ -2575,8 +2576,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+@@ -2573,8 +2574,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
  {
  	struct mt7915_phy *phy = data;
  
@@ -867,10 +867,10 @@
  	}
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 43f9690..19c9e71 100644
+index c964b14..7a71894 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
+@@ -23,6 +23,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
  	[MTK_VENDOR_ATTR_CSI_CTRL_DATA] = { .type = NLA_NESTED },
  };
  
@@ -900,7 +900,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -779,6 +802,149 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -797,6 +820,149 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len + 1;
  }
  
@@ -1050,7 +1050,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -803,6 +969,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -821,6 +987,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_amnt_ctrl_dump,
  		.policy = amnt_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
@@ -1080,10 +1080,10 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f..1b08321 100644
+index 1863eee..1a18cae 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -6,6 +6,48 @@
+@@ -7,6 +7,48 @@
  enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
  	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch b/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
index aefe8bc..78ce5f3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
@@ -1,8 +1,8 @@
-From a49b1acefb6d57b8147a931edbbe77536f870d12 Mon Sep 17 00:00:00 2001
+From d159cf9fff522805c40e0f30842e23b4f4f9b431 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 23 Mar 2023 09:55:50 +0800
-Subject: [PATCH 17/76] wifi: mt76: mt7915: add support for runtime set in-band
- discovery
+Subject: [PATCH 1005/1048] wifi: mt76: mt7915: add support for runtime set
+ in-band discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 63a1292..95a5593 100644
+index a9bba17..65d11f1 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1940,8 +1940,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -2030,8 +2030,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	bcn = (struct bss_info_bcn *)tlv;
  	bcn->enable = true;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -1978,7 +1977,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -2068,7 +2067,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 3e34d28..9def78b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,7 +1,8 @@
-From 7a1f1d03b9546d1b025637fcd8f36cd78ac2e429 Mon Sep 17 00:00:00 2001
+From c060ba823d8a6a0a749957c4559f36c91d26c8df Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 4 Apr 2023 02:27:44 +0800
-Subject: [PATCH 18/76] wifi: mt76: mt7915: add mt76 vendor muru onoff command
+Subject: [PATCH 1006/1048] wifi: mt76: mt7915: add mt76 vendor muru onoff
+ command
 
 ---
  mt7915/mcu.c    |  7 +++++++
@@ -11,10 +12,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 95a5593..9bd9253 100644
+index 65d11f1..9c07b14 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4158,6 +4158,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -4357,6 +4357,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			phy->muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,10 +30,10 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 7b7c2d1..b6e2136 100644
+index eef2fc0..8650053 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -478,6 +478,7 @@ enum {
+@@ -493,6 +493,7 @@ enum {
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
  	RATE_PARAM_FIXED_OFDMA = 31,
@@ -41,10 +42,10 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 19c9e71..6fc88f9 100644
+index 7a71894..a8b1fa8 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+@@ -35,6 +35,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
  	[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
  };
  
@@ -56,7 +57,7 @@
  static const struct nla_policy
  rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
  	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
-@@ -945,6 +950,33 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+@@ -963,6 +968,33 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -90,7 +91,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -991,6 +1023,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1009,6 +1041,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_wireless_ctrl,
  		.policy = wireless_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
@@ -109,10 +110,10 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321..2be5fc8 100644
+index 1a18cae..a4a9180 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
+@@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
  	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
  	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
@@ -120,7 +121,7 @@
  };
  
  enum mtk_capi_control_changed {
-@@ -33,6 +34,17 @@ enum mtk_vendor_attr_wireless_ctrl {
+@@ -34,6 +35,17 @@ enum mtk_vendor_attr_wireless_ctrl {
  		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
  };
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
index 4248bc6..521006d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,14 +1,14 @@
-From cec905b3ba5574b56cddde6ec5fca32990290336 Mon Sep 17 00:00:00 2001
+From c0b3af610482837dfaa04dddeb8beb099d797a7f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 19/76] wifi: mt76: mt7915: drop undefined action frame
+Subject: [PATCH 1007/1048] wifi: mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 2168387..6047121 100644
+index a5e9ce4..b9fcc10 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -737,6 +737,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
diff --git a/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
index 37f9bd0..dcf7276 100644
--- a/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
@@ -1,7 +1,8 @@
-From 88ebb3ad1cef268dd72f9e1892ef58bdb6b94a93 Mon Sep 17 00:00:00 2001
+From 89869c9c04ad990c56074b22311d49a5a57862b1 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 20/76] wifi: mt76: testmode: rework testmode init registers
+Subject: [PATCH 1008/1048] wifi: mt76: testmode: rework testmode init
+ registers
 
 ---
  mac80211.c        |   3 +-
@@ -17,7 +18,7 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 259b448..432bc40 100644
+index b30a74e..3f5c2ed 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -804,7 +804,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -31,10 +32,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index c644647..2244ab5 100644
+index 1c37031..9fe1716 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -706,6 +706,8 @@ struct mt76_testmode_ops {
+@@ -707,6 +707,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -43,7 +44,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -737,6 +739,8 @@ struct mt76_testmode_data {
+@@ -738,6 +740,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -52,7 +53,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -744,6 +748,7 @@ struct mt76_testmode_data {
+@@ -745,6 +749,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -61,10 +62,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c4f5a64..d4254be 100644
+index 36054bd..edc9e12 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1225,6 +1225,7 @@ enum {
+@@ -1231,6 +1231,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -73,7 +74,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b6e2136..c15b4b7 100644
+index 8650053..7653b5e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -85,7 +86,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index bd9e01d..0fd1a34 100644
+index 6004d64..694fc1b 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -120,6 +120,7 @@ static const u32 mt7986_reg[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
index fc2c244..a731e9f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From c568828715236c265d20d3791948041cb23de480 Mon Sep 17 00:00:00 2001
+From 01f1c8b87246849ea6cec5dbcab4b6d35d93b5e6 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 21/76] wifi: mt76: testmode: additional supports
+Subject: [PATCH 1009/1048] wifi: mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -29,10 +29,10 @@
  20 files changed, 2064 insertions(+), 169 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 9eb2b8f..d338424 100644
+index 8240691..bbae84f 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -615,8 +615,7 @@ free:
+@@ -613,8 +613,7 @@ free:
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -43,7 +43,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index 432bc40..241621c 100644
+index 3f5c2ed..305cae7 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -73,10 +73,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 2244ab5..7924cca 100644
+index 9fe1716..f8cf809 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -704,6 +704,21 @@ struct mt76_testmode_ops {
+@@ -705,6 +705,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -98,7 +98,7 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -712,16 +727,13 @@ struct mt76_testmode_data {
+@@ -713,16 +728,13 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
@@ -117,7 +117,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -737,10 +749,37 @@ struct mt76_testmode_data {
+@@ -738,10 +750,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -156,7 +156,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1327,6 +1366,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1343,6 +1382,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -216,7 +216,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1337,7 +1429,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1353,7 +1445,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -226,7 +226,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1439,7 +1532,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1455,7 +1548,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -237,10 +237,10 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index eea6831..69babba 100644
+index 7692423..2b322b0 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -397,6 +397,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -400,6 +400,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	switch (vif->type) {
  	case NL80211_IFTYPE_MESH_POINT:
  	case NL80211_IFTYPE_AP:
@@ -248,7 +248,7 @@
  		if (vif->p2p && !is_mt7921(dev))
  			conn_type = CONNECTION_P2P_GC;
  		else
-@@ -578,6 +579,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -581,6 +582,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  	rx->rca2 = 1;
  	rx->rv = 1;
  
@@ -259,18 +259,18 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index d4254be..b61c195 100644
+index edc9e12..49a3406 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1012,6 +1012,7 @@ enum {
+@@ -1016,6 +1016,7 @@ enum {
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
 +	MCU_EXT_EVENT_BF_STATUS_READ = 0x35,
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
- 	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
-@@ -1232,6 +1233,7 @@ enum {
+ 	MCU_EXT_EVENT_BSS_ACQ_PKT_CNT = 0x52,
+@@ -1238,6 +1239,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -292,10 +292,10 @@
  				return ret;
  		}
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 46d9499..db61953 100644
+index 132be2e..9613e1d 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -725,7 +725,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -726,7 +726,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -305,7 +305,7 @@
  	mt7915_txbf_init(dev);
  }
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 6047121..d3b4a60 100644
+index b9fcc10..8c9be7e 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -579,6 +579,7 @@ mt7915_mac_fill_rx_vector(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -385,7 +385,7 @@
  #endif
  }
  
-@@ -1415,7 +1439,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+@@ -1414,7 +1438,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
  		goto out;
  
  	/* set the necessary init items */
@@ -395,7 +395,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 76d1cd7..7124e18 100644
+index 1e9a3a6..2a7ad8b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -408,10 +408,10 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9bd9253..8288589 100644
+index 9c07b14..8094c9a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -391,6 +391,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -478,6 +478,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -420,10 +420,10 @@
 +		mt7915_tm_txbf_status_read(dev, skb);
 +		break;
 +#endif
- 	default:
+ 	case MCU_EXT_EVENT_BSS_ACQ_PKT_CNT:
+ 		mt7915_mcu_rx_bss_acq_pkt_cnt(dev, skb);
  		break;
- 	}
-@@ -422,6 +427,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -512,6 +517,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	     rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
  	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
  	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
@@ -431,7 +431,7 @@
  	     !rxd->seq) &&
  	     !(rxd->eid == MCU_CMD_EXT_CID &&
  	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
-@@ -2764,7 +2770,8 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+@@ -2853,7 +2859,8 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
  	}
  #endif
  
@@ -441,7 +441,7 @@
  		req.tx_path_num = fls(phy->mt76->antenna_mask);
  
  	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
-@@ -2832,21 +2839,21 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2921,21 +2928,21 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -466,7 +466,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2855,7 +2862,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2944,7 +2951,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  	struct mt7915_mcu_eeprom_info *res;
  	struct sk_buff *skb;
  	int ret;
@@ -475,7 +475,7 @@
  
  	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
  					MCU_EXT_QUERY(EFUSE_ACCESS),
-@@ -2864,8 +2871,11 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2953,8 +2960,11 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -489,7 +489,7 @@
  
  	return 0;
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c15b4b7..9982735 100644
+index 7653b5e..c791c7f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -508,7 +508,7 @@
  };
  
  struct mt7915_mcu_thermal_ctrl {
-@@ -527,6 +532,12 @@ enum {
+@@ -542,6 +547,12 @@ enum {
  
  enum {
  	MT_BF_SOUNDING_ON = 1,
@@ -521,7 +521,7 @@
  	MT_BF_TYPE_UPDATE = 20,
  	MT_BF_MODULE_UPDATE = 25
  };
-@@ -775,10 +786,20 @@ struct mt7915_muru {
+@@ -787,10 +798,20 @@ struct mt7915_muru {
  #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
  
  /* Common Config */
@@ -547,7 +547,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 0fd1a34..c0cf8fb 100644
+index 694fc1b..222e2cf 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -134,6 +134,7 @@ static const u32 mt7915_offs[] = {
@@ -567,10 +567,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ab3c8f7..b91af94 100644
+index eee4df8..03a8930 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -267,11 +267,15 @@ struct mt7915_phy {
+@@ -304,11 +304,15 @@ struct mt7915_phy {
  
  		s32 last_freq_offset;
  		u8 last_rcpi[4];
@@ -586,7 +586,7 @@
  	} test;
  #endif
  
-@@ -371,6 +375,14 @@ struct mt7915_dev {
+@@ -409,6 +413,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -601,7 +601,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -542,8 +554,8 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -583,8 +595,8 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -612,14 +612,14 @@
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
-@@ -582,6 +594,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -623,6 +635,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
 +int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_wmm_pbc_work(struct work_struct *work);
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
- {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
 index 2a9e50b..6783797 100644
 --- a/mt7915/regs.h
@@ -3226,7 +3226,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 1809b03..f1dd9f6 100644
+index 4596b36..d9731e5 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -259,8 +259,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
diff --git a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch
index 670097d..ebc3062 100644
--- a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 824fba94e1bc5a00182da6e1bad32795c4b85882 Mon Sep 17 00:00:00 2001
+From f632c95552340e4fee0bb78f128a5fdb14d09219 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 22/76] wifi: mt76: testmode: add pre-cal support
+Subject: [PATCH 1010/1048] wifi: mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -36,10 +36,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 7924cca..f43cb53 100644
+index f8cf809..9c69cfb 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -705,6 +705,7 @@ struct mt76_testmode_ops {
+@@ -706,6 +706,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -48,10 +48,10 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b61c195..964ee53 100644
+index 49a3406..1a32268 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1008,6 +1008,7 @@ enum {
+@@ -1012,6 +1012,7 @@ enum {
  
  /* ext event table */
  enum {
@@ -113,10 +113,10 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8288589..19e88b0 100644
+index 8094c9a..d983432 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -395,6 +395,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -482,6 +482,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BF_STATUS_READ:
  		mt7915_tm_txbf_status_read(dev, skb);
  		break;
@@ -124,9 +124,9 @@
 +		mt7915_tm_rf_test_event(dev, skb);
 +		break;
  #endif
- 	default:
- 		break;
-@@ -2939,7 +2942,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+ 	case MCU_EXT_EVENT_BSS_ACQ_PKT_CNT:
+ 		mt7915_mcu_rx_bss_acq_pkt_cnt(dev, skb);
+@@ -3028,7 +3031,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -135,7 +135,7 @@
  		return 0;
  
  	/*
-@@ -3019,11 +3022,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3108,11 +3111,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -168,10 +168,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b91af94..ce128ab 100644
+index 03a8930..d77a5f0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -359,6 +359,10 @@ struct mt7915_dev {
+@@ -397,6 +397,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -182,14 +182,14 @@
  
  	struct {
  		u8 debug_wm;
-@@ -595,6 +599,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -636,6 +640,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
 +void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_wmm_pbc_work(struct work_struct *work);
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
- {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
 index 32dc85c..4b34430 100644
 --- a/mt7915/testmode.c
diff --git a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch
index e9fd3aa..6b7aeb5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From b9f52cadd2e44becb966867882ba9533b7500698 Mon Sep 17 00:00:00 2001
+From 97b952fe3531f8cbdcd0ac0612d04547e254a0c4 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 23/76] wifi: mt76: testmode: add iBF command mode support
+Subject: [PATCH 1011/1048] wifi: mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 89129dc..b0bb62b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From 2dd660a1655c17d701507ab739f8fe74f8561de3 Mon Sep 17 00:00:00 2001
+From 9ae13bf78d979afa68e8586bfbe8aab5e8f64183 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 24/76] wifi: mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1012/1048] wifi: mt76: testmode: add ZWDFS test mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -18,10 +18,10 @@
  10 files changed, 508 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index f43cb53..98e8e71 100644
+index 9c69cfb..1234da6 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -790,6 +790,15 @@ struct mt76_testmode_data {
+@@ -791,6 +791,15 @@ struct mt76_testmode_data {
  		u64 fcs_error[__MT_RXQ_MAX];
  		u64 len_mismatch;
  	} rx_stats;
@@ -38,10 +38,10 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 964ee53..efb87d3 100644
+index 1a32268..4d85d32 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1227,6 +1227,7 @@ enum {
+@@ -1233,6 +1233,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -49,7 +49,7 @@
  	MCU_EXT_CMD_RX_STAT = 0xa4,
  	MCU_EXT_CMD_SET_SPR = 0xa8,
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
-@@ -1237,6 +1238,7 @@ enum {
+@@ -1243,6 +1244,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
@@ -58,10 +58,10 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 19e88b0..ddf130b 100644
+index d983432..61cf60e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2670,6 +2670,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+@@ -2759,6 +2759,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
  		req.monitor_chan = chandef->chan->hw_value;
  		req.monitor_central_chan =
  			ieee80211_frequency_to_channel(chandef->center_freq1);
@@ -69,7 +69,7 @@
  		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4708,3 +4709,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4907,3 +4908,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -139,10 +139,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9982735..f4c3bf4 100644
+index c791c7f..066246b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -686,6 +686,52 @@ struct csi_data {
+@@ -698,6 +698,52 @@ enum CSI_CHAIN_TYPE {
  };
  #endif
  
@@ -196,10 +196,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ce128ab..78ddbaf 100644
+index d77a5f0..827ee29 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -256,6 +256,7 @@ struct mt7915_phy {
+@@ -293,6 +293,7 @@ struct mt7915_phy {
  
  	struct mt76_mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -207,7 +207,7 @@
  
  	u8 stats_work_count;
  	struct list_head stats_list;
-@@ -711,6 +712,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -753,6 +754,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
index 4fccf5a..8c703ca 100644
--- a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
@@ -1,8 +1,8 @@
-From 1e99f66f9d2c81340bd1f4fb2b9adbaf69263299 Mon Sep 17 00:00:00 2001
+From 011707341e4bff752b9c4c3d6e4d553bdefae9a2 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH 25/76] wifi: mt76: testmode: add iBF/eBF cal and cert commands
- with golden
+Subject: [PATCH 1013/1048] wifi: mt76: testmode: add iBF/eBF cal and cert
+ commands with golden
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -13,7 +13,7 @@
  mt7915/mcu.c         |  29 ++-
  mt7915/mcu.h         | 172 ++++++++++++++++
  mt7915/mmio.c        |   2 +
- mt7915/mt7915.h      |  14 +-
+ mt7915/mt7915.h      |  16 +-
  mt7915/mtk_debugfs.c |  35 ++++
  mt7915/mtk_mcu.c     | 247 ++++++++++++++++++++++-
  mt7915/regs.h        |   4 +
@@ -22,13 +22,13 @@
  testmode.c           |   1 +
  testmode.h           |   9 +
  tools/fields.c       |   9 +
- 16 files changed, 858 insertions(+), 324 deletions(-)
+ 16 files changed, 859 insertions(+), 325 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 98e8e71..87bb745 100644
+index 1234da6..25b7cee 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -752,6 +752,7 @@ struct mt76_testmode_data {
+@@ -753,6 +753,7 @@ struct mt76_testmode_data {
  
  	struct list_head tm_entry_list;
  	struct mt76_wcid *cur_entry;
@@ -36,7 +36,7 @@
  	u8 entry_num;
  	union {
  		struct mt76_testmode_entry_data ed;
-@@ -780,6 +781,9 @@ struct mt76_testmode_data {
+@@ -781,6 +782,9 @@ struct mt76_testmode_data {
  
  	u8 txbf_act;
  	u16 txbf_param[8];
@@ -47,10 +47,10 @@
  	u32 tx_pending;
  	u32 tx_queued;
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 69babba..4a7b694 100644
+index 2b322b0..e23dd77 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2677,6 +2677,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -2680,6 +2680,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
  	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
  	struct bss_info_basic *bss;
  	struct tlv *tlv;
@@ -58,7 +58,7 @@
  
  	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
  	bss = (struct bss_info_basic *)tlv;
-@@ -2736,6 +2737,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -2739,6 +2740,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
  		bss->dtim_period = vif->bss_conf.dtim_period;
  		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
  							 chandef->chan->band, NULL);
@@ -68,7 +68,7 @@
  		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d3b4a60..9fd764f 100644
+index 8c9be7e..37183ca 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -730,8 +730,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -84,7 +84,7 @@
  	txwi[6] |= cpu_to_le32(val);
  #endif
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7124e18..c85a919 100644
+index 2a7ad8b..d4d5a93 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
@@ -175,7 +175,7 @@
  
  	return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ddf130b..3645540 100644
+index 61cf60e..1707aaf 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -186,7 +186,7 @@
  	if (ret)
  		return ret;
  
-@@ -391,10 +392,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -478,10 +479,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -201,7 +201,7 @@
  	case MCU_EXT_EVENT_RF_TEST:
  		mt7915_tm_rf_test_event(dev, skb);
  		break;
-@@ -683,11 +686,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
+@@ -773,11 +776,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
  	if (enable)
  		mt76_connac_mcu_bss_omac_tlv(skb, vif);
  
@@ -227,7 +227,7 @@
  
  	if (enable) {
  		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
-@@ -3440,6 +3454,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3529,6 +3543,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  
  int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  {
@@ -235,7 +235,7 @@
  	struct {
  		u8 action;
  		union {
-@@ -3466,7 +3481,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+@@ -3555,7 +3570,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  		.action = action,
  	};
  
@@ -243,7 +243,7 @@
  	switch (action) {
  	case MT_BF_SOUNDING_ON:
  		req.snd.snd_mode = MT_BF_PROCESSING;
-@@ -4601,6 +4615,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
+@@ -4800,6 +4814,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
  		req.he_opt = v2;
  		req.glo_opt = v3;
  		break;
@@ -254,10 +254,10 @@
  		return -EINVAL;
  	}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f4c3bf4..c95d990 100644
+index 066246b..de17c57 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -531,10 +531,12 @@ enum {
+@@ -546,10 +546,12 @@ enum {
  };
  
  enum {
@@ -270,7 +270,7 @@
  	MT_BF_PHASE_CAL = 14,
  	MT_BF_IBF_PHASE_COMP = 15,
  	MT_BF_PROFILE_WRITE_ALL = 17,
-@@ -542,6 +544,176 @@ enum {
+@@ -557,6 +559,176 @@ enum {
  	MT_BF_MODULE_UPDATE = 25
  };
  
@@ -448,7 +448,7 @@
  	MURU_SET_ARB_OP_MODE = 14,
  	MURU_SET_PLATFORM_TYPE = 25,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c0cf8fb..aa51df3 100644
+index 222e2cf..ddf1b72 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -133,6 +133,7 @@ static const u32 mt7915_offs[] = {
@@ -468,10 +468,10 @@
  	[AGG_AALCR0]		= 0x028,
  	[AGG_AWSCR0]		= 0x030,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 78ddbaf..2ef63a3 100644
+index 827ee29..42710e7 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -275,7 +275,6 @@ struct mt7915_phy {
+@@ -312,7 +312,6 @@ struct mt7915_phy {
  
  		u8 spe_idx;
  
@@ -479,7 +479,7 @@
  		bool bf_ever_en;
  	} test;
  #endif
-@@ -380,7 +379,7 @@ struct mt7915_dev {
+@@ -418,7 +417,7 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -488,7 +488,7 @@
  	struct {
  		void *txbf_phase_cal;
  		void *txbf_pfmu_data;
-@@ -519,6 +518,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+@@ -560,6 +559,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int mt7915_dma_start(struct mt7915_dev *dev, bool reset, bool wed_reset);
  int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
@@ -496,19 +496,22 @@
  void mt7915_reset(struct mt7915_dev *dev);
  int mt7915_run(struct ieee80211_hw *hw);
  int mt7915_mcu_init(struct mt7915_dev *dev);
-@@ -599,8 +599,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -640,10 +640,12 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
 -int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
-+
+-void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_wmm_pbc_work(struct work_struct *work);
+ 
 +#ifdef CONFIG_NL80211_TESTMODE
- void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
++void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
 +#endif
- 
++
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
-@@ -735,4 +737,10 @@ enum {
+ 	return is_mt7915(&dev->mt76) ? MT7915_WTBL_SIZE : MT7916_WTBL_SIZE;
+@@ -777,4 +779,10 @@ enum {
  
  #endif
  
@@ -520,10 +523,10 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 587497b..2ce1837 100644
+index e3f4508..0975682 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2890,6 +2890,36 @@ mt7915_txpower_level_set(void *data, u64 val)
+@@ -2888,6 +2888,36 @@ mt7915_txpower_level_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
  			 mt7915_txpower_level_set, "%lld\n");
  
@@ -560,7 +563,7 @@
  /* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
  static int
  mt7915_wa_set(void *data, u64 val)
-@@ -3649,6 +3679,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3770,6 +3800,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_file("txpower_level", 0400, dir, dev,
  			    &fops_txpower_level);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index c6bf7a4..07d3c69 100644
--- a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,17 +1,18 @@
-From 60d4943ff781d30aaedb00338f8daa5653e9f887 Mon Sep 17 00:00:00 2001
+From 58e8fc82df44c6debbafcb5237315aac0d131549 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 26/76] wifi: mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1014/1048] wifi: mt76: mt7915: init rssi in WTBL when add
+ station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c85a919..d73cf9f 100644
+index d4d5a93..0a3e8e0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -762,6 +762,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -783,6 +783,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
  #endif
  	int ret, idx;
@@ -19,7 +20,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -786,6 +787,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -807,6 +808,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
index a93efee..85d7351 100644
--- a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
@@ -1,7 +1,7 @@
-From aff3cbd4b173bd58066c0ca30a18f2ccf6607d3d Mon Sep 17 00:00:00 2001
+From 24d530077d09c7269397499bfbd040a73d4a579d Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 27/76] wifi: mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1015/1048] wifi: mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 241621c..1a7d690 100644
+index 305cae7..f9dfdf8 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -451,7 +451,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
diff --git a/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch b/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
index 4a9bca9..8110dac 100644
--- a/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
@@ -1,7 +1,8 @@
-From 3139498918652ecf180fa6ccfa465cbcdf5185fc Mon Sep 17 00:00:00 2001
+From 6e0308590a7f6301a9d80ae8b523417b614a0c6b Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 13 Dec 2023 09:55:27 +0800
-Subject: [PATCH] wifi: mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1016/1048] wifi: mt76: mt7915: add mt7986 and mt7916
+ pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -69,10 +70,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3645540..174e1b0 100644
+index 1707aaf..b21d888 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2955,7 +2955,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -3044,7 +3044,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -82,7 +83,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2993,9 +2994,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -3082,9 +3083,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -94,7 +95,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -3003,34 +3004,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -3092,34 +3093,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -174,7 +175,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3062,24 +3098,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3151,24 +3187,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
index 0c22fa9..bebf551 100644
--- a/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,8 @@
-From 7144ac4907d9ca8d2364ad29e380f3d27fadc493 Mon Sep 17 00:00:00 2001
+From baef207d73aaa18b2b4de40417ca5da7a3ac601e Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 29/76] wifi: mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1017/1048] wifi: mt76: mt7915: add phy capability vendor
+ command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,7 +11,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2ef63a3..053c6a8 100644
+index 42710e7..87a63ec 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,10 +23,10 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 6fc88f9..a801315 100644
+index a8b1fa8..757aecb 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
+@@ -51,6 +51,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
  	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF] = { .type = NLA_U8 },
  };
  
@@ -44,7 +45,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -977,6 +989,35 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
+@@ -995,6 +1007,35 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -80,7 +81,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1034,6 +1075,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1052,6 +1093,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_mu_ctrl,
  		.policy = mu_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_MU_CTRL_MAX,
@@ -99,10 +100,10 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 2be5fc8..ffdb466 100644
+index a4a9180..34dd7d0 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
+@@ -10,6 +10,7 @@ enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
  	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
  	MTK_NL80211_VENDOR_SUBCMD_MU_CTRL = 0xc5,
@@ -110,7 +111,7 @@
  };
  
  enum mtk_capi_control_changed {
-@@ -149,4 +150,28 @@ enum mtk_vendor_attr_mnt_dump {
+@@ -152,4 +153,28 @@ enum mtk_vendor_attr_mnt_dump {
  		NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
  };
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch b/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
index 69565c4..33bce1e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
@@ -1,10 +1,9 @@
-From 8fa041e702bd756560a1f409f4ad783f90b412d9 Mon Sep 17 00:00:00 2001
+From a6f57135acd192daa23860751e6f52fe5bc3657e Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 30/76] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1018/1048] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
-Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
 ---
  mt76_connac_mcu.h |   1 +
  mt7915/main.c     |   3 ++
@@ -16,10 +15,10 @@
  7 files changed, 265 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index efb87d3..9e40749 100644
+index 4d85d32..8dba184 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1237,6 +1237,7 @@ enum {
+@@ -1243,6 +1243,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -28,7 +27,7 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index d73cf9f..f7fee40 100644
+index 0a3e8e0..3f07183 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -479,6 +479,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -42,10 +41,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 174e1b0..884b394 100644
+index b21d888..697e964 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4827,3 +4827,76 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -5026,3 +5026,76 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -123,10 +122,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c95d990..d271e2b 100644
+index de17c57..1682c11 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -1116,6 +1116,27 @@ enum {
+@@ -1128,6 +1128,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -155,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 053c6a8..795af63 100644
+index 87a63ec..03df15e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -714,7 +714,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -756,7 +756,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -169,10 +168,10 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index a801315..635c218 100644
+index 757aecb..3a58684 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
+@@ -63,6 +63,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
  	[MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA] = { .type = NLA_U16 },
  };
  
@@ -197,7 +196,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1018,6 +1036,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1036,6 +1054,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -306,7 +305,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1086,6 +1206,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1104,6 +1224,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_phy_capa_ctrl_dump,
  		.policy = phy_capa_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
@@ -326,10 +325,10 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index ffdb466..0c96377 100644
+index 34dd7d0..284994a 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -2,6 +2,7 @@
+@@ -3,6 +3,7 @@
  #define __MT7915_VENDOR_H
  
  #define MTK_NL80211_VENDOR_ID	0x0ce7
@@ -337,7 +336,7 @@
  
  enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
-@@ -10,6 +11,38 @@ enum mtk_nl80211_vendor_subcmds {
+@@ -11,6 +12,38 @@ enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
  	MTK_NL80211_VENDOR_SUBCMD_MU_CTRL = 0xc5,
  	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
diff --git a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
index e78398b..e26dc91 100644
--- a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From 2b5f249307be0134f4ee8ee3ddf7a5374294ffce Mon Sep 17 00:00:00 2001
+From e380f090bfe90d7f41293326e9f830e138a17a96 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH] wifi: mt76: mt7915: implement bin file mode
+Subject: [PATCH 1019/1048] wifi: mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -52,10 +52,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 87bb745..3f55022 100644
+index 25b7cee..412ef33 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -977,6 +977,9 @@ struct mt76_dev {
+@@ -978,6 +978,9 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -65,7 +65,7 @@
  };
  
  /* per-phy stats.  */
-@@ -1225,6 +1228,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
+@@ -1241,6 +1244,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int len);
  int mt76_get_of_data_from_nvmem(struct mt76_dev *dev, void *eep,
  				const char *cell_name, int len);
@@ -214,10 +214,10 @@
  mt7915_get_channel_group_5g(int channel, bool is_7976)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 795af63..992323d 100644
+index 03df15e..f3e38bc 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -351,6 +351,8 @@ struct mt7915_dev {
+@@ -389,6 +389,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -226,7 +226,7 @@
  	bool muru_debug;
  	bool ibf;
  
-@@ -727,6 +729,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
+@@ -769,6 +771,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
  int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
@@ -235,7 +235,7 @@
  #define PKT_BIN_DEBUG_MAGIC	0xc8763123
  enum {
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 2ce1837..8c5184d 100644
+index 0975682..f51f3ce 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
@@ -246,7 +246,7 @@
  
  #ifdef MTK_DEBUG
  #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
-@@ -3600,6 +3601,47 @@ static int mt7915_fw_wm_info_read(struct seq_file *s, void *data)
+@@ -3721,6 +3722,47 @@ static int mt7915_fw_wm_info_read(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -294,7 +294,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3686,6 +3728,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3807,6 +3849,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch
index 0a5e0ce..467158a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch
@@ -1,19 +1,18 @@
-From 840d6089ac85c927bfb6f352c826ec3bd3846104 Mon Sep 17 00:00:00 2001
+From 910b19ddc72c72ebd6920ebd616f9be4e01a8de2 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 32/76] wifi: mt76: mt7915: Add mu dump support
+Subject: [PATCH 1020/1048] wifi: mt76: mt7915: Add mu dump support
 
-Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
  mt7915/vendor.c | 24 ++++++++++++++++++++++++
  mt7915/vendor.h |  1 +
  2 files changed, 25 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 635c218..25509d6 100644
+index 3a58684..ac6f637 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+@@ -38,6 +38,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
  static const struct nla_policy
  mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
  	[MTK_VENDOR_ATTR_MU_CTRL_ONOFF] = {.type = NLA_U8 },
@@ -21,7 +20,7 @@
  };
  
  static const struct nla_policy
-@@ -1007,6 +1008,28 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
+@@ -1025,6 +1026,28 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -50,7 +49,7 @@
  static int
  mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1193,6 +1216,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1211,6 +1234,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
  			WIPHY_VENDOR_CMD_NEED_RUNNING,
  		.doit = mt7915_vendor_mu_ctrl,
@@ -59,10 +58,10 @@
  		.maxattr = MTK_VENDOR_ATTR_MU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 0c96377..d8e23d3 100644
+index 284994a..8c2a996 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -72,6 +72,7 @@ enum mtk_vendor_attr_mu_ctrl {
+@@ -73,6 +73,7 @@ enum mtk_vendor_attr_mu_ctrl {
  	MTK_VENDOR_ATTR_MU_CTRL_UNSPEC,
  
  	MTK_VENDOR_ATTR_MU_CTRL_ONOFF,
diff --git a/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch b/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
index 8fd0e42..2bb3866 100644
--- a/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
@@ -1,10 +1,9 @@
-From 05f2c9d7b83e9528809d5ee9773a8f3653fe3334 Mon Sep 17 00:00:00 2001
+From 8b25fabf3bbe6c6337b7e8a4ff192562fcc8bbf3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 33/76] wifi: mt76: mt7915: add vendor subcmd three wire (PTA)
- ctrl
+Subject: [PATCH 1021/1048] wifi: mt76: mt7915: add vendor subcmd three wire
+ (PTA) ctrl
 
-Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt76_connac_mcu.h |  2 +-
@@ -16,10 +15,10 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9e40749..b4392bc 100644
+index 8dba184..6f6a889 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1236,7 +1236,7 @@ enum {
+@@ -1242,7 +1242,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -29,10 +28,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 884b394..42f699f 100644
+index 697e964..f793a95 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4526,37 +4526,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4725,37 +4725,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,10 +93,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d271e2b..5fc4e2e 100644
+index 1682c11..1b0bd06 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -904,6 +904,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -916,6 +916,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -134,10 +133,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 992323d..8730655 100644
+index f3e38bc..e01afea 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -708,6 +708,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -750,6 +750,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,10 +145,10 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 25509d6..0db493d 100644
+index ac6f637..eeac18d 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -40,6 +40,11 @@ mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
+@@ -41,6 +41,11 @@ mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
  	[MTK_VENDOR_ATTR_MU_CTRL_DUMP] = {.type = NLA_U8 },
  };
  
@@ -161,7 +160,7 @@
  static const struct nla_policy
  rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
  	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
-@@ -974,7 +979,7 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+@@ -992,7 +997,7 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
  			mt7915_set_wireless_vif, &val32);
  	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]) {
  		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
@@ -170,7 +169,7 @@
  		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
  	}
  
-@@ -1118,6 +1123,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
+@@ -1136,6 +1141,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -178,7 +177,7 @@
  static int
  mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1161,6 +1167,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1179,6 +1185,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -210,7 +209,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1242,6 +1273,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1260,6 +1291,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_edcca_ctrl_dump,
  		.policy = edcca_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
@@ -229,10 +228,10 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index d8e23d3..de3cbe2 100644
+index 8c2a996..e61a6aa 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -12,6 +12,7 @@ enum mtk_nl80211_vendor_subcmds {
+@@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_MU_CTRL = 0xc5,
  	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
  	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
@@ -240,7 +239,7 @@
  };
  
  
-@@ -31,6 +32,7 @@ enum mtk_vendor_attr_edcca_ctrl {
+@@ -32,6 +33,7 @@ enum mtk_vendor_attr_edcca_ctrl {
                  NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
  };
  
@@ -248,7 +247,7 @@
  enum mtk_vendor_attr_edcca_dump {
          MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
  
-@@ -45,6 +47,18 @@ enum mtk_vendor_attr_edcca_dump {
+@@ -46,6 +48,18 @@ enum mtk_vendor_attr_edcca_dump {
                  NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
  };
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index e4829b0..50e3241 100644
--- a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 6bc96533e92948ed6fa7fa1c497d4ff844f72af1 Mon Sep 17 00:00:00 2001
+From 10e13da2412e3d13da998a0860eb1ff521931678 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 34/76] wifi: mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1022/1048] wifi: mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,10 +10,10 @@
  2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 0db493d..f190bd0 100644
+index eeac18d..a21cbce 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
+@@ -87,6 +87,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
         [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
  };
  
@@ -25,7 +25,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1191,6 +1196,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
+@@ -1209,6 +1214,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
  	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
  }
  
@@ -80,7 +80,7 @@
  
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
-@@ -1284,6 +1337,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1302,6 +1355,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_3wire_ctrl,
  		.policy = three_wire_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
@@ -100,10 +100,10 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index de3cbe2..a6309a3 100644
+index e61a6aa..876edf3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -12,7 +12,8 @@ enum mtk_nl80211_vendor_subcmds {
+@@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_MU_CTRL = 0xc5,
  	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
  	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
@@ -113,7 +113,7 @@
  };
  
  
-@@ -222,4 +223,26 @@ enum mtk_vendor_attr_phy_capa_dump {
+@@ -225,4 +226,26 @@ enum mtk_vendor_attr_phy_capa_dump {
  		NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP - 1
  };
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch b/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch
index 69b21f7..ae6a565 100644
--- a/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch
@@ -1,24 +1,87 @@
-From 2b1ca7b7f8e5c65abd254b51a7a79418457684ea Mon Sep 17 00:00:00 2001
+From 9b79716f5ef23fae2ef839e620ec25e92cae6a82 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 30 Mar 2023 15:12:37 +0800
-Subject: [PATCH 35/76] wifi: mt76: mt7915: add cal free data merge support
+Subject: [PATCH 1023/1048] wifi: mt76: mt7915: add cal free data merge support
 
 1. add basic cal free data support
 2. add E3 low yield rate workaround for panther E3 with 7976 adie
 3. add Harrier freq offset workaround
+4. add efuse dump command for verification
+   (/sys/kernel/debug/ieee80211/phyX/mt76/otp)
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7915/eeprom.c | 188 ++++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/mcu.c    |  13 ++--
- mt7915/mt7915.h |   1 +
- 3 files changed, 198 insertions(+), 4 deletions(-)
+ mt7915/debugfs.c |  41 +++++++++++
+ mt7915/eeprom.c  | 187 +++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/eeprom.h  |   2 +
+ mt7915/mcu.c     |  13 +++-
+ mt7915/mt7915.h  |   1 +
+ 5 files changed, 240 insertions(+), 4 deletions(-)
 
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index f181377..40a126f 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -1240,6 +1240,46 @@ mt7915_rf_regval_set(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7915_rf_regval_get,
+ 			 mt7915_rf_regval_set, "0x%08llx\n");
+ 
++static ssize_t
++mt7915_efuse_get(struct file *file, char __user *user_buf,
++		 size_t count, loff_t *ppos)
++{
++	struct mt7915_dev *dev = file->private_data;
++	struct mt76_dev *mdev = &dev->mt76;
++	u8 *buff = mdev->otp.data;
++	int i;
++	ssize_t ret;
++	u32 block_num;
++
++	mdev->otp.size = mt7915_eeprom_size(dev);
++	if (is_mt7986(&dev->mt76))
++		mdev->otp.size += MT_EE_ADIE1_BASE_7896;
++
++	if (!mdev->otp.data) {
++		mdev->otp.data = devm_kzalloc(mdev->dev, mdev->otp.size, GFP_KERNEL);
++		if (!mdev->otp.data)
++			return -ENOMEM;
++
++		block_num = DIV_ROUND_UP(mdev->otp.size, MT7915_EEPROM_BLOCK_SIZE);
++		for (i = 0; i < block_num; i++) {
++			buff = mdev->otp.data + i * MT7915_EEPROM_BLOCK_SIZE;
++			ret = mt7915_mcu_get_eeprom(dev, i * MT7915_EEPROM_BLOCK_SIZE, buff);
++			if (ret)
++				continue;
++		}
++	}
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, mdev->otp.data, mdev->otp.size);
++
++	return ret;
++}
++
++static const struct file_operations mt7915_efuse_ops = {
++	.read = mt7915_efuse_get,
++	.open = simple_open,
++	.llseek = default_llseek,
++};
++
+ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+@@ -1282,6 +1322,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ 		debugfs_create_devm_seqfile(dev->mt76.dev, "rdd_monitor", dir,
+ 					    mt7915_rdd_monitor);
+ 	}
++	debugfs_create_file("otp", 0400, dir, dev, &mt7915_efuse_ops);
+ 
+ 	if (!ext_phy)
+ 		dev->debugfs_dir = dir;
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 5eb9f88..b96776d 100644
+index 3c99b4d..e11ae5e 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -271,6 +271,190 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+@@ -276,6 +276,189 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  	dev->chainshift = hweight8(dev->mphy.chainmask);
  }
  
@@ -29,7 +92,6 @@
 +#define MT_EE_ADIE1_MT7976C_OFFSET	0x270
 +#define MT_EE_ADIE1_E3_OFFSET		0x271
 +#define MT_EE_END_OFFSET		0xffff
-+#define MT_EE_ADIE1_BASE_7896		0x1000
 +	enum adie_type {
 +		ADIE_7975,
 +		ADIE_7976,
@@ -209,7 +271,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
-@@ -311,6 +495,10 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -316,6 +499,10 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -220,11 +282,24 @@
  	mt7915_eeprom_parse_hw_cap(dev, &dev->phy);
  	memcpy(dev->mphy.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
  	       ETH_ALEN);
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index a1ab05a..dd450aa 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -67,6 +67,8 @@ enum mt7915_eeprom_field {
+ #define MT_EE_RATE_DELTA_SIGN			BIT(6)
+ #define MT_EE_RATE_DELTA_EN			BIT(7)
+ 
++#define MT_EE_ADIE1_BASE_7896			0x1000
++
+ enum mt7915_adie_sku {
+ 	MT7976_ONE_ADIE_DBDC = 0x7,
+ 	MT7975_ONE_ADIE	= 0x8,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 42f699f..d3ed33a 100644
+index f793a95..0694c9a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2879,6 +2879,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
+@@ -2968,6 +2968,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
  	};
  	struct mt7915_mcu_eeprom_info *res;
  	struct sk_buff *skb;
@@ -232,7 +307,7 @@
  	int ret;
  	u8 *buf = read_buf;
  
-@@ -2889,10 +2890,14 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
+@@ -2978,10 +2979,14 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -252,10 +327,10 @@
  	dev_kfree_skb(skb);
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8730655..25a6815 100644
+index e01afea..a74a4eb 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -507,6 +507,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -548,6 +548,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
diff --git a/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch b/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
index 0bd8edc..3a8f018 100644
--- a/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
@@ -1,21 +1,20 @@
-From aa15abf250978f6a2b7452fe45390138544859b5 Mon Sep 17 00:00:00 2001
+From 5658f47a201a3cfc585e10292ecd3202ed882ef1 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 36/76] wifi: mt76: mt7915: support on off SW ACI through
+Subject: [PATCH 1024/1048] wifi: mt76: mt7915: support on off SW ACI through
  debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
 ---
  mt76_connac_mcu.h    |  1 +
  mt7915/mtk_debugfs.c | 21 +++++++++++++++++++++
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b4392bc..bf5ab81 100644
+index 6f6a889..1265401 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1238,6 +1238,7 @@ enum {
+@@ -1244,6 +1244,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_SET_CFG = 0xb7,
  	MCU_EXT_CMD_EDCCA = 0xba,
@@ -24,10 +23,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 8c5184d..b8a8516 100644
+index f51f3ce..2e1a145 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3642,6 +3642,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -3763,6 +3763,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -53,7 +52,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3730,6 +3749,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3851,6 +3870,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
diff --git a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index ae3bf93..6120b94 100644
--- a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,7 +1,7 @@
-From f337999cbbbe556d010099553b7da39d2916a70b Mon Sep 17 00:00:00 2001
+From c9b6bb691e58656f520262ec544f37f00aaf4ec2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1025/1047] wifi: mt76: mt7915: add bf backoff limit table
+Subject: [PATCH 1025/1048] wifi: mt76: mt7915: add bf backoff limit table
  support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -121,10 +121,10 @@
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
  
 diff --git a/mt76.h b/mt76.h
-index 3f55022..766c1a6 100644
+index 412ef33..781be50 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1083,6 +1083,14 @@ struct mt76_power_limits {
+@@ -1084,6 +1084,14 @@ struct mt76_power_limits {
  	s8 mcs[4][10];
  	s8 ru[7][12];
  	s8 eht[16][16];
@@ -140,7 +140,7 @@
  
  struct mt76_ethtool_worker_info {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f181377..050939f 100644
+index 40a126f..c7002ee 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1019,7 +1019,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -240,7 +240,7 @@
  static int
  mt7915_twt_stats(struct seq_file *s, void *data)
  {
-@@ -1269,7 +1332,9 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1309,7 +1372,9 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	debugfs_create_file("implicit_txbf", 0600, dir, dev,
  			    &fops_implicit_txbf);
  	debugfs_create_file("txpower_sku", 0400, dir, phy,
@@ -252,7 +252,7 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 887e2c8..2172f04 100644
+index 9613e1d..9d05d12 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -284,6 +284,8 @@ static void __mt7915_init_txpower(struct mt7915_phy *phy,
@@ -277,7 +277,7 @@
  		target_power = DIV_ROUND_UP(target_power, 2);
  		chan->max_power = min_t(int, chan->max_reg_power,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f4bbcd9..1143ba4 100644
+index 3f07183..6192c20 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,11 +73,7 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -294,10 +294,10 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5312806..3b3a79b 100644
+index 0694c9a..3e41abd 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3316,7 +3316,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3405,7 +3405,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	int ret;
  	s8 txpower_sku[MT7915_SKU_RATE_NUM];
  
@@ -307,7 +307,7 @@
  	if (ret)
  		return ret;
  
-@@ -3356,53 +3357,139 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3445,53 +3446,139 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  				 sizeof(req), true);
  }
  
@@ -474,7 +474,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3411,10 +3498,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3500,10 +3587,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -486,7 +486,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3424,9 +3510,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3513,9 +3599,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -505,7 +505,7 @@
  
  	dev_kfree_skb(skb);
  
-@@ -3455,7 +3547,7 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+@@ -3544,7 +3636,7 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  				 sizeof(req), false);
  }
  
@@ -514,7 +514,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct mt7915_sku {
-@@ -3466,10 +3558,24 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3555,10 +3647,24 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_ENABLE,
  		.band_idx = phy->mt76->band_idx,
@@ -542,10 +542,10 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 94c5e62..abccac3 100644
+index 1b0bd06..94eff26 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -502,12 +502,18 @@ enum {
+@@ -517,12 +517,18 @@ enum {
  
  enum {
  	TX_POWER_LIMIT_ENABLE,
@@ -565,7 +565,7 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3895ea4..a1bcb60 100644
+index a74a4eb..bb4ef00 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -72,6 +72,7 @@
@@ -586,7 +586,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -609,9 +613,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -612,9 +616,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
diff --git a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
index 091d42f..cffb3bc 100644
--- a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
@@ -1,7 +1,7 @@
-From ffc38f4303f435b7b885a6fa078adcf45a118e66 Mon Sep 17 00:00:00 2001
+From 4beaa0cd97bf405c0101f1410656f2641a802cad Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH 38/76] wifi: mt76: mt7915: amsdu set and get control
+Subject: [PATCH 1026/1048] wifi: mt76: mt7915: amsdu set and get control
 
 ---
  mt7915/mac.c    |  7 +++++++
@@ -11,10 +11,10 @@
  4 files changed, 50 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9fd764f..cdffdf3 100644
+index 37183ca..f214bca 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -2033,6 +2033,13 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+@@ -2029,6 +2029,13 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
  	spin_unlock_bh(&phy->stats_lock);
  }
  
@@ -29,10 +29,10 @@
  void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c2fb12d..6d28e3f 100644
+index bb4ef00..36b583e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -702,6 +702,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -744,6 +744,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -41,10 +41,10 @@
  void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index f190bd0..844b22e 100644
+index a21cbce..e25a0ce 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -30,10 +30,16 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+@@ -31,10 +31,16 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
  	[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA] = {.type = NLA_U8 },
  	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO] = {.type = NLA_U8 },
  	[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE] = {.type = NLA_U16 },
@@ -61,7 +61,7 @@
  static const struct nla_policy
  mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
  	[MTK_VENDOR_ATTR_MU_CTRL_ONOFF] = {.type = NLA_U8 },
-@@ -986,11 +992,34 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+@@ -1004,11 +1010,34 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
  		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
  		mt7915_mcu_set_cfg(phy, CFGINFO_CERT_CFG, val8); /* Cert Enable for OMI */
  		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
@@ -96,7 +96,7 @@
  static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
  				  struct wireless_dev *wdev,
  				  const void *data,
-@@ -1289,6 +1318,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1307,6 +1336,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
  			WIPHY_VENDOR_CMD_NEED_RUNNING,
  		.doit = mt7915_vendor_wireless_ctrl,
@@ -105,10 +105,10 @@
  		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a6309a3..33c75dc 100644
+index 876edf3..7c4e914 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -74,6 +74,7 @@ enum mtk_vendor_attr_wireless_ctrl {
+@@ -75,6 +75,7 @@ enum mtk_vendor_attr_wireless_ctrl {
  	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
  	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
  	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
@@ -116,7 +116,7 @@
  	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT = 9,
  
  	MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA, /* reserve */
-@@ -83,6 +84,17 @@ enum mtk_vendor_attr_wireless_ctrl {
+@@ -84,6 +85,17 @@ enum mtk_vendor_attr_wireless_ctrl {
  		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
  };
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch b/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
index 79fa538..48216fc 100644
--- a/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
@@ -1,8 +1,8 @@
-From 87a3861eb9e06519ee27a0b949cd5387d6fa9c7a Mon Sep 17 00:00:00 2001
+From ca2ec1ed8d8a31e897518a8225f3efb298bc102d Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 14:32:08 +0800
-Subject: [PATCH 39/76] wifi: mt76: mt7915: Add vendor command attribute for
- RTS BW signaling.
+Subject: [PATCH 1027/1048] wifi: mt76: mt7915: Add vendor command attribute
+ for RTS BW signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
 ---
@@ -13,10 +13,10 @@
  4 files changed, 20 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 62aad77..64fd91a 100644
+index 3e41abd..6a3ffe8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4650,6 +4650,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
+@@ -4852,6 +4852,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
  		req.cert.length = cpu_to_le16(tlv_len);
  		req.cert.cert_program = type;
  		break;
@@ -30,10 +30,10 @@
  		tlv_len = sizeof(struct three_wire_cfg);
  		req.three_wire.tag = cpu_to_le16(cfg_info);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 142bfc1..286f7a5 100644
+index 94eff26..6ebcce0 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -924,6 +924,13 @@ struct three_wire_cfg {
+@@ -936,6 +936,13 @@ struct three_wire_cfg {
  	u8 rsv[3];
  } __packed;
  
@@ -47,7 +47,7 @@
  struct cfg_basic_info {
  	u8 dbdc_idx;
  	u8 rsv[3];
-@@ -931,11 +938,13 @@ struct cfg_basic_info {
+@@ -943,11 +950,13 @@ struct cfg_basic_info {
  	union {
  		struct cert_cfg cert;
  		struct three_wire_cfg three_wire;
@@ -62,10 +62,10 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 844b22e..05d95f3 100644
+index e25a0ce..8370216 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -33,6 +33,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+@@ -34,6 +34,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
  	[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU] = {.type = NLA_U8 },
  	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA] = {.type = NLA_U8 },
  	[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
@@ -73,7 +73,7 @@
  };
  
  static const struct nla_policy
-@@ -995,6 +996,9 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+@@ -1013,6 +1014,9 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
  	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]) {
  		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]);
  		mt7915_set_wireless_amsdu(hw, val8);
@@ -84,10 +84,10 @@
  
  	return 0;
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 33c75dc..6001ce4 100644
+index 7c4e914..3672420 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -76,6 +76,7 @@ enum mtk_vendor_attr_wireless_ctrl {
+@@ -77,6 +77,7 @@ enum mtk_vendor_attr_wireless_ctrl {
  	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
  	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
  	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT = 9,
diff --git a/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch b/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
index 6eac734..0585a08 100644
--- a/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
@@ -1,7 +1,7 @@
-From ef94525684dc7777ac6a3e80b1e6fb9a08d04b25 Mon Sep 17 00:00:00 2001
+From a7ddef79ef2ae20ebb5a590cf7f5b33a4a0c6096 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Thu, 26 Jan 2023 08:50:47 +0800
-Subject: [PATCH 40/76] wifi: mt76: mt7915: add vendor cmd to get available
+Subject: [PATCH 1028/1048] wifi: mt76: mt7915: add vendor cmd to get available
  color bitmap
 
 Add a vendor cmd to notify user space available color bitmap.
@@ -14,10 +14,10 @@
  2 files changed, 48 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 05d95f3..b325b89 100644
+index 8370216..9a26f7f 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -98,6 +98,11 @@ ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
+@@ -99,6 +99,11 @@ ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
  	[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
  };
  
@@ -29,7 +29,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1277,6 +1282,27 @@ mt7915_vendor_ibf_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1295,6 +1300,27 @@ mt7915_vendor_ibf_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return 1;
  }
  
@@ -57,7 +57,7 @@
  
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
-@@ -1383,6 +1409,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1401,6 +1427,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_ibf_ctrl_dump,
  		.policy = ibf_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_IBF_CTRL_MAX,
@@ -76,10 +76,10 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 6001ce4..358a16f 100644
+index 3672420..bd1c617 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -14,6 +14,7 @@ enum mtk_nl80211_vendor_subcmds {
+@@ -15,6 +15,7 @@ enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
  	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
  	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
@@ -87,7 +87,7 @@
  };
  
  
-@@ -258,4 +259,14 @@ enum mtk_vendor_attr_ibf_dump {
+@@ -261,4 +262,14 @@ enum mtk_vendor_attr_ibf_dump {
  		NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
  };
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch b/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
index 9fca716..3e20e1a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
@@ -1,7 +1,7 @@
-From ec30b7800a1b06f58e4b0e08ee51c7073e305b26 Mon Sep 17 00:00:00 2001
+From 438b482b41ab41e0dc2e5bdf9843af8c0bbb0f4d Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Feb 2023 16:29:42 +0800
-Subject: [PATCH 41/76] wifi: mt76: mt7915: disable SW-ACI by default
+Subject: [PATCH 1029/1048] wifi: mt76: mt7915: disable SW-ACI by default
 
 Support to enable/disable SW-ACI by module parameter "sw_aci_enable".
 SW-ACI feature is disable by default.
@@ -13,7 +13,7 @@
  4 files changed, 29 insertions(+), 9 deletions(-)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0ac81ad..0318254 100644
+index 6192c20..acb4f44 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -8,6 +8,10 @@
@@ -39,10 +39,10 @@
  
  	if (phy != &dev->phy) {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 64fd91a..6ff1c47 100644
+index 6a3ffe8..0401637 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5010,3 +5010,18 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
+@@ -5212,3 +5212,18 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
  
  	return 0;
  }
@@ -62,10 +62,10 @@
 +				 sizeof(req), NULL);
 +}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6d28e3f..3f6cf7b 100644
+index 36b583e..1910060 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -726,6 +726,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -768,6 +768,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
@@ -74,10 +74,10 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index b8a8516..671791e 100644
+index 2e1a145..629b2ac 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3645,16 +3645,12 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -3766,16 +3766,12 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  static int
  mt7915_sw_aci_set(void *data, u64 val)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch b/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
index 1795f07..ca2c6d7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
@@ -1,7 +1,8 @@
-From c762ac55ec18f656d508a5805f953427e2657e9a Mon Sep 17 00:00:00 2001
+From d0b8ce415cacbc2aed254d5a0d86adfe0381ad0b Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 27 Apr 2023 15:37:33 +0800
-Subject: [PATCH 42/76] wifi: mt76: mt7915: add muru user number debug command
+Subject: [PATCH 1030/1048] wifi: mt76: mt7915: add muru user number debug
+ command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,10 +11,10 @@
  3 files changed, 17 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3f6cf7b..72fe2fc 100644
+index 1910060..34a671f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -590,6 +590,7 @@ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
+@@ -631,6 +631,7 @@ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
  int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
  			    const struct mt7915_dfs_pattern *pattern);
  int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val);
@@ -22,10 +23,10 @@
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy);
  int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b325b89..d7cb088 100644
+index 9a26f7f..432d750 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -45,6 +45,8 @@ static const struct nla_policy
+@@ -46,6 +46,8 @@ static const struct nla_policy
  mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
  	[MTK_VENDOR_ATTR_MU_CTRL_ONOFF] = {.type = NLA_U8 },
  	[MTK_VENDOR_ATTR_MU_CTRL_DUMP] = {.type = NLA_U8 },
@@ -34,7 +35,7 @@
  };
  
  static const struct nla_policy
-@@ -1035,9 +1037,10 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
+@@ -1053,9 +1055,10 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
  				  int data_len)
  {
  	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
@@ -46,7 +47,7 @@
  	u32 val32 = 0;
  
  	err = nla_parse(tb, MTK_VENDOR_ATTR_MU_CTRL_MAX, data, data_len,
-@@ -1051,6 +1054,16 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
+@@ -1069,6 +1072,16 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
  			 FIELD_PREP(RATE_CFG_VAL, val8);
  		ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
  			mt7915_set_wireless_vif, &val32);
@@ -64,10 +65,10 @@
  
  	return 0;
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 358a16f..20526ea 100644
+index bd1c617..03d1660 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
-@@ -102,6 +102,8 @@ enum mtk_vendor_attr_mu_ctrl {
+@@ -103,6 +103,8 @@ enum mtk_vendor_attr_mu_ctrl {
  
  	MTK_VENDOR_ATTR_MU_CTRL_ONOFF,
  	MTK_VENDOR_ATTR_MU_CTRL_DUMP,
diff --git a/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch b/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
index 11f2d1a..a0aedcc 100644
--- a/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
@@ -1,7 +1,7 @@
-From ace56f2c1ee008bcab3191494d7ed92538e50339 Mon Sep 17 00:00:00 2001
+From c741601223d1f5f27371ecbf2497d76b0465f1cc Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 22 May 2023 15:30:21 +0800
-Subject: [PATCH 43/76] wifi: mt76: mt7915: add debugfs for fw coredump.
+Subject: [PATCH 1031/1048] wifi: mt76: mt7915: add debugfs for fw coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 58 insertions(+), 9 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 19a37b5..ae291a3 100644
+index c7002ee..4c48b19 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -82,8 +82,10 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
@@ -67,10 +67,10 @@
  	/* SER statistics */
  	desc += scnprintf(buff + desc, bufsz - desc,
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index cdffdf3..07f0e30 100644
+index f214bca..e775f61 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1726,10 +1726,34 @@ void mt7915_mac_dump_work(struct work_struct *work)
+@@ -1722,10 +1722,34 @@ void mt7915_mac_dump_work(struct work_struct *work)
  
  	dev = container_of(work, struct mt7915_dev, dump_work);
  
@@ -107,7 +107,7 @@
  }
  
  void mt7915_reset(struct mt7915_dev *dev)
-@@ -1748,7 +1772,7 @@ void mt7915_reset(struct mt7915_dev *dev)
+@@ -1744,7 +1768,7 @@ void mt7915_reset(struct mt7915_dev *dev)
  			 wiphy_name(dev->mt76.hw->wiphy));
  
  		mt7915_irq_disable(dev, MT_INT_MCU_CMD);
@@ -117,10 +117,10 @@
  	}
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 286f7a5..583caca 100644
+index 6ebcce0..035ad97 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -745,8 +745,12 @@ enum {
+@@ -760,8 +760,12 @@ enum {
  	SER_SET_RECOVER_L3_TX_ABORT,
  	SER_SET_RECOVER_L3_TX_DISABLE,
  	SER_SET_RECOVER_L3_BF,
@@ -135,7 +135,7 @@
  	SER_ENABLE = 2,
  	SER_RECOVER
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 72fe2fc..34005a3 100644
+index 34a671f..e21a7a6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -91,6 +91,13 @@ struct mt7915_sta;
@@ -152,7 +152,7 @@
  enum mt7915_txq_id {
  	MT7915_TXQ_FWDL = 16,
  	MT7915_TXQ_MCU_WM,
-@@ -341,6 +348,7 @@ struct mt7915_dev {
+@@ -379,6 +386,7 @@ struct mt7915_dev {
  
  	/* protects coredump data */
  	struct mutex dump_mutex;
@@ -160,7 +160,7 @@
  #ifdef CONFIG_DEV_COREDUMP
  	struct {
  		struct mt7915_crash_data *crash_data[__MT76_RAM_TYPE_MAX];
-@@ -528,6 +536,7 @@ int mt7915_txbf_init(struct mt7915_dev *dev);
+@@ -569,6 +577,7 @@ int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
  int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en);
  void mt7915_reset(struct mt7915_dev *dev);
diff --git a/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch b/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch
index 5e9922c..679446b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch
@@ -1,7 +1,7 @@
-From 4d81cdd22da999d7101ed1e72ff3e3cbe04eeb34 Mon Sep 17 00:00:00 2001
+From 89645512f06c5bf9be13f774acda12341f22784c Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 24 May 2023 22:35:54 +0800
-Subject: [PATCH 44/76] wifi: mt76: mt7915: remove BW160 support
+Subject: [PATCH 1032/1048] wifi: mt76: mt7915: remove BW160 support
 
 Remove BW160 capability in mt7915.
 ---
@@ -9,10 +9,10 @@
  1 file changed, 6 insertions(+), 20 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 82fbec4..a44d3fa 100644
+index 9d05d12..5a3a61c 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -438,11 +438,6 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+@@ -439,11 +439,6 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
  			vht_cap->cap |=
  				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 |
  				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
@@ -24,7 +24,7 @@
  		} else {
  			phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
  				IEEE80211_HT_MPDU_DENSITY_2;
-@@ -898,13 +893,9 @@ mt7915_set_stream_he_txbf_caps(struct mt7915_phy *phy,
+@@ -899,13 +894,9 @@ mt7915_set_stream_he_txbf_caps(struct mt7915_phy *phy,
  	int sts = hweight8(phy->mt76->chainmask);
  	u8 c, sts_160 = sts;
  
@@ -41,7 +41,7 @@
  
  #ifdef CONFIG_MAC80211_MESH
  	if (vif == NL80211_IFTYPE_MESH_POINT)
-@@ -984,15 +975,10 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -985,15 +976,10 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  	int i, idx = 0, nss = hweight8(phy->mt76->antenna_mask);
  	u16 mcs_map = 0;
  	u16 mcs_map_160 = 0;
diff --git a/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
index 1c7278d..d1e5d8d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
@@ -1,7 +1,7 @@
-From 35f6ac0e81382f76932b195a75fe0fa4ebc690e7 Mon Sep 17 00:00:00 2001
+From 22e5c44a754b22649a56616f932a8dbf3242ec54 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 11 Jul 2023 17:06:04 +0800
-Subject: [PATCH 45/76] wifi: mt76: mt7915: add txpower info dump support
+Subject: [PATCH 1033/1048] wifi: mt76: mt7915: add txpower info dump support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -11,7 +11,7 @@
  3 files changed, 91 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index ae291a3..2bf907c 100644
+index 4c48b19..86cbef3 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1258,6 +1258,91 @@ mt7915_txpower_path_show(struct seq_file *file, void *data)
@@ -106,7 +106,7 @@
  static int
  mt7915_twt_stats(struct seq_file *s, void *data)
  {
-@@ -1347,6 +1432,8 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1387,6 +1472,8 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  			    &mt7915_txpower_fops);
  	debugfs_create_file("txpower_path", 0400, dir, phy,
  			    &mt7915_txpower_path_fops);
@@ -116,10 +116,10 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6ff1c47..80a678c 100644
+index 0401637..609eb5b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3518,6 +3518,8 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
+@@ -3607,6 +3607,8 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
  			txpower[i] = res[i][req.band_idx];
  	} else if (category == TX_POWER_INFO_PATH) {
  		memcpy(txpower, skb->data + 4, len);
@@ -129,10 +129,10 @@
  
  	dev_kfree_skb(skb);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 583caca..6e6f320 100644
+index 035ad97..3089fb6 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -510,7 +510,8 @@ enum {
+@@ -525,7 +525,8 @@ enum {
  };
  
  enum {
diff --git a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch b/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
index 3e3cc5d..0b5953c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
@@ -1,8 +1,8 @@
-From 407b1b989e82300f8fd1124364e503bd1b446a88 Mon Sep 17 00:00:00 2001
+From cacd1e6028a0446d400666fc92c982ebe3794c3e Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Fri, 23 Jun 2023 06:06:21 +0800
-Subject: [PATCH 46/76] wifi: mt76: mt7915: report tx and rx byte to tpt_led
- when wed is enabled
+Subject: [PATCH 1034/1048] wifi: mt76: mt7915: report tx and rx byte to
+ tpt_led when wed is enabled
 
 Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 ---
@@ -11,7 +11,7 @@
  2 files changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 31d2474..707892b 100644
+index 630c640..949df63 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -597,9 +597,15 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
@@ -42,10 +42,10 @@
  			sband = &mphy->sband_5g.sband;
  		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index aa51df3..06f5a19 100644
+index ddf1b72..437a9b0 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -592,6 +592,7 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
+@@ -588,6 +588,7 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
  	int idx = le16_to_cpu(stats->wlan_idx);
  	struct mt7915_dev *dev;
  	struct mt76_wcid *wcid;
@@ -53,7 +53,7 @@
  
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  
-@@ -602,6 +603,10 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
+@@ -598,6 +599,10 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
  
  	wcid = rcu_dereference(dev->mt76.wcid[idx]);
  	if (wcid) {
diff --git a/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch b/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
index 33bd524..c5c7c7c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
@@ -1,17 +1,17 @@
-From dc3bc9dadab098db977049a805ec458d19b2011d Mon Sep 17 00:00:00 2001
+From 050c56f749c6830eaf496d1016017296b0ef415e Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 8 Aug 2023 11:20:58 +0800
-Subject: [PATCH 47/76] wifi: mt76: mt7915: Establish BA in VO queue
+Subject: [PATCH 1035/1048] wifi: mt76: mt7915: Establish BA in VO queue
 
 ---
  mt76_connac_mac.c | 2 --
  1 file changed, 2 deletions(-)
 
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 707892b..362d937 100644
+index 949df63..d036047 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -1118,8 +1118,6 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -1115,8 +1115,6 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  		return;
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
diff --git a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
index c83e758..b7b8d9e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
@@ -1,8 +1,8 @@
-From a873e1dc3b0de28f1ef61e96b46a55ee7c4294bf Mon Sep 17 00:00:00 2001
+From cd794505e5448ab747d6e915a6fc756c52c237b7 Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Fri, 11 Aug 2023 16:46:53 +0800
-Subject: [PATCH 48/76] wifi: mt76: mt7915: Disable RegDB when enable single
- sku
+Subject: [PATCH 1036/1048] wifi: mt76: mt7915: Disable RegDB when enable
+ single sku
 
 ---
  mt7915/debugfs.c | 49 +++++++++++++++++++++++++++++++++++++++++++-----
@@ -11,7 +11,7 @@
  3 files changed, 57 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 2bf907c..6dcee10 100644
+index 86cbef3..ead0f98 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1019,10 +1019,16 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -103,7 +103,7 @@
  	return ret;
  }
 diff --git a/mt7915/init.c b/mt7915/init.c
-index a44d3fa..2b002df 100644
+index 5a3a61c..cdcf63e 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -283,9 +283,11 @@ static void __mt7915_init_txpower(struct mt7915_phy *phy,
diff --git a/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch b/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
index 23c9cdf..7e41ba3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
@@ -1,7 +1,7 @@
-From c36e0cb6a541fa4b91b4665119ddb280b74e87d6 Mon Sep 17 00:00:00 2001
+From 08574495af80035ea6e68da0432538be348cc566 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Thu, 24 Aug 2023 03:01:27 +0800
-Subject: [PATCH 49/76] wifi: mt76: mt7915: enable the mac80211 hw bmc ps
+Subject: [PATCH 1037/1048] wifi: mt76: mt7915: enable the mac80211 hw bmc ps
  buffer function.
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 2b002df..ff7bd11 100644
+index cdcf63e..247d552 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -412,6 +412,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+@@ -413,6 +413,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
  	ieee80211_hw_set(hw, SUPPORTS_RX_DECAP_OFFLOAD);
  	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
  	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
diff --git a/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch b/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch
index 1df84b4..7586a2a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch
@@ -1,8 +1,8 @@
-From ad7d61fd7de176ea7bec5b675ddfc355070833f7 Mon Sep 17 00:00:00 2001
+From d214b1fa6a20455d911bbaecd13292d2a6774d27 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 29 Aug 2023 09:22:18 +0800
-Subject: [PATCH 50/76] wifi: mt76: update debugfs knob to dump token pending
- time
+Subject: [PATCH 1038/1048] wifi: mt76: update debugfs knob to dump token
+ pending time
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
@@ -12,10 +12,10 @@
  3 files changed, 10 insertions(+), 4 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index c322135..4704c50 100644
+index 781be50..aed47c8 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -401,6 +401,8 @@ struct mt76_txwi_cache {
+@@ -402,6 +402,8 @@ struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
  
@@ -25,7 +25,7 @@
  		struct sk_buff *skb;
  		void *ptr;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 07f0e30..170a51b 100644
+index e775f61..e1ecefe 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -803,6 +803,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -56,10 +56,10 @@
  	}
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 671791e..f4bc89c 100644
+index 629b2ac..594989f 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2211,10 +2211,8 @@ static int mt7915_token_read(struct seq_file *s, void *data)
+@@ -2209,10 +2209,8 @@ static int mt7915_token_read(struct seq_file *s, void *data)
  	seq_printf(s, "Cut through token:\n");
  	spin_lock_bh(&dev->mt76.token_lock);
  	idr_for_each_entry(&dev->mt76.token, txwi, id) {
diff --git a/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch b/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
index fad77c9..7404dae 100644
--- a/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
@@ -1,7 +1,7 @@
-From b2c4e27677bb08e773d33b90c3d417121d5454c8 Mon Sep 17 00:00:00 2001
+From 725c52a07bd4b79ad25be2d63c83277da15b6cc7 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 5 Sep 2023 20:17:19 +0800
-Subject: [PATCH 51/76] wifi: mt76: mt7915: support enable/disable spatial
+Subject: [PATCH 1039/1048] wifi: mt76: mt7915: support enable/disable spatial
  reuse through debugfs
 
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
@@ -12,10 +12,10 @@
  3 files changed, 14 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 80a678c..ac015ab 100644
+index 609eb5b..1eb19ba 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3647,8 +3647,7 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+@@ -3739,8 +3739,7 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  				 sizeof(req), true);
  }
  
@@ -26,10 +26,10 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct mt7915_mcu_sr_ctrl req = {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 34005a3..346333e 100644
+index e21a7a6..ffc2e0b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -739,6 +739,7 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
+@@ -781,6 +781,7 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
  int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val);
  int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
@@ -38,10 +38,10 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f4bc89c..4a0bb4c 100644
+index 594989f..e706f64 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3655,6 +3655,17 @@ mt7915_sw_aci_set(void *data, u64 val)
+@@ -3776,6 +3776,17 @@ mt7915_sw_aci_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_sw_aci, NULL,
  			 mt7915_sw_aci_set, "%llx\n");
  
@@ -59,7 +59,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3745,6 +3756,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3866,6 +3877,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  				    mt7915_show_eeprom_mode);
  	debugfs_create_file("sw_aci", 0600, dir, dev,
  			    &fops_sw_aci);
diff --git a/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch b/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
index c3ef908..7930078 100644
--- a/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
@@ -1,7 +1,7 @@
-From 493e528b81ef05cb34d63440b8f0f731aaf60c08 Mon Sep 17 00:00:00 2001
+From bc7b5c61e1793abba3ef32261fc56f3b2d9885ce Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 11 Sep 2023 17:11:24 +0800
-Subject: [PATCH 52/76] wifi: mt76: mt7915: add debug log for SER flow.
+Subject: [PATCH 1040/1048] wifi: mt76: mt7915: add debug log for SER flow.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -9,20 +9,20 @@
  1 file changed, 9 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 170a51b..5e92e28 100644
+index e1ecefe..4b2c957 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1571,6 +1571,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1570,6 +1570,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
 +	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
 +		 wiphy_name(dev->mt76.hw->wiphy));
 +
- 	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
- 		mtk_wed_device_stop(&dev->mt76.mmio.wed);
- 		if (!is_mt798x(&dev->mt76))
-@@ -1649,6 +1652,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 	ieee80211_stop_queues(mt76_hw(dev));
+ 	if (ext_phy)
+ 		ieee80211_stop_queues(ext_phy->hw);
+@@ -1645,6 +1648,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
  		ieee80211_queue_delayed_work(ext_phy->hw,
  					     &phy2->mt76->mac_work,
  					     MT7915_WATCHDOG_TIME);
@@ -32,7 +32,7 @@
  }
  
  /* firmware coredump */
-@@ -1764,6 +1770,9 @@ void mt7915_coredump(struct mt7915_dev *dev, u8 state)
+@@ -1760,6 +1766,9 @@ void mt7915_coredump(struct mt7915_dev *dev, u8 state)
  
  void mt7915_reset(struct mt7915_dev *dev)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch b/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
index 906a097..b7f3425 100644
--- a/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
@@ -1,8 +1,8 @@
-From f4ae3b90eb43f820b65e55085936ce8a7fb508fd Mon Sep 17 00:00:00 2001
+From 6c4e275e886f41bb06fe0f49fcbe3343f0660abd Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 20 Sep 2023 11:10:57 +0800
-Subject: [PATCH 53/76] wifi: mt76: mt7915: add additional chain signal info to
- station dump
+Subject: [PATCH 1041/1048] wifi: mt76: mt7915: add additional chain signal
+ info to station dump
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5e92e28..e5480ee 100644
+index 4b2c957..1691e6d 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -435,7 +435,7 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
diff --git a/recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch b/recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch
index f90df87..9f44506 100644
--- a/recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch
@@ -1,7 +1,7 @@
-From 93bf76280034ba4ecb511bad9843daa29234818a Mon Sep 17 00:00:00 2001
+From 186c70f993d72481e3b1e20379f389291f455d56 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 2 Oct 2023 14:00:13 +0800
-Subject: [PATCH 54/76] wifi: mt76: mt7915: add debuffs knob for protect
+Subject: [PATCH 1042/1048] wifi: mt76: mt7915: add debuffs knob for protect
  threshold
 
 ---
@@ -10,10 +10,10 @@
  2 files changed, 12 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 346333e..ad08582 100644
+index ffc2e0b..f3d9ee5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -719,6 +719,7 @@ void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
+@@ -761,6 +761,7 @@ void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
  		       struct ieee80211_vif *vif, struct ieee80211_sta *sta);
  int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig_type);
  int mt7915_mcu_set_mu_dl_ack_policy(struct mt7915_phy *phy, u8 policy_num);
@@ -22,10 +22,10 @@
  void mt7915_mcu_set_nusers_ofdma(struct mt7915_phy *phy, u8 type, u8 ofdma_user_cnt);
  void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 4a0bb4c..49fd6c5 100644
+index e706f64..3802de8 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2838,6 +2838,16 @@ static int mt7915_sta_tx_amsdu_set(void *data, u64 tx_amsdu)
+@@ -2836,6 +2836,16 @@ static int mt7915_sta_tx_amsdu_set(void *data, u64 tx_amsdu)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_tx_amsdu, NULL,
  			 mt7915_sta_tx_amsdu_set, "%llx\n");
  
@@ -42,7 +42,7 @@
  static int mt7915_red_enable_set(void *data, u64 en)
  {
  	struct mt7915_dev *dev = data;
-@@ -3735,6 +3745,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3856,6 +3866,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_wm_info", dir,
  				    mt7915_fw_wm_info_read);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-testmode-add-cheetah-support.patch b/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-testmode-add-cheetah-support.patch
index 6aef19c..992ee1d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-testmode-add-cheetah-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-testmode-add-cheetah-support.patch
@@ -1,7 +1,7 @@
-From 5186827e8a40a71363aa2c7cc3aef1fafae3665f Mon Sep 17 00:00:00 2001
+From ceb70263bbea4b354207f9011670944b79868910 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 31 Oct 2023 16:29:13 +0800
-Subject: [PATCH 55/76] wifi: mt76: testmode: add cheetah support
+Subject: [PATCH 1043/1048] wifi: mt76: testmode: add cheetah support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -12,10 +12,10 @@
  4 files changed, 37 insertions(+), 8 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index b96776d..c8ea1d9 100644
+index e11ae5e..96b1ea3 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -39,8 +39,7 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+@@ -40,8 +40,7 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
  	if (!dev->flash_mode || !val)
  		return 0;
  
@@ -26,7 +26,7 @@
  	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
  	if (!dev->cal)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index a1ab05a..99101f9 100644
+index dd450aa..70fca0b 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -52,6 +52,7 @@ enum mt7915_eeprom_field {
@@ -37,7 +37,7 @@
  
  #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
-@@ -192,6 +193,17 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
+@@ -194,6 +195,17 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
  	}
  }
  
@@ -56,10 +56,10 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ac015ab..2b41feb 100644
+index 1eb19ba..6cee6b6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3040,13 +3040,30 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
+@@ -3129,13 +3129,30 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
  		/* 5G BW160 */
  		5250, 5570, 5815
  	};
diff --git a/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch b/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch
index 9d52762..7238522 100644
--- a/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch
@@ -1,7 +1,8 @@
-From c3880a47f6c4b0b8c2f2d2eb7824cb3545db8a60 Mon Sep 17 00:00:00 2001
+From 2d4f946641ceeac9fa1bd7d23124e590bec8233d Mon Sep 17 00:00:00 2001
 From: "Henry.Yen" <henry.yen@mediatek.com>
 Date: Mon, 11 Dec 2023 16:01:55 +0800
-Subject: [PATCH 56/76] wifi: mt76: mt7915 add mt7981 efuse variants support
+Subject: [PATCH 1044/1048] wifi: mt76: mt7915 add mt7981 efuse variants
+ support
 
 ---
  mt7915/eeprom.c | 22 ++++++++++++++++++++++
@@ -9,10 +10,10 @@
  2 files changed, 28 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index c8ea1d9..b21763a 100644
+index 96b1ea3..79d6fe9 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -174,6 +174,21 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -179,6 +179,21 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  	return mt7915_check_eeprom(dev);
  }
  
@@ -34,7 +35,7 @@
  static void mt7915_eeprom_parse_band_config(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -224,6 +239,13 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+@@ -229,6 +244,13 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  	u8 path, nss, nss_max = 4, *eeprom = dev->mt76.eeprom.data;
  	struct mt76_phy *mphy = phy->mt76;
  	u8 band = phy->mt76->band_idx;
@@ -49,10 +50,10 @@
  	mt7915_eeprom_parse_band_config(phy);
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ad08582..47349b9 100644
+index f3d9ee5..45e04af 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -361,6 +361,7 @@ struct mt7915_dev {
+@@ -399,6 +399,7 @@ struct mt7915_dev {
  
  	u32 hw_pattern;
  
@@ -60,7 +61,7 @@
  	bool dbdc_support;
  	bool flash_mode;
  	bool bin_file_mode;
-@@ -625,7 +626,11 @@ void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
+@@ -667,7 +668,11 @@ void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-support-scs-feature.patch b/recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-support-scs-feature.patch
index 4cb13d3..550a3f3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-support-scs-feature.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-support-scs-feature.patch
@@ -1,7 +1,7 @@
-From 775a9c8aa928a43fd4eaf8d252c5691dcce8fd08 Mon Sep 17 00:00:00 2001
+From fd47d976d0dc1c2bc11bfabcb6f7c7a6920a46be Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Wed, 6 Dec 2023 08:53:03 +0800
-Subject: [PATCH] wifi: mt76: mt7915: support scs feature
+Subject: [PATCH 1045/1048] wifi: mt76: mt7915: support scs feature
 
 Add support scs feature for connac2 codebase. This commit includes three
 parts.
@@ -24,15 +24,15 @@
  mt7915/main.c        |  13 +++++
  mt7915/mcu.c         | 118 +++++++++++++++++++++++++++++++++++++++++++
  mt7915/mcu.h         |   4 ++
- mt7915/mt7915.h      |  13 +++++
+ mt7915/mt7915.h      |  14 +++++
  mt7915/mtk_debugfs.c |  24 +++++++++
- 9 files changed, 187 insertions(+)
+ 9 files changed, 188 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 4704c50..c0fdbd6 100644
+index aed47c8..1aa266f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -310,6 +310,7 @@ struct mt76_sta_stats {
+@@ -311,6 +311,7 @@ struct mt76_sta_stats {
  	u64 tx_nss[4];		/* 1, 2, 3, 4 */
  	u64 tx_mcs[16];		/* mcs idx */
  	u64 tx_bytes;
@@ -40,7 +40,7 @@
  	/* WED TX */
  	u32 tx_packets;		/* unit: MSDU */
  	u32 tx_retries;
-@@ -319,6 +320,7 @@ struct mt76_sta_stats {
+@@ -320,6 +321,7 @@ struct mt76_sta_stats {
  	u32 rx_packets;
  	u32 rx_errors;
  	u32 rx_drops;
@@ -49,10 +49,10 @@
  
  enum mt76_wcid_flags {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index bf5ab81..48874d1 100644
+index 1265401..5be93f6 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1222,6 +1222,7 @@ enum {
+@@ -1228,6 +1228,7 @@ enum {
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
  	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
  	MCU_EXT_CMD_SET_SER_TRIGGER = 0x81,
@@ -61,10 +61,10 @@
  	MCU_EXT_CMD_FW_DBG_CTRL = 0x95,
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 53dea70..cab711c 100644
+index 247d552..1a41282 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1244,6 +1244,7 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1243,6 +1243,7 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	spin_lock_init(&dev->phy.stats_lock);
  	INIT_WORK(&dev->rc_work, mt7915_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7915_mac_work);
@@ -73,10 +73,10 @@
  	INIT_LIST_HEAD(&dev->twt_list);
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e5480ee..0e8c64e 100644
+index 1691e6d..db25b2f 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1503,6 +1503,8 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
+@@ -1502,6 +1502,8 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
  	if (ext_phy)
  		cancel_delayed_work_sync(&ext_phy->mac_work);
  
@@ -85,7 +85,7 @@
  	mutex_lock(&dev->mt76.mutex);
  	for (i = 0; i < 10; i++) {
  		if (!mt7915_mac_restart(dev))
-@@ -1528,6 +1530,10 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
+@@ -1527,6 +1529,10 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
  		ieee80211_queue_delayed_work(ext_phy->hw,
  					     &ext_phy->mac_work,
  					     MT7915_WATCHDOG_TIME);
@@ -96,7 +96,7 @@
  }
  
  /* system error recovery */
-@@ -1592,6 +1598,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1585,6 +1591,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
  		set_bit(MT76_RESET, &phy2->mt76->state);
  		cancel_delayed_work_sync(&phy2->mt76->mac_work);
  	}
@@ -104,7 +104,7 @@
  	mt76_worker_disable(&dev->mt76.tx_worker);
  	mt76_for_each_q_rx(&dev->mt76, i)
  		napi_disable(&dev->mt76.napi[i]);
-@@ -1653,6 +1660,10 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1649,6 +1656,10 @@ void mt7915_mac_reset_work(struct work_struct *work)
  					     &phy2->mt76->mac_work,
  					     MT7915_WATCHDOG_TIME);
  
@@ -116,10 +116,10 @@
  		 wiphy_name(dev->mt76.hw->wiphy));
  }
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0318254..5be931b 100644
+index acb4f44..5316225 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -95,12 +95,24 @@ int mt7915_run(struct ieee80211_hw *hw)
+@@ -89,12 +89,24 @@ int mt7915_run(struct ieee80211_hw *hw)
  	if (ret)
  		goto out;
  
@@ -144,7 +144,7 @@
  	if (!running)
  		mt7915_mac_reset_counters(phy);
  
-@@ -141,6 +153,7 @@ static void mt7915_stop(struct ieee80211_hw *hw)
+@@ -135,6 +147,7 @@ static void mt7915_stop(struct ieee80211_hw *hw)
  	}
  
  	if (!mt7915_dev_running(dev)) {
@@ -153,10 +153,10 @@
  		mt7915_mcu_set_mac(dev, dev->phy.mt76->band_idx, false, false);
  	}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2b41feb..38679d2 100644
+index 6cee6b6..5672e44 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5043,3 +5043,121 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val)
+@@ -5245,3 +5245,121 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SWLNA_ACI_CTRL), &req,
  				 sizeof(req), NULL);
  }
@@ -279,10 +279,10 @@
 +		ieee80211_queue_delayed_work(mt76_hw(dev), &dev->scs_work, HZ);
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 6e6f320..723f23e 100644
+index 3089fb6..742a785 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -1188,4 +1188,8 @@ struct mt7915_mcu_edcca_info {
+@@ -1200,4 +1200,8 @@ struct mt7915_mcu_edcca_info {
  };
  #endif
  
@@ -292,10 +292,10 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 47349b9..464eb3f 100644
+index 45e04af..05a3bd5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -233,6 +233,15 @@ struct mt7915_air_monitor_ctrl {
+@@ -270,6 +270,15 @@ struct mt7915_air_monitor_ctrl {
  };
  #endif
  
@@ -311,7 +311,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -306,6 +315,7 @@ struct mt7915_phy {
+@@ -344,6 +353,7 @@ struct mt7915_phy {
  
  	struct mt7915_air_monitor_ctrl amnt_ctrl;
  #endif
@@ -319,15 +319,16 @@
  };
  
  struct mt7915_dev {
-@@ -424,6 +434,7 @@ struct mt7915_dev {
- 	} dbg;
+@@ -463,6 +473,8 @@ struct mt7915_dev {
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
+ 
 +	struct delayed_work scs_work;
++
+ 	bool wmm_pbc_enable;
+ 	struct work_struct wmm_pbc_work;
  };
- 
- enum {
-@@ -746,6 +757,8 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val);
+@@ -788,6 +800,8 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val);
  int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  int mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val);
@@ -337,10 +338,10 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 49fd6c5..d8e7589 100644
+index 3802de8..64e9d59 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3676,6 +3676,29 @@ mt7915_sr_enable_set(void *data, u64 val)
+@@ -3797,6 +3797,29 @@ mt7915_sr_enable_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_sr_enable, NULL,
  			 mt7915_sr_enable_set, "%llx\n");
  
@@ -370,7 +371,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3768,6 +3791,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3889,6 +3912,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_file("sw_aci", 0600, dir, dev,
  			    &fops_sw_aci);
  	debugfs_create_file("sr_enable", 0200, dir, phy, &fops_sr_enable);
diff --git a/recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch b/recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
index 15cfd68..1a35c56 100644
--- a/recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
@@ -1,7 +1,8 @@
-From 1cd5d06d4ffdd23c383f114d046dcb3d74929add Mon Sep 17 00:00:00 2001
+From 290608dad38eb923465018470bb587153db96b8d Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 21 Dec 2023 20:35:36 +0800
-Subject: [PATCH] wifi: mt76: mt7915: support thermal recal debug commnad
+Subject: [PATCH 1046/1048] wifi: mt76: mt7915: support thermal recal debug
+ commnad
 
 Add thermal recal debug command:
 $ echo val > debugfs/thermal_recal
@@ -20,22 +21,22 @@
  4 files changed, 35 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 48874d1..9d1841e 100644
+index 5be93f6..4e1006d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1218,6 +1218,7 @@ enum {
- 	MCU_EXT_CMD_TXDPD_CAL = 0x60,
+@@ -1224,6 +1224,7 @@ enum {
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
+ 	MCU_EXT_CMD_PKT_BUDGET_CTRL = 0x6c,
 +	MCU_EXT_CMD_THERMAL_DEBUG = 0x79,
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
  	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index afb691b..99df72d 100644
+index 5672e44..7e0e277 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5253,3 +5253,18 @@ void mt7915_mcu_scs_sta_poll(struct work_struct *work)
+@@ -5363,3 +5363,18 @@ void mt7915_mcu_scs_sta_poll(struct work_struct *work)
  	if (scs_enable_flag)
  		ieee80211_queue_delayed_work(mt76_hw(dev), &dev->scs_work, HZ);
  }
@@ -55,10 +56,10 @@
 +				 sizeof(req), true);
 +}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index eb148d3..57b418a 100644
+index 05a3bd5..38a9db4 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -797,6 +797,7 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -802,6 +802,7 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  int mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val);
  int mt7915_mcu_set_scs_en(struct mt7915_phy *phy, u8 enable);
  void mt7915_mcu_scs_sta_poll(struct work_struct *work);
diff --git a/recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch b/recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch
index 840c24f..d965749 100644
--- a/recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch
@@ -1,7 +1,7 @@
-From 563bc086375268e5e0136fa6fa1b3512e2e33c9e Mon Sep 17 00:00:00 2001
+From 14733d632430b788c7323b038bd679045a9dba95 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Fri, 15 Dec 2023 14:03:11 +0800
-Subject: [PATCH 1047/1047] wifi: mt76: mt7915: Add support for lpi and
+Subject: [PATCH 1047/1048] wifi: mt76: mt7915: Add support for lpi and
  duplicate mode
 
 Add support lpi and duplicate mode.
@@ -95,10 +95,10 @@
  		return target_power;
  
 diff --git a/mt76.h b/mt76.h
-index 18a3f5d..f5ed12b 100644
+index 1aa266f..4291acd 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -851,6 +851,9 @@ struct mt76_phy {
+@@ -852,6 +852,9 @@ struct mt76_phy {
  	u8 macaddr[ETH_ALEN];
  
  	int txpower_cur;
@@ -108,7 +108,7 @@
  	u8 antenna_mask;
  	u16 chainmask;
  
-@@ -1731,7 +1734,7 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
+@@ -1740,7 +1743,7 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
  void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr, u32 clear, u32 set);
  
  struct device_node *
@@ -134,7 +134,7 @@
 +
  #endif /* __MT76_CONNAC2_MAC_H */
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 362d937..541ba3a 100644
+index d036047..d41f004 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -564,7 +564,8 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
@@ -159,10 +159,10 @@
  
  		txwi[7] &= ~cpu_to_le32(MT_TXD7_HW_AMSDU);
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9d1841e..5bd773d 100644
+index 4e1006d..e581084 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1243,6 +1243,7 @@ enum {
+@@ -1249,6 +1249,7 @@ enum {
  	MCU_EXT_CMD_SWLNA_ACI_CTRL = 0xc0,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
@@ -171,7 +171,7 @@
  
  enum {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 519e34c..fc03867 100644
+index ead0f98..017d43d 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1296,7 +1296,6 @@ mt7915_txpower_info_show(struct seq_file *file, void *data)
@@ -192,7 +192,7 @@
  
  out:
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 2fa1d2d..75e0912 100644
+index 1a41282..32bbd6c 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -287,7 +287,7 @@ static void __mt7915_init_txpower(struct mt7915_phy *phy,
@@ -217,10 +217,10 @@
  
  static void
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 84ec1db..377bb7d 100644
+index 7e0e277..ba47d0d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1432,7 +1432,8 @@ mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1522,7 +1522,8 @@ mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct mt76_phy *mphy = mvif->phy->mt76;
@@ -230,7 +230,7 @@
  
  	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
  					      RATE_PARAM_SPE_UPDATE);
-@@ -3399,6 +3400,22 @@ mt7915_update_txpower(struct mt7915_phy *phy, int tx_power)
+@@ -3488,6 +3489,22 @@ mt7915_update_txpower(struct mt7915_phy *phy, int tx_power)
  		mphy->txpower_cur = e2p_power_limit;
  }
  
@@ -253,7 +253,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  {
  #define TX_POWER_LIMIT_TABLE_RATE	0
-@@ -3430,14 +3447,37 @@ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
+@@ -3519,14 +3536,37 @@ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  		mt7915_update_txpower(phy, tx_power);
  		return 0;
  	}
@@ -293,7 +293,7 @@
  	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
  	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
  
-@@ -3467,8 +3507,34 @@ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
+@@ -3556,8 +3596,34 @@ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  	hdr.limit_type = TX_POWER_LIMIT_TABLE_PATH;
  	skb_put_data(skb, &hdr, sizeof(hdr));
  	skb_put_data(skb, &la.path.cck, sizeof(la.path.cck));
@@ -330,7 +330,7 @@
  
  	/* HT20 and HT40 */
  	skb_put_data(skb, &la.path.ru[3], sizeof(la.path.ru[3]));
-@@ -3544,6 +3610,21 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
+@@ -3633,6 +3699,21 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
  	return 0;
  }
  
@@ -353,10 +353,10 @@
  			      u8 en)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 57b418a..684fe2f 100644
+index 38a9db4..23ee118 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -788,6 +788,7 @@ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
+@@ -793,6 +793,7 @@ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
diff --git a/recipes-wifi/linux-mt76/files/patches/1048-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch b/recipes-wifi/linux-mt76/files/patches/1048-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch
new file mode 100644
index 0000000..1ab6d29
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1048-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch
@@ -0,0 +1,154 @@
+From 4ad662df4310858461f31ad26d26e3043d43eb60 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Date: Wed, 24 Jan 2024 14:39:14 +0800
+Subject: [PATCH 1048/1048] wifi: mt76: mt7915: add no_beacon vendor command
+ for cert
+
+Add the vendor command to disable/enable beacon
+
+[Usage]
+hostapd_cli -i <interface> no_beacon <value>
+<value>
+0: enable beacon
+1: disable beacon
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ mt7915/mcu.c    | 11 +++++++++++
+ mt7915/mt7915.h |  1 +
+ mt7915/vendor.c | 42 +++++++++++++++++++++++++++++++++++++++++-
+ mt7915/vendor.h | 12 ++++++++++++
+ 4 files changed, 65 insertions(+), 1 deletion(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index ba47d0d..3b214a2 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -5107,6 +5107,17 @@ int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig
+ 		return 0;
+ 	}
+ }
++
++void mt7915_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
++{
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct ieee80211_hw *hw = mvif->phy->mt76->hw;
++	u8 val = *((u8 *)data);
++
++	vif->bss_conf.enable_beacon = val;
++
++	mt7915_mcu_add_beacon(hw, vif, val);
++}
+ #endif
+ 
+ #ifdef MTK_DEBUG
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 23ee118..3a596da 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -794,6 +794,7 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+ 				  struct ieee80211_sta *sta);
+ int mt7915_mcu_set_lpi(struct mt7915_phy *phy, bool en);
++void mt7915_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
+ #endif
+ int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
+ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 566fec0..6154d1a 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -113,6 +113,11 @@ txpower_ctrl_policy[NUM_MTK_VENDOR_ATTRS_TXPOWER_CTRL] = {
+ 	[MTK_VENDOR_ATTR_TXPOWER_CTRL_BCN_DUP] = { .type = NLA_U8 },
+ };
+ 
++static const struct nla_policy
++beacon_ctrl_policy[NUM_MTK_VENDOR_ATTRS_BEACON_CTRL] = {
++		[MTK_VENDOR_ATTR_BEACON_CTRL_MODE] = { .type = NLA_U8 },
++};
++
+ struct csi_null_tone {
+ 	u8 start;
+ 	u8 end;
+@@ -1399,6 +1404,30 @@ static int mt7915_vendor_txpower_ctrl(struct wiphy *wiphy,
+ 	return 0;
+ }
+ 
++static int mt7915_vendor_beacon_ctrl(struct wiphy *wiphy,
++				     struct wireless_dev *wdev,
++				     const void *data,
++				     int data_len)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_BEACON_CTRL];
++	int err;
++	u8 val8;
++
++	err = nla_parse(tb, MTK_VENDOR_ATTR_BEACON_CTRL_MAX, data, data_len,
++			beacon_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	if (tb[MTK_VENDOR_ATTR_BEACON_CTRL_MODE]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_BEACON_CTRL_MODE]);
++		ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
++				mt7915_set_beacon_vif, &val8);
++	}
++
++	return 0;
++}
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 	{
+ 		.info = {
+@@ -1526,7 +1555,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 		.doit = mt7915_vendor_txpower_ctrl,
+ 		.policy = txpower_ctrl_policy,
+ 		.maxattr = MTK_VENDOR_ATTR_TXPOWER_CTRL_MAX,
+-	}
++	},
++	{
++		.info = {
++			.vendor_id = MTK_NL80211_VENDOR_ID,
++			.subcmd = MTK_NL80211_VENDOR_SUBCMD_BEACON_CTRL,
++		},
++		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++			 WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = mt7915_vendor_beacon_ctrl,
++		.policy = beacon_ctrl_policy,
++		.maxattr = MTK_VENDOR_ATTR_BEACON_CTRL_MAX,
++	},
+ };
+ 
+ void mt7915_vendor_register(struct mt7915_phy *phy)
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 5b8a1fb..661d636 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -16,6 +16,7 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
+ 	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ 	MTK_NL80211_VENDOR_SUBCMD_BSS_COLOR_CTRL = 0xca,
++	MTK_NL80211_VENDOR_SUBCMD_BEACON_CTRL = 0xcd,
+ 	MTK_NL80211_VENDOR_SUBCMD_TXPOWER_CTRL = 0xce,
+ };
+ 
+@@ -289,4 +290,15 @@ enum mtk_vendor_attr_txpower_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_TXPOWER_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_beacon_ctrl {
++	MTK_VENDOR_ATTR_BEACON_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_BEACON_CTRL_MODE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_BEACON_CTRL,
++	MTK_VENDOR_ATTR_BEACON_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_BEACON_CTRL - 1
++};
++
+ #endif
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1049-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch b/recipes-wifi/linux-mt76/files/patches/1049-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch
new file mode 100644
index 0000000..628f2c2
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1049-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch
@@ -0,0 +1,331 @@
+From 771b77a2b49f7b4cfd4181cea48391e549a046b1 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 15 Feb 2024 11:16:16 +0800
+Subject: [PATCH] wifi: mt76: mt7915: support spatial reuse debug commands
+
+Support 3 spatial reuse debug commands:
+1. sr_enable: enable/disable spatial reuse
+2. sr_scene_cond: check spatial resue scene detection algorithm result
+3. sr_stats: check spatial resue tx statistics
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+---
+ mt76_connac_mcu.h    |  1 +
+ mt7915/mcu.c         | 94 ++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/mcu.h         | 48 ++++++++++++++++++++++
+ mt7915/mt7915.h      |  3 ++
+ mt7915/mtk_debugfs.c | 48 ++++++++++++++++++++--
+ 5 files changed, 190 insertions(+), 4 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index e581084..791dc1d 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1024,6 +1024,7 @@ enum {
+ 	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
+ 	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
+ 	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
++	MCU_EXT_EVENT_SR = 0xa8,
+ 	MCU_EXT_EVENT_CSI_REPORT = 0xc2,
+ };
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 3b214a2..4bd7a3b 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -452,6 +452,90 @@ mt7915_mcu_rx_bss_acq_pkt_cnt(struct mt7915_dev *dev, struct sk_buff * skb)
+ 	}
+ }
+ 
++#ifdef MTK_DEBUG
++void mt7915_mcu_rx_sr_swsd(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++#define SR_SCENE_DETECTION_TIMER_PERIOD_MS 500
++	struct mt7915_mcu_sr_swsd_event *event;
++	static const char * const rules[] = {"NO CONNECTED", "NO CONGESTION",
++					     "NO INTERFERENCE", "SR ON"};
++	u8 idx;
++
++	event = (struct mt7915_mcu_sr_swsd_event *)skb->data;
++	idx = event->basic.band_idx;
++
++	dev_info(dev->mt76.dev, "Band index = %u\n", event->basic.band_idx);
++	dev_info(dev->mt76.dev, "Hit Rule = %s\n", rules[event->rule[idx]]);
++	dev_info(dev->mt76.dev, "Timer Period = %d(us)\n"
++		 "Congestion Ratio  = %d.%1d%%\n",
++		 SR_SCENE_DETECTION_TIMER_PERIOD_MS * 1000,
++		 le32_to_cpu(event->total_airtime_ratio[idx]) / 10,
++		 le32_to_cpu(event->total_airtime_ratio[idx]) % 10);
++	dev_info(dev->mt76.dev,
++		 "Total Airtime = %d(us)\n"
++		 "ChBusy = %d\n"
++		 "SrTx = %d\n"
++		 "OBSS = %d\n"
++		 "MyTx = %d\n"
++		 "MyRx = %d\n"
++		 "Interference Ratio = %d.%1d%%\n",
++		 le32_to_cpu(event->total_airtime[idx]),
++		 le32_to_cpu(event->channel_busy_time[idx]),
++		 le32_to_cpu(event->sr_tx_airtime[idx]),
++		 le32_to_cpu(event->obss_airtime[idx]),
++		 le32_to_cpu(event->my_tx_airtime[idx]),
++		 le32_to_cpu(event->my_rx_airtime[idx]),
++		 le32_to_cpu(event->obss_airtime_ratio[idx]) / 10,
++		 le32_to_cpu(event->obss_airtime_ratio[idx]) % 10);
++}
++
++void mt7915_mcu_rx_sr_hw_indicator(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++	struct mt7915_mcu_sr_hw_ind_event *event;
++
++	event = (struct mt7915_mcu_sr_hw_ind_event *)skb->data;
++
++	dev_info(dev->mt76.dev, "Inter PPDU Count = %u\n",
++		 le16_to_cpu(event->inter_bss_ppdu_cnt));
++	dev_info(dev->mt76.dev, "SR Valid Count = %u\n",
++		 le16_to_cpu(event->non_srg_valid_cnt));
++	dev_info(dev->mt76.dev, "SR Tx Count = %u\n",
++		 le32_to_cpu(event->sr_ampdu_mpdu_cnt));
++	dev_info(dev->mt76.dev, "SR Tx Acked Count = %u\n",
++		 le32_to_cpu(event->sr_ampdu_mpdu_acked_cnt));
++}
++
++static void
++mt7915_mcu_rx_sr_event(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++	struct mt7915_mcu_sr_basic_event *event;
++	struct mt7915_phy *phy;
++
++	event = (struct mt7915_mcu_sr_basic_event *)skb->data;
++
++	if (event->band_idx > MT_BAND1)
++		dev_info(dev->mt76.dev, "Invalid band idx %d\n", event->band_idx);
++
++	switch (event->sub_event_id) {
++	case SPR_EVENT_CFG_SR_ENABLE:
++		phy = dev->mt76.phys[event->band_idx]->priv;
++		if (phy)
++			phy->sr_enable = le32_to_cpu(event->value);
++		break;
++	case SPR_EVENT_SR_SW_SD:
++		mt7915_mcu_rx_sr_swsd(dev, skb);
++		break;
++	case SPR_EVENT_SR_HW_IND:
++		mt7915_mcu_rx_sr_hw_indicator(dev, skb);
++		break;
++	default:
++		dev_info(dev->mt76.dev, "Unknown SR event tag %d\n",
++			 event->sub_event_id);
++		break;
++	}
++}
++#endif
++
+ static void
+ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ {
+@@ -479,6 +563,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	case MCU_EXT_EVENT_BCC_NOTIFY:
+ 		mt7915_mcu_rx_bcc_notify(dev, skb);
+ 		break;
++#ifdef MTK_DEBUG
++	case MCU_EXT_EVENT_SR:
++		mt7915_mcu_rx_sr_event(dev, skb);
++		break;
++#endif
+ #if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
+ 	case MCU_EXT_EVENT_BF_STATUS_READ:
+ 		mt7915_mcu_txbf_status_read(dev, skb);
+@@ -524,6 +613,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	     rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
+ 	     rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
+ 	     rxd->ext_eid == MCU_EXT_EVENT_BF_STATUS_READ ||
++	     rxd->ext_eid == MCU_EXT_EVENT_SR ||
+ 	     !rxd->seq) &&
+ 	     !(rxd->eid == MCU_CMD_EXT_CID &&
+ 	       rxd->ext_eid == MCU_EXT_EVENT_WA_TX_STAT))
+@@ -4002,6 +4092,10 @@ int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 	if (ret)
+ 		return ret;
+ 
++#ifdef MTK_DEBUG
++	phy->sr_enable = he_obss_pd->enable;
++#endif
++
+ 	if (sr_scene_detect || !he_obss_pd->enable)
+ 		return 0;
+ 
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 742a785..f476767 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -42,6 +42,45 @@ struct mt7915_mcu_thermal_notify {
+ 	u8 rsv[8];
+ } __packed;
+ 
++#ifdef MTK_DEBUG
++struct mt7915_mcu_sr_basic_event {
++	struct mt76_connac2_mcu_rxd rxd;
++
++	u8 sub_event_id;
++	u8 arg_num;
++	u8 band_idx;
++	u8 status;
++	u8 rsv[4];
++	__le32 value;
++} __packed;
++
++struct mt7915_mcu_sr_swsd_event {
++	struct mt7915_mcu_sr_basic_event basic;
++	u8 rsv[32];
++	__le32 sr_tx_airtime[2];
++	__le32 obss_airtime[2];
++	__le32 my_tx_airtime[2];
++	__le32 my_rx_airtime[2];
++	__le32 channel_busy_time[2];
++	__le32 total_airtime[2];
++	__le32 total_airtime_ratio[2];
++	__le32 obss_airtime_ratio[2];
++	u8 rule[2];
++	u8 rsv2[102];
++} __packed;
++
++struct mt7915_mcu_sr_hw_ind_event {
++	struct mt7915_mcu_sr_basic_event basic;
++	u8 rsv[2];
++	__le16 non_srg_valid_cnt;
++	u8 rsv2[4];
++	__le16 inter_bss_ppdu_cnt;
++	u8 rsv3[6];
++	__le32 sr_ampdu_mpdu_cnt;
++	__le32 sr_ampdu_mpdu_acked_cnt;
++} __packed;
++#endif
++
+ struct mt7915_mcu_csa_notify {
+ 	struct mt76_connac2_mcu_rxd rxd;
+ 
+@@ -532,15 +571,24 @@ enum {
+ 
+ enum {
+ 	SPR_ENABLE = 0x1,
++	SPR_GET_ENABLE = 0x2,
+ 	SPR_ENABLE_SD = 0x3,
+ 	SPR_ENABLE_MODE = 0x5,
+ 	SPR_ENABLE_DPD = 0x23,
+ 	SPR_ENABLE_TX = 0x25,
+ 	SPR_SET_SRG_BITMAP = 0x80,
++	SPR_GET_SCENE_COND = 0x84,
+ 	SPR_SET_PARAM = 0xc2,
++	SPR_GET_STATS = 0xd4,
+ 	SPR_SET_SIGA = 0xdc,
+ };
+ 
++enum {
++	SPR_EVENT_CFG_SR_ENABLE = 0x1,
++	SPR_EVENT_SR_SW_SD = 0x82,
++	SPR_EVENT_SR_HW_IND = 0xC9,
++};
++
+ enum {
+ 	THERMAL_PROTECT_PARAMETER_CTRL,
+ 	THERMAL_PROTECT_BASIC_INFO,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 3a596da..2ec2c77 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -354,6 +354,9 @@ struct mt7915_phy {
+ 	struct mt7915_air_monitor_ctrl amnt_ctrl;
+ #endif
+ 	struct mt7915_scs_ctrl scs_ctrl;
++#ifdef MTK_DEBUG
++	bool sr_enable;
++#endif
+ };
+ 
+ struct mt7915_dev {
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 1017ee7..9f8b408 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -3786,16 +3786,34 @@ mt7915_sw_aci_set(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_sw_aci, NULL,
+ 			 mt7915_sw_aci_set, "%llx\n");
+ 
++static int
++mt7915_sr_enable_get(void *data, u64 *enable)
++{
++	struct mt7915_phy *phy = data;
++
++	*enable = phy->sr_enable;
++
++	return 0;
++}
++
+ static int
+ mt7915_sr_enable_set(void *data, u64 val)
+ {
+ 	struct mt7915_phy *phy = data;
++	int ret;
++
++	if (!!val == phy->sr_enable)
++		return 0;
++
++	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, !!val);
++	if (ret)
++		return ret;
+ 
+-	return mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, val);
++	return mt7915_mcu_enable_obss_spr(phy, SPR_GET_ENABLE, 0);
+ }
+ 
+-DEFINE_DEBUGFS_ATTRIBUTE(fops_sr_enable, NULL,
+-			 mt7915_sr_enable_set, "%llx\n");
++DEFINE_DEBUGFS_ATTRIBUTE(fops_sr_enable, mt7915_sr_enable_get,
++			 mt7915_sr_enable_set, "%llu\n");
+ 
+ static int
+ mt7915_scs_enable_set(void *data, u64 val)
+@@ -3836,6 +3854,26 @@ mt7915_thermal_recal_set(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_recal, NULL,
+ 			 mt7915_thermal_recal_set, "%llu\n");
+ 
++static int
++mt7915_sr_stats_show(struct seq_file *file, void *data)
++{
++	struct mt7915_phy *phy = file->private;
++
++	return mt7915_mcu_enable_obss_spr(phy, SPR_GET_STATS, 0);
++}
++
++DEFINE_SHOW_ATTRIBUTE(mt7915_sr_stats);
++
++static int
++mt7915_sr_scene_cond_show(struct seq_file *file, void *data)
++{
++	struct mt7915_phy *phy = file->private;
++
++	return mt7915_mcu_enable_obss_spr(phy, SPR_GET_SCENE_COND, 0);
++}
++
++DEFINE_SHOW_ATTRIBUTE(mt7915_sr_scene_cond);
++
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+@@ -3928,9 +3966,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ 				    mt7915_show_eeprom_mode);
+ 	debugfs_create_file("sw_aci", 0600, dir, dev,
+ 			    &fops_sw_aci);
+-	debugfs_create_file("sr_enable", 0200, dir, phy, &fops_sr_enable);
++	debugfs_create_file("sr_enable", 0600, dir, phy, &fops_sr_enable);
+ 	debugfs_create_file("scs_enable", 0200, dir, phy, &fops_scs_enable);
+ 	debugfs_create_file("thermal_recal", 0200, dir, dev, &fops_thermal_recal);
++	debugfs_create_file("sr_stats", 0400, dir, phy, &mt7915_sr_stats_fops);
++	debugfs_create_file("sr_scene_cond", 0400, dir, phy, &mt7915_sr_scene_cond_fops);
+ 
+ 	return 0;
+ }
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
index 773f894..efab9b7 100644
--- a/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,33 +1,20 @@
-From 9182ca1fd7e9df4dc89a80105137edd62c00d924 Mon Sep 17 00:00:00 2001
+From 48e4b327150a9b9480911af9fe654420d545013c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 58/76] wifi: mt76: mt7915: wed: add wed tx support
+Subject: [PATCH 2000/2012] wifi: mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- mmio.c          |  2 +-
  mt76_connac.h   |  1 +
  mt7915/mac.c    | 10 +++++++---
  mt7915/main.c   |  4 ++--
  mt7915/mmio.c   |  3 ++-
  mt7915/mt7915.h |  2 +-
+ wed.c           |  2 +-
  6 files changed, 14 insertions(+), 8 deletions(-)
 
-diff --git a/mmio.c b/mmio.c
-index 6e25a14..d9d5047 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -194,7 +194,7 @@ void mt76_mmio_wed_offload_disable(struct mtk_wed_device *wed)
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
- 
- 	spin_lock_bh(&dev->token_lock);
--	dev->token_size = dev->drv->token_size;
-+	dev->token_size = wed->wlan.token_start;
- 	spin_unlock_bh(&dev->token_lock);
- }
- EXPORT_SYMBOL_GPL(mt76_mmio_wed_offload_disable);
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 6c8a453..e482a7e 100644
+index e23a41c..58421e5 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -130,6 +130,7 @@ struct mt76_connac_sta_key_conf {
@@ -39,7 +26,7 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0e8c64e..8aeee3c 100644
+index db25b2f..53a8f97 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -870,9 +870,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -82,10 +69,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2e1f4b9..659ae48 100644
+index 5316225..9037fa9 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1708,14 +1708,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1728,14 +1728,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -103,7 +90,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 06f5a19..cdfd35f 100644
+index 437a9b0..91100f1 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -13,7 +13,7 @@
@@ -115,7 +102,7 @@
  module_param(wed_enable, bool, 0644);
  MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
  
-@@ -736,6 +736,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -732,6 +732,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
@@ -124,7 +111,7 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 464eb3f..bb0a806 100644
+index 3a596da..8967a97 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,7 +62,7 @@
@@ -136,6 +123,19 @@
  #define MT7915_TOKEN_SIZE		8192
  
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
+diff --git a/wed.c b/wed.c
+index f7a3f1b..47c81a2 100644
+--- a/wed.c
++++ b/wed.c
+@@ -187,7 +187,7 @@ void mt76_wed_offload_disable(struct mtk_wed_device *wed)
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ 
+ 	spin_lock_bh(&dev->token_lock);
+-	dev->token_size = dev->drv->token_size;
++	dev->token_size = wed->wlan.token_start;
+ 	spin_unlock_bh(&dev->token_lock);
+ }
+ EXPORT_SYMBOL_GPL(mt76_wed_offload_disable);
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch b/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
index 467d98e..5cd362e 100644
--- a/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
@@ -1,8 +1,8 @@
-From 1c87f95ce8be271a28470bf1d2809aed425c6870 Mon Sep 17 00:00:00 2001
+From 4e2aa09d90a1574c3baa3242d1d4dc8dda3f9c97 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 17:51:26 +0800
-Subject: [PATCH 59/76] wifi: mt76: mt7915: wed: add wds support when wed is
- enabled
+Subject: [PATCH 2001/2012] wifi: mt76: mt7915: wed: add wds support when wed
+ is enabled
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  6 files changed, 82 insertions(+), 10 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index c0fdbd6..a54da76 100644
+index 4291acd..fd8e2ff 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -78,6 +78,12 @@ enum mt76_wed_type {
@@ -32,10 +32,10 @@
  	u32 (*rr)(struct mt76_dev *dev, u32 offset);
  	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 659ae48..bbfb643 100644
+index 9037fa9..c92f580 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -788,8 +788,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -804,8 +804,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -52,7 +52,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1276,6 +1283,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1296,6 +1303,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -66,7 +66,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1715,8 +1729,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1735,8 +1749,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -81,10 +81,10 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 38679d2..405bdfc 100644
+index 3b214a2..465ab26 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2397,10 +2397,18 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2487,10 +2487,18 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -108,10 +108,10 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 723f23e..3b169d6 100644
+index 742a785..683b22c 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -339,6 +339,7 @@ enum {
+@@ -353,6 +353,7 @@ enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
  	MCU_WA_PARAM_RED = 0x0e,
diff --git a/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch b/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
index 1a25989..27a4e8a 100644
--- a/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
@@ -1,7 +1,7 @@
-From d14b8c573cb2b131505eab63751fc8cb10afea77 Mon Sep 17 00:00:00 2001
+From dcc4acde168f6971da961f8ac22c21a62f7876c9 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 19 May 2023 07:05:22 +0800
-Subject: [PATCH 60/76] wifi: mt76: mt7915: wed: add fill receive path to
+Subject: [PATCH 2002/2012] wifi: mt76: mt7915: wed: add fill receive path to
  report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 18 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index bbfb643..72ad108 100644
+index c92f580..e495e29 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1740,6 +1740,23 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1760,6 +1760,23 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -37,12 +37,12 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1794,6 +1811,7 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1815,6 +1832,7 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
 +	.net_fill_receive_path = mt7915_net_fill_receive_path,
- 	.net_setup_tc = mt76_net_setup_tc,
+ 	.net_setup_tc = mt76_wed_net_setup_tc,
  #endif
  };
 -- 
diff --git a/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch b/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
index e2feee5..6223e45 100644
--- a/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
@@ -1,7 +1,7 @@
-From 20b4bf7d7c23e79dc6dd8d067ddeb2c5e7358f92 Mon Sep 17 00:00:00 2001
+From 76b4963531910a40ec153e9d383cae8167347f0b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 61/76] wifi: mt76: mt7915: wed: find rx token by physical
+Subject: [PATCH 2003/2012] wifi: mt76: mt7915: wed: find rx token by physical
  address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -13,10 +13,10 @@
  1 file changed, 24 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index d338424..b2b30d6 100644
+index bbae84f..fbf97ae 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -446,9 +446,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -444,9 +444,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  	mt76_dma_should_drop_buf(drop, ctrl, buf1, desc_info);
  
  	if (mt76_queue_is_wed_rx(q)) {
diff --git a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 8c280bf..3b2ebdf 100644
--- a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,25 +1,25 @@
-From eff1a6ef317006da115f694dab8e5ba721771929 Mon Sep 17 00:00:00 2001
+From c11eefaf75f2b0a6ad64c16d5b5d8071b1c8d8b4 Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH] wifi: mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 2004/2012] wifi: mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76_connac_mcu.h    |   2 +
- mt7915/debugfs.c     | 405 +++++++++++++++++++++++++++++++++++++++++++
+ mt7915/debugfs.c     | 357 +++++++++++++++++++++++++++++++++++++++++++
  mt7915/init.c        |  58 +++++++
  mt7915/main.c        |  14 ++
- mt7915/mcu.c         | 169 +++++++++++++++++-
- mt7915/mt7915.h      |  69 ++++++++
- mt7915/mtk_debugfs.c | 130 ++++++++++++++
- 7 files changed, 844 insertions(+), 3 deletions(-)
+ mt7915/mcu.c         | 169 +++++++++++++++++++-
+ mt7915/mt7915.h      |  69 +++++++++
+ mt7915/mtk_debugfs.c | 130 ++++++++++++++++
+ 7 files changed, 796 insertions(+), 3 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 48874d1..22a6779 100644
+index e581084..7b61427 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1196,6 +1196,7 @@ enum {
+@@ -1201,6 +1201,7 @@ enum {
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
  	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
@@ -27,7 +27,7 @@
  	MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
  	MCU_EXT_CMD_ATE_CTRL = 0x3d,
  	MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
-@@ -1205,6 +1206,7 @@ enum {
+@@ -1210,6 +1211,7 @@ enum {
  	MCU_EXT_CMD_MUAR_UPDATE = 0x48,
  	MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
  	MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 6dcee10..ca42b69 100644
+index 017d43d..d1e33ef 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -50,7 +50,7 @@
  /** global debugfs **/
  
  struct hw_queue_map {
-@@ -223,6 +227,406 @@ static const struct file_operations mt7915_sys_recovery_ops = {
+@@ -223,6 +227,358 @@ static const struct file_operations mt7915_sys_recovery_ops = {
  	.llseek = default_llseek,
  };
  
@@ -323,13 +323,13 @@
 +
 +static ssize_t
 +mt7915_vow_set(struct file *file, const char __user *user_buf,
-+		  size_t count, loff_t *ppos)
++	       size_t count, loff_t *ppos)
 +{
 +	struct mt7915_phy *phy = file->private_data;
 +	struct mt7915_dev *dev = phy->dev;
-+	u32 rv, param1, param2, param3;
-+	char buf[128];
-+	int ret = 0;
++	u32 param1, param2, param3;
++	char buf[64];
++	int ret;
 +
 +	if (count >= sizeof(buf))
 +		return -EINVAL;
@@ -342,109 +342,61 @@
 +	else
 +		buf[count] = '\0';
 +
-+	if (!strncmp(buf, "vow_sta_dwrr_quantum_id",
-+		strlen("vow_sta_dwrr_quantum_id")))
-+	{
-+		rv = sscanf(buf, "vow_sta_dwrr_quantum_id=%d-%d-%d",
-+			    &param1, &param2, &param3);
-+		if ((rv > 2) && (param2 < IEEE80211_NUM_ACS) &&
-+                    (param3 < VOW_WATF_LEVEL_NUM)) {
-+			ret = mt7915_set_vow_sta_dwrr_quantum_id(dev, param1,
-+								 param2, param3);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_atf_en", strlen("vow_atf_en")))
-+	{
-+		rv = sscanf(buf, "vow_atf_en=%d", &param1);
-+		if (rv > 0) {
-+			ret = mt7915_set_vow_atf_en(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_dwrr_max_wait_time",
-+		 strlen("vow_dwrr_max_wait_time")))
-+	{
-+		rv = sscanf(buf, "vow_dwrr_max_wait_time=%d", &param1);
-+		if (rv > 0) {
-+			ret = mt7915_set_vow_dwrr_max_wait_time(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_watf_en", strlen("vow_watf_en")))
-+	{
-+		rv = sscanf(buf, "vow_watf_en=%d", &param1);
-+		if (rv > 0) {
-+			ret = mt7915_set_vow_watf_en(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_watf_quantum",
-+		 strlen("vow_watf_quantum")))
-+	{
-+		rv = sscanf(buf, "vow_watf_quantum=%d-%d",
-+			    &param1, &param2);
-+		if ((dev->vow_cfg.vow_watf_en) && (rv > 1) &&
-+                    (param1 < VOW_WATF_LEVEL_NUM)) {
-+			ret = mt7915_set_vow_watf_quantum(dev, param1, param2);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_show_en", strlen("vow_show_en")))
-+	{
-+		rv = sscanf(buf, "vow_show_en=%d", &param1);
-+		if (rv > 0) {
-+			ret = mt7915_set_vow_show_en(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_show_sta", strlen("vow_show_sta")))
-+	{
-+		rv = sscanf(buf, "vow_show_sta=%d", &param1);
-+		if ((rv > 0)&& (param1 < MT7915_WTBL_STA)) {
-+			ret = mt7915_set_vow_show_sta(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "show_vow_info", strlen("show_vow_info")))
-+	{
-+		if (rv == 0) {
-+			ret = mt7915_set_show_vow_info(dev);
-+		}
-+		else {
-+			dev_err(dev->mt76.dev, "show_vow_info\n");
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "show_vow_sta_conf", strlen("show_vow_sta_conf")))
-+	{
-+		rv = sscanf(buf, "show_vow_sta_conf=%d", &param1);
-+		if ((rv > 0) && (param1 < MT7915_WTBL_STA)) {
-+			ret = mt7915_show_vow_sta_conf(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
++	if (!strncmp(buf, "vow_sta_dwrr_quantum_id", strlen("vow_sta_dwrr_quantum_id"))) {
++		ret = sscanf(buf, "vow_sta_dwrr_quantum_id=%u-%u-%u",
++		             &param1, &param2, &param3);
++		if (ret != 3 || param2 >= IEEE80211_NUM_ACS || param3 >= VOW_WATF_LEVEL_NUM)
++			return -EINVAL;
 +
-+	if (ret)
-+		return ret;
-+out:
-+	return count;
++		ret = mt7915_set_vow_sta_dwrr_quantum_id(dev, param1, param2, param3);
++	} else if (!strncmp(buf, "vow_atf_en", strlen("vow_atf_en"))) {
++		ret = sscanf(buf, "vow_atf_en=%u", &param1);
++		if (ret != 1)
++			return -EINVAL;
++
++		ret = mt7915_set_vow_atf_en(dev, param1);
++	} else if (!strncmp(buf, "vow_dwrr_max_wait_time", strlen("vow_dwrr_max_wait_time"))) {
++		ret = sscanf(buf, "vow_dwrr_max_wait_time=%u", &param1);
++		if (ret != 1)
++			return -EINVAL;
++
++		ret = mt7915_set_vow_dwrr_max_wait_time(dev, param1);
++	} else if (!strncmp(buf, "vow_watf_en", strlen("vow_watf_en"))) {
++		ret = sscanf(buf, "vow_watf_en=%u", &param1);
++		if (ret != 1)
++			return -EINVAL;
++
++		ret = mt7915_set_vow_watf_en(dev, param1);
++	} else if (!strncmp(buf, "vow_watf_quantum", strlen("vow_watf_quantum"))) {
++		ret = sscanf(buf, "vow_watf_quantum=%u-%u", &param1, &param2);
++		if (!dev->vow_cfg.vow_watf_en || ret != 2 || param1 >= VOW_WATF_LEVEL_NUM)
++			return -EINVAL;
++
++		ret = mt7915_set_vow_watf_quantum(dev, param1, param2);
++	} else if (!strncmp(buf, "vow_show_en", strlen("vow_show_en"))) {
++		ret = sscanf(buf, "vow_show_en=%u", &param1);
++		if (ret != 1)
++			return -EINVAL;
++
++		ret = mt7915_set_vow_show_en(dev, param1);
++	} else if (!strncmp(buf, "vow_show_sta", strlen("vow_show_sta"))) {
++		ret = sscanf(buf, "vow_show_sta=%u", &param1);
++		if (ret != 1 || param1 >= MT7915_WTBL_STA)
++			return -EINVAL;
++
++		ret = mt7915_set_vow_show_sta(dev, param1);
++	} else if (!strncmp(buf, "show_vow_info", strlen("show_vow_info")))
++		ret = mt7915_set_show_vow_info(dev);
++	else if (!strncmp(buf, "show_vow_sta_conf", strlen("show_vow_sta_conf"))) {
++		ret = sscanf(buf, "show_vow_sta_conf=%u", &param1);
++		if (ret != 1 || param1 >= MT7915_WTBL_STA)
++			return -EINVAL;
++
++		ret = mt7915_show_vow_sta_conf(dev, param1);
++	} else
++		return -EINVAL;
++
++	return ret ? ret : count;
 +}
 +
 +static const struct file_operations mt7915_vow_ops = {
@@ -457,7 +409,7 @@
  static int
  mt7915_radar_trigger(void *data, u64 val)
  {
-@@ -1476,6 +1880,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1515,6 +1871,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
@@ -466,10 +418,10 @@
  	if (!dev->dbdc_support || phy->mt76->band_idx) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index cab711c..e00c667 100644
+index 32bbd6c..b62521f 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -608,10 +608,65 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -610,10 +610,65 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  	}
  }
  
@@ -535,7 +487,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -635,6 +690,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -637,6 +692,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		mt7915_mac_init_band(dev, i);
  
  	mt7915_init_led_mux(dev);
@@ -546,10 +498,10 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 26ea989..9a3c1db 100644
+index e495e29..374526b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -232,6 +232,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+@@ -226,6 +226,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct mt7915_dev *dev = phy->dev;
@@ -557,7 +509,7 @@
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
  	int idx, ret = 0;
-@@ -294,6 +295,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+@@ -288,6 +289,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
@@ -567,7 +519,7 @@
  	return ret;
  }
  
-@@ -784,6 +788,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -799,6 +803,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -575,7 +527,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
  #endif
-@@ -834,6 +839,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -849,6 +854,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (phy->muru_onoff & MUMIMO_DL_CERT)
  		mt7915_mcu_set_mimo(phy, 0);
  #endif
@@ -592,10 +544,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 405bdfc..d66b42a 100644
+index 465ab26..94c5c2e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1674,7 +1674,7 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1765,7 +1765,7 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  {
  #define MT_STA_BSS_GROUP		1
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -604,7 +556,7 @@
  	struct {
  		__le32 action;
  		u8 wlan_idx_lo;
-@@ -1685,10 +1685,9 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1776,10 +1776,9 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		u8 rsv1[8];
  	} __packed req = {
  		.action = cpu_to_le32(MT_STA_BSS_GROUP),
@@ -616,7 +568,7 @@
  	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
  	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
  
-@@ -1746,6 +1745,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1837,6 +1836,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
  	}
  
@@ -624,7 +576,7 @@
  	ret = mt7915_mcu_add_group(dev, vif, sta);
  	if (ret) {
  		dev_kfree_skb(skb);
-@@ -3623,6 +3623,169 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3796,6 +3796,169 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -795,7 +747,7 @@
  {
  #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index bb0a806..cc4c402 100644
+index 8967a97..662d14e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -141,6 +141,58 @@ struct mt7915_twt_flow {
@@ -865,16 +817,16 @@
  };
  
  struct mt7915_vif_cap {
-@@ -435,6 +488,8 @@ struct mt7915_dev {
- 	const struct mt7915_dbg_reg_desc *dbg_reg;
+@@ -474,6 +527,8 @@ struct mt7915_dev {
  #endif
+ 
  	struct delayed_work scs_work;
 +	struct delayed_work vow_work;
 +	struct mt7915_vow_cfg vow_cfg;
- };
  
- enum {
-@@ -467,6 +522,15 @@ enum mt7915_rdd_cmd {
+ 	bool wmm_pbc_enable;
+ 	struct work_struct wmm_pbc_work;
+@@ -509,6 +564,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -890,7 +842,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -596,6 +660,11 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -638,6 +702,11 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -903,7 +855,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index eaff887..387d51b 100644
+index 50e7b6c..c67448b 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1518,6 +1518,136 @@ static void chip_get_sta_pause(struct mt7915_dev *dev, u32 *sta_pause)
diff --git a/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch b/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
index 61121c8..552939a 100644
--- a/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
@@ -1,23 +1,23 @@
-From 2948ff57ae985d1698739c1a696d93c57aa462b5 Mon Sep 17 00:00:00 2001
+From e31e574cddc41d2ea34a0097c7798579eccf14b0 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 6 Jan 2023 18:18:50 +0800
-Subject: [PATCH 63/76] wifi: mt76: mt7915: wed: add rxwi for further in chip
- rro
+Subject: [PATCH 2005/2012] wifi: mt76: mt7915: wed: add rxwi for further in
+ chip rro
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  dma.c           | 93 +++++++++++++++++++++++++------------------------
  mac80211.c      |  2 +-
- mmio.c          | 26 +++++++-------
  mt76.h          | 24 ++++++++-----
  mt7915/dma.c    |  2 --
  mt7915/mmio.c   |  3 +-
  mt7915/mt7915.h |  1 +
  tx.c            | 16 ++++-----
+ wed.c           | 26 +++++++-------
  8 files changed, 87 insertions(+), 80 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index b2b30d6..cf6ca04 100644
+index fbf97ae..53597b5 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -64,17 +64,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -129,7 +129,7 @@
  	}
  	local_bh_enable();
  }
-@@ -230,7 +230,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -228,7 +228,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  		    struct mt76_queue_buf *buf, void *data)
  {
  	struct mt76_queue_entry *entry = &q->entry[q->head];
@@ -138,7 +138,7 @@
  	struct mt76_desc *desc;
  	int idx = q->head;
  	u32 buf1 = 0, ctrl;
-@@ -251,13 +251,13 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -249,13 +249,13 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  #endif
  
  	if (mt76_queue_is_wed_rx(q)) {
@@ -156,7 +156,7 @@
  			return -ENOMEM;
  		}
  
-@@ -273,7 +273,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -271,7 +271,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  done:
  	entry->dma_addr[0] = buf->addr;
  	entry->dma_len[0] = buf->len;
@@ -165,7 +165,7 @@
  	entry->buf = data;
  	entry->wcid = 0xffff;
  	entry->skip_buf1 = true;
-@@ -286,7 +286,7 @@ done:
+@@ -284,7 +284,7 @@ done:
  static int
  mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
  		 struct mt76_queue_buf *buf, int nbufs, u32 info,
@@ -174,7 +174,7 @@
  {
  	struct mt76_queue_entry *entry;
  	struct mt76_desc *desc;
-@@ -346,6 +346,7 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -344,6 +344,7 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
  	}
  
  	q->entry[idx].txwi = txwi;
@@ -182,7 +182,7 @@
  	q->entry[idx].skb = skb;
  	q->entry[idx].wcid = 0xffff;
  
-@@ -448,13 +449,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -446,13 +447,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  	if (mt76_queue_is_wed_rx(q)) {
  		u32 id, find = 0;
  		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN, buf1);
@@ -199,7 +199,7 @@
  					find = 1;
  					token = id;
  
-@@ -471,19 +472,19 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -469,19 +470,19 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				return NULL;
  		}
  
@@ -226,7 +226,7 @@
  		if (drop)
  			*drop |= !!(buf1 & MT_DMA_CTL_WO_DROP);
  	} else {
-@@ -545,7 +546,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -543,7 +544,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
  	buf.len = skb->len;
  
  	spin_lock_bh(&q->lock);
@@ -235,7 +235,7 @@
  	mt76_dma_kick_queue(dev, q);
  	spin_unlock_bh(&q->lock);
  
-@@ -625,7 +626,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -623,7 +624,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
  		goto unmap;
  
  	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
@@ -245,7 +245,7 @@
  unmap:
  	for (n--; n > 0; n--)
 diff --git a/mac80211.c b/mac80211.c
-index 1a7d690..013298e 100644
+index f9dfdf8..225b290 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -618,7 +618,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -264,81 +264,8 @@
  
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
-diff --git a/mmio.c b/mmio.c
-index d9d5047..edc3cac 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -96,18 +96,18 @@ void mt76_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- 				sizeof(struct skb_shared_info));
- 
- 	for (i = 0; i < dev->rx_token_size; i++) {
--		struct mt76_txwi_cache *t;
-+		struct mt76_rxwi_cache *r;
- 
--		t = mt76_rx_token_release(dev, i);
--		if (!t || !t->ptr)
-+		r = mt76_rx_token_release(dev, i);
-+		if (!r || !r->ptr)
- 			continue;
- 
--		dma_unmap_single(dev->dma_dev, t->dma_addr,
-+		dma_unmap_single(dev->dma_dev, r->dma_addr,
- 				 wed->wlan.rx_size, DMA_FROM_DEVICE);
--		__free_pages(virt_to_page(t->ptr), get_order(length));
--		t->ptr = NULL;
-+		__free_pages(virt_to_page(r->ptr), get_order(length));
-+		r->ptr = NULL;
- 
--		mt76_put_rxwi(dev, t);
-+		mt76_put_rxwi(dev, r);
- 	}
- 
- 	mt76_free_pending_rxwi(dev);
-@@ -125,18 +125,18 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 				sizeof(struct skb_shared_info));
- 
- 	for (i = 0; i < size; i++) {
--		struct mt76_txwi_cache *t = mt76_get_rxwi(dev);
-+		struct mt76_rxwi_cache *r = mt76_get_rxwi(dev);
- 		dma_addr_t phy_addr;
- 		struct page *page;
- 		int token;
- 		void *ptr;
- 
--		if (!t)
-+		if (!r)
- 			goto unmap;
- 
- 		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
- 		if (!page) {
--			mt76_put_rxwi(dev, t);
-+			mt76_put_rxwi(dev, r);
- 			goto unmap;
- 		}
- 
-@@ -146,17 +146,17 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 					  DMA_TO_DEVICE);
- 		if (unlikely(dma_mapping_error(dev->dev, phy_addr))) {
- 			__free_pages(page, get_order(length));
--			mt76_put_rxwi(dev, t);
-+			mt76_put_rxwi(dev, r);
- 			goto unmap;
- 		}
- 
- 		desc->buf0 = cpu_to_le32(phy_addr);
--		token = mt76_rx_token_consume(dev, ptr, t, phy_addr);
-+		token = mt76_rx_token_consume(dev, ptr, r, phy_addr);
- 		if (token < 0) {
- 			dma_unmap_single(dev->dma_dev, phy_addr,
- 					 wed->wlan.rx_size, DMA_TO_DEVICE);
- 			__free_pages(page, get_order(length));
--			mt76_put_rxwi(dev, t);
-+			mt76_put_rxwi(dev, r);
- 			goto unmap;
- 		}
- 
 diff --git a/mt76.h b/mt76.h
-index a54da76..981445a 100644
+index fd8e2ff..5485719 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -193,6 +193,7 @@ struct mt76_queue_entry {
@@ -349,7 +276,7 @@
  		struct urb *urb;
  		int buf_sz;
  	};
-@@ -411,10 +412,15 @@ struct mt76_txwi_cache {
+@@ -412,10 +413,15 @@ struct mt76_txwi_cache {
  
  	unsigned long jiffies;
  
@@ -369,7 +296,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -501,6 +507,7 @@ struct mt76_driver_ops {
+@@ -502,6 +508,7 @@ struct mt76_driver_ops {
  	u16 txwi_size;
  	u16 token_size;
  	u8 mcs_rates;
@@ -377,7 +304,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  
-@@ -889,7 +896,6 @@ struct mt76_dev {
+@@ -893,7 +900,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -385,7 +312,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1599,8 +1605,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1617,8 +1623,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -396,7 +323,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1785,9 +1791,9 @@ struct mt76_txwi_cache *
+@@ -1796,9 +1802,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -409,7 +336,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index c91a1c5..17a3fa0 100644
+index 0baa82c..552410a 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -512,7 +512,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -429,19 +356,19 @@
  		}
  
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index cdfd35f..c8258f1 100644
+index 91100f1..3391a94 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -729,7 +729,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -725,7 +725,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.reset = mt7915_mmio_wed_reset;
- 	wed->wlan.reset_complete = mt76_mmio_wed_reset_complete;
+ 	wed->wlan.reset_complete = mt76_wed_reset_complete;
  
 -	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
 +	dev->mt76.rx_token_size += wed->wlan.rx_npkt;
  
  	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -937,6 +937,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -933,6 +933,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  				SURVEY_INFO_TIME_RX |
  				SURVEY_INFO_TIME_BSS_RX,
  		.token_size = MT7915_TOKEN_SIZE,
@@ -450,7 +377,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index cc4c402..8dd9386 100644
+index 662d14e..410d47a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -64,6 +64,7 @@
@@ -462,10 +389,10 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index f1dd9f6..e290aef 100644
+index d9731e5..ba7c13c 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -842,16 +842,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+@@ -850,16 +850,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  EXPORT_SYMBOL_GPL(mt76_token_consume);
  
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
@@ -486,7 +413,7 @@
  	}
  	spin_unlock_bh(&dev->rx_token_lock);
  
-@@ -888,15 +888,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+@@ -896,15 +896,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
  }
  EXPORT_SYMBOL_GPL(mt76_token_release);
  
@@ -506,6 +433,79 @@
 +	return r;
  }
  EXPORT_SYMBOL_GPL(mt76_rx_token_release);
+diff --git a/wed.c b/wed.c
+index 47c81a2..c03b52f 100644
+--- a/wed.c
++++ b/wed.c
+@@ -16,18 +16,18 @@ void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
+ 				sizeof(struct skb_shared_info));
+ 
+ 	for (i = 0; i < dev->rx_token_size; i++) {
+-		struct mt76_txwi_cache *t;
++		struct mt76_rxwi_cache *r;
+ 
+-		t = mt76_rx_token_release(dev, i);
+-		if (!t || !t->ptr)
++		r = mt76_rx_token_release(dev, i);
++		if (!r || !r->ptr)
+ 			continue;
+ 
+-		dma_unmap_single(dev->dma_dev, t->dma_addr,
++		dma_unmap_single(dev->dma_dev, r->dma_addr,
+ 				 wed->wlan.rx_size, DMA_FROM_DEVICE);
+-		__free_pages(virt_to_page(t->ptr), get_order(length));
+-		t->ptr = NULL;
++		__free_pages(virt_to_page(r->ptr), get_order(length));
++		r->ptr = NULL;
+ 
+-		mt76_put_rxwi(dev, t);
++		mt76_put_rxwi(dev, r);
+ 	}
+ 
+ 	mt76_free_pending_rxwi(dev);
+@@ -46,18 +46,18 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 				sizeof(struct skb_shared_info));
+ 
+ 	for (i = 0; i < size; i++) {
+-		struct mt76_txwi_cache *t = mt76_get_rxwi(dev);
++		struct mt76_rxwi_cache *r = mt76_get_rxwi(dev);
+ 		dma_addr_t phy_addr;
+ 		struct page *page;
+ 		int token;
+ 		void *ptr;
+ 
+-		if (!t)
++		if (!r)
+ 			goto unmap;
+ 
+ 		page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
+ 		if (!page) {
+-			mt76_put_rxwi(dev, t);
++			mt76_put_rxwi(dev, r);
+ 			goto unmap;
+ 		}
+ 
+@@ -67,17 +67,17 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 					  DMA_TO_DEVICE);
+ 		if (unlikely(dma_mapping_error(dev->dev, phy_addr))) {
+ 			__free_pages(page, get_order(length));
+-			mt76_put_rxwi(dev, t);
++			mt76_put_rxwi(dev, r);
+ 			goto unmap;
+ 		}
+ 
+ 		desc->buf0 = cpu_to_le32(phy_addr);
+-		token = mt76_rx_token_consume(dev, ptr, t, phy_addr);
++		token = mt76_rx_token_consume(dev, ptr, r, phy_addr);
+ 		if (token < 0) {
+ 			dma_unmap_single(dev->dma_dev, phy_addr,
+ 					 wed->wlan.rx_size, DMA_TO_DEVICE);
+ 			__free_pages(page, get_order(length));
+-			mt76_put_rxwi(dev, t);
++			mt76_put_rxwi(dev, r);
+ 			goto unmap;
+ 		}
+ 
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch b/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch
index 578f6c4..c5ed7a0 100644
--- a/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch
@@ -1,4 +1,4 @@
-From 78305a57eb61142d2dcabe1c733d9014792c56d1 Mon Sep 17 00:00:00 2001
+From 3fb67d2375966060b879d6435d089258a5f987b0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 11 Jan 2023 10:56:27 +0800
 Subject: [PATCH] wifi: mt76: add debugfs knob to show packet error rate
@@ -14,10 +14,10 @@
  6 files changed, 194 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 2b026f7..18488f9 100644
+index 5485719..3844e3b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -320,8 +320,10 @@ struct mt76_sta_stats {
+@@ -321,8 +321,10 @@ struct mt76_sta_stats {
  	u64 last_tx_bytes;
  	/* WED TX */
  	u32 tx_packets;		/* unit: MSDU */
@@ -29,10 +29,10 @@
  	u64 rx_bytes;
  	u32 rx_packets;
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ddcb2ea..ced784c 100644
+index f8f4eed..438e87f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1194,6 +1194,7 @@ enum {
+@@ -1200,6 +1200,7 @@ enum {
  	MCU_EXT_CMD_EDCA_UPDATE = 0x27,
  	MCU_EXT_CMD_DEV_INFO_UPDATE = 0x2A,
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
@@ -41,10 +41,10 @@
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
  	MCU_EXT_CMD_SET_FEATURE_CTRL = 0x38,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d059a03..12ead54 100644
+index 579c431..d5216b8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4287,6 +4287,114 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx)
+@@ -4550,6 +4550,114 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx)
  		return mt7915_mcu_get_tx_rate_v2(phy, wcidx);
  }
  
@@ -160,10 +160,10 @@
  				struct cfg80211_he_bss_color *he_bss_color)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 675b2cc..2cb8f72 100644
+index 52baaa7..ec7ad7d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -791,7 +791,8 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
+@@ -854,7 +854,8 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
  }
  
  enum {
@@ -173,7 +173,7 @@
  };
  
  #ifdef CONFIG_MTK_VENDOR
-@@ -1067,6 +1068,24 @@ struct mt7915_muru {
+@@ -1130,6 +1131,24 @@ struct mt7915_muru {
  /* DL&UL User config */
  #define MURU_USER_CNT                   BIT(4)
  
@@ -199,10 +199,10 @@
     CAPI_SU,
     CAPI_MU,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5be0844..aa8ed48 100644
+index f61aea2..929da03 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -732,6 +732,7 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -739,6 +739,7 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
  				     struct cfg80211_chan_def *chandef);
  int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wcid);
@@ -211,12 +211,12 @@
  int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
  int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 06f6383..3aa7c0e 100644
+index 4936c4b..6327ab8 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3966,6 +3966,66 @@ mt7915_thermal_recal_set(void *data, u64 val)
- DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_recal, NULL,
- 			 mt7915_thermal_recal_set, "%llu\n");
+@@ -4008,6 +4008,66 @@ mt7915_sr_scene_cond_show(struct seq_file *file, void *data)
+ 
+ DEFINE_SHOW_ATTRIBUTE(mt7915_sr_scene_cond);
  
 +static int mt7915_reset_counter(void *data, u64 val)
 +{
@@ -281,10 +281,10 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -4060,6 +4120,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- 	debugfs_create_file("sr_enable", 0200, dir, phy, &fops_sr_enable);
- 	debugfs_create_file("scs_enable", 0200, dir, phy, &fops_scs_enable);
+@@ -4105,6 +4165,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_file("thermal_recal", 0200, dir, dev, &fops_thermal_recal);
+ 	debugfs_create_file("sr_stats", 0400, dir, phy, &mt7915_sr_stats_fops);
+ 	debugfs_create_file("sr_scene_cond", 0400, dir, phy, &mt7915_sr_scene_cond_fops);
 +	debugfs_create_file("reset_counter", 0200, dir, dev, &fops_reset_counter);
 +	debugfs_create_devm_seqfile(dev->mt76.dev, "per", dir, mt7915_per_read);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch b/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
index 1513414..b46568b 100644
--- a/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
@@ -1,7 +1,7 @@
-From 5142b743b0fa3d2eca084469e2826778924808f4 Mon Sep 17 00:00:00 2001
+From 121430ff1e7bbfb0a4b5763275530a5cc8939634 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 6 Apr 2023 17:50:52 +0800
-Subject: [PATCH 65/76] wifi: mt76: mt7915: add ctxd support for mt7916
+Subject: [PATCH 2007/2012] wifi: mt76: mt7915: add ctxd support for mt7916
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 35 insertions(+)
 
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 17a3fa0..a0f393a 100644
+index 552410a..4f9f5a3 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -435,6 +435,26 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
diff --git a/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
index 852d5f9..47564fc 100644
--- a/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,19 +1,19 @@
-From 9e48b3a3d1ddfd625bedf7fdd7aac2121ba03e71 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Thu, 5 Jan 2023 16:43:57 +0800
-Subject: [PATCH 66/76] wifi: mt76: connac: wed: add wed rx copy skb
+From 7873df2f26b6b5b22f8f6f696f4830a5282f6621 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Sun, 4 Feb 2024 17:52:44 +0800
+Subject: [PATCH 2008/2012] wifi: mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c  | 71 ++++++++++++++++++++++++++++++++++++++++++++--------------
- mmio.c | 37 +++++++++++++++++++++---------
+ dma.c | 71 +++++++++++++++++++++++++++++++++++++++++++++--------------
+ wed.c | 37 ++++++++++++++++++++++---------
  2 files changed, 80 insertions(+), 28 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index cf6ca04..dfedbcd 100644
+index 53597b5..2f108de 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -227,10 +227,10 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -225,10 +225,10 @@ void mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
  
  static int
  mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
@@ -26,7 +26,7 @@
  	struct mt76_desc *desc;
  	int idx = q->head;
  	u32 buf1 = 0, ctrl;
-@@ -251,9 +251,11 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -249,9 +249,11 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
  #endif
  
  	if (mt76_queue_is_wed_rx(q)) {
@@ -41,7 +41,7 @@
  
  		rx_token = mt76_rx_token_consume(dev, data, rxwi, buf->addr);
  		if (rx_token < 0) {
-@@ -423,7 +425,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
+@@ -421,7 +423,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
  
  static void *
  mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -50,7 +50,7 @@
  {
  	struct mt76_queue_entry *e = &q->entry[idx];
  	struct mt76_desc *desc = &q->desc[idx];
-@@ -480,11 +482,44 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -478,11 +480,44 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
  
@@ -99,7 +99,7 @@
  		if (drop)
  			*drop |= !!(buf1 & MT_DMA_CTL_WO_DROP);
  	} else {
-@@ -521,7 +556,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+@@ -519,7 +554,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
  	q->tail = (q->tail + 1) % q->ndesc;
  	q->queued--;
  
@@ -108,7 +108,7 @@
  }
  
  static int
-@@ -688,7 +723,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -685,7 +720,7 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  done:
  		qbuf.len = len - offset;
  		qbuf.skip_unmap = false;
@@ -117,7 +117,7 @@
  			dma_unmap_single(dev->dma_dev, addr, len,
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
-@@ -864,12 +899,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -786,12 +821,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	spin_unlock_bh(&q->lock);
  
@@ -137,12 +137,12 @@
  }
  
  static void
-diff --git a/mmio.c b/mmio.c
-index edc3cac..cdd5595 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -89,12 +89,9 @@ EXPORT_SYMBOL_GPL(mt76_set_irq_mask);
- void mt76_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+diff --git a/wed.c b/wed.c
+index c03b52f..70e4057 100644
+--- a/wed.c
++++ b/wed.c
+@@ -9,12 +9,9 @@
+ void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
  {
  	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
 -	u32 length;
@@ -155,7 +155,7 @@
  	for (i = 0; i < dev->rx_token_size; i++) {
  		struct mt76_rxwi_cache *r;
  
-@@ -104,13 +101,33 @@ void mt76_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -24,13 +21,33 @@ void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
  
  		dma_unmap_single(dev->dma_dev, r->dma_addr,
  				 wed->wlan.rx_size, DMA_FROM_DEVICE);
@@ -188,9 +188,9 @@
 +	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
 +	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
  }
- EXPORT_SYMBOL_GPL(mt76_mmio_wed_release_rx_buf);
+ EXPORT_SYMBOL_GPL(mt76_wed_release_rx_buf);
  
-@@ -127,25 +144,23 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -48,25 +65,23 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  	for (i = 0; i < size; i++) {
  		struct mt76_rxwi_cache *r = mt76_get_rxwi(dev);
  		dma_addr_t phy_addr;
@@ -219,7 +219,7 @@
  			mt76_put_rxwi(dev, r);
  			goto unmap;
  		}
-@@ -155,7 +170,7 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -76,7 +91,7 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  		if (token < 0) {
  			dma_unmap_single(dev->dma_dev, phy_addr,
  					 wed->wlan.rx_size, DMA_TO_DEVICE);
diff --git a/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch b/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch
index 367f32d..257facf 100644
--- a/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch
@@ -1,7 +1,7 @@
-From 114a4a301cdb7f1d6d02d8f9b04de1ec5b597c6b Mon Sep 17 00:00:00 2001
+From ad0972dfe60c53c93dab73fd139e149a2e0ca66a Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 8 Sep 2023 18:26:21 +0800
-Subject: [PATCH 67/76] wifi: mt76: mt7915: enable wa log to uart
+Subject: [PATCH 2009/2012] wifi: mt76: mt7915: enable wa log to uart
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index ca42b69..fd35b57 100644
+index d1e33ef..df110b0 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
-@@ -988,7 +988,11 @@ mt7915_fw_debug_wa_set(void *data, u64 val)
+@@ -940,7 +940,11 @@ mt7915_fw_debug_wa_set(void *data, u64 val)
  	struct mt7915_dev *dev = data;
  	int ret;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch b/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch
index 31077d2..942738c 100644
--- a/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch
@@ -1,7 +1,7 @@
-From ef41f8efe719d69b5c7e5e6bb1bca9544762d647 Mon Sep 17 00:00:00 2001
+From c93ac32c9f173fae7d662f7ff8d51667e4aff89b Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 8 Sep 2023 18:29:32 +0800
-Subject: [PATCH 68/76] wifi: mt76: mt7915: add error message when driver
+Subject: [PATCH 2010/2012] wifi: mt76: mt7915: add error message when driver
  receive invalid token id
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 8aeee3c..a5a5ebd 100644
+index 53a8f97..882d812 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -999,6 +999,12 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
diff --git a/recipes-wifi/linux-mt76/files/patches/2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch b/recipes-wifi/linux-mt76/files/patches/2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch
index a81b578..12322c8 100644
--- a/recipes-wifi/linux-mt76/files/patches/2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch
@@ -1,44 +1,22 @@
-From 7c1d1577b0df8af83a6d3db7aa006cb00fef321c Mon Sep 17 00:00:00 2001
+From cea4cefe43864504c91e9c0e699237fb55b62208 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Mon, 11 Sep 2023 17:57:32 +0800
-Subject: [PATCH 69/76] wifi: mt76: mt7915: wed: change wed token init size to
- adapt wed version
+Subject: [PATCH 2011/2012] wifi: mt76: mt7915: wed: change wed token init size
+ to adapt wed version
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
- mmio.c          |  4 ++--
  mt76.h          |  2 ++
  mt7915/mac.c    | 10 ++++++++--
  mt7915/mcu.c    |  7 +++++--
  mt7915/mmio.c   |  9 ++++++---
  mt7915/mt7915.h |  4 +++-
  tx.c            | 26 ++++++++------------------
+ wed.c           |  4 ++--
  7 files changed, 34 insertions(+), 28 deletions(-)
 
-diff --git a/mmio.c b/mmio.c
-index cdd5595..b6617f7 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -197,7 +197,7 @@ int mt76_mmio_wed_offload_enable(struct mtk_wed_device *wed)
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
- 
- 	spin_lock_bh(&dev->token_lock);
--	dev->token_size = wed->wlan.token_start;
-+	dev->token_size = MT76_WED_SW_TOKEN_SIZE;
- 	spin_unlock_bh(&dev->token_lock);
- 
- 	return !wait_event_timeout(dev->tx_wait, !dev->wed_token_count, HZ);
-@@ -209,7 +209,7 @@ void mt76_mmio_wed_offload_disable(struct mtk_wed_device *wed)
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
- 
- 	spin_lock_bh(&dev->token_lock);
--	dev->token_size = wed->wlan.token_start;
-+	dev->token_size = MT76_WED_SW_TOKEN_SIZE;
- 	spin_unlock_bh(&dev->token_lock);
- }
- EXPORT_SYMBOL_GPL(mt76_mmio_wed_offload_disable);
 diff --git a/mt76.h b/mt76.h
-index f5776ab..5fea9a5 100644
+index 3844e3b..2adfa94 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -29,6 +29,8 @@
@@ -51,7 +29,7 @@
  #define MT_QFLAG_WED_TYPE	GENMASK(4, 2)
  #define MT_QFLAG_WED		BIT(5)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a5a5ebd..fdafaf3 100644
+index 882d812..51e2f24 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -932,7 +932,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
@@ -86,10 +64,10 @@
  					msdu);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 19d5aa5..d0f4bf6 100644
+index 3e0acc0..c052774 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2318,6 +2318,9 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2408,6 +2408,9 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  static int mt7915_red_set_watermark(struct mt7915_dev *dev)
  {
  #define RED_GLOBAL_TOKEN_WATERMARK 2
@@ -99,7 +77,7 @@
  	struct {
  		__le32 args[3];
  		u8 cmd;
-@@ -2331,8 +2334,8 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
+@@ -2421,8 +2424,8 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
  		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
  		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
  		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
@@ -111,10 +89,10 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c8258f1..74cf4ad 100644
+index 3391a94..6309dd9 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -699,11 +699,14 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -695,11 +695,14 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
  		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
  	}
@@ -131,7 +109,7 @@
  	wed->wlan.wcid_512 = !is_mt7915(&dev->mt76);
  
  	wed->wlan.rx_nbuf = 65536;
-@@ -736,7 +739,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -732,7 +735,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
@@ -141,7 +119,7 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 79e0fae..057b0f1 100644
+index 0c1ada2..f95ed89 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,7 +62,9 @@
@@ -156,10 +134,10 @@
  #define MT7915_RX_TOKEN_SIZE		4096
  
 diff --git a/tx.c b/tx.c
-index e290aef..96f9009 100644
+index ba7c13c..b1d8b32 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -818,20 +818,18 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
+@@ -826,20 +826,18 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
  
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  {
@@ -187,7 +165,7 @@
  	if (dev->token_count >= dev->token_size - MT76_TOKEN_FREE_THR)
  		__mt76_set_tx_blocked(dev, true);
  
-@@ -867,17 +865,9 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+@@ -875,17 +873,9 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
  	spin_lock_bh(&dev->token_lock);
  
  	txwi = idr_remove(&dev->token, token);
@@ -206,6 +184,28 @@
  	if (dev->token_count < dev->token_size - MT76_TOKEN_FREE_THR &&
  	    dev->phy.q_tx[0]->blocked)
  		*wake = true;
+diff --git a/wed.c b/wed.c
+index 70e4057..5ed681e 100644
+--- a/wed.c
++++ b/wed.c
+@@ -118,7 +118,7 @@ int mt76_wed_offload_enable(struct mtk_wed_device *wed)
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ 
+ 	spin_lock_bh(&dev->token_lock);
+-	dev->token_size = wed->wlan.token_start;
++	dev->token_size = MT76_WED_SW_TOKEN_SIZE;
+ 	spin_unlock_bh(&dev->token_lock);
+ 
+ 	return !wait_event_timeout(dev->tx_wait, !dev->wed_token_count, HZ);
+@@ -202,7 +202,7 @@ void mt76_wed_offload_disable(struct mtk_wed_device *wed)
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ 
+ 	spin_lock_bh(&dev->token_lock);
+-	dev->token_size = wed->wlan.token_start;
++	dev->token_size = MT76_WED_SW_TOKEN_SIZE;
+ 	spin_unlock_bh(&dev->token_lock);
+ }
+ EXPORT_SYMBOL_GPL(mt76_wed_offload_disable);
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch b/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
index 3d4d7f6..afb19e1 100644
--- a/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
@@ -1,7 +1,7 @@
-From 8fe16f6826223482cd87c672b6015463cfdc4ba8 Mon Sep 17 00:00:00 2001
+From 7eabaa784be431f18204f1e2a10ed6e7c851149d Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 1 Nov 2023 07:50:08 +0800
-Subject: [PATCH 70/76] wifi: mt76: mt7915: wed: add per bss statistic info
+Subject: [PATCH 2012/2012] wifi: mt76: mt7915: wed: add per bss statistic info
 
 ---
  mt7915/init.c        |  1 +
@@ -14,10 +14,10 @@
  7 files changed, 78 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 14bf6ef..978e585 100644
+index b62521f..9ab6752 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -397,6 +397,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+@@ -400,6 +400,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_DISCOVERY);
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
@@ -26,7 +26,7 @@
  	if (!is_mt7915(&dev->mt76))
  		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STA_TX_PWR);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index fdafaf3..e452337 100644
+index 51e2f24..7b3963f 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -1067,6 +1067,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
@@ -44,7 +44,7 @@
 +	last_bytes = wcid->stats.tx_bytes;
  	msta = container_of(wcid, struct mt7915_sta, wcid);
  
- 	if (pid == MT_PACKET_ID_WED)
+ 	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == MT_TXS_PPDU_FMT)
 @@ -1095,6 +1097,24 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  	if (!wcid->sta)
  		goto out;
@@ -70,7 +70,7 @@
  	spin_lock_bh(&dev->mt76.sta_poll_lock);
  	if (list_empty(&msta->wcid.poll_list))
  		list_add_tail(&msta->wcid.poll_list, &dev->mt76.sta_poll_list);
-@@ -2092,6 +2112,7 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+@@ -2088,6 +2108,7 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
  		spin_unlock_bh(&phy->stats_lock);
  
  		mt7915_mcu_get_tx_rate(phy, sta->wcid.idx);
@@ -79,10 +79,10 @@
  		spin_lock_bh(&phy->stats_lock);
  	}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 92750df..02682ce 100644
+index 374526b..c4e0dbc 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1200,7 +1200,7 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1220,7 +1220,7 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
  
@@ -92,10 +92,10 @@
  			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
  		}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d0f4bf6..3ff53db 100644
+index c052774..50db7f2 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4472,7 +4472,8 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -4645,7 +4645,8 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -105,7 +105,7 @@
  {
  	struct {
  		__le32 cmd;
-@@ -4516,11 +4517,34 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
+@@ -4707,11 +4708,34 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
  	rcu_read_lock();
  
  	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
@@ -143,10 +143,10 @@
  out:
  	dev_kfree_skb(skb);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 74cf4ad..f4ba115 100644
+index 6309dd9..142f308 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -596,7 +596,7 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
+@@ -592,7 +592,7 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
  
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  
@@ -155,7 +155,7 @@
  		return;
  
  	rcu_read_lock();
-@@ -611,8 +611,32 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
+@@ -607,8 +607,32 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
  		wcid->stats.rx_packets += le32_to_cpu(stats->rx_pkt_cnt);
  		wcid->stats.rx_errors += le32_to_cpu(stats->rx_err_cnt);
  		wcid->stats.rx_drops += le32_to_cpu(stats->rx_drop_cnt);
@@ -189,10 +189,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 057b0f1..a61651a 100644
+index f95ed89..aa02b26 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -695,7 +695,8 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -737,7 +737,8 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta, struct rate_info *rate);
  int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
  				     struct cfg80211_chan_def *chandef);
@@ -203,10 +203,10 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
  int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 367f41d..a5c6d35 100644
+index f551149..7078da2 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3835,7 +3835,7 @@ static int mt7915_reset_counter(void *data, u64 val)
+@@ -3973,7 +3973,7 @@ static int mt7915_reset_counter(void *data, u64 val)
  	struct mt76_wcid *wcid;
  
  	/* Clear the firmware counters */
diff --git a/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch b/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
deleted file mode 100644
index cfa8066..0000000
--- a/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 877b1fb4df6f2302b0eecbaf4311a1c432ee3c3a Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 23 Oct 2023 10:25:13 +0800
-Subject: [PATCH 71/76] Revert "wifi: mt76: mt7921: fix the wrong rate selected
- in fw for the chanctx driver"
-
-This reverts commit 9fc37b0ac5467cfe5e3d2ad8a29e9a7646ece2be.
----
- mt76_connac_mcu.c | 9 ++-------
- 1 file changed, 2 insertions(+), 7 deletions(-)
-
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 4a7b694..e359388 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -847,9 +847,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
- 			     struct ieee80211_vif *vif,
- 			     u8 rcpi, u8 sta_state)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = mvif->ctx ?
--					    &mvif->ctx->def : &mphy->chandef;
-+	struct cfg80211_chan_def *chandef = &mphy->chandef;
- 	enum nl80211_band band = chandef->chan->band;
- 	struct mt76_dev *dev = mphy->dev;
- 	struct sta_rec_ra_info *ra_info;
-@@ -1355,10 +1353,7 @@ EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
- const struct ieee80211_sta_he_cap *
- mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = mvif->ctx ?
--					    &mvif->ctx->def : &phy->chandef;
--	enum nl80211_band band = chandef->chan->band;
-+	enum nl80211_band band = phy->chandef.chan->band;
- 	struct ieee80211_supported_band *sband;
- 
- 	sband = phy->hw->wiphy->bands[band];
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch b/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
deleted file mode 100644
index aae4f6c..0000000
--- a/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 371a05c81b4ae064bcf3b5409839048ffc45f447 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 23 Oct 2023 10:25:18 +0800
-Subject: [PATCH 72/76] Revert "wifi: mt76: mt7921: fix the wrong rate pickup
- for the chanctx driver"
-
-This reverts commit 66d5694e1898c5584a83c60876bec16909ebe2b0.
----
- mac80211.c        | 9 ++-------
- mt76.h            | 3 +--
- mt76_connac_mac.c | 7 ++-----
- 3 files changed, 5 insertions(+), 14 deletions(-)
-
-diff --git a/mac80211.c b/mac80211.c
-index 013298e..09c9eb2 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -1728,16 +1728,11 @@ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
- }
- EXPORT_SYMBOL_GPL(mt76_init_queue);
- 
--u16 mt76_calculate_default_rate(struct mt76_phy *phy,
--				struct ieee80211_vif *vif, int rateidx)
-+u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = mvif->ctx ?
--					    &mvif->ctx->def :
--					    &phy->chandef;
- 	int offset = 0;
- 
--	if (chandef->chan->band != NL80211_BAND_2GHZ)
-+	if (phy->chandef.chan->band != NL80211_BAND_2GHZ)
- 		offset = 4;
- 
- 	/* pick the lowest rate for hidden nodes */
-diff --git a/mt76.h b/mt76.h
-index 5fea9a5..d082b24 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -1262,8 +1262,7 @@ bool mt76_check_bin_file_mode(struct mt76_dev *dev);
- struct mt76_queue *
- mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
- 		int ring_base, void *wed, u32 flags);
--u16 mt76_calculate_default_rate(struct mt76_phy *phy,
--				struct ieee80211_vif *vif, int rateidx);
-+u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx);
- static inline int mt76_init_tx_queue(struct mt76_phy *phy, int qid, int idx,
- 				     int n_desc, int ring_base, void *wed,
- 				     u32 flags)
-diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 362d937..83d0dd2 100644
---- a/mt76_connac_mac.c
-+++ b/mt76_connac_mac.c
-@@ -294,10 +294,7 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
- 				 struct ieee80211_vif *vif,
- 				 bool beacon, bool mcast)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = mvif->ctx ?
--					    &mvif->ctx->def : &mphy->chandef;
--	u8 nss = 0, mode = 0, band = chandef->chan->band;
-+	u8 nss = 0, mode = 0, band = mphy->chandef.chan->band;
- 	int rateidx = 0, mcast_rate;
- 
- 	if (!vif)
-@@ -330,7 +327,7 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
- 		rateidx = ffs(vif->bss_conf.basic_rates) - 1;
- 
- legacy:
--	rateidx = mt76_calculate_default_rate(mphy, vif, rateidx);
-+	rateidx = mt76_calculate_default_rate(mphy, rateidx);
- 	mode = rateidx >> 8;
- 	rateidx &= GENMASK(7, 0);
- out:
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch b/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
deleted file mode 100644
index 474ef7b..0000000
--- a/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From c5df80abbbbcfe8b3845a03ca48fc7745ba0d972 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 23 Oct 2023 10:25:25 +0800
-Subject: [PATCH 73/76] Revert "wifi: mt76: move struct ieee80211_chanctx_conf
- up to struct mt76_vif"
-
-This reverts commit d1881b1b2bf6018d1cb1b91e4301a60021cacaa3.
----
- mt76.h        |  1 -
- mt7921/main.c | 12 ++++++------
- mt792x.h      |  1 +
- mt792x_core.c |  4 ++--
- 4 files changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index d082b24..699d84e 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -836,7 +836,6 @@ struct mt76_vif {
- 	u8 basic_rates_idx;
- 	u8 mcast_rates_idx;
- 	u8 beacon_rates_idx;
--	struct ieee80211_chanctx_conf *ctx;
- };
- 
- struct mt76_phy {
-diff --git a/mt7921/main.c b/mt7921/main.c
-index aa0cd78..ffcad1e 100644
---- a/mt7921/main.c
-+++ b/mt7921/main.c
-@@ -801,7 +801,7 @@ void mt7921_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 
- 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls)
- 		mt76_connac_mcu_uni_add_bss(&dev->mphy, vif, &mvif->sta.wcid,
--					    true, mvif->mt76.ctx);
-+					    true, mvif->ctx);
- 
- 	ewma_avg_signal_init(&msta->avg_ack_signal);
- 
-@@ -836,7 +836,7 @@ void mt7921_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 		if (!sta->tdls)
- 			mt76_connac_mcu_uni_add_bss(&dev->mphy, vif,
- 						    &mvif->sta.wcid, false,
--						    mvif->mt76.ctx);
-+						    mvif->ctx);
- 	}
- 
- 	spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -1255,7 +1255,7 @@ mt7921_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	mt792x_mutex_acquire(dev);
- 
- 	err = mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
--					  true, mvif->mt76.ctx);
-+					  true, mvif->ctx);
- 	if (err)
- 		goto out;
- 
-@@ -1287,7 +1287,7 @@ mt7921_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		goto out;
- 
- 	mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid, false,
--				    mvif->mt76.ctx);
-+				    mvif->ctx);
- 
- out:
- 	mt792x_mutex_release(dev);
-@@ -1312,7 +1312,7 @@ static void mt7921_ctx_iter(void *priv, u8 *mac,
- 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
- 	struct ieee80211_chanctx_conf *ctx = priv;
- 
--	if (ctx != mvif->mt76.ctx)
-+	if (ctx != mvif->ctx)
- 		return;
- 
- 	if (vif->type == NL80211_IFTYPE_MONITOR)
-@@ -1345,7 +1345,7 @@ static void mt7921_mgd_prepare_tx(struct ieee80211_hw *hw,
- 		       jiffies_to_msecs(HZ);
- 
- 	mt792x_mutex_acquire(dev);
--	mt7921_set_roc(mvif->phy, mvif, mvif->mt76.ctx->def.chan, duration,
-+	mt7921_set_roc(mvif->phy, mvif, mvif->ctx->def.chan, duration,
- 		       MT7921_ROC_REQ_JOIN);
- 	mt792x_mutex_release(dev);
- }
-diff --git a/mt792x.h b/mt792x.h
-index 3c897b3..558753f 100644
---- a/mt792x.h
-+++ b/mt792x.h
-@@ -106,6 +106,7 @@ struct mt792x_vif {
- 	struct ewma_rssi rssi;
- 
- 	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
-+	struct ieee80211_chanctx_conf *ctx;
- };
- 
- struct mt792x_phy {
-diff --git a/mt792x_core.c b/mt792x_core.c
-index 502be22..1228a8a 100644
---- a/mt792x_core.c
-+++ b/mt792x_core.c
-@@ -265,7 +265,7 @@ int mt792x_assign_vif_chanctx(struct ieee80211_hw *hw,
- 	struct mt792x_dev *dev = mt792x_hw_dev(hw);
- 
- 	mutex_lock(&dev->mt76.mutex);
--	mvif->mt76.ctx = ctx;
-+	mvif->ctx = ctx;
- 	mutex_unlock(&dev->mt76.mutex);
- 
- 	return 0;
-@@ -281,7 +281,7 @@ void mt792x_unassign_vif_chanctx(struct ieee80211_hw *hw,
- 	struct mt792x_dev *dev = mt792x_hw_dev(hw);
- 
- 	mutex_lock(&dev->mt76.mutex);
--	mvif->mt76.ctx = NULL;
-+	mvif->ctx = NULL;
- 	mutex_unlock(&dev->mt76.mutex);
- }
- EXPORT_SYMBOL_GPL(mt792x_unassign_vif_chanctx);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch b/recipes-wifi/linux-mt76/files/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
deleted file mode 100644
index 10eeb5e..0000000
--- a/recipes-wifi/linux-mt76/files/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
+++ /dev/null
@@ -1,256 +0,0 @@
-From 32681b271d223bd7646372cae382c11d8784797b Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 23 Oct 2023 10:26:01 +0800
-Subject: [PATCH 74/76] Revert "wifi: mt76: fix race condition related to
- checking tx queue fill status"
-
-This reverts commit f1e1e67d97d1e9a8bb01b59ab20c45ebc985a958.
----
- mac80211.c |  27 --------------
- mt76.h     |   5 ---
- tx.c       | 108 ++++++++++-------------------------------------------
- 3 files changed, 20 insertions(+), 120 deletions(-)
-
-diff --git a/mac80211.c b/mac80211.c
-index 09c9eb2..5e01353 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -438,9 +438,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
- 	struct mt76_dev *dev = phy->dev;
- 	struct wiphy *wiphy = hw->wiphy;
- 
--	INIT_LIST_HEAD(&phy->tx_list);
--	spin_lock_init(&phy->tx_lock);
--
- 	SET_IEEE80211_DEV(hw, dev->dev);
- 	SET_IEEE80211_PERM_ADDR(hw, phy->macaddr);
- 
-@@ -673,7 +670,6 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
- 	int ret;
- 
- 	dev_set_drvdata(dev->dev, dev);
--	mt76_wcid_init(&dev->global_wcid);
- 	ret = mt76_phy_init(phy, hw);
- 	if (ret)
- 		return ret;
-@@ -729,7 +725,6 @@ void mt76_unregister_device(struct mt76_dev *dev)
- 	if (IS_ENABLED(CONFIG_MT76_LEDS))
- 		mt76_led_cleanup(&dev->phy);
- 	mt76_tx_status_check(dev, true);
--	mt76_wcid_cleanup(dev, &dev->global_wcid);
- 	ieee80211_unregister_hw(hw);
- }
- EXPORT_SYMBOL_GPL(mt76_unregister_device);
-@@ -1477,9 +1472,6 @@ EXPORT_SYMBOL_GPL(mt76_sta_pre_rcu_remove);
- 
- void mt76_wcid_init(struct mt76_wcid *wcid)
- {
--	INIT_LIST_HEAD(&wcid->tx_list);
--	skb_queue_head_init(&wcid->tx_pending);
--
- 	INIT_LIST_HEAD(&wcid->list);
- 	idr_init(&wcid->pktid);
- }
-@@ -1487,32 +1479,13 @@ EXPORT_SYMBOL_GPL(mt76_wcid_init);
- 
- void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
- {
--	struct mt76_phy *phy = dev->phys[wcid->phy_idx];
--	struct ieee80211_hw *hw;
- 	struct sk_buff_head list;
--	struct sk_buff *skb;
- 
- 	mt76_tx_status_lock(dev, &list);
- 	mt76_tx_status_skb_get(dev, wcid, -1, &list);
- 	mt76_tx_status_unlock(dev, &list);
- 
- 	idr_destroy(&wcid->pktid);
--
--	spin_lock_bh(&phy->tx_lock);
--
--	if (!list_empty(&wcid->tx_list))
--		list_del_init(&wcid->tx_list);
--
--	spin_lock(&wcid->tx_pending.lock);
--	skb_queue_splice_tail_init(&wcid->tx_pending, &list);
--	spin_unlock(&wcid->tx_pending.lock);
--
--	spin_unlock_bh(&phy->tx_lock);
--
--	while ((skb = __skb_dequeue(&list)) != NULL) {
--		hw = mt76_tx_status_get_hw(dev, skb);
--		ieee80211_free_txskb(hw, skb);
--	}
- }
- EXPORT_SYMBOL_GPL(mt76_wcid_cleanup);
- 
-diff --git a/mt76.h b/mt76.h
-index 699d84e..70801f7 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -380,9 +380,6 @@ struct mt76_wcid {
- 	u32 tx_info;
- 	bool sw_iv;
- 
--	struct list_head tx_list;
--	struct sk_buff_head tx_pending;
--
- 	struct list_head list;
- 	struct idr pktid;
- 
-@@ -846,8 +843,6 @@ struct mt76_phy {
- 	unsigned long state;
- 	u8 band_idx;
- 
--	spinlock_t tx_lock;
--	struct list_head tx_list;
- 	struct mt76_queue *q_tx[__MT_TXQ_MAX];
- 
- 	struct cfg80211_chan_def chandef;
-diff --git a/tx.c b/tx.c
-index 96f9009..c88fb29 100644
---- a/tx.c
-+++ b/tx.c
-@@ -328,32 +328,40 @@ void
- mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
- 	struct mt76_wcid *wcid, struct sk_buff *skb)
- {
-+	struct mt76_dev *dev = phy->dev;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-+	struct mt76_queue *q;
-+	int qid = skb_get_queue_mapping(skb);
- 
- 	if (mt76_testmode_enabled(phy)) {
- 		ieee80211_free_txskb(phy->hw, skb);
- 		return;
- 	}
- 
--	if (WARN_ON(skb_get_queue_mapping(skb) >= MT_TXQ_PSD))
--		skb_set_queue_mapping(skb, MT_TXQ_BE);
-+	if (WARN_ON(qid >= MT_TXQ_PSD)) {
-+		qid = MT_TXQ_BE;
-+		skb_set_queue_mapping(skb, qid);
-+	}
-+
-+	if ((dev->drv->drv_flags & MT_DRV_HW_MGMT_TXQ) &&
-+	    !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
-+	    !ieee80211_is_data(hdr->frame_control) &&
-+	    !ieee80211_is_bufferable_mmpdu(skb)) {
-+		qid = MT_TXQ_PSD;
-+	}
- 
- 	if (wcid && !(wcid->tx_info & MT_WCID_TX_INFO_SET))
- 		ieee80211_get_tx_rates(info->control.vif, sta, skb,
- 				       info->control.rates, 1);
- 
- 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->band_idx);
-+	q = phy->q_tx[qid];
- 
--	spin_lock_bh(&wcid->tx_pending.lock);
--	__skb_queue_tail(&wcid->tx_pending, skb);
--	spin_unlock_bh(&wcid->tx_pending.lock);
--
--	spin_lock_bh(&phy->tx_lock);
--	if (list_empty(&wcid->tx_list))
--		list_add_tail(&wcid->tx_list, &phy->tx_list);
--	spin_unlock_bh(&phy->tx_lock);
--
--	mt76_worker_schedule(&phy->dev->tx_worker);
-+	spin_lock_bh(&q->lock);
-+	__mt76_tx_queue_skb(phy, qid, skb, wcid, sta, NULL);
-+	dev->queue_ops->kick(dev, q);
-+	spin_unlock_bh(&q->lock);
- }
- EXPORT_SYMBOL_GPL(mt76_tx);
- 
-@@ -584,86 +592,10 @@ void mt76_txq_schedule(struct mt76_phy *phy, enum mt76_txq_id qid)
- }
- EXPORT_SYMBOL_GPL(mt76_txq_schedule);
- 
--static int
--mt76_txq_schedule_pending_wcid(struct mt76_phy *phy, struct mt76_wcid *wcid)
--{
--	struct mt76_dev *dev = phy->dev;
--	struct ieee80211_sta *sta;
--	struct mt76_queue *q;
--	struct sk_buff *skb;
--	int ret = 0;
--
--	spin_lock(&wcid->tx_pending.lock);
--	while ((skb = skb_peek(&wcid->tx_pending)) != NULL) {
--		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
--		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--		int qid = skb_get_queue_mapping(skb);
--
--		if ((dev->drv->drv_flags & MT_DRV_HW_MGMT_TXQ) &&
--		    !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
--		    !ieee80211_is_data(hdr->frame_control) &&
--		    !ieee80211_is_bufferable_mmpdu(skb))
--			qid = MT_TXQ_PSD;
--
--		q = phy->q_tx[qid];
--		if (mt76_txq_stopped(q)) {
--			ret = -1;
--			break;
--		}
--
--		__skb_unlink(skb, &wcid->tx_pending);
--		spin_unlock(&wcid->tx_pending.lock);
--
--		sta = wcid_to_sta(wcid);
--		spin_lock(&q->lock);
--		__mt76_tx_queue_skb(phy, qid, skb, wcid, sta, NULL);
--		dev->queue_ops->kick(dev, q);
--		spin_unlock(&q->lock);
--
--		spin_lock(&wcid->tx_pending.lock);
--	}
--	spin_unlock(&wcid->tx_pending.lock);
--
--	return ret;
--}
--
--static void mt76_txq_schedule_pending(struct mt76_phy *phy)
--{
--	if (list_empty(&phy->tx_list))
--		return;
--
--	local_bh_disable();
--	rcu_read_lock();
--
--	spin_lock(&phy->tx_lock);
--	while (!list_empty(&phy->tx_list)) {
--		struct mt76_wcid *wcid = NULL;
--		int ret;
--
--		wcid = list_first_entry(&phy->tx_list, struct mt76_wcid, tx_list);
--		list_del_init(&wcid->tx_list);
--
--		spin_unlock(&phy->tx_lock);
--		ret = mt76_txq_schedule_pending_wcid(phy, wcid);
--		spin_lock(&phy->tx_lock);
--
--		if (ret) {
--			if (list_empty(&wcid->tx_list))
--				list_add_tail(&wcid->tx_list, &phy->tx_list);
--			break;
--		}
--	}
--	spin_unlock(&phy->tx_lock);
--
--	rcu_read_unlock();
--	local_bh_enable();
--}
--
- void mt76_txq_schedule_all(struct mt76_phy *phy)
- {
- 	int i;
- 
--	mt76_txq_schedule_pending(phy);
- 	for (i = 0; i <= MT_TXQ_BK; i++)
- 		mt76_txq_schedule(phy, i);
- }
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/2999-wifi-mt76-mt7915-support-backaward-compatiable.patch b/recipes-wifi/linux-mt76/files/patches/2999-wifi-mt76-mt7915-support-backaward-compatiable.patch
index 933e475..a63471d 100644
--- a/recipes-wifi/linux-mt76/files/patches/2999-wifi-mt76-mt7915-support-backaward-compatiable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2999-wifi-mt76-mt7915-support-backaward-compatiable.patch
@@ -1,18 +1,26 @@
-From d862aa94954361f72187565f0835a6bd025d3b7a Mon Sep 17 00:00:00 2001
+From 8e71bf60aeb05d38f45e680d55ffdb894f8af4bc Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Mon, 11 Dec 2023 19:21:16 +0800
-Subject: [PATCH 75/76] wifi: mt76: mt7915: support backaward compatiable
+Subject: [PATCH] wifi: mt76: mt7915: support backaward compatiable
 
 ---
- dma.c  | 20 --------------------
- mmio.c |  2 +-
- 2 files changed, 1 insertion(+), 21 deletions(-)
+ wed.c | 22 +---------------------
+ 1 file changed, 1 insertion(+), 21 deletions(-)
 
-diff --git a/dma.c b/dma.c
-index dfedbcd..174ac89 100644
---- a/dma.c
-+++ b/dma.c
-@@ -781,26 +781,6 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+diff --git a/wed.c b/wed.c
+index 5ed681e..2d6a944 100644
+--- a/wed.c
++++ b/wed.c
+@@ -55,7 +55,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_release_rx_buf);
+ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ {
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+-	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
++	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
+ 	u32 length;
+ 	int i;
+ 
+@@ -166,26 +166,6 @@ int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  		if (!ret)
  			q->wed_regs = q->wed->rx_ring[ring].reg_base;
  		break;
@@ -25,7 +33,7 @@
 -		break;
 -	case MT76_WED_RRO_Q_MSDU_PG:
 -		q->flags &= ~MT_QFLAG_WED;
--		__mt76_dma_queue_reset(dev, q, false);
+-		__mt76_dma_queue_reset(dev, q);
 -		mtk_wed_device_msdu_pg_rx_ring_setup(q->wed, ring, q->regs);
 -		q->head = q->ndesc - 1;
 -		q->queued = q->head;
@@ -39,19 +47,6 @@
  	default:
  		ret = -EINVAL;
  		break;
-diff --git a/mmio.c b/mmio.c
-index b6617f7..f4d0142 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -134,7 +134,7 @@ EXPORT_SYMBOL_GPL(mt76_mmio_wed_release_rx_buf);
- u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- {
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
--	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
-+	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
- 	u32 length;
- 	int i;
- 
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
index 3946fb9..29d5c81 100644
--- a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,13 +1,12 @@
-From f399cbeaea461c522df665bea9f46b927eb2b691 Mon Sep 17 00:00:00 2001
+From 9457a43b37b21a14e19fbfc2833f891cb3456c60 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 5 Apr 2023 08:29:19 +0800
-Subject: [PATCH 76/76] mt76: revert for backports-5.15 wireless stack
+Subject: [PATCH] mt76: revert for backports-5.15 wireless stack
 
 wifi: mt76: mt7915: add support for he ldpc control from hostapd
 ---
  dma.c             |   2 +-
  mac80211.c        |  15 +--
- mmio.c            |   1 +
  mt7615/dma.c      |   4 +-
  mt7615/main.c     |   6 +-
  mt7615/mcu.c      |   8 +-
@@ -21,13 +20,14 @@
  mt7915/mcu.c      | 246 ++++++++++++++++++++++++++++++----------------
  mt7915/testmode.c |   8 +-
  tx.c              |  22 ++---
+ wed.c             |   1 +
  16 files changed, 259 insertions(+), 225 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 174ac89..34b8a5c 100644
+index 2f108de..6ec0715 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -1071,7 +1071,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -1013,7 +1013,7 @@ mt76_dma_init(struct mt76_dev *dev,
  	init_completion(&dev->mmio.wed_reset_complete);
  
  	mt76_for_each_q_rx(dev, i) {
@@ -37,10 +37,10 @@
  		napi_enable(&dev->napi[i]);
  	}
 diff --git a/mac80211.c b/mac80211.c
-index 5e01353..5bf918b 100644
+index 225b290..54e0c8a 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1053,14 +1053,9 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1058,14 +1058,9 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  	status->enc_flags = mstat.enc_flags;
  	status->encoding = mstat.encoding;
  	status->bw = mstat.bw;
@@ -58,7 +58,7 @@
  	status->rate_idx = mstat.rate_idx;
  	status->nss = mstat.nss;
  	status->band = mstat.band;
-@@ -1558,7 +1553,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
+@@ -1585,7 +1580,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
  static void
  __mt76_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -67,7 +67,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -1580,7 +1575,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1607,7 +1602,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct mt76_dev *dev = priv;
  
@@ -76,18 +76,6 @@
  		return;
  
  	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
-diff --git a/mmio.c b/mmio.c
-index f4d0142..04c4988 100644
---- a/mmio.c
-+++ b/mmio.c
-@@ -159,6 +159,7 @@ u32 mt76_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 		phy_addr = dma_map_single(dev->dma_dev, ptr,
- 					  wed->wlan.rx_size,
- 					  DMA_TO_DEVICE);
-+
- 		if (unlikely(dma_mapping_error(dev->dev, phy_addr))) {
- 			skb_free_frag(ptr);
- 			mt76_put_rxwi(dev, r);
 diff --git a/mt7615/dma.c b/mt7615/dma.c
 index e7135b2..6767c39 100644
 --- a/mt7615/dma.c
@@ -175,10 +163,10 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 83d0dd2..74a65df 100644
+index d41f004..abb95b3 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -1111,7 +1111,7 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -1114,7 +1114,7 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  	u32 val;
  
  	if (!sta ||
@@ -188,7 +176,7 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index e359388..5bf5fa1 100644
+index e23dd77..e6c0f51 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -199,7 +199,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
@@ -200,7 +188,7 @@
  	};
  
  	if (vif->type != NL80211_IFTYPE_STATION)
-@@ -411,7 +411,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -414,7 +414,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  		else
  			conn_type = CONNECTION_INFRA_AP;
  		basic->conn_type = cpu_to_le32(conn_type);
@@ -209,7 +197,7 @@
  		break;
  	case NL80211_IFTYPE_ADHOC:
  		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
-@@ -555,7 +555,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -558,7 +558,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  
  	if (sta) {
  		if (vif->type == NL80211_IFTYPE_STATION)
@@ -218,7 +206,7 @@
  		else
  			generic->partial_aid = cpu_to_le16(sta->aid);
  		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
-@@ -604,14 +604,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -607,14 +607,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  	    vif->type != NL80211_IFTYPE_STATION)
  		return;
  
@@ -235,7 +223,7 @@
  			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
  
  	wcid->amsdu = true;
-@@ -622,7 +622,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -625,7 +625,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  static void
  mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
@@ -244,7 +232,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he *he;
  	struct tlv *tlv;
-@@ -710,7 +710,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -713,7 +713,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -253,7 +241,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -755,7 +755,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -758,7 +758,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  void
  mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
@@ -262,7 +250,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he_v2 *he;
  	struct tlv *tlv;
-@@ -766,7 +766,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -769,7 +769,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  	memcpy(he->he_phy_cap, elem->phy_cap_info, sizeof(he->he_phy_cap));
  	memcpy(he->he_mac_cap, elem->mac_cap_info, sizeof(he->he_mac_cap));
  
@@ -271,7 +259,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -782,7 +782,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -785,7 +785,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  		break;
  	}
  
@@ -280,7 +268,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_he_tlv_v2);
  
-@@ -793,14 +793,12 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+@@ -796,14 +796,12 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
  	struct ieee80211_sta_ht_cap *ht_cap;
  	struct ieee80211_sta_vht_cap *vht_cap;
  	const struct ieee80211_sta_he_cap *he_cap;
@@ -298,7 +286,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -808,7 +806,6 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+@@ -811,7 +809,6 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
  		ht_cap = &sband->ht_cap;
  		vht_cap = &sband->vht_cap;
  		he_cap = ieee80211_get_he_iftype_cap(sband, vif->type);
@@ -306,7 +294,7 @@
  	}
  
  	if (band == NL80211_BAND_2GHZ) {
-@@ -819,9 +816,6 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+@@ -822,9 +819,6 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
  
  		if (he_cap && he_cap->has_he)
  			mode |= PHY_TYPE_BIT_HE;
@@ -316,7 +304,7 @@
  	} else if (band == NL80211_BAND_5GHZ || band == NL80211_BAND_6GHZ) {
  		mode |= PHY_TYPE_BIT_OFDM;
  
-@@ -833,9 +827,6 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+@@ -836,9 +830,6 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
  
  		if (he_cap && he_cap->has_he)
  			mode |= PHY_TYPE_BIT_HE;
@@ -326,7 +314,7 @@
  	}
  
  	return mode;
-@@ -857,25 +848,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -862,25 +853,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	u16 supp_rates;
  
  	/* starec ht */
@@ -358,7 +346,7 @@
  	}
  
  	/* starec uapsd */
-@@ -884,11 +875,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -889,11 +880,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	if (!is_mt7921(dev))
  		return;
  
@@ -372,7 +360,7 @@
  		mt76_connac_mcu_sta_he_tlv(skb, sta);
  		mt76_connac_mcu_sta_he_tlv_v2(skb, sta);
  		if (band == NL80211_BAND_6GHZ &&
-@@ -898,7 +889,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -903,7 +894,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
  						      sizeof(*he_6g_capa));
  			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
@@ -381,7 +369,7 @@
  		}
  	}
  
-@@ -908,14 +899,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -913,14 +904,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
  	phy->rcpi = rcpi;
  	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
@@ -399,7 +387,7 @@
  	if (band == NL80211_BAND_2GHZ)
  		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
  			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
-@@ -924,18 +915,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -929,18 +920,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  
  	ra_info->legacy = cpu_to_le16(supp_rates);
  
@@ -423,7 +411,7 @@
  			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
  	}
  }
-@@ -951,7 +942,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
+@@ -956,7 +947,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
  					     wtbl_tlv, sta_wtbl);
  	smps = (struct wtbl_smps *)tlv;
@@ -432,7 +420,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
  
-@@ -963,27 +954,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -968,27 +959,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u32 flags = 0;
  
@@ -468,7 +456,7 @@
  		struct wtbl_vht *vht;
  		u8 af;
  
-@@ -992,18 +983,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -997,18 +988,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sta_wtbl);
  		vht = (struct wtbl_vht *)tlv;
  		vht->ldpc = vht_ldpc &&
@@ -490,7 +478,7 @@
  		/* sgi */
  		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
  			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
-@@ -1013,15 +1004,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1018,15 +1009,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sizeof(*raw), wtbl_tlv,
  						     sta_wtbl);
  
@@ -511,7 +499,7 @@
  				flags |= MT_WTBL_W5_SHORT_GI_160;
  		}
  		raw = (struct wtbl_raw *)tlv;
-@@ -1310,9 +1301,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1315,9 +1306,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  		return 0x38;
  
  	if (sta) {
@@ -524,7 +512,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -1632,7 +1623,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1640,7 +1631,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	for (i = 0; i < sreq->n_ssids; i++) {
  		if (!sreq->ssids[i].ssid_len)
  			continue;
@@ -532,7 +520,7 @@
  		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
  		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
  		       sreq->ssids[i].ssid_len);
-@@ -1772,7 +1762,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
+@@ -1780,7 +1770,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
  		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
  		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
  	}
@@ -540,7 +528,7 @@
  	req->match_num = sreq->n_match_sets;
  	for (i = 0; i < req->match_num; i++) {
  		match = &sreq->match_sets[i];
-@@ -2148,10 +2137,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2156,10 +2145,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  				      struct mt76_vif *vif,
  				      struct ieee80211_bss_conf *info)
  {
@@ -552,7 +540,7 @@
  			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
  	struct {
  		struct {
-@@ -2179,7 +2166,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2187,7 +2174,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  
  	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
  	for (i = 0; i < len; i++)
@@ -587,10 +575,10 @@
  		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
  			ba_size = 0;
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index fd35b57..117ebb5 100644
+index df110b0..49756ea 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
-@@ -2049,8 +2049,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
+@@ -2041,8 +2041,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
  
  	phy.ldpc = (phy.bw || phy.ldpc) * GENMASK(2, 0);
  	for (i = 0; i <= phy.bw; i++) {
@@ -602,7 +590,7 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index a0f393a..4cb94d3 100644
+index 4f9f5a3..fde6a38 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -596,8 +596,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -617,10 +605,10 @@
  
  	mt7915_dma_enable(dev, false);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 978e585..c845bfe 100644
+index 9ab6752..bb6b746 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1181,8 +1181,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -1184,8 +1184,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  			mt76_connac_gen_ppe_thresh(he_cap->ppe_thres, nss);
  		} else {
  			he_cap_elem->phy_cap_info[9] |=
@@ -631,10 +619,10 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 02682ce..1b47016 100644
+index c4e0dbc..8b6a4df 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -552,7 +552,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -547,7 +547,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  
  static int
  mt7915_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -643,7 +631,7 @@
  	       const struct ieee80211_tx_queue_params *params)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-@@ -653,7 +653,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
+@@ -648,7 +648,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
  static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  				    struct ieee80211_vif *vif,
  				    struct ieee80211_bss_conf *info,
@@ -652,7 +640,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -669,7 +669,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -664,7 +664,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	    vif->type == NL80211_IFTYPE_STATION)
  		set_bss_info = set_sta = !is_zero_ether_addr(info->bssid);
  	if (changed & BSS_CHANGED_ASSOC)
@@ -661,7 +649,7 @@
  	if (changed & BSS_CHANGED_BEACON_ENABLED &&
  	    vif->type != NL80211_IFTYPE_AP)
  		set_bss_info = set_sta = info->enable_beacon;
-@@ -717,27 +717,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -712,27 +712,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -690,7 +678,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -745,8 +726,6 @@ mt7915_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -740,8 +721,6 @@ mt7915_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -699,7 +687,7 @@
  	err = mt7915_mcu_add_bss_info(phy, vif, true);
  	if (err)
  		goto out;
-@@ -758,8 +737,7 @@ out:
+@@ -753,8 +732,7 @@ out:
  }
  
  static void
@@ -709,7 +697,7 @@
  {
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
  
-@@ -1329,10 +1307,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
+@@ -1349,10 +1327,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
@@ -723,7 +711,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3ff53db..2af358c 100644
+index 50db7f2..04cc72e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -67,7 +67,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
@@ -795,7 +783,7 @@
  		return;
  
  	ieee80211_color_change_finish(vif);
-@@ -754,13 +754,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -844,13 +844,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  		      struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -811,7 +799,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -846,8 +846,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -936,8 +936,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -822,7 +810,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -897,7 +897,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -987,7 +987,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -831,7 +819,7 @@
  	struct mt7915_phy *phy = mvif->phy;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
-@@ -922,11 +922,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1012,11 +1012,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
  
@@ -846,7 +834,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -962,13 +962,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1052,13 +1052,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_ht *ht;
  	struct tlv *tlv;
  
@@ -862,7 +850,7 @@
  }
  
  static void
-@@ -977,15 +977,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1067,15 +1067,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
  
@@ -882,7 +870,7 @@
  }
  
  static void
-@@ -1000,7 +1000,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1090,7 +1090,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -891,7 +879,7 @@
  	    return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -1009,7 +1009,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1099,7 +1099,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	amsdu->amsdu_en = true;
  	msta->wcid.amsdu = true;
  
@@ -900,7 +888,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		if (!is_mt7915(&dev->mt76)) {
  			amsdu->max_mpdu_size =
-@@ -1072,8 +1072,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1162,8 +1162,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	if (!bfee && sts < 2)
  		return false;
  
@@ -911,7 +899,7 @@
  
  		if (bfee)
  			return mvif->cap.he_su_ebfee &&
-@@ -1083,8 +1083,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1173,8 +1173,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -922,7 +910,7 @@
  
  		if (bfee)
  			return mvif->cap.vht_su_ebfee &&
-@@ -1110,7 +1110,7 @@ static void
+@@ -1200,7 +1200,7 @@ static void
  mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		       struct sta_rec_bf *bf)
  {
@@ -931,7 +919,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1135,7 +1135,7 @@ static void
+@@ -1225,7 +1225,7 @@ static void
  mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  			struct sta_rec_bf *bf, bool explicit)
  {
@@ -940,7 +928,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1156,14 +1156,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
+@@ -1246,14 +1246,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -957,7 +945,7 @@
  			bf->ibf_nrow = 1;
  	}
  }
-@@ -1172,7 +1172,7 @@ static void
+@@ -1262,7 +1262,7 @@ static void
  mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
  {
@@ -966,7 +954,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1197,7 +1197,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1287,7 +1287,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -975,7 +963,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1245,7 +1245,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1335,7 +1335,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -984,7 +972,7 @@
  		return;
  
  	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1259,21 +1259,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1349,21 +1349,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -1012,7 +1000,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1283,7 +1283,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1373,7 +1373,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -1021,7 +1009,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1308,7 +1308,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1398,7 +1398,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -1030,7 +1018,7 @@
  		return;
  
  	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1317,13 +1317,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1407,13 +1407,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
  	bfee = (struct sta_rec_bfee *)tlv;
  
@@ -1048,7 +1036,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1379,7 +1379,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -1469,7 +1469,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -1057,7 +1045,7 @@
  		break;
  	case RATE_PARAM_SPE_UPDATE:
  		ra->spe_idx = *(u8 *)data;
-@@ -1454,7 +1454,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1545,7 +1545,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  	do {									\
  		u8 i, gi = mask->control[band]._gi;				\
  		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
@@ -1066,7 +1054,7 @@
  			phy.sgi |= gi << (i << (_he));				\
  			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
  		}								\
-@@ -1468,11 +1468,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1559,11 +1559,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		}								\
  	} while (0)
  
@@ -1081,7 +1069,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -1506,7 +1506,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1597,7 +1597,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		 * actual txrate hardware sends out.
  		 */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
@@ -1090,7 +1078,7 @@
  			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1539,7 +1539,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1630,7 +1630,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra *ra;
  	struct tlv *tlv;
@@ -1099,7 +1087,7 @@
  	u32 cap = sta->wme ? STA_CAP_WMM : 0;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1549,9 +1549,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1640,9 +1640,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	ra->auto_rate = true;
  	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
  	ra->channel = chandef->chan->hw_value;
@@ -1112,7 +1100,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -1571,22 +1571,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1662,22 +1662,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		}
  	}
  
@@ -1143,7 +1131,7 @@
  			cap |= STA_CAP_LDPC;
  
  		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1594,37 +1594,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1685,37 +1685,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
  	}
  
@@ -1191,7 +1179,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  
-@@ -1833,7 +1833,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -1924,7 +1924,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1200,7 +1188,7 @@
  	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
  					   &bcn->sub_ntlv, &bcn->len);
  	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -1918,9 +1918,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -2009,9 +2009,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1212,7 +1200,7 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -1930,6 +1930,85 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -2021,6 +2021,85 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
  }
  
@@ -1298,7 +1286,7 @@
  int
  mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  			     u32 changed)
-@@ -2043,7 +2122,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2133,7 +2212,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif, in
  	if (!en)
  		goto out;
  
@@ -1307,7 +1295,7 @@
  	if (!skb) {
  		dev_kfree_skb(rskb);
  		return -EINVAL;
-@@ -2059,6 +2138,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2149,6 +2228,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif, in
  	info = IEEE80211_SKB_CB(skb);
  	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
  
@@ -1315,7 +1303,7 @@
  	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
  	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
  	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
-@@ -3356,17 +3436,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3446,17 +3526,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1358,7 +1346,7 @@
  	sta->wme = 1;
  
 diff --git a/tx.c b/tx.c
-index c88fb29..9dfc289 100644
+index b1d8b32..1442050 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
@@ -1413,6 +1401,18 @@
  		spin_lock_bh(&dev->rx_lock);
  		ieee80211_tx_status_ext(hw, &status);
  		spin_unlock_bh(&dev->rx_lock);
+diff --git a/wed.c b/wed.c
+index 2d6a944..5b3da09 100644
+--- a/wed.c
++++ b/wed.c
+@@ -80,6 +80,7 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+ 		phy_addr = dma_map_single(dev->dma_dev, ptr,
+ 					  wed->wlan.rx_size,
+ 					  DMA_TO_DEVICE);
++
+ 		if (unlikely(dma_mapping_error(dev->dev, phy_addr))) {
+ 			skb_free_frag(ptr);
+ 			mt76_put_rxwi(dev, r);
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 3c3bb67..c51416d 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -4,13 +4,15 @@
     file://0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch \
     file://0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch \
     file://0004-wifi-mt76-mt7915-fix-txpower-issues.patch \
-    file://0005-wifi-mt76-mt7915-rework-mmio-access-flow.patch \
-    file://0006-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch \
-    file://0007-wifi-mt76-mt7915-add-new-chip-version-in-power-on-se.patch \
-    file://0008-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch \
-    file://0009-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch \
-    file://0010-wifi-mt76-check-txs-format-before-getting-skb-by-pid.patch \
-    file://0010-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch \
+    file://0005-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch \
+    file://0006-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch \
+    file://0007-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch \
+    file://0008-wifi-mt76-mt7915-add-support-for-realtime-Rx-rate-up.patch \
+    file://0009-wifi-mt76-mt7915-remove-redundant-argument-in-add_be.patch \
+    file://0010-wifi-mt76-mt7915-add-support-for-WMM-PBC-configurati.patch \
+    file://0011-wifi-mt76-mt7915-fix-mcu-command-format-for-mt7915-t.patch \
+    file://0012-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch \
+    file://0013-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch \
     file://0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch \
     file://1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch \
     file://1001-wifi-mt76-mt7915-csi-implement-csi-support.patch \
@@ -60,6 +62,8 @@
     file://1045-wifi-mt76-mt7915-support-scs-feature.patch \
     file://1046-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch \
     file://1047-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch \
+    file://1048-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch \
+    file://1049-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch \
     file://2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch \
     file://2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch \
@@ -73,10 +77,6 @@
     file://2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch \
     file://2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch \
     file://2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch \
-    file://2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch \
-    file://2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch \
-    file://2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch \
-    file://2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch \
     file://2999-wifi-mt76-mt7915-support-backaward-compatiable.patch \
     file://9999-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7988/i2p5ge-phy-pmb.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7988/i2p5ge-phy-pmb.bin
deleted file mode 100644
index 125dbcf..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7988/i2p5ge-phy-pmb.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/mt76.inc b/recipes-wifi/linux-mt76/mt76.inc
index b14cd49..1096049 100644
--- a/recipes-wifi/linux-mt76/mt76.inc
+++ b/recipes-wifi/linux-mt76/mt76.inc
@@ -1 +1 @@
-SRCREV ?= "bebd9cffc2aeb2cecb40aadbb8c6eab3bdf7971b"
+SRCREV ?= "6124ea9135ed512671933f5520c46842906c78bc"
diff --git a/recipes-wifi/mt76-vendor/files/src/hemu.c b/recipes-wifi/mt76-vendor/files/src/hemu.c
deleted file mode 100755
index ec1cea0..0000000
--- a/recipes-wifi/mt76-vendor/files/src/hemu.c
+++ /dev/null
@@ -1,58 +0,0 @@
-/* Copyright (C) 2021 Mediatek Inc. */
-#define _GNU_SOURCE
-
-#include "mt76-vendor.h"
-
-static int mt76_hemu_onoff_set_attr(struct nl_msg *msg, int argc, char **argv)
-{
-	char *val;
-
-	val = strchr(argv[0], '=');
-	if (!val)
-		return -EINVAL;
-
-	*(val++) = 0;
-
-	if (!strncmp(argv[0], "onoff", 5))
-		nla_put_u8(msg, MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF, strtoul(val, NULL, 0));
-
-	return 0;
-}
-
-int mt76_hemu_onoff_set(int idx, int argc, char **argv)
-{
-	struct nl_msg *msg;
-	void *data;
-	int ret;
-
-	if (argc < 1)
-		return 1;
-
-	if (unl_genl_init(&unl, "nl80211") < 0) {
-		fprintf(stderr, "Failed to connect to nl80211\n");
-		return 2;
-	}
-
-	msg = unl_genl_msg(&unl, NL80211_CMD_VENDOR, false);
-
-	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, idx) ||
-	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, MTK_NL80211_VENDOR_ID) ||
-	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL))
-		return false;
-
-	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA | NLA_F_NESTED);
-	if (!data)
-		return -ENOMEM;
-
-	mt76_hemu_onoff_set_attr(msg, argc, argv);
-
-	nla_nest_end(msg, data);
-
-	ret = unl_genl_request(&unl, msg, NULL, NULL);
-	if (ret)
-		fprintf(stderr, "nl80211 call failed: %s\n", strerror(-ret));
-
-	unl_free(&unl);
-
-	return ret;
-}
\ No newline at end of file
diff --git a/recipes-wifi/wireless-regdb/wireless-regdb_2023.09.01.bb b/recipes-wifi/wireless-regdb/wireless-regdb_2024.01.23.bb
similarity index 89%
rename from recipes-wifi/wireless-regdb/wireless-regdb_2023.09.01.bb
rename to recipes-wifi/wireless-regdb/wireless-regdb_2024.01.23.bb
index ebc282f..d3af406 100644
--- a/recipes-wifi/wireless-regdb/wireless-regdb_2023.09.01.bb
+++ b/recipes-wifi/wireless-regdb/wireless-regdb_2024.01.23.bb
@@ -5,7 +5,7 @@
 LIC_FILES_CHKSUM = "file://LICENSE;md5=07c4f6dea3845b02a18dc00c8c87699c"
 
 SRC_URI = "https://www.kernel.org/pub/software/network/${BPN}/${BP}.tar.xz"
-SRC_URI[sha256sum] = "26d4c2a727cc59239b84735aad856b7c7d0b04e30aa5c235c4f7f47f5f053491"
+SRC_URI[sha256sum] = "c8a61c9acf76fa7eb4239e89f640dee3e87098d9f69b4d3518c9c60fc6d20c55"
 
 FILESEXTRAPATHS_prepend := "${THISDIR}/files/patches:"
 require files/patches/patches.inc
@@ -22,7 +22,7 @@
     install -d -m0755 ${D}${nonarch_libdir}/crda
     install -d -m0755 ${D}${sysconfdir}/wireless-regdb/pubkeys
     install -m 0644 regulatory.bin ${D}${nonarch_libdir}/crda/regulatory.bin
-    install -m 0644 sforshee.key.pub.pem ${D}${sysconfdir}/wireless-regdb/pubkeys/sforshee.key.pub.pem
+    install -m 0644 wens.key.pub.pem ${D}${sysconfdir}/wireless-regdb/pubkeys/wens.key.pub.pem
 
     install -m 0644 -D regulatory.db ${D}${nonarch_base_libdir}/firmware/regulatory.db
     install -m 0644 regulatory.db.p7s ${D}${nonarch_base_libdir}/firmware/regulatory.db.p7s
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/993-2023-10-28-ACS-Fix-typo-in-bw_40-frequency-array.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/993-2023-10-28-ACS-Fix-typo-in-bw_40-frequency-array.patch
new file mode 100644
index 0000000..948c51b
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/993-2023-10-28-ACS-Fix-typo-in-bw_40-frequency-array.patch
@@ -0,0 +1,25 @@
+From 7a733993211ad46cf3032038c1e7e6bdc2322336 Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Tue, 5 Sep 2023 09:43:25 +0800
+Subject: [PATCH] ACS: Fix typo in bw_40 frequency array
+
+The range for the 5 GHz channel 118 was encoded with an incorrect
+channel number.
+
+Fixes: ed8e13decc71 (ACS: Extract bw40/80/160 freqs out of acs_usable_bwXXX_chan())
+Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com>
+---
+ src/ap/acs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -256,7 +256,7 @@ struct bw_item {
+ static const struct bw_item bw_40[] = {
+ 	{ 5180, 5200, 38 }, { 5220, 5240, 46 }, { 5260, 5280, 54 },
+ 	{ 5300, 5320, 62 }, { 5500, 5520, 102 }, { 5540, 5560, 110 },
+-	{ 5580, 5600, 110 }, { 5620, 5640, 126}, { 5660, 5680, 134 },
++	{ 5580, 5600, 118 }, { 5620, 5640, 126 }, { 5660, 5680, 134 },
+ 	{ 5700, 5720, 142 }, { 5745, 5765, 151 }, { 5785, 5805, 159 },
+ 	{ 5825, 5845, 167 }, { 5865, 5885, 175 },
+ 	{ 5955, 5975, 3 }, { 5995, 6015, 11 }, { 6035, 6055, 19 },
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
index 8ad0077..325e353 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
@@ -62,6 +62,7 @@
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://991-Fix-OpenWrt-13156.patch \
     file://992-nl80211-add-extra-ies-only-if-allowed-by-driver.patch \
+    file://993-2023-10-28-ACS-Fix-typo-in-bw_40-frequency-array.patch \
     file://mtk-0001-mtk-hostapd-Add-neighbor-report-and-BSS-Termination-.patch \
     file://mtk-0002-mtk-hostapd-print-sae-groups-by-hostapd-ctrl.patch \
     file://mtk-0003-mtk-hostapd-add-support-for-runtime-set-in-band-disc.patch \
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0047-hostapd-mtk-add-support-for-channel-switching-to-dfs.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0047-hostapd-mtk-add-support-for-channel-switching-to-dfs.patch
index 82b66f4..4e24ba6 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0047-hostapd-mtk-add-support-for-channel-switching-to-dfs.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0047-hostapd-mtk-add-support-for-channel-switching-to-dfs.patch
@@ -1,19 +1,19 @@
-From 018d87d5b9b53b3e630032bf2cb7e6eaeae09d71 Mon Sep 17 00:00:00 2001
+From 22adaf9edb6e4e60dbe5c7cc8366c08b8141571f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 15 Nov 2023 15:06:00 +0800
-Subject: [PATCH 47/49] hostapd: mtk: add support for channel switching to dfs
- with csa sent
+Subject: [PATCH] hostapd: mtk: add support for channel switching to dfs with
+ csa sent
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  hostapd/ctrl_iface.c | 26 ++------------------------
  src/ap/beacon.c      |  5 +++++
- src/ap/dfs.c         | 16 ++++++++++++----
+ src/ap/dfs.c         | 18 ++++++++++++++----
  src/ap/ieee802_11.c  |  5 +++++
- 4 files changed, 24 insertions(+), 28 deletions(-)
+ 4 files changed, 26 insertions(+), 28 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index b521a08..0afa6a2 100644
+index b0117e5..96b593a 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -2747,7 +2747,6 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
@@ -73,7 +73,7 @@
  
  	if (ieee802_11_build_ap_params(hapd, &params) < 0)
 diff --git a/src/ap/dfs.c b/src/ap/dfs.c
-index 80d3605..012050c 100644
+index 80d3605..d490032 100644
 --- a/src/ap/dfs.c
 +++ b/src/ap/dfs.c
 @@ -1255,10 +1255,10 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
@@ -90,21 +90,23 @@
  
  			/*
  			 * When background radar is enabled but the CAC completion
-@@ -1272,6 +1272,13 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+@@ -1272,6 +1272,15 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
  	} else if (hostapd_dfs_is_background_event(iface, freq)) {
  		iface->radar_background.cac_started = 0;
  		hostpad_dfs_update_background_chain(iface);
 +	} else {
 +		int i;
 +
-+		iface->cac_started = 0;
++		/* If interface is already setup, clear cac_started flag to avoid re-setup */
++		if (iface->state == HAPD_IFACE_ENABLED)
++			iface->cac_started = 0;
 +		/* Clear all CSA flags once channel switch to DFS channel fails */
 +		for (i = 0; i < iface->num_bss; i++)
 +			iface->bss[i]->csa_in_progress = 0;
  	}
  
  	return 0;
-@@ -1646,7 +1653,8 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
+@@ -1646,7 +1655,8 @@ int hostapd_dfs_start_cac(struct hostapd_iface *iface, int freq,
  	} else {
  		/* This is called when the driver indicates that an offloaded
  		 * DFS has started CAC. */
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0050-hostapd-mtk-add-support-for-removeing-the-main-BSS.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0050-hostapd-mtk-add-support-for-removeing-the-main-BSS.patch
new file mode 100644
index 0000000..d6f13f1
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0050-hostapd-mtk-add-support-for-removeing-the-main-BSS.patch
@@ -0,0 +1,284 @@
+From cc04411d78f2569cc235e0f5620b3476091a1af1 Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Thu, 14 Dec 2023 14:42:58 +0800
+Subject: [PATCH 1/2] hostapd: mtk: add support for removeing the main BSS
+
+The first hostapd_data/i802_bss are important to hostapd since many
+operations/events are directly operated on the first BSS.
+(such as iface->bss[0], drv->first_bss, etc)
+
+To remove the main BSS, the 1st and 2nd hostapd_data/i802_bss are
+switched, then the new 2nd hostapd_data/i802_bss are removed as it is
+done to remove BSS other than the first one.
+
+This patch add the new command to remove the BSS (including the first
+one):
+$ hostapd_cli -i global raw REMOVE_BSS <ifname>
+
+Note that if the command is used in OpenWrt, an additional step is
+needed:
+update the "aplist" in /var/state/wireless according to the removed ifname
+Therefore the "wifi" command can work normally.
+
+Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+---
+ hostapd/ctrl_iface.c         | 14 ++++++
+ src/ap/ap_drv_ops.h          | 10 +++++
+ src/ap/hostapd.c             | 85 +++++++++++++++++++++++++++++++++++-
+ src/ap/hostapd.h             |  1 +
+ src/drivers/driver.h         |  2 +
+ src/drivers/driver_nl80211.c | 43 ++++++++++++++++++
+ 6 files changed, 153 insertions(+), 2 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 6552bc4..650af3b 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -5028,6 +5028,17 @@ static int hostapd_ctrl_iface_add(struct hapd_interfaces *interfaces,
+ }
+ 
+ 
++static int hostapd_ctrl_bss_remove(struct hapd_interfaces *interfaces,
++				   char *buf)
++{
++	if (hostapd_remove_bss(interfaces, buf) < 0) {
++		wpa_printf(MSG_ERROR, "Removing interface %s failed", buf);
++		return -1;
++	}
++	return 0;
++}
++
++
+ static int hostapd_ctrl_iface_remove(struct hapd_interfaces *interfaces,
+ 				     char *buf)
+ {
+@@ -5444,6 +5455,9 @@ static void hostapd_global_ctrl_iface_receive(int sock, void *eloop_ctx,
+ 	} else if (os_strncmp(buf, "REMOVE ", 7) == 0) {
+ 		if (hostapd_ctrl_iface_remove(interfaces, buf + 7) < 0)
+ 			reply_len = -1;
++	} else if (os_strncmp(buf, "REMOVE_BSS ", 11) == 0) {
++		if (hostapd_ctrl_bss_remove(interfaces, buf + 11) < 0)
++			reply_len = -1;
+ 	} else if (os_strcmp(buf, "ATTACH") == 0) {
+ 		if (hostapd_global_ctrl_iface_attach(interfaces, &from,
+ 						     fromlen, NULL))
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 2a89b99..95db664 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -310,6 +310,16 @@ static inline const char * hostapd_drv_get_radio_name(struct hostapd_data *hapd)
+ 	return hapd->driver->get_radio_name(hapd->drv_priv);
+ }
+ 
++static inline int hostapd_drv_move_bss_to_first(struct hostapd_data *hapd,
++						const char *ifname)
++{
++	if (hapd->driver == NULL || hapd->driver->move_bss_to_first == NULL ||
++	    hapd->drv_priv == NULL)
++		return -1;
++
++	return hapd->driver->move_bss_to_first(hapd->drv_priv, ifname);
++}
++
+ static inline int hostapd_drv_switch_channel(struct hostapd_data *hapd,
+ 					     struct csa_settings *settings)
+ {
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 250c168..7f58354 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -3297,7 +3297,35 @@ fail:
+ }
+ 
+ 
+-static int hostapd_remove_bss(struct hostapd_iface *iface, unsigned int idx)
++int hostapd_move_bss_to_first(struct hostapd_iface *iface, int idx)
++{
++	struct hostapd_data *target_hapd, *first_hapd;
++
++	if (idx == 0 || idx >= iface->num_bss)
++		return -1;
++
++	target_hapd = iface->bss[idx];
++	first_hapd = iface->bss[0];
++	if (hostapd_drv_move_bss_to_first(first_hapd, target_hapd->conf->iface))
++		return -1;
++
++	iface->bss[0] = target_hapd;
++	iface->bss[idx] = first_hapd;
++	iface->conf->bss[0] = iface->bss[0]->conf;
++	iface->conf->bss[idx] = iface->bss[idx]->conf;
++
++	first_hapd->interface_added = 1;
++	target_hapd->interface_added = 0;
++
++	if (idx == iface->num_bss - 1)
++		iface->conf->last_bss = iface->bss[idx]->conf;
++
++	return 0;
++}
++
++
++static int hostapd_remove_bss_by_idx(struct hostapd_iface *iface,
++				     unsigned int idx)
+ {
+ 	size_t i;
+ 
+@@ -3331,6 +3359,59 @@ static int hostapd_remove_bss(struct hostapd_iface *iface, unsigned int idx)
+ }
+ 
+ 
++int hostapd_remove_bss(struct hapd_interfaces *interfaces, char *buf)
++{
++	struct hostapd_iface *hapd_iface;
++	size_t i, j, k = 0;
++	int ret;
++
++	for (i = 0; i < interfaces->count; i++) {
++		hapd_iface = interfaces->iface[i];
++		if (hapd_iface == NULL)
++			return -1;
++
++		if (!os_strcmp(hapd_iface->conf->bss[0]->iface, buf)) {
++			if (hapd_iface->conf->num_bss == 1) {
++				wpa_printf(MSG_INFO, "Remove interface '%s'", buf);
++				hapd_iface->driver_ap_teardown =
++					!!(hapd_iface->drv_flags &
++					   WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT);
++
++				hostapd_interface_deinit_free(hapd_iface);
++				k = i;
++				while (k < (interfaces->count - 1)) {
++					interfaces->iface[k] =
++						interfaces->iface[k + 1];
++					k++;
++				}
++				interfaces->count--;
++				return 0;
++			} else {
++				wpa_printf(MSG_INFO, "Switch interface to %s",
++					   hapd_iface->bss[1]->conf->iface);
++
++				ret = hostapd_move_bss_to_first(hapd_iface, 1);
++				if (ret < 0) {
++					wpa_printf(MSG_ERROR,
++						   "Interface switch failed");
++					return ret;
++				}
++			}
++		}
++
++		for (j = 0; j < hapd_iface->conf->num_bss; j++) {
++			if (!os_strcmp(hapd_iface->conf->bss[j]->iface, buf)) {
++				hapd_iface->driver_ap_teardown =
++					!(hapd_iface->drv_flags &
++					  WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT);
++				return hostapd_remove_bss_by_idx(hapd_iface, j);
++			}
++		}
++	}
++	return -1;
++}
++
++
+ int hostapd_remove_iface(struct hapd_interfaces *interfaces, char *buf)
+ {
+ 	struct hostapd_iface *hapd_iface;
+@@ -3362,7 +3443,7 @@ int hostapd_remove_iface(struct hapd_interfaces *interfaces, char *buf)
+ 				hapd_iface->driver_ap_teardown =
+ 					!(hapd_iface->drv_flags &
+ 					  WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT);
+-				return hostapd_remove_bss(hapd_iface, j);
++				return hostapd_remove_bss_by_idx(hapd_iface, j);
+ 			}
+ 		}
+ 	}
+diff --git a/src/ap/hostapd.h b/src/ap/hostapd.h
+index 3b51050..824a24a 100644
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -701,6 +701,7 @@ void hostapd_bss_deinit_no_free(struct hostapd_data *hapd);
+ void hostapd_free_hapd_data(struct hostapd_data *hapd);
+ void hostapd_cleanup_iface_partial(struct hostapd_iface *iface);
+ int hostapd_add_iface(struct hapd_interfaces *ifaces, char *buf);
++int hostapd_remove_bss(struct hapd_interfaces *ifaces, char *buf);
+ int hostapd_remove_iface(struct hapd_interfaces *ifaces, char *buf);
+ void hostapd_channel_list_updated(struct hostapd_iface *iface, int initiator);
+ void hostapd_set_state(struct hostapd_iface *iface, enum hostapd_iface_state s);
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 01281a1..ab19794 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -3185,6 +3185,8 @@ struct wpa_driver_ops {
+ 	 */
+ 	void (*hapd_deinit)(void *priv);
+ 
++	int (*move_bss_to_first)(void *priv, const char *ifname);
++
+ 	/**
+ 	 * set_ieee8021x - Enable/disable IEEE 802.1X support (AP only)
+ 	 * @priv: Private driver interface data
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index e744a18..cef502f 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -7986,6 +7986,48 @@ static void i802_deinit(void *priv)
+ 	wpa_driver_nl80211_deinit(bss);
+ }
+ 
++static int i802_move_bss_to_first(void *priv, const char *ifname)
++{
++	struct i802_bss *bss = priv;
++	struct i802_bss *first_bss, *target_bss, *prev_bss, *tmp_bss;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++
++	if (!os_strcmp(bss->ifname, ifname)) {
++		wpa_printf(MSG_ERROR, "nl80211: BSS is already the first one");
++		return -1;
++	}
++
++	prev_bss = drv->first_bss;
++	target_bss = drv->first_bss->next;
++	while (target_bss) {
++		if (!os_strcmp(target_bss->ifname, ifname))
++			break;
++
++		prev_bss = target_bss;
++		target_bss = target_bss->next;
++	}
++
++	if (!target_bss) {
++		wpa_printf(MSG_ERROR, "nl80211: Failed to find the target BSS");
++		return -1;
++	}
++
++	first_bss = drv->first_bss;
++	drv->first_bss = target_bss;
++	prev_bss->next = first_bss;
++
++	tmp_bss = first_bss->next;
++	first_bss->next = target_bss->next;
++	target_bss->next = tmp_bss;
++
++	memcpy(drv->perm_addr, drv->first_bss->addr, ETH_ALEN);
++	drv->ifindex = if_nametoindex(drv->first_bss->ifname);
++	drv->ctx = drv->first_bss->ctx;
++
++	first_bss->added_if = 1;
++	target_bss->added_if = 0;
++	return 0;
++}
+ 
+ static enum nl80211_iftype wpa_driver_nl80211_if_type(
+ 	enum wpa_driver_if_type type)
+@@ -13433,6 +13475,7 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.sta_set_airtime_weight = driver_nl80211_sta_set_airtime_weight,
+ 	.hapd_init = i802_init,
+ 	.hapd_deinit = i802_deinit,
++	.move_bss_to_first = i802_move_bss_to_first,
+ 	.set_wds_sta = i802_set_wds_sta,
+ 	.get_seqnum = i802_get_seqnum,
+ 	.flush = i802_flush,
+-- 
+2.25.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0051-hostapd-mtk-add-support-for-enable-disable-single-BS.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0051-hostapd-mtk-add-support-for-enable-disable-single-BS.patch
new file mode 100644
index 0000000..dd9795a
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0051-hostapd-mtk-add-support-for-enable-disable-single-BS.patch
@@ -0,0 +1,248 @@
+From be968a6aeea80dca7661e59e0ab5db32341cadb8 Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Mon, 18 Dec 2023 11:35:34 +0800
+Subject: [PATCH 2/2] hostapd: mtk: add support for enable/disable single BSS
+
+Enabling or disabling single BSS mean that the beacon of the BSS is
+enabled or disabled.
+
+When the BSS is disabled, the following statements are true:
+1. the events or packets from the driver are all ignored.
+2. Per radio functions (ex. channel switch, color change) will not
+   execute for the BSS, but are finished by other enabling BSS(es).
+   The changed parameters take effect when the BSS is enabled again.
+3. Enabling the BSS will not reload the configuration. In other word,
+   if the configuration changes during the BSS disabling, the BSS needs
+   to be removed and added again, not just be enabled.
+
+This patch add new commands to enable/disable single BSS:
+$ hostapd_cli -i <ifname> enable_bss
+$ hostapd_cli -i <ifname> disable_bss
+
+Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+---
+ hostapd/ctrl_iface.c               | 26 ++++++++++++++++++++
+ hostapd/hostapd_cli.c              | 18 ++++++++++++++
+ src/ap/hostapd.c                   | 39 ++++++++++++++++++++++++++++++
+ src/ap/hostapd.h                   |  2 ++
+ src/drivers/driver_nl80211.c       | 11 +++++++++
+ src/drivers/driver_nl80211_event.c |  6 +++++
+ 6 files changed, 102 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 650af3b..a980c0b 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -1590,6 +1590,16 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
+ }
+ 
+ 
++static int hostapd_ctrl_iface_enable_bss(struct hostapd_data *hapd)
++{
++	if (hostapd_enable_bss(hapd) < 0) {
++		wpa_printf(MSG_ERROR, "Enabling of BSS failed");
++		return -1;
++	}
++	return 0;
++}
++
++
+ static int hostapd_ctrl_iface_enable(struct hostapd_iface *iface)
+ {
+ 	if (hostapd_enable_iface(iface) < 0) {
+@@ -1610,6 +1620,16 @@ static int hostapd_ctrl_iface_reload(struct hostapd_iface *iface)
+ }
+ 
+ 
++static int hostapd_ctrl_iface_disable_bss(struct hostapd_data *hapd)
++{
++	if (hostapd_disable_bss(hapd) < 0) {
++		wpa_printf(MSG_ERROR, "Disabling of BSS failed");
++		return -1;
++	}
++	return 0;
++}
++
++
+ static int hostapd_ctrl_iface_disable(struct hostapd_iface *iface)
+ {
+ 	if (hostapd_disable_iface(iface) < 0) {
+@@ -4196,6 +4216,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "GET ", 4) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get(hapd, buf + 4, reply,
+ 						   reply_size);
++	} else if (os_strncmp(buf, "ENABLE_BSS", 10) == 0) {
++		if (hostapd_ctrl_iface_enable_bss(hapd))
++			reply_len = -1;
+ 	} else if (os_strncmp(buf, "ENABLE", 6) == 0) {
+ 		if (hostapd_ctrl_iface_enable(hapd->iface))
+ 			reply_len = -1;
+@@ -4205,6 +4228,9 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 	} else if (os_strncmp(buf, "RELOAD", 6) == 0) {
+ 		if (hostapd_ctrl_iface_reload(hapd->iface))
+ 			reply_len = -1;
++	} else if (os_strncmp(buf, "DISABLE_BSS", 11) == 0) {
++		if (hostapd_ctrl_iface_disable_bss(hapd))
++			reply_len = -1;
+ 	} else if (os_strncmp(buf, "DISABLE", 7) == 0) {
+ 		if (hostapd_ctrl_iface_disable(hapd->iface))
+ 			reply_len = -1;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0c4a176..c8f0566 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1215,6 +1215,13 @@ static int hostapd_cli_cmd_enable(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_enable_bss(struct wpa_ctrl *ctrl, int argc,
++				      char *argv[])
++{
++	return wpa_ctrl_command(ctrl, "ENABLE_BSS");
++}
++
++
+ static int hostapd_cli_cmd_reload(struct wpa_ctrl *ctrl, int argc,
+ 				      char *argv[])
+ {
+@@ -1229,6 +1236,13 @@ static int hostapd_cli_cmd_disable(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_disable_bss(struct wpa_ctrl *ctrl, int argc,
++				       char *argv[])
++{
++	return wpa_ctrl_command(ctrl, "DISABLE_BSS");
++}
++
++
+ static int hostapd_cli_cmd_update_beacon(struct wpa_ctrl *ctrl, int argc,
+ 				      char *argv[])
+ {
+@@ -1731,10 +1745,14 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ 	  "  = send vendor driver command" },
+ 	{ "enable", hostapd_cli_cmd_enable, NULL,
+ 	  "= enable hostapd on current interface" },
++	{ "enable_bss", hostapd_cli_cmd_enable_bss, NULL,
++	  "= enable hostapd on current BSS" },
+ 	{ "reload", hostapd_cli_cmd_reload, NULL,
+ 	  "= reload configuration for current interface" },
+ 	{ "disable", hostapd_cli_cmd_disable, NULL,
+ 	  "= disable hostapd on current interface" },
++	{ "disable_bss", hostapd_cli_cmd_disable_bss, NULL,
++	  "= disable hostapd on current BSS" },
+ 	{ "update_beacon", hostapd_cli_cmd_update_beacon, NULL,
+ 	  "= update Beacon frame contents\n"},
+ 	{ "erp_flush", hostapd_cli_cmd_erp_flush, NULL,
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index 7f58354..8b4fc4e 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -3297,6 +3297,42 @@ fail:
+ }
+ 
+ 
++int hostapd_enable_bss(struct hostapd_data *hapd)
++{
++	if (hapd->beacon_set_done)
++		return 0;
++
++	if (hapd->conf->bss_load_update_period && bss_load_update_init(hapd)) {
++		wpa_printf(MSG_ERROR, "BSS Load initialization failed");
++		return -1;
++	}
++	return ieee802_11_set_beacon(hapd);
++}
++
++
++int hostapd_disable_bss(struct hostapd_data *hapd)
++{
++	struct hostapd_iface *iface = hapd->iface;
++	int i, remain_bss = 0;
++
++	if (!hapd->beacon_set_done)
++		return 0;
++
++	for (i = 0; i < iface->num_bss; i++)
++		remain_bss += iface->bss[i]->beacon_set_done ? 1 : 0;
++
++	if (remain_bss == 1) {
++		wpa_printf(MSG_ERROR, "Cannot disable last BSS");
++		return -1;
++	}
++
++	hapd->beacon_set_done = 0;
++	bss_load_update_deinit(hapd);
++	hostapd_bss_deinit_no_free(hapd);
++	return hostapd_drv_stop_ap(hapd);
++}
++
++
+ int hostapd_move_bss_to_first(struct hostapd_iface *iface, int idx)
+ {
+ 	struct hostapd_data *target_hapd, *first_hapd;
+@@ -3905,6 +3941,9 @@ int hostapd_switch_channel(struct hostapd_data *hapd,
+ {
+ 	int ret;
+ 
++	if (!hapd->beacon_set_done)
++		return 0;
++
+ 	if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA)) {
+ 		wpa_printf(MSG_INFO, "CSA is not supported");
+ 		return -1;
+diff --git a/src/ap/hostapd.h b/src/ap/hostapd.h
+index 824a24a..88ff1ca 100644
+--- a/src/ap/hostapd.h
++++ b/src/ap/hostapd.h
+@@ -701,6 +701,8 @@ void hostapd_bss_deinit_no_free(struct hostapd_data *hapd);
+ void hostapd_free_hapd_data(struct hostapd_data *hapd);
+ void hostapd_cleanup_iface_partial(struct hostapd_iface *iface);
+ int hostapd_add_iface(struct hapd_interfaces *ifaces, char *buf);
++int hostapd_enable_bss(struct hostapd_data *hapd);
++int hostapd_disable_bss(struct hostapd_data *hapd);
+ int hostapd_remove_bss(struct hapd_interfaces *ifaces, char *buf);
+ int hostapd_remove_iface(struct hapd_interfaces *ifaces, char *buf);
+ void hostapd_channel_list_updated(struct hostapd_iface *iface, int initiator);
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index cef502f..8e8e194 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -4693,6 +4693,17 @@ static int wpa_driver_nl80211_set_ap(void *priv,
+ 	wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
+ 	wpa_printf(MSG_DEBUG, "nl80211: ssid=%s",
+ 		   wpa_ssid_txt(params->ssid, params->ssid_len));
++
++	if (!beacon_set) {
++		/* update wdev->preset_chandef in MAC80211 */
++		ret = nl80211_set_channel(bss, params->freq, 1);
++		if (ret) {
++			wpa_printf(MSG_ERROR,
++				   "nl80211: Frequency set failed: %d (%s)",
++				   ret, strerror(-ret));
++		}
++	}
++
+ 	if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
+ 	    nla_put(msg, NL80211_ATTR_BEACON_HEAD, params->head_len,
+ 		    params->head) ||
+diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
+index 585d207..6600c9c 100644
+--- a/src/drivers/driver_nl80211_event.c
++++ b/src/drivers/driver_nl80211_event.c
+@@ -1094,6 +1094,12 @@ static void mlme_event(struct i802_bss *bss,
+ 		return;
+ 	}
+ 
++	if (is_ap_interface(drv->nlmode) && !bss->beacon_set) {
++		wpa_printf(MSG_DEBUG,
++			   "nl80211: drop BSS Event due to disabled BSS");
++		return;
++	}
++
+ 	if (frame == NULL) {
+ 		wpa_printf(MSG_DEBUG,
+ 			   "nl80211: MLME event %d (%s) without frame data",
+-- 
+2.25.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch
new file mode 100644
index 0000000..1099ef2
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch
@@ -0,0 +1,44 @@
+From 7f442586bbff0c7b6aca157237b442291b90116b Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Tue, 23 Jan 2024 10:52:57 +0800
+Subject: [PATCH] hostapd: mtk: ACS: remove chan/freq list check when scan
+ request and factor calculation
+
+Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+---
+ src/ap/acs.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+diff --git a/src/ap/acs.c b/src/ap/acs.c
+index e4871921f..089d9c5f4 100644
+--- a/src/ap/acs.c
++++ b/src/ap/acs.c
+@@ -590,12 +590,6 @@ static void acs_survey_mode_interference_factor(
+ 		    iface->conf->acs_exclude_dfs)
+ 			continue;
+ 
+-		if (!is_in_chanlist(iface, chan))
+-			continue;
+-
+-		if (!is_in_freqlist(iface, chan))
+-			continue;
+-
+ 		if (chan->max_tx_power < iface->conf->min_tx_power)
+ 			continue;
+ 
+@@ -1327,12 +1321,6 @@ static int * acs_request_scan_add_freqs(struct hostapd_iface *iface,
+ 		     iface->conf->acs_exclude_dfs))
+ 			continue;
+ 
+-		if (!is_in_chanlist(iface, chan))
+-			continue;
+-
+-		if (!is_in_freqlist(iface, chan))
+-			continue;
+-
+ 		if (chan->max_tx_power < iface->conf->min_tx_power)
+ 			continue;
+ 
+-- 
+2.25.1
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch
new file mode 100644
index 0000000..e99e2a3
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch
@@ -0,0 +1,240 @@
+From e621aacd1eb69668a8e9176b4cd09125394d2fb8 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Date: Wed, 24 Jan 2024 15:15:26 +0800
+Subject: [PATCH] hostapd: mtk: add no_beacon vendor command for cert
+
+Add the vendor command to disable/enable beacon
+
+[Usage]
+hostapd_cli -i <interface> no_beacon <value>
+ <value>
+ 0: enable beacon
+ 1: disable beacon
+---
+ hostapd/ctrl_iface.c              | 18 +++++++++++++++++
+ hostapd/hostapd_cli.c             |  7 +++++++
+ src/ap/ap_drv_ops.c               |  7 +++++++
+ src/ap/ap_drv_ops.h               |  1 +
+ src/common/mtk_vendor.h           | 12 +++++++++++
+ src/drivers/driver.h              |  7 +++++++
+ src/drivers/driver_nl80211.c      | 33 +++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |  1 +
+ src/drivers/driver_nl80211_capa.c |  3 +++
+ 9 files changed, 89 insertions(+)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index bacf14c..c662417 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -4034,6 +4034,22 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
+ 	return os_snprintf(buf, buflen, "OK\n");
+ }
+ 
++static int
++hostapd_ctrl_iface_disable_beacon(struct hostapd_data *hapd, char *value,
++				  char *buf, size_t buflen)
++{
++	int disable_beacon = atoi(value);
++
++	if (disable_beacon < 0) {
++		wpa_printf(MSG_ERROR, "Invalid value for beacon ctrl");
++		return -1;
++	}
++
++	if (hostapd_drv_beacon_ctrl(hapd, !disable_beacon) == 0)
++		return os_snprintf(buf, buflen, "OK\n");
++	else
++		return -1;
++}
+ 
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+@@ -4615,6 +4631,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 							reply, reply_size);
+ 	} else if (os_strncmp(buf, "SET_OFFCHAN_CTRL", 16) == 0) {
+ 		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
++	} else if (os_strncmp(buf, "NO_BEACON ", 10) == 0) {
++		reply_len = hostapd_ctrl_iface_disable_beacon(hapd, buf + 10, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index 0c4a176..60e963a 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1393,6 +1393,11 @@ static int hostapd_cli_cmd_get_mu(struct wpa_ctrl *ctrl, int argc,
+ 	return hostapd_cli_cmd(ctrl, "GET_MU", 0, NULL, NULL);
+ }
+ 
++static int hostapd_cli_cmd_disable_beacon(struct wpa_ctrl *ctrl, int argc,
++					  char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "NO_BEACON", 1, argc, argv);
++}
+ 
+ #ifdef CONFIG_DPP
+ 
+@@ -1762,6 +1767,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+ 		"<value> [0-15] bitmap- UL MU-MIMO(bit3), DL MU-MIMO(bit2), UL OFDMA(bit1), DL OFDMA(bit0)"},
+ 	{ "get_mu", hostapd_cli_cmd_get_mu, NULL,
+ 		" = show mu onoff value in 0-15 bitmap"},
++	{ "no_beacon", hostapd_cli_cmd_disable_beacon, NULL,
++		"<value> 0: Enable beacon, 1: Disable beacon"},
+ #ifdef CONFIG_DPP
+ 	{ "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
+ 	  "report a scanned DPP URI from a QR Code" },
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index a060f5c..b1f7c92 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1143,3 +1143,10 @@ int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_
+ 		return 0;
+ 	return hapd->driver->amnt_dump(hapd->drv_priv, amnt_idx, amnt_dump_buf);
+ }
++
++int hostapd_drv_beacon_ctrl(struct hostapd_data *hapd, u8 beacon_mode)
++{
++		if (!hapd->driver || !hapd->driver->beacon_ctrl)
++			return 0;
++		return hapd->driver->beacon_ctrl(hapd->drv_priv, beacon_mode);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 5f11a57..c5fdb00 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -158,6 +158,7 @@ int hostapd_drv_ap_trig_type(struct hostapd_data *hapd, u8 enable, u8 type);
+ 
+ int hostapd_drv_amnt_set(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_sta_mac);
+ int hostapd_drv_amnt_dump(struct hostapd_data *hapd, u8 amnt_idx, u8 *amnt_dump_buf);
++int hostapd_drv_beacon_ctrl(struct hostapd_data *hapd, u8 beacon_mode);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 21e735f..c7ed8e8 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -16,6 +16,7 @@ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
+ 	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
+ 	MTK_NL80211_VENDOR_SUBCMD_BSS_COLOR_CTRL = 0xca,
++	MTK_NL80211_VENDOR_SUBCMD_BEACON_CTRL = 0xcd,
+ 	MTK_NL80211_VENDOR_SUBCMD_TXPOWER_CTRL = 0xce,
+ };
+ 
+@@ -253,6 +254,17 @@ enum mtk_vendor_attr_txpower_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_TXPOWER_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_beacon_ctrl {
++	MTK_VENDOR_ATTR_BEACON_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_BEACON_CTRL_MODE,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_BEACON_CTRL,
++	MTK_VENDOR_ATTR_BEACON_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_BEACON_CTRL - 1
++};
++
+ #define CSI_MAX_COUNT 256
+ #define ETH_ALEN 6
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 0e3934e..f420464 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4749,6 +4749,13 @@ struct wpa_driver_ops {
+ 	 int (*mu_ctrl)(void *priv, u8 mode, u8 val);
+ 	 int (*mu_dump)(void *priv, u8 *mu_onoff);
+ 
++	/**
++	* beacon_ctrl - ctrl on off for beacon
++	* @priv: Private driver interface data
++	*
++	*/
++	int (*beacon_ctrl)(void *priv, u8 beacon_mode);
++
+ 	/**
+ 	 * three_wire_ctrl - set three_wire_ctrl mode
+ 	 * @priv: Private driver interface data
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index c8720bb..a1ce671 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12565,6 +12565,38 @@ static int nl80211_mu_dump(void *priv, u8 *mu_onoff)
+ }
+ #endif /* CONFIG_IEEE80211AX */
+ 
++static int nl80211_beacon_ctrl(void *priv, u8 beacon_mode)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_beacon_ctrl_vendor_cmd_avail) {
++		wpa_printf(MSG_ERROR,
++			   "nl80211: Driver does not support setting beacon control");
++		return 0;
++	}
++
++	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_BEACON_CTRL) ||
++		!(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
++		nla_put_u8(msg, MTK_VENDOR_ATTR_BEACON_CTRL_MODE, beacon_mode)) {
++		nlmsg_free(msg);
++		return -ENOBUFS;
++	}
++
++	nla_nest_end(msg, data);
++
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++
++	if (ret)
++		wpa_printf(MSG_ERROR, "Failed to set beacon_ctrl. ret=%d (%s)", ret, strerror(-ret));
++
++	return ret;
++}
+ 
+ #ifdef CONFIG_DPP
+ static int nl80211_dpp_listen(void *priv, bool enable)
+@@ -13586,6 +13618,7 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.set_4addr_mode = nl80211_set_4addr_mode,
+ 	.mu_ctrl = nl80211_mu_ctrl,
+ 	.mu_dump = nl80211_mu_dump,
++	.beacon_ctrl = nl80211_beacon_ctrl,
+ #ifdef CONFIG_DPP
+ 	.dpp_listen = nl80211_dpp_listen,
+ #endif /* CONFIG_DPP */
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 640fdc5..53cf2be 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -190,6 +190,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int mtk_rfeatures_vendor_cmd_avail:1;
+ 	unsigned int mtk_amnt_vendor_cmd_avail:1;
+ 	unsigned int mtk_txpower_vendor_cmd_avail:1;
++	unsigned int mtk_beacon_ctrl_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 004c452..d13a64c 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1103,6 +1103,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_TXPOWER_CTRL:
+ 					drv->mtk_txpower_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_BEACON_CTRL :
++					drv->mtk_beacon_ctrl_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/patches.inc b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
index 5268b34..73393d2 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
@@ -116,5 +116,9 @@
     file://mtk-0048-hostapd-mtk-add-support-for-channel-switching-with-c.patch \
     file://mtk-0049-hostapd-mtk-Add-DFS-offchan-channel-switch.patch \
     file://mtk-0050-hostapd-mtk-Add-txpower-vendor-command.patch \
+    file://mtk-0050-hostapd-mtk-add-support-for-removeing-the-main-BSS.patch \
     file://mtk-0051-hostapd-mtk-Update-Wide-Bandwidth-Channel-Switch-element.patch \
+    file://mtk-0051-hostapd-mtk-add-support-for-enable-disable-single-BS.patch \
+    file://mtk-0052-hostapd-mtk-ACS-remove-chan-freq-list-check-when-sca.patch \
+    file://mtk-0053-hostapd-mtk-add-no_beacon-vendor-command-for-cert.patch \
     "