[rdk-b][common][bsp][Refactor and sync kernel/wifi from Openwrt]

[Description]
Refactor and sync kernel/wifi7 from Openwrt

[Release-log]
N/A

diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/015-ipw200-mtu.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/015-ipw200-mtu.patch
deleted file mode 100644
index 68db4f7..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/build/015-ipw200-mtu.patch
+++ /dev/null
@@ -1,34 +0,0 @@
---- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
-+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
-@@ -11470,6 +11470,15 @@ static const struct attribute_group ipw_
- 	.attrs = ipw_sysfs_entries,
- };
- 
-+#if LINUX_VERSION_IS_LESS(4,10,0)
-+static int __change_mtu(struct net_device *ndev, int new_mtu){
-+	if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
-+		return -EINVAL;
-+	ndev->mtu = new_mtu;
-+	return 0;
-+}
-+#endif
-+
- #ifdef CPTCFG_IPW2200_PROMISCUOUS
- static int ipw_prom_open(struct net_device *dev)
- {
-@@ -11518,15 +11527,6 @@ static netdev_tx_t ipw_prom_hard_start_x
- 	return NETDEV_TX_OK;
- }
- 
--#if LINUX_VERSION_IS_LESS(4,10,0)
--static int __change_mtu(struct net_device *ndev, int new_mtu){
--	if (new_mtu < 68 || new_mtu > LIBIPW_DATA_LEN)
--		return -EINVAL;
--	ndev->mtu = new_mtu;
--	return 0;
--}
--#endif
--
- static const struct net_device_ops ipw_prom_netdev_ops = {
- #if LINUX_VERSION_IS_LESS(4,10,0)
- 	.ndo_change_mtu = __change_mtu,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/060-no_local_ssb_bcma.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/060-no_local_ssb_bcma.patch
index 089ff21..4ad2ac0 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/build/060-no_local_ssb_bcma.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/060-no_local_ssb_bcma.patch
@@ -1,6 +1,6 @@
 --- a/local-symbols
 +++ b/local-symbols
-@@ -451,43 +451,6 @@ USB_VL600=
+@@ -470,43 +470,6 @@ USB_VL600=
  USB_NET_CH9200=
  USB_NET_AQC111=
  USB_RTL8153_ECM=
@@ -99,7 +99,7 @@
  	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
  #else
  	return bus->chipco.dev;
-@@ -4870,7 +4870,7 @@ static int b43_wireless_core_init(struct
+@@ -4871,7 +4871,7 @@ static int b43_wireless_core_init(struct
  	}
  	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
  		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
@@ -158,27 +158,6 @@
  	pcidev = bus->pcicore.dev;
  #endif
  	gpiodev = bus->chipco.dev ? : pcidev;
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/led.h
-@@ -24,7 +24,7 @@ struct brcms_led {
- 	struct gpio_desc *gpiod;
- };
- 
--#ifdef CPTCFG_BCMA_DRIVER_GPIO
-+#ifdef CONFIG_BCMA_DRIVER_GPIO
- void brcms_led_unregister(struct brcms_info *wl);
- int brcms_led_register(struct brcms_info *wl);
- #else
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/Makefile
-@@ -42,6 +42,6 @@ brcmsmac-y := \
- 	brcms_trace_events.o \
- 	debug.o
- 
--brcmsmac-$(CPTCFG_BCMA_DRIVER_GPIO) += led.o
-+brcmsmac-$(CONFIG_BCMA_DRIVER_GPIO) += led.o
- 
- obj-$(CPTCFG_BRCMSMAC)	+= brcmsmac.o
 --- a/drivers/net/wireless/broadcom/brcm80211/Kconfig
 +++ b/drivers/net/wireless/broadcom/brcm80211/Kconfig
 @@ -8,7 +8,7 @@ config BRCMSMAC
@@ -187,12 +166,12 @@
  	depends on BCMA_POSSIBLE
 -	select BCMA
 +	depends on BCMA
- 	select NEW_LEDS if BCMA_DRIVER_GPIO
- 	select LEDS_CLASS if BCMA_DRIVER_GPIO
  	select BRCMUTIL
+ 	depends on FW_LOADER
+ 	depends on CORDIC
 --- a/Kconfig.local
 +++ b/Kconfig.local
-@@ -1357,117 +1357,6 @@ config BACKPORTED_USB_NET_AQC111
+@@ -1414,117 +1414,6 @@ config BACKPORTED_USB_NET_AQC111
  config BACKPORTED_USB_RTL8153_ECM
  	tristate
  	default USB_RTL8153_ECM
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/070-remove-broken-wext-select.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/070-remove-broken-wext-select.patch
index 77b6e1d..121b7fa 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/build/070-remove-broken-wext-select.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/070-remove-broken-wext-select.patch
@@ -5,6 +5,6 @@
  	depends on WLAN && MMC && CFG80211
  	depends on m
 -	select CFG80211_WEXT
+ 	depends on CRYPTO
  	select BPAUTO_CRYPTO_LIB_ARC4
  	help
- 	This option enables support for RTL8723BS SDIO drivers, such as
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/080-resv_start_op.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/080-resv_start_op.patch
new file mode 100644
index 0000000..67ccc73
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/080-resv_start_op.patch
@@ -0,0 +1,24 @@
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -5363,7 +5363,9 @@ static struct genl_family hwsim_genl_fam
+ 	.module = THIS_MODULE,
+ 	.small_ops = hwsim_ops,
+ 	.n_small_ops = ARRAY_SIZE(hwsim_ops),
++#if LINUX_VERSION_IS_GEQ(6,1,0)
+ 	.resv_start_op = HWSIM_CMD_DEL_MAC_ADDR + 1,
++#endif
+ 	.mcgrps = hwsim_mcgrps,
+ 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
+ };
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -17232,7 +17232,9 @@ static struct genl_family nl80211_fam __
+ 	.n_ops = ARRAY_SIZE(nl80211_ops),
+ 	.small_ops = nl80211_small_ops,
+ 	.n_small_ops = ARRAY_SIZE(nl80211_small_ops),
++#if LINUX_VERSION_IS_GEQ(6,1,0)
+ 	.resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
++#endif
+ 	.mcgrps = nl80211_mcgrps,
+ 	.n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
+ 	.parallel_ops = true,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/090-bcma-otp.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/build/090-bcma-otp.patch
new file mode 100644
index 0000000..3974776
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/090-bcma-otp.patch
@@ -0,0 +1,13 @@
+--- /dev/null
++++ b/backport-include/linux/bcma/bcma_driver_chipcommon.h
+@@ -0,0 +1,10 @@
++#ifndef __BACKPORT_BCMA_DRIVER_CHIPCOMMON_H
++#define __BACKPORT_BCMA_DRIVER_CHIPCOMMON_H
++
++#include_next <linux/bcma/bcma_driver_chipcommon.h>
++
++#ifndef BCMA_CC_SROM_CONTROL_OTP_PRESENT
++#define BCMA_CC_SROM_CONTROL_OTP_PRESENT 0x00000020
++#endif
++
++#endif
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
index a50f5cd..b733e12 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/build/build.inc
@@ -5,8 +5,9 @@
     file://002-change_allconfig.patch \
     file://003-remove_bogus_modparams.patch \
     file://012-kernel_build_check.patch \
-    file://015-ipw200-mtu.patch \
     file://050-lib80211_option.patch \
     file://060-no_local_ssb_bcma.patch \
     file://070-remove-broken-wext-select.patch \
+    file://080-resv_start_op.patch \
+    file://090-bcma-otp.patch \
     "
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index 397026b..4dd26da 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -9,11 +9,11 @@
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1319,7 +1319,6 @@ static int ieee80211_stop_ap(struct wiph
- 	sdata->vif.bss_conf.ftmr_params = NULL;
+@@ -1512,7 +1512,6 @@ static int ieee80211_stop_ap(struct wiph
+ 	link_conf->ftmr_params = NULL;
  
  	__sta_info_flush(sdata, true);
 -	ieee80211_free_keys(sdata, true);
  
- 	sdata->vif.bss_conf.enable_beacon = false;
+ 	link_conf->enable_beacon = false;
  	sdata->beacon_rate_set = false;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/150-disable_addr_notifier.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/150-disable_addr_notifier.patch
deleted file mode 100644
index 7ad5427..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/150-disable_addr_notifier.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 24 Feb 2013 00:00:00 +0100
-Subject: [PATCH] mac80211: disable ipv4/ipv6 address notifiers
-
----
- net/mac80211/main.c | 18 +++++++++---------
- 1 file changed, 9 insertions(+), 9 deletions(-)
-
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -337,7 +337,7 @@ void ieee80211_restart_hw(struct ieee802
- }
- EXPORT_SYMBOL(ieee80211_restart_hw);
- 
--#ifdef CONFIG_INET
-+#ifdef __disabled__CONFIG_INET
- static int ieee80211_ifa_changed(struct notifier_block *nb,
- 				 unsigned long data, void *arg)
- {
-@@ -396,7 +396,7 @@ static int ieee80211_ifa_changed(struct
- }
- #endif
- 
--#if IS_ENABLED(CONFIG_IPV6)
-+#if IS_ENABLED(__disabled__CONFIG_IPV6)
- static int ieee80211_ifa6_changed(struct notifier_block *nb,
- 				  unsigned long data, void *arg)
- {
-@@ -1321,14 +1321,14 @@ int ieee80211_register_hw(struct ieee802
- 	wiphy_unlock(hw->wiphy);
- 	rtnl_unlock();
- 
--#ifdef CONFIG_INET
-+#ifdef __disabled__CONFIG_INET
- 	local->ifa_notifier.notifier_call = ieee80211_ifa_changed;
- 	result = register_inetaddr_notifier(&local->ifa_notifier);
- 	if (result)
- 		goto fail_ifa;
- #endif
- 
--#if IS_ENABLED(CONFIG_IPV6)
-+#if IS_ENABLED(__disabled__CONFIG_IPV6)
- 	local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
- 	result = register_inet6addr_notifier(&local->ifa6_notifier);
- 	if (result)
-@@ -1337,13 +1337,13 @@ int ieee80211_register_hw(struct ieee802
- 
- 	return 0;
- 
--#if IS_ENABLED(CONFIG_IPV6)
-+#if IS_ENABLED(__disabled__CONFIG_IPV6)
-  fail_ifa6:
--#ifdef CONFIG_INET
-+#ifdef __disabled__CONFIG_INET
- 	unregister_inetaddr_notifier(&local->ifa_notifier);
- #endif
- #endif
--#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
-+#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6)
-  fail_ifa:
- #endif
- 	wiphy_unregister(local->hw.wiphy);
-@@ -1373,10 +1373,10 @@ void ieee80211_unregister_hw(struct ieee
- 	tasklet_kill(&local->tx_pending_tasklet);
- 	tasklet_kill(&local->tasklet);
- 
--#ifdef CONFIG_INET
-+#ifdef __disabled__CONFIG_INET
- 	unregister_inetaddr_notifier(&local->ifa_notifier);
- #endif
--#if IS_ENABLED(CONFIG_IPV6)
-+#if IS_ENABLED(__disabled__CONFIG_IPV6)
- 	unregister_inet6addr_notifier(&local->ifa6_notifier);
- #endif
- 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch
index 9b8e084..bfbb28c 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/210-ap_scan.patch
@@ -8,12 +8,12 @@
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2497,7 +2497,7 @@ static int ieee80211_scan(struct wiphy *
- 		 * the  frames sent while scanning on other channel will be
- 		 * lost)
+@@ -2720,6 +2720,8 @@ static int ieee80211_scan(struct wiphy *
  		 */
--		if (sdata->u.ap.beacon &&
-+		if (0 && sdata->u.ap.beacon &&
- 		    (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
- 		     !(req->flags & NL80211_SCAN_FLAG_AP)))
- 			return -EOPNOTSUPP;
+ 		fallthrough;
+ 	case NL80211_IFTYPE_AP:
++		/* skip check */
++		break;
+ 		/*
+ 		 * If the scan has been forced (and the driver supports
+ 		 * forcing), don't care about being beaconing already.
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
index d09d707..63b2177 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
@@ -28,7 +28,7 @@
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -357,6 +357,7 @@ struct sta_info *sta_info_alloc(struct i
+@@ -554,6 +554,7 @@ __sta_info_alloc(struct ieee80211_sub_if
  	INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
  	INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
  	mutex_init(&sta->ampdu_mlme.mtx);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/302-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
similarity index 100%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/302-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
similarity index 94%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
index 3be43b8..f26477e 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
@@ -18,7 +18,7 @@
 
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -703,7 +703,8 @@ minstrel_ht_calc_rate_stats(struct minst
+@@ -769,7 +769,8 @@ minstrel_ht_calc_rate_stats(struct minst
  	unsigned int cur_prob;
  
  	if (unlikely(mrs->attempts > 0)) {
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/303-v5.16-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/303-v5.16-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
deleted file mode 100644
index 159aad5..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/303-v5.16-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From: Xing Song <xing.song@mediatek.com>
-Date: Tue, 23 Nov 2021 11:31:23 +0800
-Subject: [PATCH] mac80211: set up the fwd_skb->dev for mesh forwarding
-
-Mesh forwarding requires that the fwd_skb->dev is set up for TX handling,
-otherwise the following warning will be generated, so set it up for the
-pending frames.
-
-[   72.835674 ] WARNING: CPU: 0 PID: 1193 at __skb_flow_dissect+0x284/0x1298
-[   72.842379 ] Modules linked in: ksmbd pppoe ppp_async l2tp_ppp ...
-[   72.962020 ] CPU: 0 PID: 1193 Comm: kworker/u5:1 Tainted: P S 5.4.137 #0
-[   72.969938 ] Hardware name: MT7622_MT7531 RFB (DT)
-[   72.974659 ] Workqueue: napi_workq napi_workfn
-[   72.979025 ] pstate: 60000005 (nZCv daif -PAN -UAO)
-[   72.983822 ] pc : __skb_flow_dissect+0x284/0x1298
-[   72.988444 ] lr : __skb_flow_dissect+0x54/0x1298
-[   72.992977 ] sp : ffffffc010c738c0
-[   72.996293 ] x29: ffffffc010c738c0 x28: 0000000000000000
-[   73.001615 ] x27: 000000000000ffc2 x26: ffffff800c2eb818
-[   73.006937 ] x25: ffffffc010a987c8 x24: 00000000000000ce
-[   73.012259 ] x23: ffffffc010c73a28 x22: ffffffc010a99c60
-[   73.017581 ] x21: 000000000000ffc2 x20: ffffff80094da800
-[   73.022903 ] x19: 0000000000000000 x18: 0000000000000014
-[   73.028226 ] x17: 00000000084d16af x16: 00000000d1fc0bab
-[   73.033548 ] x15: 00000000715f6034 x14: 000000009dbdd301
-[   73.038870 ] x13: 00000000ea4dcbc3 x12: 0000000000000040
-[   73.044192 ] x11: 000000000eb00ff0 x10: 0000000000000000
-[   73.049513 ] x9 : 000000000eb00073 x8 : 0000000000000088
-[   73.054834 ] x7 : 0000000000000000 x6 : 0000000000000001
-[   73.060155 ] x5 : 0000000000000000 x4 : 0000000000000000
-[   73.065476 ] x3 : ffffffc010a98000 x2 : 0000000000000000
-[   73.070797 ] x1 : 0000000000000000 x0 : 0000000000000000
-[   73.076120 ] Call trace:
-[   73.078572 ]  __skb_flow_dissect+0x284/0x1298
-[   73.082846 ]  __skb_get_hash+0x7c/0x228
-[   73.086629 ]  ieee80211_txq_may_transmit+0x7fc/0x17b8 [mac80211]
-[   73.092564 ]  ieee80211_tx_prepare_skb+0x20c/0x268 [mac80211]
-[   73.098238 ]  ieee80211_tx_pending+0x144/0x330 [mac80211]
-[   73.103560 ]  tasklet_action_common.isra.16+0xb4/0x158
-[   73.108618 ]  tasklet_action+0x2c/0x38
-[   73.112286 ]  __do_softirq+0x168/0x3b0
-[   73.115954 ]  do_softirq.part.15+0x88/0x98
-[   73.119969 ]  __local_bh_enable_ip+0xb0/0xb8
-[   73.124156 ]  napi_workfn+0x58/0x90
-[   73.127565 ]  process_one_work+0x20c/0x478
-[   73.131579 ]  worker_thread+0x50/0x4f0
-[   73.135249 ]  kthread+0x124/0x128
-[   73.138484 ]  ret_from_fork+0x10/0x1c
-
-Signed-off-by: Xing Song <xing.song@mediatek.com>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2950,6 +2950,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
- 	if (!fwd_skb)
- 		goto out;
- 
-+	fwd_skb->dev = sdata->dev;
- 	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
- 	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
- 	info = IEEE80211_SKB_CB(fwd_skb);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
similarity index 89%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
index 13bed48..9b3cc3a 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
@@ -18,7 +18,7 @@
 
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -514,6 +514,14 @@ minstrel_ht_set_best_prob_rate(struct mi
+@@ -580,6 +580,14 @@ minstrel_ht_set_best_prob_rate(struct mi
  	int cur_tp_avg, cur_group, cur_idx;
  	int max_gpr_group, max_gpr_idx;
  	int max_gpr_tp_avg, max_gpr_prob;
@@ -33,7 +33,7 @@
  
  	cur_group = MI_RATE_GROUP(index);
  	cur_idx = MI_RATE_IDX(index);
-@@ -535,11 +543,6 @@ minstrel_ht_set_best_prob_rate(struct mi
+@@ -601,11 +609,6 @@ minstrel_ht_set_best_prob_rate(struct mi
  	    !minstrel_ht_is_legacy_group(max_tp_group))
  		return;
  
@@ -45,7 +45,7 @@
  	max_gpr_group = MI_RATE_GROUP(mg->max_group_prob_rate);
  	max_gpr_idx = MI_RATE_IDX(mg->max_group_prob_rate);
  	max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_avg;
-@@ -597,40 +600,6 @@ minstrel_ht_assign_best_tp_rates(struct
+@@ -663,40 +666,6 @@ minstrel_ht_assign_best_tp_rates(struct
  
  }
  
@@ -60,7 +60,7 @@
 -	int tmp_max_streams, group, tmp_idx, tmp_prob;
 -	int tmp_tp = 0;
 -
--	if (!mi->sta->ht_cap.ht_supported)
+-	if (!mi->sta->deflink.ht_cap.ht_supported)
 -		return;
 -
 -	group = MI_RATE_GROUP(mi->max_tp_rate[0]);
@@ -86,7 +86,7 @@
  static u16
  __minstrel_ht_get_sample_rate(struct minstrel_ht_sta *mi,
  			      enum minstrel_sample_type type)
-@@ -1110,8 +1079,6 @@ minstrel_ht_update_stats(struct minstrel
+@@ -1176,8 +1145,6 @@ minstrel_ht_update_stats(struct minstrel
  
  	mi->max_prob_rate = tmp_max_prob_rate;
  
@@ -95,7 +95,7 @@
  	minstrel_ht_refill_sample_rates(mi);
  
  #ifdef CPTCFG_MAC80211_DEBUGFS
-@@ -1156,7 +1123,7 @@ minstrel_ht_txstat_valid(struct minstrel
+@@ -1256,7 +1223,7 @@ minstrel_ht_ri_txstat_valid(struct minst
  }
  
  static void
@@ -104,7 +104,7 @@
  {
  	int group, orig_group;
  
-@@ -1171,11 +1138,7 @@ minstrel_downgrade_rate(struct minstrel_
+@@ -1271,11 +1238,7 @@ minstrel_downgrade_rate(struct minstrel_
  		    minstrel_mcs_groups[orig_group].streams)
  			continue;
  
@@ -117,7 +117,7 @@
  	}
  }
  
-@@ -1186,7 +1149,7 @@ minstrel_ht_tx_status(void *priv, struct
+@@ -1286,7 +1249,7 @@ minstrel_ht_tx_status(void *priv, struct
  	struct ieee80211_tx_info *info = st->info;
  	struct minstrel_ht_sta *mi = priv_sta;
  	struct ieee80211_tx_rate *ar = info->status.rates;
@@ -126,7 +126,7 @@
  	struct minstrel_priv *mp = priv;
  	u32 update_interval = mp->update_interval;
  	bool last, update = false;
-@@ -1236,18 +1199,13 @@ minstrel_ht_tx_status(void *priv, struct
+@@ -1354,18 +1317,13 @@ minstrel_ht_tx_status(void *priv, struct
  		/*
  		 * check for sudden death of spatial multiplexing,
  		 * downgrade to a lower number of streams if necessary.
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/337-mac80211-increase-quantum-for-airtime-scheduler.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
similarity index 89%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/337-mac80211-increase-quantum-for-airtime-scheduler.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
index 74e8576..d541b62 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/337-mac80211-increase-quantum-for-airtime-scheduler.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -23,7 +23,7 @@
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -3894,7 +3894,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -3976,7 +3976,7 @@ struct ieee80211_txq *ieee80211_next_txq
  
  		if (deficit < 0)
  			sta->airtime[txqi->txq.ac].deficit +=
@@ -32,7 +32,7 @@
  
  		if (deficit < 0 || !aql_check) {
  			list_move_tail(&txqi->schedule_order,
-@@ -4037,7 +4037,8 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4119,7 +4119,8 @@ bool ieee80211_txq_may_transmit(struct i
  		}
  		sta = container_of(iter->txq.sta, struct sta_info, sta);
  		if (ieee80211_sta_deficit(sta, ac) < 0)
@@ -42,7 +42,7 @@
  		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
  	}
  
-@@ -4045,7 +4046,7 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4127,7 +4128,7 @@ bool ieee80211_txq_may_transmit(struct i
  	if (sta->airtime[ac].deficit >= 0)
  		goto out;
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-01-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-01-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch
new file mode 100644
index 0000000..7686983
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-01-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch
@@ -0,0 +1,192 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Sun, 9 Oct 2022 18:30:38 +0200
+Subject: [PATCH] wifi: mac80211: add internal handler for wake_tx_queue
+
+Start to align the TX handling to only use internal TX queues (iTXQs):
+
+Provide a handler for drivers not having a custom wake_tx_queue
+callback and update the documentation.
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -89,15 +89,13 @@
+ /**
+  * DOC: mac80211 software tx queueing
+  *
+- * mac80211 provides an optional intermediate queueing implementation designed
+- * to allow the driver to keep hardware queues short and provide some fairness
+- * between different stations/interfaces.
+- * In this model, the driver pulls data frames from the mac80211 queue instead
+- * of letting mac80211 push them via drv_tx().
+- * Other frames (e.g. control or management) are still pushed using drv_tx().
++ * mac80211 uses an intermediate queueing implementation, designed to allow the
++ * driver to keep hardware queues short and to provide some fairness between
++ * different stations/interfaces.
+  *
+- * Drivers indicate that they use this model by implementing the .wake_tx_queue
+- * driver operation.
++ * Drivers must provide the .wake_tx_queue driver operation by either
++ * linking it to ieee80211_handle_wake_tx_queue() or implementing a custom
++ * handler.
+  *
+  * Intermediate queues (struct ieee80211_txq) are kept per-sta per-tid, with
+  * another per-sta for non-data/non-mgmt and bufferable management frames, and
+@@ -106,9 +104,12 @@
+  * The driver is expected to initialize its private per-queue data for stations
+  * and interfaces in the .add_interface and .sta_add ops.
+  *
+- * The driver can't access the queue directly. To dequeue a frame from a
+- * txq, it calls ieee80211_tx_dequeue(). Whenever mac80211 adds a new frame to a
+- * queue, it calls the .wake_tx_queue driver op.
++ * The driver can't access the internal TX queues (iTXQs) directly.
++ * Whenever mac80211 adds a new frame to a queue, it calls the .wake_tx_queue
++ * driver op.
++ * Drivers implementing a custom .wake_tx_queue op can get them by calling
++ * ieee80211_tx_dequeue(). Drivers using ieee80211_handle_wake_tx_queue() will
++ * simply get the individual frames pushed via the .tx driver operation.
+  *
+  * Drivers can optionally delegate responsibility for scheduling queues to
+  * mac80211, to take advantage of airtime fairness accounting. In this case, to
+@@ -1826,7 +1827,7 @@ struct ieee80211_vif_cfg {
+  *	for this interface.
+  * @drv_priv: data area for driver use, will always be aligned to
+  *	sizeof(void \*).
+- * @txq: the multicast data TX queue (if driver uses the TXQ abstraction)
++ * @txq: the multicast data TX queue
+  * @txqs_stopped: per AC flag to indicate that intermediate TXQs are stopped,
+  *	protected by fq->lock.
+  * @offload_flags: 802.3 -> 802.11 enapsulation offload flags, see
+@@ -2252,8 +2253,8 @@ struct ieee80211_link_sta {
+  *	For non MLO STA it will point to the deflink data. For MLO STA
+  *	ieee80211_sta_recalc_aggregates() must be called to update it.
+  * @support_p2p_ps: indicates whether the STA supports P2P PS mechanism or not.
+- * @txq: per-TID data TX queues (if driver uses the TXQ abstraction); note that
+- *	the last entry (%IEEE80211_NUM_TIDS) is used for non-data frames
++ * @txq: per-TID data TX queues; note that the last entry (%IEEE80211_NUM_TIDS)
++ *	is used for non-data frames
+  * @deflink: This holds the default link STA information, for non MLO STA all link
+  *	specific STA information is accessed through @deflink or through
+  *	link[0] which points to address of @deflink. For MLO Link STA
+@@ -5691,7 +5692,7 @@ void ieee80211_key_replay(struct ieee802
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  * @queue: queue number (counted from zero).
+  *
+- * Drivers should use this function instead of netif_wake_queue.
++ * Drivers must use this function instead of netif_wake_queue.
+  */
+ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue);
+ 
+@@ -5700,7 +5701,7 @@ void ieee80211_wake_queue(struct ieee802
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  * @queue: queue number (counted from zero).
+  *
+- * Drivers should use this function instead of netif_stop_queue.
++ * Drivers must use this function instead of netif_stop_queue.
+  */
+ void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue);
+ 
+@@ -5709,7 +5710,7 @@ void ieee80211_stop_queue(struct ieee802
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  * @queue: queue number (counted from zero).
+  *
+- * Drivers should use this function instead of netif_stop_queue.
++ * Drivers must use this function instead of netif_queue_stopped.
+  *
+  * Return: %true if the queue is stopped. %false otherwise.
+  */
+@@ -5720,7 +5721,7 @@ int ieee80211_queue_stopped(struct ieee8
+  * ieee80211_stop_queues - stop all queues
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  *
+- * Drivers should use this function instead of netif_stop_queue.
++ * Drivers must use this function instead of netif_tx_stop_all_queues.
+  */
+ void ieee80211_stop_queues(struct ieee80211_hw *hw);
+ 
+@@ -5728,7 +5729,7 @@ void ieee80211_stop_queues(struct ieee80
+  * ieee80211_wake_queues - wake all queues
+  * @hw: pointer as obtained from ieee80211_alloc_hw().
+  *
+- * Drivers should use this function instead of netif_wake_queue.
++ * Drivers must use this function instead of netif_tx_wake_all_queues.
+  */
+ void ieee80211_wake_queues(struct ieee80211_hw *hw);
+ 
+@@ -6950,6 +6951,18 @@ static inline struct sk_buff *ieee80211_
+ }
+ 
+ /**
++ * ieee80211_handle_wake_tx_queue - mac80211 handler for wake_tx_queue callback
++ *
++ * @hw: pointer as obtained from wake_tx_queue() callback().
++ * @txq: pointer as obtained from wake_tx_queue() callback().
++ *
++ * Drivers can use this function for the mandatory mac80211 wake_tx_queue
++ * callback in struct ieee80211_ops. They should not call this function.
++ */
++void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
++				    struct ieee80211_txq *txq);
++
++/**
+  * ieee80211_next_txq - get next tx queue to pull packets from
+  *
+  * @hw: pointer as obtained from ieee80211_alloc_hw()
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -288,6 +288,52 @@ __le16 ieee80211_ctstoself_duration(stru
+ }
+ EXPORT_SYMBOL(ieee80211_ctstoself_duration);
+ 
++static void wake_tx_push_queue(struct ieee80211_local *local,
++			       struct ieee80211_sub_if_data *sdata,
++			       struct ieee80211_txq *queue)
++{
++	int q = sdata->vif.hw_queue[queue->ac];
++	struct ieee80211_tx_control control = {
++		.sta = queue->sta,
++	};
++	struct sk_buff *skb;
++	unsigned long flags;
++	bool q_stopped;
++
++	while (1) {
++		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
++		q_stopped = local->queue_stop_reasons[q];
++		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
++
++		if (q_stopped)
++			break;
++
++		skb = ieee80211_tx_dequeue(&local->hw, queue);
++		if (!skb)
++			break;
++
++		drv_tx(local, &control, skb);
++	}
++}
++
++/* wake_tx_queue handler for driver not implementing a custom one*/
++void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
++				    struct ieee80211_txq *txq)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
++	struct ieee80211_txq *queue;
++
++	/* Use ieee80211_next_txq() for airtime fairness accounting */
++	ieee80211_txq_schedule_start(hw, txq->ac);
++	while ((queue = ieee80211_next_txq(hw, txq->ac))) {
++		wake_tx_push_queue(local, sdata, queue);
++		ieee80211_return_txq(hw, queue, false);
++	}
++	ieee80211_txq_schedule_end(hw, txq->ac);
++}
++EXPORT_SYMBOL(ieee80211_handle_wake_tx_queue);
++
+ static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
+ {
+ 	struct ieee80211_local *local = sdata->local;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-02-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-02-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch
new file mode 100644
index 0000000..8e2c205
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-02-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch
@@ -0,0 +1,396 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Sun, 9 Oct 2022 18:30:39 +0200
+Subject: [PATCH] wifi: mac80211: add wake_tx_queue callback to drivers
+
+mac80211 is fully switching over to the internal TX queue (iTXQ)
+implementation. Update all drivers not yet providing the now mandatory
+wake_tx_queue() callback.
+
+As an side effect the netdev interfaces of all updated drivers will
+switch to the noqueue qdisc.
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+[add staging drivers]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/drivers/net/wireless/admtek/adm8211.c
++++ b/drivers/net/wireless/admtek/adm8211.c
+@@ -1760,6 +1760,7 @@ static int adm8211_alloc_rings(struct ie
+ 
+ static const struct ieee80211_ops adm8211_ops = {
+ 	.tx			= adm8211_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= adm8211_start,
+ 	.stop			= adm8211_stop,
+ 	.add_interface		= adm8211_add_interface,
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -1355,6 +1355,7 @@ static const struct ieee80211_ops ar5523
+ 	.start			= ar5523_start,
+ 	.stop			= ar5523_stop,
+ 	.tx			= ar5523_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.set_rts_threshold	= ar5523_set_rts_threshold,
+ 	.add_interface		= ar5523_add_interface,
+ 	.remove_interface	= ar5523_remove_interface,
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -8539,6 +8539,7 @@ err_fallback:
+ 
+ static const struct ieee80211_ops ath11k_ops = {
+ 	.tx				= ath11k_mac_op_tx,
++	.wake_tx_queue			= ieee80211_handle_wake_tx_queue,
+ 	.start                          = ath11k_mac_op_start,
+ 	.stop                           = ath11k_mac_op_stop,
+ 	.reconfig_complete              = ath11k_mac_op_reconfig_complete,
+--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
++++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+@@ -781,6 +781,7 @@ static int ath5k_set_ringparam(struct ie
+ 
+ const struct ieee80211_ops ath5k_hw_ops = {
+ 	.tx			= ath5k_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= ath5k_start,
+ 	.stop			= ath5k_stop,
+ 	.add_interface		= ath5k_add_interface,
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -1870,6 +1870,7 @@ static void ath9k_htc_channel_switch_bea
+ 
+ struct ieee80211_ops ath9k_htc_ops = {
+ 	.tx                 = ath9k_htc_tx,
++	.wake_tx_queue      = ieee80211_handle_wake_tx_queue,
+ 	.start              = ath9k_htc_start,
+ 	.stop               = ath9k_htc_stop,
+ 	.add_interface      = ath9k_htc_add_interface,
+--- a/drivers/net/wireless/ath/carl9170/main.c
++++ b/drivers/net/wireless/ath/carl9170/main.c
+@@ -1715,6 +1715,7 @@ static const struct ieee80211_ops carl91
+ 	.start			= carl9170_op_start,
+ 	.stop			= carl9170_op_stop,
+ 	.tx			= carl9170_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.flush			= carl9170_op_flush,
+ 	.add_interface		= carl9170_op_add_interface,
+ 	.remove_interface	= carl9170_op_remove_interface,
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -1362,6 +1362,7 @@ static const struct ieee80211_ops wcn36x
+ 	.prepare_multicast	= wcn36xx_prepare_multicast,
+ 	.configure_filter       = wcn36xx_configure_filter,
+ 	.tx			= wcn36xx_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.set_key		= wcn36xx_set_key,
+ 	.hw_scan		= wcn36xx_hw_scan,
+ 	.cancel_hw_scan		= wcn36xx_cancel_hw_scan,
+--- a/drivers/net/wireless/atmel/at76c50x-usb.c
++++ b/drivers/net/wireless/atmel/at76c50x-usb.c
+@@ -2187,6 +2187,7 @@ static int at76_set_key(struct ieee80211
+ 
+ static const struct ieee80211_ops at76_ops = {
+ 	.tx = at76_mac80211_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.add_interface = at76_add_interface,
+ 	.remove_interface = at76_remove_interface,
+ 	.config = at76_config,
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -5171,6 +5171,7 @@ static int b43_op_get_survey(struct ieee
+ 
+ static const struct ieee80211_ops b43_hw_ops = {
+ 	.tx			= b43_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.conf_tx		= b43_op_conf_tx,
+ 	.add_interface		= b43_op_add_interface,
+ 	.remove_interface	= b43_op_remove_interface,
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -3532,6 +3532,7 @@ static int b43legacy_op_get_survey(struc
+ 
+ static const struct ieee80211_ops b43legacy_hw_ops = {
+ 	.tx			= b43legacy_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.conf_tx		= b43legacy_op_conf_tx,
+ 	.add_interface		= b43legacy_op_add_interface,
+ 	.remove_interface	= b43legacy_op_remove_interface,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+@@ -962,6 +962,7 @@ static int brcms_ops_beacon_set_tim(stru
+ 
+ static const struct ieee80211_ops brcms_ops = {
+ 	.tx = brcms_ops_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = brcms_ops_start,
+ 	.stop = brcms_ops_stop,
+ 	.add_interface = brcms_ops_add_interface,
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3435,6 +3435,7 @@ static const struct attribute_group il39
+ 
+ static struct ieee80211_ops il3945_mac_ops __ro_after_init = {
+ 	.tx = il3945_mac_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = il3945_mac_start,
+ 	.stop = il3945_mac_stop,
+ 	.add_interface = il_mac_add_interface,
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -6304,6 +6304,7 @@ il4965_tx_queue_set_status(struct il_pri
+ 
+ static const struct ieee80211_ops il4965_mac_ops = {
+ 	.tx = il4965_mac_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = il4965_mac_start,
+ 	.stop = il4965_mac_stop,
+ 	.add_interface = il_mac_add_interface,
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
+@@ -1571,6 +1571,7 @@ static void iwlagn_mac_sta_notify(struct
+ 
+ const struct ieee80211_ops iwlagn_hw_ops = {
+ 	.tx = iwlagn_mac_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = iwlagn_mac_start,
+ 	.stop = iwlagn_mac_stop,
+ #ifdef CONFIG_PM_SLEEP
+--- a/drivers/net/wireless/intersil/p54/main.c
++++ b/drivers/net/wireless/intersil/p54/main.c
+@@ -705,6 +705,7 @@ static void p54_set_coverage_class(struc
+ 
+ static const struct ieee80211_ops p54_ops = {
+ 	.tx			= p54_tx_80211,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= p54_start,
+ 	.stop			= p54_stop,
+ 	.add_interface		= p54_add_interface,
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3109,6 +3109,7 @@ static int mac80211_hwsim_change_sta_lin
+ 
+ #define HWSIM_COMMON_OPS					\
+ 	.tx = mac80211_hwsim_tx,				\
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,	\
+ 	.start = mac80211_hwsim_start,				\
+ 	.stop = mac80211_hwsim_stop,				\
+ 	.add_interface = mac80211_hwsim_add_interface,		\
+--- a/drivers/net/wireless/marvell/libertas_tf/main.c
++++ b/drivers/net/wireless/marvell/libertas_tf/main.c
+@@ -474,6 +474,7 @@ static int lbtf_op_get_survey(struct iee
+ 
+ static const struct ieee80211_ops lbtf_ops = {
+ 	.tx			= lbtf_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= lbtf_op_start,
+ 	.stop			= lbtf_op_stop,
+ 	.add_interface		= lbtf_op_add_interface,
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -5611,6 +5611,7 @@ static void mwl8k_sw_scan_complete(struc
+ 
+ static const struct ieee80211_ops mwl8k_ops = {
+ 	.tx			= mwl8k_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= mwl8k_start,
+ 	.stop			= mwl8k_stop,
+ 	.add_interface		= mwl8k_add_interface,
+--- a/drivers/net/wireless/mediatek/mt7601u/main.c
++++ b/drivers/net/wireless/mediatek/mt7601u/main.c
+@@ -406,6 +406,7 @@ out:
+ 
+ const struct ieee80211_ops mt7601u_ops = {
+ 	.tx = mt7601u_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = mt7601u_start,
+ 	.stop = mt7601u_stop,
+ 	.add_interface = mt7601u_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
+@@ -1706,6 +1706,7 @@ static int rt2400pci_tx_last_beacon(stru
+ 
+ static const struct ieee80211_ops rt2400pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2500pci.c
+@@ -2004,6 +2004,7 @@ static int rt2500pci_tx_last_beacon(stru
+ 
+ static const struct ieee80211_ops rt2500pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2500usb.c
+@@ -1795,6 +1795,7 @@ static int rt2500usb_probe_hw(struct rt2
+ 
+ static const struct ieee80211_ops rt2500usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800pci.c
+@@ -288,6 +288,7 @@ static int rt2800pci_read_eeprom(struct
+ 
+ static const struct ieee80211_ops rt2800pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -133,6 +133,7 @@ static int rt2800soc_write_firmware(stru
+ 
+ static const struct ieee80211_ops rt2800soc_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+@@ -630,6 +630,7 @@ static int rt2800usb_probe_hw(struct rt2
+ 
+ static const struct ieee80211_ops rt2800usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+@@ -2873,6 +2873,7 @@ static u64 rt61pci_get_tsf(struct ieee80
+ 
+ static const struct ieee80211_ops rt61pci_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/ralink/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt73usb.c
+@@ -2292,6 +2292,7 @@ static u64 rt73usb_get_tsf(struct ieee80
+ 
+ static const struct ieee80211_ops rt73usb_mac80211_ops = {
+ 	.tx			= rt2x00mac_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rt2x00mac_start,
+ 	.stop			= rt2x00mac_stop,
+ 	.add_interface		= rt2x00mac_add_interface,
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+@@ -1608,6 +1608,7 @@ static void rtl8180_configure_filter(str
+ 
+ static const struct ieee80211_ops rtl8180_ops = {
+ 	.tx			= rtl8180_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rtl8180_start,
+ 	.stop			= rtl8180_stop,
+ 	.add_interface		= rtl8180_add_interface,
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+@@ -1378,6 +1378,7 @@ static int rtl8187_conf_tx(struct ieee80
+ 
+ static const struct ieee80211_ops rtl8187_ops = {
+ 	.tx			= rtl8187_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= rtl8187_start,
+ 	.stop			= rtl8187_stop,
+ 	.add_interface		= rtl8187_add_interface,
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -6561,6 +6561,7 @@ static void rtl8xxxu_stop(struct ieee802
+ 
+ static const struct ieee80211_ops rtl8xxxu_ops = {
+ 	.tx = rtl8xxxu_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.add_interface = rtl8xxxu_add_interface,
+ 	.remove_interface = rtl8xxxu_remove_interface,
+ 	.config = rtl8xxxu_config,
+--- a/drivers/net/wireless/realtek/rtlwifi/core.c
++++ b/drivers/net/wireless/realtek/rtlwifi/core.c
+@@ -1912,6 +1912,7 @@ const struct ieee80211_ops rtl_ops = {
+ 	.start = rtl_op_start,
+ 	.stop = rtl_op_stop,
+ 	.tx = rtl_op_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.add_interface = rtl_op_add_interface,
+ 	.remove_interface = rtl_op_remove_interface,
+ 	.change_interface = rtl_op_change_interface,
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -896,6 +896,7 @@ static void rtw_ops_sta_rc_update(struct
+ 
+ const struct ieee80211_ops rtw_ops = {
+ 	.tx			= rtw_ops_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw_ops_wake_tx_queue,
+ 	.start			= rtw_ops_start,
+ 	.stop			= rtw_ops_stop,
+--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
+@@ -918,6 +918,7 @@ static int rtw89_ops_set_tid_config(stru
+ 
+ const struct ieee80211_ops rtw89_ops = {
+ 	.tx			= rtw89_ops_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw89_ops_wake_tx_queue,
+ 	.start			= rtw89_ops_start,
+ 	.stop			= rtw89_ops_stop,
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -1958,6 +1958,7 @@ static int rsi_mac80211_resume(struct ie
+ 
+ static const struct ieee80211_ops mac80211_ops = {
+ 	.tx = rsi_mac80211_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.start = rsi_mac80211_start,
+ 	.stop = rsi_mac80211_stop,
+ 	.add_interface = rsi_mac80211_add_interface,
+--- a/drivers/net/wireless/st/cw1200/main.c
++++ b/drivers/net/wireless/st/cw1200/main.c
+@@ -209,6 +209,7 @@ static const struct ieee80211_ops cw1200
+ 	.remove_interface	= cw1200_remove_interface,
+ 	.change_interface	= cw1200_change_interface,
+ 	.tx			= cw1200_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.hw_scan		= cw1200_hw_scan,
+ 	.set_tim		= cw1200_set_tim,
+ 	.sta_notify		= cw1200_sta_notify,
+--- a/drivers/net/wireless/ti/wl1251/main.c
++++ b/drivers/net/wireless/ti/wl1251/main.c
+@@ -1359,6 +1359,7 @@ static const struct ieee80211_ops wl1251
+ 	.prepare_multicast = wl1251_op_prepare_multicast,
+ 	.configure_filter = wl1251_op_configure_filter,
+ 	.tx = wl1251_op_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.set_key = wl1251_op_set_key,
+ 	.hw_scan = wl1251_op_hw_scan,
+ 	.bss_info_changed = wl1251_op_bss_info_changed,
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -5942,6 +5942,7 @@ static const struct ieee80211_ops wl1271
+ 	.prepare_multicast = wl1271_op_prepare_multicast,
+ 	.configure_filter = wl1271_op_configure_filter,
+ 	.tx = wl1271_op_tx,
++	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
+ 	.set_key = wlcore_op_set_key,
+ 	.hw_scan = wl1271_op_hw_scan,
+ 	.cancel_hw_scan = wl1271_op_cancel_hw_scan,
+--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
++++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+@@ -1344,6 +1344,7 @@ static u64 zd_op_get_tsf(struct ieee8021
+ 
+ static const struct ieee80211_ops zd_ops = {
+ 	.tx			= zd_op_tx,
++	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.start			= zd_op_start,
+ 	.stop			= zd_op_stop,
+ 	.add_interface		= zd_op_add_interface,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-03-wifi-mac80211-Drop-support-for-TX-push-path.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-03-wifi-mac80211-Drop-support-for-TX-push-path.patch
new file mode 100644
index 0000000..9d58345
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-03-wifi-mac80211-Drop-support-for-TX-push-path.patch
@@ -0,0 +1,655 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Sun, 9 Oct 2022 18:30:40 +0200
+Subject: [PATCH] wifi: mac80211: Drop support for TX push path
+
+All drivers are now using mac80211 internal queues (iTXQs).
+Drop mac80211 internal support for the old push path.
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -4339,9 +4339,6 @@ static int ieee80211_get_txq_stats(struc
+ 	struct ieee80211_sub_if_data *sdata;
+ 	int ret = 0;
+ 
+-	if (!local->ops->wake_tx_queue)
+-		return 1;
+-
+ 	spin_lock_bh(&local->fq.lock);
+ 	rcu_read_lock();
+ 
+--- a/net/mac80211/debugfs.c
++++ b/net/mac80211/debugfs.c
+@@ -663,9 +663,7 @@ void debugfs_hw_add(struct ieee80211_loc
+ 	DEBUGFS_ADD_MODE(force_tx_status, 0600);
+ 	DEBUGFS_ADD_MODE(aql_enable, 0600);
+ 	DEBUGFS_ADD(aql_pending);
+-
+-	if (local->ops->wake_tx_queue)
+-		DEBUGFS_ADD_MODE(aqm, 0600);
++	DEBUGFS_ADD_MODE(aqm, 0600);
+ 
+ 	DEBUGFS_ADD_MODE(airtime_flags, 0600);
+ 
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -677,8 +677,7 @@ static void add_common_files(struct ieee
+ 	DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz);
+ 	DEBUGFS_ADD(hw_queues);
+ 
+-	if (sdata->local->ops->wake_tx_queue &&
+-	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
++	if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+ 	    sdata->vif.type != NL80211_IFTYPE_NAN)
+ 		DEBUGFS_ADD(aqm);
+ }
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -1056,10 +1056,8 @@ void ieee80211_sta_debugfs_add(struct st
+ 	DEBUGFS_ADD_COUNTER(rx_fragments, deflink.rx_stats.fragments);
+ 	DEBUGFS_ADD_COUNTER(tx_filtered, deflink.status_stats.filtered);
+ 
+-	if (local->ops->wake_tx_queue) {
+-		DEBUGFS_ADD(aqm);
+-		DEBUGFS_ADD(airtime);
+-	}
++	DEBUGFS_ADD(aqm);
++	DEBUGFS_ADD(airtime);
+ 
+ 	if (wiphy_ext_feature_isset(local->hw.wiphy,
+ 				    NL80211_EXT_FEATURE_AQL))
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2290,7 +2290,6 @@ void ieee80211_wake_queue_by_reason(stru
+ void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+ 				    enum queue_stop_reason reason,
+ 				    bool refcounted);
+-void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue);
+ void ieee80211_add_pending_skb(struct ieee80211_local *local,
+ 			       struct sk_buff *skb);
+ void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -458,12 +458,6 @@ static void ieee80211_do_stop(struct iee
+ 	if (cancel_scan)
+ 		ieee80211_scan_cancel(local);
+ 
+-	/*
+-	 * Stop TX on this interface first.
+-	 */
+-	if (!local->ops->wake_tx_queue && sdata->dev)
+-		netif_tx_stop_all_queues(sdata->dev);
+-
+ 	ieee80211_roc_purge(local, sdata);
+ 
+ 	switch (sdata->vif.type) {
+@@ -811,13 +805,6 @@ static void ieee80211_uninit(struct net_
+ 	ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
+ }
+ 
+-static u16 ieee80211_netdev_select_queue(struct net_device *dev,
+-					 struct sk_buff *skb,
+-					 struct net_device *sb_dev)
+-{
+-	return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
+-}
+-
+ static void
+ ieee80211_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
+ {
+@@ -831,7 +818,6 @@ static const struct net_device_ops ieee8
+ 	.ndo_start_xmit		= ieee80211_subif_start_xmit,
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address 	= ieee80211_change_mac,
+-	.ndo_select_queue	= ieee80211_netdev_select_queue,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ };
+ 
+@@ -939,7 +925,6 @@ static const struct net_device_ops ieee8
+ 	.ndo_start_xmit		= ieee80211_subif_start_xmit_8023,
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address	= ieee80211_change_mac,
+-	.ndo_select_queue	= ieee80211_netdev_select_queue,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
+ };
+@@ -1441,35 +1426,6 @@ int ieee80211_do_open(struct wireless_de
+ 
+ 	ieee80211_recalc_ps(local);
+ 
+-	if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+-	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+-	    local->ops->wake_tx_queue) {
+-		/* XXX: for AP_VLAN, actually track AP queues */
+-		if (dev)
+-			netif_tx_start_all_queues(dev);
+-	} else if (dev) {
+-		unsigned long flags;
+-		int n_acs = IEEE80211_NUM_ACS;
+-		int ac;
+-
+-		if (local->hw.queues < IEEE80211_NUM_ACS)
+-			n_acs = 1;
+-
+-		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+-		if (sdata->vif.cab_queue == IEEE80211_INVAL_HW_QUEUE ||
+-		    (local->queue_stop_reasons[sdata->vif.cab_queue] == 0 &&
+-		     skb_queue_empty(&local->pending[sdata->vif.cab_queue]))) {
+-			for (ac = 0; ac < n_acs; ac++) {
+-				int ac_queue = sdata->vif.hw_queue[ac];
+-
+-				if (local->queue_stop_reasons[ac_queue] == 0 &&
+-				    skb_queue_empty(&local->pending[ac_queue]))
+-					netif_start_subqueue(dev, ac);
+-			}
+-		}
+-		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+-	}
+-
+ 	set_bit(SDATA_STATE_RUNNING, &sdata->state);
+ 
+ 	return 0;
+@@ -1499,17 +1455,12 @@ static void ieee80211_if_setup(struct ne
+ {
+ 	ether_setup(dev);
+ 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
++	dev->priv_flags |= IFF_NO_QUEUE;
+ 	dev->netdev_ops = &ieee80211_dataif_ops;
+ 	dev->needs_free_netdev = true;
+ 	dev->priv_destructor = ieee80211_if_free;
+ }
+ 
+-static void ieee80211_if_setup_no_queue(struct net_device *dev)
+-{
+-	ieee80211_if_setup(dev);
+-	dev->priv_flags |= IFF_NO_QUEUE;
+-}
+-
+ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
+ 					struct ieee80211_sub_if_data *sdata,
+ 					struct sk_buff *skb)
+@@ -2094,9 +2045,7 @@ int ieee80211_if_add(struct ieee80211_lo
+ 	struct net_device *ndev = NULL;
+ 	struct ieee80211_sub_if_data *sdata = NULL;
+ 	struct txq_info *txqi;
+-	void (*if_setup)(struct net_device *dev);
+ 	int ret, i;
+-	int txqs = 1;
+ 
+ 	ASSERT_RTNL();
+ 
+@@ -2119,30 +2068,18 @@ int ieee80211_if_add(struct ieee80211_lo
+ 				 sizeof(void *));
+ 		int txq_size = 0;
+ 
+-		if (local->ops->wake_tx_queue &&
+-		    type != NL80211_IFTYPE_AP_VLAN &&
++		if (type != NL80211_IFTYPE_AP_VLAN &&
+ 		    (type != NL80211_IFTYPE_MONITOR ||
+ 		     (params->flags & MONITOR_FLAG_ACTIVE)))
+ 			txq_size += sizeof(struct txq_info) +
+ 				    local->hw.txq_data_size;
+ 
+-		if (local->ops->wake_tx_queue) {
+-			if_setup = ieee80211_if_setup_no_queue;
+-		} else {
+-			if_setup = ieee80211_if_setup;
+-			if (local->hw.queues >= IEEE80211_NUM_ACS)
+-				txqs = IEEE80211_NUM_ACS;
+-		}
+-
+ 		ndev = alloc_netdev_mqs(size + txq_size,
+ 					name, name_assign_type,
+-					if_setup, txqs, 1);
++					ieee80211_if_setup, 1, 1);
+ 		if (!ndev)
+ 			return -ENOMEM;
+ 
+-		if (!local->ops->wake_tx_queue && local->hw.wiphy->tx_queue_len)
+-			ndev->tx_queue_len = local->hw.wiphy->tx_queue_len;
+-
+ 		dev_net_set(ndev, wiphy_net(local->hw.wiphy));
+ 
+ 		ndev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -630,7 +630,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 
+ 	if (WARN_ON(!ops->tx || !ops->start || !ops->stop || !ops->config ||
+ 		    !ops->add_interface || !ops->remove_interface ||
+-		    !ops->configure_filter))
++		    !ops->configure_filter || !ops->wake_tx_queue))
+ 		return NULL;
+ 
+ 	if (WARN_ON(ops->sta_state && (ops->sta_add || ops->sta_remove)))
+@@ -719,9 +719,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 	if (!ops->set_key)
+ 		wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+ 
+-	if (ops->wake_tx_queue)
+-		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_TXQS);
+-
++	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_TXQS);
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_RRM);
+ 
+ 	wiphy->bss_priv_size = sizeof(struct ieee80211_bss);
+@@ -834,10 +832,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 		atomic_set(&local->agg_queue_stop[i], 0);
+ 	}
+ 	tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
+-
+-	if (ops->wake_tx_queue)
+-		tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
+-
++	tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
+ 	tasklet_setup(&local->tasklet, ieee80211_tasklet_handler);
+ 
+ 	skb_queue_head_init(&local->skb_queue);
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1571,9 +1571,6 @@ static void sta_ps_start(struct sta_info
+ 
+ 	ieee80211_clear_fast_xmit(sta);
+ 
+-	if (!sta->sta.txq[0])
+-		return;
+-
+ 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
+ 		struct ieee80211_txq *txq = sta->sta.txq[tid];
+ 		struct txq_info *txqi = to_txq_info(txq);
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -140,17 +140,15 @@ static void __cleanup_single_sta(struct
+ 		atomic_dec(&ps->num_sta_ps);
+ 	}
+ 
+-	if (sta->sta.txq[0]) {
+-		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+-			struct txq_info *txqi;
++	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++		struct txq_info *txqi;
+ 
+-			if (!sta->sta.txq[i])
+-				continue;
++		if (!sta->sta.txq[i])
++			continue;
+ 
+-			txqi = to_txq_info(sta->sta.txq[i]);
++		txqi = to_txq_info(sta->sta.txq[i]);
+ 
+-			ieee80211_txq_purge(local, txqi);
+-		}
++		ieee80211_txq_purge(local, txqi);
+ 	}
+ 
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+@@ -425,8 +423,7 @@ void sta_info_free(struct ieee80211_loca
+ 
+ 	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
+ 
+-	if (sta->sta.txq[0])
+-		kfree(to_txq_info(sta->sta.txq[0]));
++	kfree(to_txq_info(sta->sta.txq[0]));
+ 	kfree(rcu_dereference_raw(sta->sta.rates));
+ #ifdef CPTCFG_MAC80211_MESH
+ 	kfree(sta->mesh);
+@@ -527,6 +524,8 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_hw *hw = &local->hw;
+ 	struct sta_info *sta;
++	void *txq_data;
++	int size;
+ 	int i;
+ 
+ 	sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
+@@ -597,21 +596,18 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 
+ 	sta->last_connected = ktime_get_seconds();
+ 
+-	if (local->ops->wake_tx_queue) {
+-		void *txq_data;
+-		int size = sizeof(struct txq_info) +
+-			   ALIGN(hw->txq_data_size, sizeof(void *));
++	size = sizeof(struct txq_info) +
++	       ALIGN(hw->txq_data_size, sizeof(void *));
+ 
+-		txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
+-		if (!txq_data)
+-			goto free;
++	txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
++	if (!txq_data)
++		goto free;
+ 
+-		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
+-			struct txq_info *txq = txq_data + i * size;
++	for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++		struct txq_info *txq = txq_data + i * size;
+ 
+-			/* might not do anything for the bufferable MMPDU TXQ */
+-			ieee80211_txq_init(sdata, sta, txq, i);
+-		}
++		/* might not do anything for the (bufferable) MMPDU TXQ */
++		ieee80211_txq_init(sdata, sta, txq, i);
+ 	}
+ 
+ 	if (sta_prepare_rate_control(local, sta, gfp))
+@@ -685,8 +681,7 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 	return sta;
+ 
+ free_txq:
+-	if (sta->sta.txq[0])
+-		kfree(to_txq_info(sta->sta.txq[0]));
++	kfree(to_txq_info(sta->sta.txq[0]));
+ free:
+ 	sta_info_free_link(&sta->deflink);
+ #ifdef CPTCFG_MAC80211_MESH
+@@ -1959,9 +1954,6 @@ ieee80211_sta_ps_deliver_response(struct
+ 		 * TIM recalculation.
+ 		 */
+ 
+-		if (!sta->sta.txq[0])
+-			return;
+-
+ 		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
+ 			if (!sta->sta.txq[tid] ||
+ 			    !(driver_release_tids & BIT(tid)) ||
+@@ -2446,7 +2438,7 @@ static void sta_set_tidstats(struct sta_
+ 		tidstats->tx_msdu_failed = sta->deflink.status_stats.msdu_failed[tid];
+ 	}
+ 
+-	if (local->ops->wake_tx_queue && tid < IEEE80211_NUM_TIDS) {
++	if (tid < IEEE80211_NUM_TIDS) {
+ 		spin_lock_bh(&local->fq.lock);
+ 		rcu_read_lock();
+ 
+@@ -2774,9 +2766,6 @@ unsigned long ieee80211_sta_last_active(
+ 
+ static void sta_update_codel_params(struct sta_info *sta, u32 thr)
+ {
+-	if (!sta->sdata->local->ops->wake_tx_queue)
+-		return;
+-
+ 	if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) {
+ 		sta->cparams.target = MS2TIME(50);
+ 		sta->cparams.interval = MS2TIME(300);
+--- a/net/mac80211/tdls.c
++++ b/net/mac80211/tdls.c
+@@ -1016,7 +1016,6 @@ ieee80211_tdls_prep_mgmt_packet(struct w
+ 		skb->priority = 256 + 5;
+ 		break;
+ 	}
+-	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, skb));
+ 
+ 	/*
+ 	 * Set the WLAN_TDLS_TEARDOWN flag to indicate a teardown in progress.
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1599,9 +1599,6 @@ int ieee80211_txq_setup_flows(struct iee
+ 	bool supp_vht = false;
+ 	enum nl80211_band band;
+ 
+-	if (!local->ops->wake_tx_queue)
+-		return 0;
+-
+ 	ret = fq_init(fq, 4096);
+ 	if (ret)
+ 		return ret;
+@@ -1649,9 +1646,6 @@ void ieee80211_txq_teardown_flows(struct
+ {
+ 	struct fq *fq = &local->fq;
+ 
+-	if (!local->ops->wake_tx_queue)
+-		return;
+-
+ 	kfree(local->cvars);
+ 	local->cvars = NULL;
+ 
+@@ -1668,8 +1662,7 @@ static bool ieee80211_queue_skb(struct i
+ 	struct ieee80211_vif *vif;
+ 	struct txq_info *txqi;
+ 
+-	if (!local->ops->wake_tx_queue ||
+-	    sdata->vif.type == NL80211_IFTYPE_MONITOR)
++	if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+ 		return false;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+@@ -4185,12 +4178,7 @@ void __ieee80211_subif_start_xmit(struct
+ 	if (IS_ERR(sta))
+ 		sta = NULL;
+ 
+-	if (local->ops->wake_tx_queue) {
+-		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
+-		skb_set_queue_mapping(skb, queue);
+-		skb_get_hash(skb);
+-	}
+-
++	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 	ieee80211_aggr_check(sdata, sta, skb);
+ 
+ 	sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
+@@ -4501,11 +4489,7 @@ static void ieee80211_8023_xmit(struct i
+ 	struct tid_ampdu_tx *tid_tx;
+ 	u8 tid;
+ 
+-	if (local->ops->wake_tx_queue) {
+-		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
+-		skb_set_queue_mapping(skb, queue);
+-		skb_get_hash(skb);
+-	}
++	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
+ 
+ 	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
+ 	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+@@ -4759,9 +4743,6 @@ void ieee80211_tx_pending(struct tasklet
+ 			if (!txok)
+ 				break;
+ 		}
+-
+-		if (skb_queue_empty(&local->pending[i]))
+-			ieee80211_propagate_queue_wake(local, i);
+ 	}
+ 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+ 
+@@ -5954,10 +5935,9 @@ int ieee80211_tx_control_port(struct wip
+ 	}
+ 
+ 	if (!IS_ERR(sta)) {
+-		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
++		u16 queue = ieee80211_select_queue(sdata, sta, skb);
+ 
+ 		skb_set_queue_mapping(skb, queue);
+-		skb_get_hash(skb);
+ 
+ 		/*
+ 		 * for MLO STA, the SA should be the AP MLD address, but
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -446,39 +446,6 @@ void ieee80211_wake_txqs(struct tasklet_
+ 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+ }
+ 
+-void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
+-{
+-	struct ieee80211_sub_if_data *sdata;
+-	int n_acs = IEEE80211_NUM_ACS;
+-
+-	if (local->ops->wake_tx_queue)
+-		return;
+-
+-	if (local->hw.queues < IEEE80211_NUM_ACS)
+-		n_acs = 1;
+-
+-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+-		int ac;
+-
+-		if (!sdata->dev)
+-			continue;
+-
+-		if (sdata->vif.cab_queue != IEEE80211_INVAL_HW_QUEUE &&
+-		    local->queue_stop_reasons[sdata->vif.cab_queue] != 0)
+-			continue;
+-
+-		for (ac = 0; ac < n_acs; ac++) {
+-			int ac_queue = sdata->vif.hw_queue[ac];
+-
+-			if (ac_queue == queue ||
+-			    (sdata->vif.cab_queue == queue &&
+-			     local->queue_stop_reasons[ac_queue] == 0 &&
+-			     skb_queue_empty(&local->pending[ac_queue])))
+-				netif_wake_subqueue(sdata->dev, ac);
+-		}
+-	}
+-}
+-
+ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
+ 				   enum queue_stop_reason reason,
+ 				   bool refcounted,
+@@ -509,11 +476,7 @@ static void __ieee80211_wake_queue(struc
+ 		/* someone still has this queue stopped */
+ 		return;
+ 
+-	if (skb_queue_empty(&local->pending[queue])) {
+-		rcu_read_lock();
+-		ieee80211_propagate_queue_wake(local, queue);
+-		rcu_read_unlock();
+-	} else
++	if (!skb_queue_empty(&local->pending[queue]))
+ 		tasklet_schedule(&local->tx_pending_tasklet);
+ 
+ 	/*
+@@ -523,12 +486,10 @@ static void __ieee80211_wake_queue(struc
+ 	 * release someone's lock, but it is fine because all the callers of
+ 	 * __ieee80211_wake_queue call it right before releasing the lock.
+ 	 */
+-	if (local->ops->wake_tx_queue) {
+-		if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
+-			tasklet_schedule(&local->wake_txqs_tasklet);
+-		else
+-			_ieee80211_wake_txqs(local, flags);
+-	}
++	if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
++		tasklet_schedule(&local->wake_txqs_tasklet);
++	else
++		_ieee80211_wake_txqs(local, flags);
+ }
+ 
+ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
+@@ -585,10 +546,6 @@ static void __ieee80211_stop_queue(struc
+ 		for (ac = 0; ac < n_acs; ac++) {
+ 			if (sdata->vif.hw_queue[ac] == queue ||
+ 			    sdata->vif.cab_queue == queue) {
+-				if (!local->ops->wake_tx_queue) {
+-					netif_stop_subqueue(sdata->dev, ac);
+-					continue;
+-				}
+ 				spin_lock(&local->fq.lock);
+ 				sdata->vif.txqs_stopped[ac] = true;
+ 				spin_unlock(&local->fq.lock);
+--- a/net/mac80211/wme.c
++++ b/net/mac80211/wme.c
+@@ -122,6 +122,9 @@ u16 ieee80211_select_queue_80211(struct
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	u8 *p;
+ 
++	/* Ensure hash is set prior to potential SW encryption */
++	skb_get_hash(skb);
++
+ 	if ((info->control.flags & IEEE80211_TX_CTRL_DONT_REORDER) ||
+ 	    local->hw.queues < IEEE80211_NUM_ACS)
+ 		return 0;
+@@ -141,12 +144,15 @@ u16 ieee80211_select_queue_80211(struct
+ 	return ieee80211_downgrade_queue(sdata, NULL, skb);
+ }
+ 
+-u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			     struct sta_info *sta, struct sk_buff *skb)
++u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
++			   struct sta_info *sta, struct sk_buff *skb)
+ {
+ 	struct mac80211_qos_map *qos_map;
+ 	bool qos;
+ 
++	/* Ensure hash is set prior to potential SW encryption */
++	skb_get_hash(skb);
++
+ 	/* all mesh/ocb stations are required to support WME */
+ 	if (sta && (sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
+ 		    sdata->vif.type == NL80211_IFTYPE_OCB))
+@@ -176,59 +182,6 @@ u16 __ieee80211_select_queue(struct ieee
+ 	return ieee80211_downgrade_queue(sdata, sta, skb);
+ }
+ 
+-
+-/* Indicate which queue to use. */
+-u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			   struct sk_buff *skb)
+-{
+-	struct ieee80211_local *local = sdata->local;
+-	struct sta_info *sta = NULL;
+-	const u8 *ra = NULL;
+-	u16 ret;
+-
+-	/* when using iTXQ, we can do this later */
+-	if (local->ops->wake_tx_queue)
+-		return 0;
+-
+-	if (local->hw.queues < IEEE80211_NUM_ACS || skb->len < 6) {
+-		skb->priority = 0; /* required for correct WPA/11i MIC */
+-		return 0;
+-	}
+-
+-	rcu_read_lock();
+-	switch (sdata->vif.type) {
+-	case NL80211_IFTYPE_AP_VLAN:
+-		sta = rcu_dereference(sdata->u.vlan.sta);
+-		if (sta)
+-			break;
+-		fallthrough;
+-	case NL80211_IFTYPE_AP:
+-		ra = skb->data;
+-		break;
+-	case NL80211_IFTYPE_STATION:
+-		/* might be a TDLS station */
+-		sta = sta_info_get(sdata, skb->data);
+-		if (sta)
+-			break;
+-
+-		ra = sdata->deflink.u.mgd.bssid;
+-		break;
+-	case NL80211_IFTYPE_ADHOC:
+-		ra = skb->data;
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	if (!sta && ra && !is_multicast_ether_addr(ra))
+-		sta = sta_info_get(sdata, ra);
+-
+-	ret = __ieee80211_select_queue(sdata, sta, skb);
+-
+-	rcu_read_unlock();
+-	return ret;
+-}
+-
+ /**
+  * ieee80211_set_qos_hdr - Fill in the QoS header if there is one.
+  *
+--- a/net/mac80211/wme.h
++++ b/net/mac80211/wme.h
+@@ -13,10 +13,8 @@
+ u16 ieee80211_select_queue_80211(struct ieee80211_sub_if_data *sdata,
+ 				 struct sk_buff *skb,
+ 				 struct ieee80211_hdr *hdr);
+-u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			     struct sta_info *sta, struct sk_buff *skb);
+ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+-			   struct sk_buff *skb);
++			   struct sta_info *sta, struct sk_buff *skb);
+ void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
+ 			   struct sk_buff *skb);
+ 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-04-wifi-realtek-remove-duplicated-wake_tx_queue.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-04-wifi-realtek-remove-duplicated-wake_tx_queue.patch
new file mode 100644
index 0000000..f0dfc75
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-04-wifi-realtek-remove-duplicated-wake_tx_queue.patch
@@ -0,0 +1,32 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 10 Oct 2022 19:17:46 +0200
+Subject: [PATCH] wifi: realtek: remove duplicated wake_tx_queue
+
+By accident, the previous patch duplicated the initialization
+of the wake_tx_queue callback. Fix that by removing the new
+initializations.
+
+Fixes: a790cc3a4fad ("wifi: mac80211: add wake_tx_queue callback to drivers")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -896,7 +896,6 @@ static void rtw_ops_sta_rc_update(struct
+ 
+ const struct ieee80211_ops rtw_ops = {
+ 	.tx			= rtw_ops_tx,
+-	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw_ops_wake_tx_queue,
+ 	.start			= rtw_ops_start,
+ 	.stop			= rtw_ops_stop,
+--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
+@@ -918,7 +918,6 @@ static int rtw89_ops_set_tid_config(stru
+ 
+ const struct ieee80211_ops rtw89_ops = {
+ 	.tx			= rtw89_ops_tx,
+-	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
+ 	.wake_tx_queue		= rtw89_ops_wake_tx_queue,
+ 	.start			= rtw89_ops_start,
+ 	.stop			= rtw89_ops_stop,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-v5.17-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-v5.17-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
deleted file mode 100644
index c43cd3a..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/306-v5.17-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 14 Dec 2021 17:53:12 +0100
-Subject: [PATCH] mac80211: use coarse boottime for airtime fairness code
-
-The time values used by the airtime fairness code only need to be accurate
-enough to cover station activity detection.
-Using ktime_get_coarse_boottime_ns instead of ktime_get_boottime_ns will
-drop the accuracy down to jiffies intervals, but at the same time saves
-a lot of CPU cycles in a hot path
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3820,7 +3820,7 @@ struct ieee80211_txq *ieee80211_next_txq
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
- 	struct airtime_sched_info *air_sched;
--	u64 now = ktime_get_boottime_ns();
-+	u64 now = ktime_get_coarse_boottime_ns();
- 	struct ieee80211_txq *ret = NULL;
- 	struct airtime_info *air_info;
- 	struct txq_info *txqi = NULL;
-@@ -3947,7 +3947,7 @@ void ieee80211_update_airtime_weight(str
- 	u64 weight_sum = 0;
- 
- 	if (unlikely(!now))
--		now = ktime_get_boottime_ns();
-+		now = ktime_get_coarse_boottime_ns();
- 
- 	lockdep_assert_held(&air_sched->lock);
- 
-@@ -3973,7 +3973,7 @@ void ieee80211_schedule_txq(struct ieee8
- 	struct ieee80211_local *local = hw_to_local(hw);
- 	struct txq_info *txqi = to_txq_info(txq);
- 	struct airtime_sched_info *air_sched;
--	u64 now = ktime_get_boottime_ns();
-+	u64 now = ktime_get_coarse_boottime_ns();
- 	struct airtime_info *air_info;
- 	u8 ac = txq->ac;
- 	bool was_active;
-@@ -4031,7 +4031,7 @@ static void __ieee80211_unschedule_txq(s
- 
- 	if (!purge)
- 		airtime_set_active(air_sched, air_info,
--				   ktime_get_boottime_ns());
-+				   ktime_get_coarse_boottime_ns());
- 
- 	rb_erase_cached(&txqi->schedule_order,
- 			&air_sched->active_txqs);
-@@ -4119,7 +4119,7 @@ bool ieee80211_txq_may_transmit(struct i
- 	if (RB_EMPTY_NODE(&txqi->schedule_order))
- 		goto out;
- 
--	now = ktime_get_boottime_ns();
-+	now = ktime_get_coarse_boottime_ns();
- 
- 	/* Like in ieee80211_next_txq(), make sure the first station in the
- 	 * scheduling order is eligible for transmission to avoid starvation.
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch
deleted file mode 100644
index 9c3b38a..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/307-mac80211_hwsim-make-6-GHz-channels-usable.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 24 May 2021 11:46:09 +0200
-Subject: [PATCH] mac80211_hwsim: make 6 GHz channels usable
-
-The previous commit that claimed to add 6 GHz channels didn't actually make
-them usable, since the 6 GHz band was not registered with mac80211.
-
-Fixes: 28881922abd7 ("mac80211_hwsim: add 6GHz channels")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/mac80211_hwsim.c
-+++ b/drivers/net/wireless/mac80211_hwsim.c
-@@ -3008,15 +3008,19 @@ static void mac80211_hwsim_he_capab(stru
- {
- 	u16 n_iftype_data;
- 
--	if (sband->band == NL80211_BAND_2GHZ) {
-+	switch (sband->band) {
-+	case NL80211_BAND_2GHZ:
- 		n_iftype_data = ARRAY_SIZE(he_capa_2ghz);
- 		sband->iftype_data =
- 			(struct ieee80211_sband_iftype_data *)he_capa_2ghz;
--	} else if (sband->band == NL80211_BAND_5GHZ) {
-+		break;
-+	case NL80211_BAND_5GHZ:
-+	case NL80211_BAND_6GHZ:
- 		n_iftype_data = ARRAY_SIZE(he_capa_5ghz);
- 		sband->iftype_data =
- 			(struct ieee80211_sband_iftype_data *)he_capa_5ghz;
--	} else {
-+		break;
-+	default:
- 		return;
- 	}
- 
-@@ -3306,6 +3310,12 @@ static int mac80211_hwsim_new_radio(stru
- 			sband->vht_cap.vht_mcs.tx_mcs_map =
- 				sband->vht_cap.vht_mcs.rx_mcs_map;
- 			break;
-+		case NL80211_BAND_6GHZ:
-+			sband->channels = data->channels_6ghz;
-+			sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
-+			sband->bitrates = data->rates + 4;
-+			sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
-+			break;
- 		case NL80211_BAND_S1GHZ:
- 			memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
- 			       sizeof(sband->s1g_cap));
-@@ -3316,6 +3326,13 @@ static int mac80211_hwsim_new_radio(stru
- 			continue;
- 		}
- 
-+		mac80211_hwsim_he_capab(sband);
-+
-+		hw->wiphy->bands[band] = sband;
-+
-+		if (band == NL80211_BAND_6GHZ)
-+			continue;
-+
- 		sband->ht_cap.ht_supported = true;
- 		sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
- 				    IEEE80211_HT_CAP_GRN_FLD |
-@@ -3329,10 +3346,6 @@ static int mac80211_hwsim_new_radio(stru
- 		sband->ht_cap.mcs.rx_mask[0] = 0xff;
- 		sband->ht_cap.mcs.rx_mask[1] = 0xff;
- 		sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
--
--		mac80211_hwsim_he_capab(sband);
--
--		hw->wiphy->bands[band] = sband;
- 	}
- 
- 	/* By default all radios belong to the first group */
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/308-v5.17-mac80211-add-support-for-.ndo_fill_forward_path.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/308-v5.17-mac80211-add-support-for-.ndo_fill_forward_path.patch
deleted file mode 100644
index a9a6182..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/308-v5.17-mac80211-add-support-for-.ndo_fill_forward_path.patch
+++ /dev/null
@@ -1,178 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 12 Nov 2021 12:22:23 +0100
-Subject: [PATCH] mac80211: add support for .ndo_fill_forward_path
-
-This allows drivers to provide a destination device + info for flow offload
-Only supported in combination with 802.3 encap offload
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Tested-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/20211112112223.1209-1-nbd@nbd.name
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -3937,6 +3937,8 @@ struct ieee80211_prep_tx_info {
-  *	twt structure.
-  * @twt_teardown_request: Update the hw with TWT teardown request received
-  *	from the peer.
-+ * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
-+ *	resolve a path for hardware flow offloading
-  */
- struct ieee80211_ops {
- 	void (*tx)(struct ieee80211_hw *hw,
-@@ -4265,6 +4267,13 @@ struct ieee80211_ops {
- 			      struct ieee80211_twt_setup *twt);
- 	void (*twt_teardown_request)(struct ieee80211_hw *hw,
- 				     struct ieee80211_sta *sta, u8 flowid);
-+#if LINUX_VERSION_IS_GEQ(5,10,0)
-+	int (*net_fill_forward_path)(struct ieee80211_hw *hw,
-+				     struct ieee80211_vif *vif,
-+				     struct ieee80211_sta *sta,
-+				     struct net_device_path_ctx *ctx,
-+				     struct net_device_path *path);
-+#endif
- };
- 
- /**
---- a/net/mac80211/driver-ops.h
-+++ b/net/mac80211/driver-ops.h
-@@ -1486,4 +1486,28 @@ static inline void drv_twt_teardown_requ
- 	trace_drv_return_void(local);
- }
- 
-+#if LINUX_VERSION_IS_GEQ(5,10,0)
-+static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
-+					    struct ieee80211_sub_if_data *sdata,
-+					    struct ieee80211_sta *sta,
-+					    struct net_device_path_ctx *ctx,
-+					    struct net_device_path *path)
-+{
-+	int ret = -EOPNOTSUPP;
-+
-+	sdata = get_bss_sdata(sdata);
-+	if (!check_sdata_in_driver(sdata))
-+		return -EIO;
-+
-+	trace_drv_net_fill_forward_path(local, sdata, sta);
-+	if (local->ops->net_fill_forward_path)
-+		ret = local->ops->net_fill_forward_path(&local->hw,
-+							&sdata->vif, sta,
-+							ctx, path);
-+	trace_drv_return_int(local, ret);
-+
-+	return ret;
-+}
-+#endif
-+
- #endif /* __MAC80211_DRIVER_OPS */
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1489,7 +1489,7 @@ struct ieee80211_local {
- };
- 
- static inline struct ieee80211_sub_if_data *
--IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
-+IEEE80211_DEV_TO_SUB_IF(const struct net_device *dev)
- {
- 	return netdev_priv(dev);
- }
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -822,6 +822,66 @@ static const struct net_device_ops ieee8
- 
- };
- 
-+#if LINUX_VERSION_IS_GEQ(5,10,0)
-+static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
-+					      struct net_device_path *path)
-+{
-+	struct ieee80211_sub_if_data *sdata;
-+	struct ieee80211_local *local;
-+	struct sta_info *sta;
-+	int ret = -ENOENT;
-+
-+	sdata = IEEE80211_DEV_TO_SUB_IF(ctx->dev);
-+	local = sdata->local;
-+
-+	if (!local->ops->net_fill_forward_path)
-+		return -EOPNOTSUPP;
-+
-+	rcu_read_lock();
-+	switch (sdata->vif.type) {
-+	case NL80211_IFTYPE_AP_VLAN:
-+		sta = rcu_dereference(sdata->u.vlan.sta);
-+		if (sta)
-+			break;
-+		if (sdata->wdev.use_4addr)
-+			goto out;
-+		if (is_multicast_ether_addr(ctx->daddr))
-+			goto out;
-+		sta = sta_info_get_bss(sdata, ctx->daddr);
-+		break;
-+	case NL80211_IFTYPE_AP:
-+		if (is_multicast_ether_addr(ctx->daddr))
-+			goto out;
-+		sta = sta_info_get(sdata, ctx->daddr);
-+		break;
-+	case NL80211_IFTYPE_STATION:
-+		if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
-+			sta = sta_info_get(sdata, ctx->daddr);
-+			if (sta && test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
-+				if (!test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
-+					goto out;
-+
-+				break;
-+			}
-+		}
-+
-+		sta = sta_info_get(sdata, sdata->u.mgd.bssid);
-+		break;
-+	default:
-+		goto out;
-+	}
-+
-+	if (!sta)
-+		goto out;
-+
-+	ret = drv_net_fill_forward_path(local, sdata, &sta->sta, ctx, path);
-+out:
-+	rcu_read_unlock();
-+
-+	return ret;
-+}
-+#endif
-+
- static const struct net_device_ops ieee80211_dataif_8023_ops = {
- #if LINUX_VERSION_IS_LESS(4,10,0)
- 	.ndo_change_mtu = __change_mtu,
-@@ -839,7 +899,9 @@ static const struct net_device_ops ieee8
- #else
- 	.ndo_get_stats64 = bp_ieee80211_get_stats64,
- #endif
--
-+#if LINUX_VERSION_IS_GEQ(5,10,0)
-+	.ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
-+#endif
- };
- 
- static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
---- a/net/mac80211/trace.h
-+++ b/net/mac80211/trace.h
-@@ -2892,6 +2892,15 @@ TRACE_EVENT(drv_twt_teardown_request,
- 	)
- );
- 
-+#if LINUX_VERSION_IS_GEQ(5,10,0)
-+DEFINE_EVENT(sta_event, drv_net_fill_forward_path,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sub_if_data *sdata,
-+		 struct ieee80211_sta *sta),
-+	TP_ARGS(local, sdata, sta)
-+);
-+#endif
-+
- #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/364-mac80211-add-support-for-restricting-netdev-features.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-mac80211-add-support-for-restricting-netdev-features.patch
similarity index 86%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/364-mac80211-add-support-for-restricting-netdev-features.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-mac80211-add-support-for-restricting-netdev-features.patch
index d133ed9..cd6048b 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/364-mac80211-add-support-for-restricting-netdev-features.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/310-mac80211-add-support-for-restricting-netdev-features.patch
@@ -59,10 +59,10 @@
  		flow = fq_find_fattest_flow(fq);
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1685,6 +1685,10 @@ enum ieee80211_offload_flags {
-  *	write-protected by sdata_lock and local->mtx so holding either is fine
-  *	for read access.
-  * @mu_mimo_owner: indicates interface owns MU-MIMO capability
+@@ -1807,6 +1807,10 @@ struct ieee80211_vif_cfg {
+  * @addr: address of this interface
+  * @p2p: indicates whether this AP or STA interface is a p2p
+  *	interface, i.e. a GO or p2p-sta respectively
 + * @netdev_features: tx netdev features supported by the hardware for this
 + *	vif. mac80211 initializes this to hw->netdev_features, and the driver
 + *	can mask out specific tx features. mac80211 will handle software fixup
@@ -70,9 +70,9 @@
   * @driver_flags: flags/capabilities the driver has for this interface,
   *	these need to be set (or cleared) when the interface is added
   *	or, if supported by the driver, the interface type is changed
-@@ -1736,6 +1740,7 @@ struct ieee80211_vif {
+@@ -1848,6 +1852,7 @@ struct ieee80211_vif {
  
- 	struct ieee80211_chanctx_conf __rcu *chanctx_conf;
+ 	struct ieee80211_txq *txq;
  
 +	netdev_features_t netdev_features;
  	u32 driver_flags;
@@ -80,8 +80,8 @@
  
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -2209,6 +2209,7 @@ int ieee80211_if_add(struct ieee80211_lo
- 		ndev->features |= local->hw.netdev_features;
+@@ -2179,6 +2179,7 @@ int ieee80211_if_add(struct ieee80211_lo
+ 		ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
  		ndev->hw_features |= ndev->features &
  					MAC80211_SUPPORTED_FEATURES_TX;
 +		sdata->vif.netdev_features = local->hw.netdev_features;
@@ -90,7 +90,7 @@
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1310,7 +1310,11 @@ static struct txq_info *ieee80211_get_tx
+@@ -1355,7 +1355,11 @@ static struct txq_info *ieee80211_get_tx
  
  static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
  {
@@ -103,7 +103,7 @@
  }
  
  static u32 codel_skb_len_func(const struct sk_buff *skb)
-@@ -3499,47 +3503,71 @@ ieee80211_xmit_fast_finish(struct ieee80
+@@ -3578,55 +3582,79 @@ ieee80211_xmit_fast_finish(struct ieee80
  	return TX_CONTINUE;
  }
  
@@ -167,8 +167,9 @@
 +
 +		consume_skb(skb);
 +		return segs;
-+	}
-+
+ 	}
+ 
+-	/* after this point (skb is modified) we cannot return false */
 +	if (skb_needs_linearize(skb, features) && __skb_linearize(skb))
 +		goto free;
 +
@@ -182,9 +183,8 @@
 +
 +		if (skb_csum_hwoffload_help(skb, features))
 +			goto free;
- 	}
- 
--	/* after this point (skb is modified) we cannot return false */
++	}
++
 +	skb_mark_not_on_list(skb);
 +	return skb;
 +
@@ -207,15 +207,10 @@
 +	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
 +	struct ethhdr eth;
  
- 	if (skb_shared(skb)) {
- 		struct sk_buff *tmp_skb = skb;
-@@ -3548,12 +3576,12 @@ static bool ieee80211_xmit_fast(struct i
- 		kfree_skb(tmp_skb);
- 
- 		if (!skb)
--			return true;
-+			return;
- 	}
+ 	skb = skb_share_check(skb, GFP_ATOMIC);
+ 	if (unlikely(!skb))
+-		return true;
++		return;
  
  	if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
  	    ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
@@ -224,7 +219,7 @@
  
  	/* will not be crypto-handled beyond what we do here, so use false
  	 * as the may-encrypt argument for the resize to not account for
-@@ -3562,10 +3590,8 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3635,10 +3663,8 @@ static bool ieee80211_xmit_fast(struct i
  	if (unlikely(ieee80211_skb_resize(sdata, skb,
  					  max_t(int, extra_head + hw_headroom -
  						     skb_headroom(skb), 0),
@@ -237,16 +232,16 @@
  
  	memcpy(&eth, skb->data, ETH_HLEN - 2);
  	hdr = skb_push(skb, extra_head);
-@@ -3579,7 +3605,7 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3652,7 +3678,7 @@ static bool ieee80211_xmit_fast(struct i
  	info->control.vif = &sdata->vif;
  	info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
  		      IEEE80211_TX_CTL_DONTFRAG |
 -		      (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
 +		      (ampdu ? IEEE80211_TX_CTL_AMPDU : 0);
- 	info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT;
- 
- #ifdef CPTCFG_MAC80211_DEBUGFS
-@@ -3601,16 +3627,14 @@ static bool ieee80211_xmit_fast(struct i
+ 	info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT |
+ 			      u32_encode_bits(IEEE80211_LINK_UNSPECIFIED,
+ 					      IEEE80211_TX_CTRL_MLO_LINK);
+@@ -3676,16 +3702,14 @@ static bool ieee80211_xmit_fast(struct i
  	tx.key = fast_tx->key;
  
  	if (ieee80211_queue_skb(local, sdata, sta, skb))
@@ -266,7 +261,7 @@
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
  		sdata = container_of(sdata->bss,
-@@ -3618,6 +3642,55 @@ static bool ieee80211_xmit_fast(struct i
+@@ -3693,6 +3717,56 @@ static bool ieee80211_xmit_fast(struct i
  
  	__skb_queue_tail(&tx.skbs, skb);
  	ieee80211_tx_frags(local, &sdata->vif, sta, &tx.skbs, false);
@@ -310,6 +305,7 @@
 +		}
 +	}
 +
++	/* after this point (skb is modified) we cannot return false */
 +	skb = ieee80211_tx_skb_fixup(skb, ieee80211_sdata_netdev_features(sdata));
 +	if (!skb)
 +		return true;
@@ -322,7 +318,7 @@
  	return true;
  }
  
-@@ -4123,31 +4196,14 @@ void __ieee80211_subif_start_xmit(struct
+@@ -4193,31 +4267,14 @@ void __ieee80211_subif_start_xmit(struct
  			goto out;
  	}
  
@@ -362,7 +358,7 @@
  	}
  
  	skb_list_walk_safe(skb, skb, next) {
-@@ -4310,9 +4366,11 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+@@ -4435,9 +4492,11 @@ normal:
  	return NETDEV_TX_OK;
  }
  
@@ -377,7 +373,7 @@
  {
  	struct ieee80211_local *local = sdata->local;
  	struct ieee80211_tx_control control = {};
-@@ -4321,14 +4379,6 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4446,14 +4505,6 @@ static bool ieee80211_tx_8023(struct iee
  	unsigned long flags;
  	int q = info->hw_queue;
  
@@ -392,7 +388,7 @@
  	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
  
  	if (local->queue_stop_reasons[q] ||
-@@ -4355,27 +4405,50 @@ static bool ieee80211_tx_8023(struct iee
+@@ -4480,6 +4531,26 @@ static bool ieee80211_tx_8023(struct iee
  	return true;
  }
  
@@ -419,9 +415,8 @@
  static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
  				struct net_device *dev, struct sta_info *sta,
  				struct ieee80211_key *key, struct sk_buff *skb)
- {
--	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_tx_info *info;
+@@ -4487,9 +4558,13 @@ static void ieee80211_8023_xmit(struct i
+ 	struct ieee80211_tx_info *info;
  	struct ieee80211_local *local = sdata->local;
  	struct tid_ampdu_tx *tid_tx;
 +	struct sk_buff *seg, *next;
@@ -429,25 +424,23 @@
 +	u16 queue;
  	u8 tid;
  
- 	if (local->ops->wake_tx_queue) {
--		u16 queue = __ieee80211_select_queue(sdata, sta, skb);
-+		queue = __ieee80211_select_queue(sdata, sta, skb);
- 		skb_set_queue_mapping(skb, queue);
- 		skb_get_hash(skb);
-+	} else {
-+		queue = skb_get_queue_mapping(skb);
- 	}
+-	skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, sta, skb));
++	queue = ieee80211_select_queue(sdata, sta, skb);
++	skb_set_queue_mapping(skb, queue);
  
  	if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
  	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
- 		goto out_free;
+@@ -4499,9 +4574,6 @@ static void ieee80211_8023_xmit(struct i
+ 	if (unlikely(!skb))
+ 		return;
  
+-	info = IEEE80211_SKB_CB(skb);
 -	memset(info, 0, sizeof(*info));
 -
  	ieee80211_aggr_check(sdata, sta, skb);
  
  	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-@@ -4387,22 +4460,20 @@ static void ieee80211_8023_xmit(struct i
+@@ -4515,22 +4587,20 @@ static void ieee80211_8023_xmit(struct i
  			return;
  		}
  
@@ -472,13 +465,13 @@
  
 -	dev_sw_netstats_tx_add(dev, 1, skb->len);
 -
--	sta->tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
--	sta->tx_stats.packets[skb_get_queue_mapping(skb)]++;
+-	sta->deflink.tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
+-	sta->deflink.tx_stats.packets[skb_get_queue_mapping(skb)]++;
 +	info->hw_queue = sdata->vif.hw_queue[queue];
  
  	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
  		sdata = container_of(sdata->bss,
-@@ -4414,6 +4485,24 @@ static void ieee80211_8023_xmit(struct i
+@@ -4542,6 +4612,24 @@ static void ieee80211_8023_xmit(struct i
  	if (key)
  		info->control.hw_key = &key->conf;
  
@@ -495,15 +488,15 @@
 +							     &info->flags, NULL);
 +
 +	dev_sw_netstats_tx_add(dev, skbs, len);
-+	sta->tx_stats.packets[queue] += skbs;
-+	sta->tx_stats.bytes[queue] += len;
++	sta->deflink.tx_stats.packets[queue] += skbs;
++	sta->deflink.tx_stats.bytes[queue] += len;
 +
 +	ieee80211_tpt_led_trig_tx(local, len);
 +
  	ieee80211_tx_8023(sdata, skb, sta, false);
  
  	return;
-@@ -4455,6 +4544,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
+@@ -4583,6 +4671,7 @@ netdev_tx_t ieee80211_subif_start_xmit_8
  		    key->conf.cipher == WLAN_CIPHER_SUITE_TKIP))
  		goto skip_offload;
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/312-v5.16-mac80211-split-beacon-retrieval-functions.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/312-v5.16-mac80211-split-beacon-retrieval-functions.patch
deleted file mode 100644
index 18b1951..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/312-v5.16-mac80211-split-beacon-retrieval-functions.patch
+++ /dev/null
@@ -1,262 +0,0 @@
-From: Aloka Dixit <alokad@codeaurora.org>
-Date: Tue, 5 Oct 2021 21:09:36 -0700
-Subject: [PATCH] mac80211: split beacon retrieval functions
-
-Split __ieee80211_beacon_get() into a separate function for AP mode
-ieee80211_beacon_get_ap().
-Also, move the code common to all modes (AP, adhoc and mesh) to
-a separate function ieee80211_beacon_get_finish().
-
-Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
-Link: https://lore.kernel.org/r/20211006040938.9531-2-alokad@codeaurora.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -4987,6 +4987,115 @@ static int ieee80211_beacon_protect(stru
- 	return 0;
- }
- 
-+static void
-+ieee80211_beacon_get_finish(struct ieee80211_hw *hw,
-+			    struct ieee80211_vif *vif,
-+			    struct ieee80211_mutable_offsets *offs,
-+			    struct beacon_data *beacon,
-+			    struct sk_buff *skb,
-+			    struct ieee80211_chanctx_conf *chanctx_conf,
-+			    u16 csa_off_base)
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-+	struct ieee80211_tx_info *info;
-+	enum nl80211_band band;
-+	struct ieee80211_tx_rate_control txrc;
-+
-+	/* CSA offsets */
-+	if (offs && beacon) {
-+		u16 i;
-+
-+		for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; i++) {
-+			u16 csa_off = beacon->cntdwn_counter_offsets[i];
-+
-+			if (!csa_off)
-+				continue;
-+
-+			offs->cntdwn_counter_offs[i] = csa_off_base + csa_off;
-+		}
-+	}
-+
-+	band = chanctx_conf->def.chan->band;
-+	info = IEEE80211_SKB_CB(skb);
-+	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-+	info->flags |= IEEE80211_TX_CTL_NO_ACK;
-+	info->band = band;
-+
-+	memset(&txrc, 0, sizeof(txrc));
-+	txrc.hw = hw;
-+	txrc.sband = local->hw.wiphy->bands[band];
-+	txrc.bss_conf = &sdata->vif.bss_conf;
-+	txrc.skb = skb;
-+	txrc.reported_rate.idx = -1;
-+	if (sdata->beacon_rate_set && sdata->beacon_rateidx_mask[band])
-+		txrc.rate_idx_mask = sdata->beacon_rateidx_mask[band];
-+	else
-+		txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
-+	txrc.bss = true;
-+	rate_control_get_rate(sdata, NULL, &txrc);
-+
-+	info->control.vif = vif;
-+	info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
-+		       IEEE80211_TX_CTL_ASSIGN_SEQ |
-+		       IEEE80211_TX_CTL_FIRST_FRAGMENT;
-+}
-+
-+static struct sk_buff *
-+ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
-+			struct ieee80211_vif *vif,
-+			struct ieee80211_mutable_offsets *offs,
-+			bool is_template,
-+			struct beacon_data *beacon,
-+			struct ieee80211_chanctx_conf *chanctx_conf)
-+{
-+	struct ieee80211_local *local = hw_to_local(hw);
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-+	struct ieee80211_if_ap *ap = &sdata->u.ap;
-+	struct sk_buff *skb = NULL;
-+	u16 csa_off_base = 0;
-+
-+	if (beacon->cntdwn_counter_offsets[0]) {
-+		if (!is_template)
-+			ieee80211_beacon_update_cntdwn(vif);
-+
-+		ieee80211_set_beacon_cntdwn(sdata, beacon);
-+	}
-+
-+	/* headroom, head length,
-+	 * tail length and maximum TIM length
-+	 */
-+	skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
-+			    beacon->tail_len + 256 +
-+			    local->hw.extra_beacon_tailroom);
-+	if (!skb)
-+		return NULL;
-+
-+	skb_reserve(skb, local->tx_headroom);
-+	skb_put_data(skb, beacon->head, beacon->head_len);
-+
-+	ieee80211_beacon_add_tim(sdata, &ap->ps, skb, is_template);
-+
-+	if (offs) {
-+		offs->tim_offset = beacon->head_len;
-+		offs->tim_length = skb->len - beacon->head_len;
-+		offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
-+
-+		/* for AP the csa offsets are from tail */
-+		csa_off_base = skb->len;
-+	}
-+
-+	if (beacon->tail)
-+		skb_put_data(skb, beacon->tail, beacon->tail_len);
-+
-+	if (ieee80211_beacon_protect(skb, local, sdata) < 0)
-+		return NULL;
-+
-+	ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb, chanctx_conf,
-+				    csa_off_base);
-+	return skb;
-+}
-+
- static struct sk_buff *
- __ieee80211_beacon_get(struct ieee80211_hw *hw,
- 		       struct ieee80211_vif *vif,
-@@ -4996,12 +5105,8 @@ __ieee80211_beacon_get(struct ieee80211_
- 	struct ieee80211_local *local = hw_to_local(hw);
- 	struct beacon_data *beacon = NULL;
- 	struct sk_buff *skb = NULL;
--	struct ieee80211_tx_info *info;
- 	struct ieee80211_sub_if_data *sdata = NULL;
--	enum nl80211_band band;
--	struct ieee80211_tx_rate_control txrc;
- 	struct ieee80211_chanctx_conf *chanctx_conf;
--	int csa_off_base = 0;
- 
- 	rcu_read_lock();
- 
-@@ -5018,48 +5123,11 @@ __ieee80211_beacon_get(struct ieee80211_
- 		struct ieee80211_if_ap *ap = &sdata->u.ap;
- 
- 		beacon = rcu_dereference(ap->beacon);
--		if (beacon) {
--			if (beacon->cntdwn_counter_offsets[0]) {
--				if (!is_template)
--					ieee80211_beacon_update_cntdwn(vif);
--
--				ieee80211_set_beacon_cntdwn(sdata, beacon);
--			}
--
--			/*
--			 * headroom, head length,
--			 * tail length and maximum TIM length
--			 */
--			skb = dev_alloc_skb(local->tx_headroom +
--					    beacon->head_len +
--					    beacon->tail_len + 256 +
--					    local->hw.extra_beacon_tailroom);
--			if (!skb)
--				goto out;
--
--			skb_reserve(skb, local->tx_headroom);
--			skb_put_data(skb, beacon->head, beacon->head_len);
--
--			ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
--						 is_template);
--
--			if (offs) {
--				offs->tim_offset = beacon->head_len;
--				offs->tim_length = skb->len - beacon->head_len;
--				offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
--
--				/* for AP the csa offsets are from tail */
--				csa_off_base = skb->len;
--			}
--
--			if (beacon->tail)
--				skb_put_data(skb, beacon->tail,
--					     beacon->tail_len);
--
--			if (ieee80211_beacon_protect(skb, local, sdata) < 0)
--				goto out;
--		} else
-+		if (!beacon)
- 			goto out;
-+
-+		skb = ieee80211_beacon_get_ap(hw, vif, offs, is_template,
-+					      beacon, chanctx_conf);
- 	} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
- 		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
- 		struct ieee80211_hdr *hdr;
-@@ -5085,6 +5153,9 @@ __ieee80211_beacon_get(struct ieee80211_
- 		hdr = (struct ieee80211_hdr *) skb->data;
- 		hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
- 						 IEEE80211_STYPE_BEACON);
-+
-+		ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb,
-+					    chanctx_conf, 0);
- 	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
- 		struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
- 
-@@ -5124,51 +5195,13 @@ __ieee80211_beacon_get(struct ieee80211_
- 		}
- 
- 		skb_put_data(skb, beacon->tail, beacon->tail_len);
-+		ieee80211_beacon_get_finish(hw, vif, offs, beacon, skb,
-+					    chanctx_conf, 0);
- 	} else {
- 		WARN_ON(1);
- 		goto out;
- 	}
- 
--	/* CSA offsets */
--	if (offs && beacon) {
--		int i;
--
--		for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; i++) {
--			u16 csa_off = beacon->cntdwn_counter_offsets[i];
--
--			if (!csa_off)
--				continue;
--
--			offs->cntdwn_counter_offs[i] = csa_off_base + csa_off;
--		}
--	}
--
--	band = chanctx_conf->def.chan->band;
--
--	info = IEEE80211_SKB_CB(skb);
--
--	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
--	info->flags |= IEEE80211_TX_CTL_NO_ACK;
--	info->band = band;
--
--	memset(&txrc, 0, sizeof(txrc));
--	txrc.hw = hw;
--	txrc.sband = local->hw.wiphy->bands[band];
--	txrc.bss_conf = &sdata->vif.bss_conf;
--	txrc.skb = skb;
--	txrc.reported_rate.idx = -1;
--	if (sdata->beacon_rate_set && sdata->beacon_rateidx_mask[band])
--		txrc.rate_idx_mask = sdata->beacon_rateidx_mask[band];
--	else
--		txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
--	txrc.bss = true;
--	rate_control_get_rate(sdata, NULL, &txrc);
--
--	info->control.vif = vif;
--
--	info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
--			IEEE80211_TX_CTL_ASSIGN_SEQ |
--			IEEE80211_TX_CTL_FIRST_FRAGMENT;
-  out:
- 	rcu_read_unlock();
- 	return skb;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/313-v5.16-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/313-v5.16-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch
deleted file mode 100644
index 429886d..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/313-v5.16-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch
+++ /dev/null
@@ -1,493 +0,0 @@
-From: John Crispin <john@phrozen.org>
-Date: Wed, 15 Sep 2021 19:54:34 -0700
-Subject: [PATCH] nl80211: MBSSID and EMA support in AP mode
-
-Add new attributes to configure support for multiple BSSID
-and advanced multi-BSSID advertisements (EMA) in AP mode.
-
-- NL80211_ATTR_MBSSID_CONFIG used for per interface configuration.
-- NL80211_ATTR_MBSSID_ELEMS used to MBSSID elements for beacons.
-
-Memory for the elements is allocated dynamically. This change frees
-the memory in existing functions which call nl80211_parse_beacon(),
-a comment is added to indicate the new references to do the same.
-
-Signed-off-by: John Crispin <john@phrozen.org>
-Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
-Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
-Link: https://lore.kernel.org/r/20210916025437.29138-2-alokad@codeaurora.org
-[don't leave ERR_PTR hanging around]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1046,6 +1046,36 @@ struct cfg80211_crypto_settings {
- };
- 
- /**
-+ * struct cfg80211_mbssid_config - AP settings for multi bssid
-+ *
-+ * @tx_wdev: pointer to the transmitted interface in the MBSSID set
-+ * @index: index of this AP in the multi bssid group.
-+ * @ema: set to true if the beacons should be sent out in EMA mode.
-+ */
-+struct cfg80211_mbssid_config {
-+	struct wireless_dev *tx_wdev;
-+	u8 index;
-+	bool ema;
-+};
-+
-+/**
-+ * struct cfg80211_mbssid_elems - Multiple BSSID elements
-+ *
-+ * @cnt: Number of elements in array %elems.
-+ *
-+ * @elem: Array of multiple BSSID element(s) to be added into Beacon frames.
-+ * @elem.data: Data for multiple BSSID elements.
-+ * @elem.len: Length of data.
-+ */
-+struct cfg80211_mbssid_elems {
-+	u8 cnt;
-+	struct {
-+		const u8 *data;
-+		size_t len;
-+	} elem[];
-+};
-+
-+/**
-  * struct cfg80211_beacon_data - beacon data
-  * @head: head portion of beacon (before TIM IE)
-  *	or %NULL if not changed
-@@ -1063,6 +1093,7 @@ struct cfg80211_crypto_settings {
-  * @assocresp_ies_len: length of assocresp_ies in octets
-  * @probe_resp_len: length of probe response template (@probe_resp)
-  * @probe_resp: probe response template (AP mode only)
-+ * @mbssid_ies: multiple BSSID elements
-  * @ftm_responder: enable FTM responder functionality; -1 for no change
-  *	(which also implies no change in LCI/civic location data)
-  * @lci: Measurement Report element content, starting with Measurement Token
-@@ -1080,6 +1111,7 @@ struct cfg80211_beacon_data {
- 	const u8 *probe_resp;
- 	const u8 *lci;
- 	const u8 *civicloc;
-+	struct cfg80211_mbssid_elems *mbssid_ies;
- 	s8 ftm_responder;
- 
- 	size_t head_len, tail_len;
-@@ -1194,6 +1226,7 @@ enum cfg80211_ap_settings_flags {
-  * @he_oper: HE operation IE (or %NULL if HE isn't enabled)
-  * @fils_discovery: FILS discovery transmission parameters
-  * @unsol_bcast_probe_resp: Unsolicited broadcast probe response parameters
-+ * @mbssid_config: AP settings for multiple bssid
-  */
- struct cfg80211_ap_settings {
- 	struct cfg80211_chan_def chandef;
-@@ -1226,6 +1259,7 @@ struct cfg80211_ap_settings {
- 	struct cfg80211_he_bss_color he_bss_color;
- 	struct cfg80211_fils_discovery fils_discovery;
- 	struct cfg80211_unsol_bcast_probe_resp unsol_bcast_probe_resp;
-+	struct cfg80211_mbssid_config mbssid_config;
- };
- 
- /**
-@@ -4986,6 +5020,13 @@ struct wiphy_iftype_akm_suites {
-  *	%NL80211_TID_CONFIG_ATTR_RETRY_LONG attributes
-  * @sar_capa: SAR control capabilities
-  * @rfkill: a pointer to the rfkill structure
-+ *
-+ * @mbssid_max_interfaces: maximum number of interfaces supported by the driver
-+ *	in a multiple BSSID set. This field must be set to a non-zero value
-+ *	by the driver to advertise MBSSID support.
-+ * @mbssid_max_ema_profile_periodicity: maximum profile periodicity supported by
-+ *	the driver. Setting this field to a non-zero value indicates that the
-+ *	driver supports enhanced multi-BSSID advertisements (EMA AP).
-  */
- struct wiphy {
- 	struct mutex mtx;
-@@ -5133,6 +5174,9 @@ struct wiphy {
- 
- 	struct rfkill *rfkill;
- 
-+	u8 mbssid_max_interfaces;
-+	u8 ema_max_profile_periodicity;
-+
- 	char priv[] __aligned(NETDEV_ALIGN);
- };
- 
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -337,7 +337,10 @@
-  * @NL80211_CMD_DEL_INTERFACE: Virtual interface was deleted, has attributes
-  *	%NL80211_ATTR_IFINDEX and %NL80211_ATTR_WIPHY. Can also be sent from
-  *	userspace to request deletion of a virtual interface, then requires
-- *	attribute %NL80211_ATTR_IFINDEX.
-+ *	attribute %NL80211_ATTR_IFINDEX. If multiple BSSID advertisements are
-+ *	enabled using %NL80211_ATTR_MBSSID_CONFIG, %NL80211_ATTR_MBSSID_ELEMS,
-+ *	and if this command is used for the transmitting interface, then all
-+ *	the non-transmitting interfaces are deleted as well.
-  *
-  * @NL80211_CMD_GET_KEY: Get sequence counter information for a key specified
-  *	by %NL80211_ATTR_KEY_IDX and/or %NL80211_ATTR_MAC.
-@@ -2593,6 +2596,18 @@ enum nl80211_commands {
-  * @NL80211_ATTR_COLOR_CHANGE_ELEMS: Nested set of attributes containing the IE
-  *	information for the time while performing a color switch.
-  *
-+ * @NL80211_ATTR_MBSSID_CONFIG: Nested attribute for multiple BSSID
-+ *	advertisements (MBSSID) parameters in AP mode.
-+ *	Kernel uses this attribute to indicate the driver's support for MBSSID
-+ *	and enhanced multi-BSSID advertisements (EMA AP) to the userspace.
-+ *	Userspace should use this attribute to configure per interface MBSSID
-+ *	parameters.
-+ *	See &enum nl80211_mbssid_config_attributes for details.
-+ *
-+ * @NL80211_ATTR_MBSSID_ELEMS: Nested parameter to pass multiple BSSID elements.
-+ *	Mandatory parameter for the transmitting interface to enable MBSSID.
-+ *	Optional for the non-transmitting interfaces.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3096,6 +3111,9 @@ enum nl80211_attrs {
- 	NL80211_ATTR_COLOR_CHANGE_COLOR,
- 	NL80211_ATTR_COLOR_CHANGE_ELEMS,
- 
-+	NL80211_ATTR_MBSSID_CONFIG,
-+	NL80211_ATTR_MBSSID_ELEMS,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -7349,4 +7367,60 @@ enum nl80211_sar_specs_attrs {
- 	NL80211_SAR_ATTR_SPECS_MAX = __NL80211_SAR_ATTR_SPECS_LAST - 1,
- };
- 
-+/**
-+ * enum nl80211_mbssid_config_attributes - multiple BSSID (MBSSID) and enhanced
-+ * multi-BSSID advertisements (EMA) in AP mode.
-+ * Kernel uses some of these attributes to advertise driver's support for
-+ * MBSSID and EMA.
-+ * Remaining attributes should be used by the userspace to configure the
-+ * features.
-+ *
-+ * @__NL80211_MBSSID_CONFIG_ATTR_INVALID: Invalid
-+ *
-+ * @NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES: Used by the kernel to advertise
-+ *	the maximum number of MBSSID interfaces supported by the driver.
-+ *	Driver should indicate MBSSID support by setting
-+ *	wiphy->mbssid_max_interfaces to a value more than or equal to 2.
-+ *
-+ * @NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY: Used by the kernel
-+ *	to advertise the maximum profile periodicity supported by the driver
-+ *	if EMA is enabled. Driver should indicate EMA support to the userspace
-+ *	by setting wiphy->mbssid_max_ema_profile_periodicity to
-+ *	a non-zero value.
-+ *
-+ * @NL80211_MBSSID_CONFIG_ATTR_INDEX: Mandatory parameter to pass the index of
-+ *	this BSS (u8) in the multiple BSSID set.
-+ *	Value must be set to 0 for the transmitting interface and non-zero for
-+ *	all non-transmitting interfaces. The userspace will be responsible
-+ *	for using unique indices for the interfaces.
-+ *	Range: 0 to wiphy->mbssid_max_interfaces-1.
-+ *
-+ * @NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX: Mandatory parameter for
-+ *	a non-transmitted profile which provides the interface index (u32) of
-+ *	the transmitted profile. The value must match one of the interface
-+ *	indices advertised by the kernel. Optional if the interface being set up
-+ *	is the transmitting one, however, if provided then the value must match
-+ *	the interface index of the same.
-+ *
-+ * @NL80211_MBSSID_CONFIG_ATTR_EMA: Flag used to enable EMA AP feature.
-+ *	Setting this flag is permitted only if the driver advertises EMA support
-+ *	by setting wiphy->mbssid_max_ema_profile_periodicity to non-zero.
-+ *
-+ * @__NL80211_MBSSID_CONFIG_ATTR_LAST: Internal
-+ * @NL80211_MBSSID_CONFIG_ATTR_MAX: highest attribute
-+ */
-+enum nl80211_mbssid_config_attributes {
-+	__NL80211_MBSSID_CONFIG_ATTR_INVALID,
-+
-+	NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
-+	NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
-+	NL80211_MBSSID_CONFIG_ATTR_INDEX,
-+	NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX,
-+	NL80211_MBSSID_CONFIG_ATTR_EMA,
-+
-+	/* keep last */
-+	__NL80211_MBSSID_CONFIG_ATTR_LAST,
-+	NL80211_MBSSID_CONFIG_ATTR_MAX = __NL80211_MBSSID_CONFIG_ATTR_LAST - 1,
-+};
-+
- #endif /* __LINUX_NL80211_H */
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -442,6 +442,16 @@ sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
- 	[NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
- };
- 
-+static const struct nla_policy
-+nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
-+	[NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
-+	[NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
-+						NLA_POLICY_MIN(NLA_U8, 1),
-+	[NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
-+	[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
-+	[NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
-+};
-+
- static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
- 	[0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
- 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
-@@ -788,6 +798,9 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
- 	[NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
- 	[NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
-+	[NL80211_ATTR_MBSSID_CONFIG] =
-+			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
-+	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
- };
- 
- /* policy for the key attributes */
-@@ -2236,6 +2249,35 @@ fail:
- 	return -ENOBUFS;
- }
- 
-+static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
-+{
-+	struct nlattr *config;
-+
-+	if (!wiphy->mbssid_max_interfaces)
-+		return 0;
-+
-+	config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
-+	if (!config)
-+		return -ENOBUFS;
-+
-+	if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
-+		       wiphy->mbssid_max_interfaces))
-+		goto fail;
-+
-+	if (wiphy->ema_max_profile_periodicity &&
-+	    nla_put_u8(msg,
-+		       NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
-+		       wiphy->ema_max_profile_periodicity))
-+		goto fail;
-+
-+	nla_nest_end(msg, config);
-+	return 0;
-+
-+fail:
-+	nla_nest_cancel(msg, config);
-+	return -ENOBUFS;
-+}
-+
- struct nl80211_dump_wiphy_state {
- 	s64 filter_wiphy;
- 	long start;
-@@ -2821,6 +2863,9 @@ static int nl80211_send_wiphy(struct cfg
- 		if (nl80211_put_sar_specs(rdev, msg))
- 			goto nla_put_failure;
- 
-+		if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
-+			goto nla_put_failure;
-+
- 		/* done */
- 		state->split_start = 0;
- 		break;
-@@ -5020,6 +5065,96 @@ static int validate_beacon_tx_rate(struc
- 	return 0;
- }
- 
-+static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
-+				       struct net_device *dev,
-+				       struct nlattr *attrs,
-+				       struct cfg80211_mbssid_config *config,
-+				       u8 num_elems)
-+{
-+	struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
-+
-+	if (!wiphy->mbssid_max_interfaces)
-+		return -EOPNOTSUPP;
-+
-+	if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
-+			     NULL) ||
-+	    !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
-+		return -EINVAL;
-+
-+	config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
-+	if (config->ema) {
-+		if (!wiphy->ema_max_profile_periodicity)
-+			return -EOPNOTSUPP;
-+
-+		if (num_elems > wiphy->ema_max_profile_periodicity)
-+			return -EINVAL;
-+	}
-+
-+	config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
-+	if (config->index >= wiphy->mbssid_max_interfaces ||
-+	    (!config->index && !num_elems))
-+		return -EINVAL;
-+
-+	if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
-+		u32 tx_ifindex =
-+			nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
-+
-+		if ((!config->index && tx_ifindex != dev->ifindex) ||
-+		    (config->index && tx_ifindex == dev->ifindex))
-+			return -EINVAL;
-+
-+		if (tx_ifindex != dev->ifindex) {
-+			struct net_device *tx_netdev =
-+				dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
-+
-+			if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
-+			    tx_netdev->ieee80211_ptr->wiphy != wiphy ||
-+			    tx_netdev->ieee80211_ptr->iftype !=
-+							NL80211_IFTYPE_AP) {
-+				dev_put(tx_netdev);
-+				return -EINVAL;
-+			}
-+
-+			config->tx_wdev = tx_netdev->ieee80211_ptr;
-+		} else {
-+			config->tx_wdev = dev->ieee80211_ptr;
-+		}
-+	} else if (!config->index) {
-+		config->tx_wdev = dev->ieee80211_ptr;
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
-+static struct cfg80211_mbssid_elems *
-+nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
-+{
-+	struct nlattr *nl_elems;
-+	struct cfg80211_mbssid_elems *elems;
-+	int rem_elems;
-+	u8 i = 0, num_elems = 0;
-+
-+	if (!wiphy->mbssid_max_interfaces)
-+		return ERR_PTR(-EINVAL);
-+
-+	nla_for_each_nested(nl_elems, attrs, rem_elems)
-+		num_elems++;
-+
-+	elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
-+	if (!elems)
-+		return ERR_PTR(-ENOMEM);
-+
-+	nla_for_each_nested(nl_elems, attrs, rem_elems) {
-+		elems->elem[i].data = nla_data(nl_elems);
-+		elems->elem[i].len = nla_len(nl_elems);
-+		i++;
-+	}
-+	elems->cnt = num_elems;
-+	return elems;
-+}
-+
- static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
- 				struct nlattr *attrs[],
- 				struct cfg80211_beacon_data *bcn)
-@@ -5100,6 +5235,17 @@ static int nl80211_parse_beacon(struct c
- 		bcn->ftm_responder = -1;
- 	}
- 
-+	if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
-+		struct cfg80211_mbssid_elems *mbssid =
-+			nl80211_parse_mbssid_elems(&rdev->wiphy,
-+						   attrs[NL80211_ATTR_MBSSID_ELEMS]);
-+
-+		if (IS_ERR(mbssid))
-+			return PTR_ERR(mbssid);
-+
-+		bcn->mbssid_ies = mbssid;
-+	}
-+
- 	return 0;
- }
- 
-@@ -5556,6 +5702,17 @@ static int nl80211_start_ap(struct sk_bu
- 			goto out;
- 	}
- 
-+	if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
-+		err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
-+						  info->attrs[NL80211_ATTR_MBSSID_CONFIG],
-+						  &params.mbssid_config,
-+						  params.beacon.mbssid_ies ?
-+							params.beacon.mbssid_ies->cnt :
-+							0);
-+		if (err)
-+			goto out;
-+	}
-+
- 	nl80211_calculate_ap_params(&params);
- 
- 	if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
-@@ -5577,6 +5734,11 @@ static int nl80211_start_ap(struct sk_bu
- 
- out:
- 	kfree(params.acl);
-+	kfree(params.beacon.mbssid_ies);
-+	if (params.mbssid_config.tx_wdev &&
-+	    params.mbssid_config.tx_wdev->netdev &&
-+	    params.mbssid_config.tx_wdev->netdev != dev)
-+		dev_put(params.mbssid_config.tx_wdev->netdev);
- 
- 	return err;
- }
-@@ -5601,12 +5763,14 @@ static int nl80211_set_beacon(struct sk_
- 
- 	err = nl80211_parse_beacon(rdev, info->attrs, &params);
- 	if (err)
--		return err;
-+		goto out;
- 
- 	wdev_lock(wdev);
- 	err = rdev_change_beacon(rdev, dev, &params);
- 	wdev_unlock(wdev);
- 
-+out:
-+	kfree(params.mbssid_ies);
- 	return err;
- }
- 
-@@ -9283,12 +9447,14 @@ static int nl80211_channel_switch(struct
- 
- 	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
- 	if (err)
--		return err;
-+		goto free;
- 
- 	csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
- 			    GFP_KERNEL);
--	if (!csa_attrs)
--		return -ENOMEM;
-+	if (!csa_attrs) {
-+		err = -ENOMEM;
-+		goto free;
-+	}
- 
- 	err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
- 					  info->attrs[NL80211_ATTR_CSA_IES],
-@@ -9407,6 +9573,8 @@ skip_beacons:
- 	wdev_unlock(wdev);
- 
- free:
-+	kfree(params.beacon_after.mbssid_ies);
-+	kfree(params.beacon_csa.mbssid_ies);
- 	kfree(csa_attrs);
- 	return err;
- }
-@@ -14959,6 +15127,8 @@ static int nl80211_color_change(struct s
- 	wdev_unlock(wdev);
- 
- out:
-+	kfree(params.beacon_next.mbssid_ies);
-+	kfree(params.beacon_color_change.mbssid_ies);
- 	kfree(tb);
- 	return err;
- }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/314-v5.17-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/314-v5.17-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch
deleted file mode 100644
index 2038ee6..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/314-v5.17-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch
+++ /dev/null
@@ -1,378 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Sat, 23 Oct 2021 11:10:50 +0200
-Subject: [PATCH] cfg80211: implement APIs for dedicated radar detection HW
-
-If a dedicated (off-channel) radar detection hardware (chain)
-is available in the hardware/driver, allow this to be used by
-calling the NL80211_CMD_RADAR_DETECT command with a new flag
-attribute requesting off-channel radar detection is used.
-
-Offchannel CAC (channel availability check) avoids the CAC
-downtime when switching to a radar channel or when turning on
-the AP.
-
-Drivers advertise support for this using the new feature flag
-NL80211_EXT_FEATURE_RADAR_OFFCHAN.
-
-Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/7468e291ef5d05d692c1738d25b8f778d8ea5c3f.1634979655.git.lorenzo@kernel.org
-Link: https://lore.kernel.org/r/1e60e60fef00e14401adae81c3d49f3e5f307537.1634979655.git.lorenzo@kernel.org
-Link: https://lore.kernel.org/r/85fa50f57fc3adb2934c8d9ca0be30394de6b7e8.1634979655.git.lorenzo@kernel.org
-Link: https://lore.kernel.org/r/4b6c08671ad59aae0ac46fc94c02f31b1610eb72.1634979655.git.lorenzo@kernel.org
-Link: https://lore.kernel.org/r/241849ccaf2c228873c6f8495bf87b19159ba458.1634979655.git.lorenzo@kernel.org
-[remove offchan_mutex, fix cfg80211_stop_offchan_radar_detection(),
- remove gfp_t argument, fix documentation, fix tracing]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -4057,6 +4057,15 @@ struct mgmt_frame_regs {
-  * @set_sar_specs: Update the SAR (TX power) settings.
-  *
-  * @color_change: Initiate a color change.
-+ *
-+ * @set_radar_offchan: Configure dedicated offchannel chain available for
-+ *	radar/CAC detection on some hw. This chain can't be used to transmit
-+ *	or receive frames and it is bounded to a running wdev.
-+ *	Offchannel radar/CAC detection allows to avoid the CAC downtime
-+ *	switching to a different channel during CAC detection on the selected
-+ *	radar channel.
-+ *	The caller is expected to set chandef pointer to NULL in order to
-+ *	disable offchannel CAC/radar detection.
-  */
- struct cfg80211_ops {
- 	int	(*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
-@@ -4387,6 +4396,8 @@ struct cfg80211_ops {
- 	int	(*color_change)(struct wiphy *wiphy,
- 				struct net_device *dev,
- 				struct cfg80211_color_change_settings *params);
-+	int	(*set_radar_offchan)(struct wiphy *wiphy,
-+				     struct cfg80211_chan_def *chandef);
- };
- 
- /*
-@@ -7608,6 +7619,20 @@ void cfg80211_cac_event(struct net_devic
- 			const struct cfg80211_chan_def *chandef,
- 			enum nl80211_radar_event event, gfp_t gfp);
- 
-+/**
-+ * cfg80211_offchan_cac_event - Channel Availability Check (CAC) offchan event
-+ * @wiphy: the wiphy
-+ * @chandef: chandef for the current channel
-+ * @event: type of event
-+ *
-+ * This function is called when a Channel Availability Check (CAC) is finished,
-+ * started or aborted by a offchannel dedicated chain.
-+ *
-+ * Note that this acquires the wiphy lock.
-+ */
-+void cfg80211_offchan_cac_event(struct wiphy *wiphy,
-+				const struct cfg80211_chan_def *chandef,
-+				enum nl80211_radar_event event);
- 
- /**
-  * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -2608,6 +2608,13 @@ enum nl80211_commands {
-  *	Mandatory parameter for the transmitting interface to enable MBSSID.
-  *	Optional for the non-transmitting interfaces.
-  *
-+ * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated offchannel chain available for
-+ *	radar/CAC detection on some hw. This chain can't be used to transmit
-+ *	or receive frames and it is bounded to a running wdev.
-+ *	Offchannel radar/CAC detection allows to avoid the CAC downtime
-+ *	switching on a different channel during CAC detection on the selected
-+ *	radar channel.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3114,6 +3121,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_MBSSID_CONFIG,
- 	NL80211_ATTR_MBSSID_ELEMS,
- 
-+	NL80211_ATTR_RADAR_OFFCHAN,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
-@@ -6013,6 +6022,9 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-  *	detection and change announcemnts.
-  *
-+ * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
-+ *	detection.
-+ *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
-  */
-@@ -6078,6 +6090,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
- 	NL80211_EXT_FEATURE_BSS_COLOR,
-+	NL80211_EXT_FEATURE_RADAR_OFFCHAN,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
---- a/net/wireless/core.c
-+++ b/net/wireless/core.c
-@@ -543,6 +543,7 @@ use_default_name:
- 	INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
- 	INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
- 	INIT_WORK(&rdev->event_work, cfg80211_event_work);
-+	INIT_DELAYED_WORK(&rdev->offchan_cac_work, cfg80211_offchan_cac_work);
- 
- 	init_waitqueue_head(&rdev->dev_wait);
- 
-@@ -1205,6 +1206,8 @@ void __cfg80211_leave(struct cfg80211_re
- 
- 	cfg80211_pmsr_wdev_down(wdev);
- 
-+	cfg80211_stop_offchan_radar_detection(wdev);
-+
- 	switch (wdev->iftype) {
- 	case NL80211_IFTYPE_ADHOC:
- 		__cfg80211_leave_ibss(rdev, dev, true);
---- a/net/wireless/core.h
-+++ b/net/wireless/core.h
-@@ -84,6 +84,10 @@ struct cfg80211_registered_device {
- 
- 	struct delayed_work dfs_update_channels_wk;
- 
-+	struct wireless_dev *offchan_radar_wdev;
-+	struct cfg80211_chan_def offchan_radar_chandef;
-+	struct delayed_work offchan_cac_work;
-+
- 	/* netlink port which started critical protocol (0 means not started) */
- 	u32 crit_proto_nlportid;
- 
-@@ -491,6 +495,15 @@ cfg80211_chandef_dfs_cac_time(struct wip
- 
- void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
- 
-+int
-+cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
-+				       struct wireless_dev *wdev,
-+				       struct cfg80211_chan_def *chandef);
-+
-+void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
-+
-+void cfg80211_offchan_cac_work(struct work_struct *work);
-+
- bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
- 				  struct ieee80211_channel *chan);
- 
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -970,3 +970,116 @@ void cfg80211_cac_event(struct net_devic
- 	nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
- }
- EXPORT_SYMBOL(cfg80211_cac_event);
-+
-+void cfg80211_offchan_cac_work(struct work_struct *work)
-+{
-+	struct delayed_work *delayed_work = to_delayed_work(work);
-+	struct cfg80211_registered_device *rdev;
-+
-+	rdev = container_of(delayed_work, struct cfg80211_registered_device,
-+			    offchan_cac_work);
-+	cfg80211_offchan_cac_event(&rdev->wiphy, &rdev->offchan_radar_chandef,
-+				   NL80211_RADAR_CAC_FINISHED);
-+}
-+
-+static void
-+__cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
-+			     struct wireless_dev *wdev,
-+			     const struct cfg80211_chan_def *chandef,
-+			     enum nl80211_radar_event event)
-+{
-+	struct wiphy *wiphy = &rdev->wiphy;
-+	struct net_device *netdev;
-+
-+	lockdep_assert_wiphy(&rdev->wiphy);
-+
-+	if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
-+		return;
-+
-+	switch (event) {
-+	case NL80211_RADAR_CAC_FINISHED:
-+		cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
-+		memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
-+		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
-+		cfg80211_sched_dfs_chan_update(rdev);
-+		wdev = rdev->offchan_radar_wdev;
-+		rdev->offchan_radar_wdev = NULL;
-+		break;
-+	case NL80211_RADAR_CAC_ABORTED:
-+		cancel_delayed_work(&rdev->offchan_cac_work);
-+		wdev = rdev->offchan_radar_wdev;
-+		rdev->offchan_radar_wdev = NULL;
-+		break;
-+	case NL80211_RADAR_CAC_STARTED:
-+		WARN_ON(!wdev);
-+		rdev->offchan_radar_wdev = wdev;
-+		break;
-+	default:
-+		return;
-+	}
-+
-+	netdev = wdev ? wdev->netdev : NULL;
-+	nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
-+}
-+
-+void cfg80211_offchan_cac_event(struct wiphy *wiphy,
-+				const struct cfg80211_chan_def *chandef,
-+				enum nl80211_radar_event event)
-+{
-+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
-+
-+	wiphy_lock(wiphy);
-+	__cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
-+	wiphy_unlock(wiphy);
-+}
-+EXPORT_SYMBOL(cfg80211_offchan_cac_event);
-+
-+int
-+cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
-+				       struct wireless_dev *wdev,
-+				       struct cfg80211_chan_def *chandef)
-+{
-+	unsigned int cac_time_ms;
-+	int err;
-+
-+	lockdep_assert_wiphy(&rdev->wiphy);
-+
-+	if (!wiphy_ext_feature_isset(&rdev->wiphy,
-+				     NL80211_EXT_FEATURE_RADAR_OFFCHAN))
-+		return -EOPNOTSUPP;
-+
-+	if (rdev->offchan_radar_wdev)
-+		return -EBUSY;
-+
-+	err = rdev_set_radar_offchan(rdev, chandef);
-+	if (err)
-+		return err;
-+
-+	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, chandef);
-+	if (!cac_time_ms)
-+		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
-+
-+	rdev->offchan_radar_chandef = *chandef;
-+	__cfg80211_offchan_cac_event(rdev, wdev, chandef,
-+				     NL80211_RADAR_CAC_STARTED);
-+	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_work,
-+			   msecs_to_jiffies(cac_time_ms));
-+
-+	return 0;
-+}
-+
-+void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev)
-+{
-+	struct wiphy *wiphy = wdev->wiphy;
-+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
-+
-+	lockdep_assert_wiphy(wiphy);
-+
-+	if (wdev != rdev->offchan_radar_wdev)
-+		return;
-+
-+	rdev_set_radar_offchan(rdev, NULL);
-+
-+	__cfg80211_offchan_cac_event(rdev, NULL, NULL,
-+				     NL80211_RADAR_CAC_ABORTED);
-+}
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -801,6 +801,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_MBSSID_CONFIG] =
- 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
- 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
-+	[NL80211_ATTR_RADAR_OFFCHAN] = { .type = NLA_FLAG },
- };
- 
- /* policy for the key attributes */
-@@ -9287,12 +9288,6 @@ static int nl80211_start_radar_detection
- 	if (err)
- 		return err;
- 
--	if (netif_carrier_ok(dev))
--		return -EBUSY;
--
--	if (wdev->cac_started)
--		return -EBUSY;
--
- 	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
- 	if (err < 0)
- 		return err;
-@@ -9303,6 +9298,16 @@ static int nl80211_start_radar_detection
- 	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
- 		return -EINVAL;
- 
-+	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN]))
-+		return cfg80211_start_offchan_radar_detection(rdev, wdev,
-+							      &chandef);
-+
-+	if (netif_carrier_ok(dev))
-+		return -EBUSY;
-+
-+	if (wdev->cac_started)
-+		return -EBUSY;
-+
- 	/* CAC start is offloaded to HW and can't be started manually */
- 	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
- 		return -EOPNOTSUPP;
---- a/net/wireless/rdev-ops.h
-+++ b/net/wireless/rdev-ops.h
-@@ -1381,4 +1381,21 @@ static inline int rdev_color_change(stru
- 	return ret;
- }
- 
-+static inline int
-+rdev_set_radar_offchan(struct cfg80211_registered_device *rdev,
-+		       struct cfg80211_chan_def *chandef)
-+{
-+	struct wiphy *wiphy = &rdev->wiphy;
-+	int ret;
-+
-+	if (!rdev->ops->set_radar_offchan)
-+		return -EOPNOTSUPP;
-+
-+	trace_rdev_set_radar_offchan(wiphy, chandef);
-+	ret = rdev->ops->set_radar_offchan(wiphy, chandef);
-+	trace_rdev_return_int(wiphy, ret);
-+
-+	return ret;
-+}
-+
- #endif /* __CFG80211_RDEV_OPS */
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -3643,6 +3643,25 @@ TRACE_EVENT(cfg80211_bss_color_notify,
- 		  __entry->color_bitmap)
- );
- 
-+TRACE_EVENT(rdev_set_radar_offchan,
-+	TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
-+
-+	TP_ARGS(wiphy, chandef),
-+
-+	TP_STRUCT__entry(
-+		WIPHY_ENTRY
-+		CHAN_DEF_ENTRY
-+	),
-+
-+	TP_fast_assign(
-+		WIPHY_ASSIGN;
-+		CHAN_DEF_ASSIGN(chandef)
-+	),
-+
-+	TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
-+		  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
-+);
-+
- #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
- 
- #undef TRACE_INCLUDE_PATH
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v5.17-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v5.17-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch
deleted file mode 100644
index b1a1d2c..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/315-v5.17-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch
+++ /dev/null
@@ -1,183 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Wed, 27 Oct 2021 11:03:42 +0200
-Subject: [PATCH] cfg80211: move offchan_cac_event to a dedicated work
-
-In order to make cfg80211_offchan_cac_abort() (renamed from
-cfg80211_offchan_cac_event) callable in other contexts and
-without so much locking restrictions, make it trigger a new
-work instead of operating directly.
-
-Do some other renames while at it to clarify.
-
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/6145c3d0f30400a568023f67981981d24c7c6133.1635325205.git.lorenzo@kernel.org
-[rewrite commit log]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -7620,19 +7620,13 @@ void cfg80211_cac_event(struct net_devic
- 			enum nl80211_radar_event event, gfp_t gfp);
- 
- /**
-- * cfg80211_offchan_cac_event - Channel Availability Check (CAC) offchan event
-+ * cfg80211_offchan_cac_abort - Channel Availability Check offchan abort event
-  * @wiphy: the wiphy
-- * @chandef: chandef for the current channel
-- * @event: type of event
-  *
-- * This function is called when a Channel Availability Check (CAC) is finished,
-- * started or aborted by a offchannel dedicated chain.
-- *
-- * Note that this acquires the wiphy lock.
-+ * This function is called by the driver when a Channel Availability Check
-+ * (CAC) is aborted by a offchannel dedicated chain.
-  */
--void cfg80211_offchan_cac_event(struct wiphy *wiphy,
--				const struct cfg80211_chan_def *chandef,
--				enum nl80211_radar_event event);
-+void cfg80211_offchan_cac_abort(struct wiphy *wiphy);
- 
- /**
-  * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
---- a/net/wireless/core.c
-+++ b/net/wireless/core.c
-@@ -543,7 +543,9 @@ use_default_name:
- 	INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
- 	INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
- 	INIT_WORK(&rdev->event_work, cfg80211_event_work);
--	INIT_DELAYED_WORK(&rdev->offchan_cac_work, cfg80211_offchan_cac_work);
-+	INIT_WORK(&rdev->offchan_cac_abort_wk, cfg80211_offchan_cac_abort_wk);
-+	INIT_DELAYED_WORK(&rdev->offchan_cac_done_wk,
-+			  cfg80211_offchan_cac_done_wk);
- 
- 	init_waitqueue_head(&rdev->dev_wait);
- 
-@@ -1053,11 +1055,13 @@ void wiphy_unregister(struct wiphy *wiph
- 	cancel_work_sync(&rdev->conn_work);
- 	flush_work(&rdev->event_work);
- 	cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
-+	cancel_delayed_work_sync(&rdev->offchan_cac_done_wk);
- 	flush_work(&rdev->destroy_work);
- 	flush_work(&rdev->sched_scan_stop_wk);
- 	flush_work(&rdev->propagate_radar_detect_wk);
- 	flush_work(&rdev->propagate_cac_done_wk);
- 	flush_work(&rdev->mgmt_registrations_update_wk);
-+	flush_work(&rdev->offchan_cac_abort_wk);
- 
- #ifdef CONFIG_PM
- 	if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
---- a/net/wireless/core.h
-+++ b/net/wireless/core.h
-@@ -86,7 +86,8 @@ struct cfg80211_registered_device {
- 
- 	struct wireless_dev *offchan_radar_wdev;
- 	struct cfg80211_chan_def offchan_radar_chandef;
--	struct delayed_work offchan_cac_work;
-+	struct delayed_work offchan_cac_done_wk;
-+	struct work_struct offchan_cac_abort_wk;
- 
- 	/* netlink port which started critical protocol (0 means not started) */
- 	u32 crit_proto_nlportid;
-@@ -502,7 +503,9 @@ cfg80211_start_offchan_radar_detection(s
- 
- void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
- 
--void cfg80211_offchan_cac_work(struct work_struct *work);
-+void cfg80211_offchan_cac_done_wk(struct work_struct *work);
-+
-+void cfg80211_offchan_cac_abort_wk(struct work_struct *work);
- 
- bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
- 				  struct ieee80211_channel *chan);
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -971,17 +971,6 @@ void cfg80211_cac_event(struct net_devic
- }
- EXPORT_SYMBOL(cfg80211_cac_event);
- 
--void cfg80211_offchan_cac_work(struct work_struct *work)
--{
--	struct delayed_work *delayed_work = to_delayed_work(work);
--	struct cfg80211_registered_device *rdev;
--
--	rdev = container_of(delayed_work, struct cfg80211_registered_device,
--			    offchan_cac_work);
--	cfg80211_offchan_cac_event(&rdev->wiphy, &rdev->offchan_radar_chandef,
--				   NL80211_RADAR_CAC_FINISHED);
--}
--
- static void
- __cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
- 			     struct wireless_dev *wdev,
-@@ -1006,7 +995,7 @@ __cfg80211_offchan_cac_event(struct cfg8
- 		rdev->offchan_radar_wdev = NULL;
- 		break;
- 	case NL80211_RADAR_CAC_ABORTED:
--		cancel_delayed_work(&rdev->offchan_cac_work);
-+		cancel_delayed_work(&rdev->offchan_cac_done_wk);
- 		wdev = rdev->offchan_radar_wdev;
- 		rdev->offchan_radar_wdev = NULL;
- 		break;
-@@ -1022,17 +1011,44 @@ __cfg80211_offchan_cac_event(struct cfg8
- 	nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
- }
- 
--void cfg80211_offchan_cac_event(struct wiphy *wiphy,
--				const struct cfg80211_chan_def *chandef,
--				enum nl80211_radar_event event)
-+static void
-+cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
-+			   const struct cfg80211_chan_def *chandef,
-+			   enum nl80211_radar_event event)
-+{
-+	wiphy_lock(&rdev->wiphy);
-+	__cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
-+	wiphy_unlock(&rdev->wiphy);
-+}
-+
-+void cfg80211_offchan_cac_done_wk(struct work_struct *work)
-+{
-+	struct delayed_work *delayed_work = to_delayed_work(work);
-+	struct cfg80211_registered_device *rdev;
-+
-+	rdev = container_of(delayed_work, struct cfg80211_registered_device,
-+			    offchan_cac_done_wk);
-+	cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
-+				   NL80211_RADAR_CAC_FINISHED);
-+}
-+
-+void cfg80211_offchan_cac_abort_wk(struct work_struct *work)
-+{
-+	struct cfg80211_registered_device *rdev;
-+
-+	rdev = container_of(work, struct cfg80211_registered_device,
-+			    offchan_cac_abort_wk);
-+	cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
-+				   NL80211_RADAR_CAC_ABORTED);
-+}
-+
-+void cfg80211_offchan_cac_abort(struct wiphy *wiphy)
- {
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
- 
--	wiphy_lock(wiphy);
--	__cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
--	wiphy_unlock(wiphy);
-+	queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
- }
--EXPORT_SYMBOL(cfg80211_offchan_cac_event);
-+EXPORT_SYMBOL(cfg80211_offchan_cac_abort);
- 
- int
- cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
-@@ -1062,7 +1078,7 @@ cfg80211_start_offchan_radar_detection(s
- 	rdev->offchan_radar_chandef = *chandef;
- 	__cfg80211_offchan_cac_event(rdev, wdev, chandef,
- 				     NL80211_RADAR_CAC_STARTED);
--	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_work,
-+	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
- 			   msecs_to_jiffies(cac_time_ms));
- 
- 	return 0;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/316-v5.17-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/316-v5.17-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch
deleted file mode 100644
index 362bb88..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/316-v5.17-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Wed, 3 Nov 2021 18:02:35 +0100
-Subject: [PATCH] cfg80211: fix possible NULL pointer dereference in
- cfg80211_stop_offchan_radar_detection
-
-Fix the following NULL pointer dereference in
-cfg80211_stop_offchan_radar_detection routine that occurs when hostapd
-is stopped during the CAC on offchannel chain:
-
-Sat Jan  1 0[  779.567851]   ESR = 0x96000005
-0:12:50 2000 dae[  779.572346]   EC = 0x25: DABT (current EL), IL = 32 bits
-mon.debug hostap[  779.578984]   SET = 0, FnV = 0
-d: hostapd_inter[  779.583445]   EA = 0, S1PTW = 0
-face_deinit_free[  779.587936] Data abort info:
-: num_bss=1 conf[  779.592224]   ISV = 0, ISS = 0x00000005
-->num_bss=1
-Sat[  779.597403]   CM = 0, WnR = 0
- Jan  1 00:12:50[  779.601749] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000418b2000
- 2000 daemon.deb[  779.609601] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
-ug hostapd: host[  779.619657] Internal error: Oops: 96000005 [#1] SMP
-[  779.770810] CPU: 0 PID: 2202 Comm: hostapd Not tainted 5.10.75 #0
-[  779.776892] Hardware name: MediaTek MT7622 RFB1 board (DT)
-[  779.782370] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
-[  779.788384] pc : cfg80211_chandef_valid+0x10/0x490 [cfg80211]
-[  779.794128] lr : cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
-[  779.800731] sp : ffffffc01204b7e0
-[  779.804036] x29: ffffffc01204b7e0 x28: ffffff80039bdc00
-[  779.809340] x27: 0000000000000000 x26: ffffffc008cb3050
-[  779.814644] x25: 0000000000000000 x24: 0000000000000002
-[  779.819948] x23: ffffff8002630000 x22: ffffff8003e748d0
-[  779.825252] x21: 0000000000000cc0 x20: ffffff8003da4a00
-[  779.830556] x19: 0000000000000000 x18: ffffff8001bf7ce0
-[  779.835860] x17: 00000000ffffffff x16: 0000000000000000
-[  779.841164] x15: 0000000040d59200 x14: 00000000000019c0
-[  779.846467] x13: 00000000000001c8 x12: 000636b9e9dab1c6
-[  779.851771] x11: 0000000000000141 x10: 0000000000000820
-[  779.857076] x9 : 0000000000000000 x8 : ffffff8003d7d038
-[  779.862380] x7 : 0000000000000000 x6 : ffffff8003d7d038
-[  779.867683] x5 : 0000000000000e90 x4 : 0000000000000038
-[  779.872987] x3 : 0000000000000002 x2 : 0000000000000004
-[  779.878291] x1 : 0000000000000000 x0 : 0000000000000000
-[  779.883594] Call trace:
-[  779.886039]  cfg80211_chandef_valid+0x10/0x490 [cfg80211]
-[  779.891434]  cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
-[  779.897697]  nl80211_radar_notify+0x138/0x19c [cfg80211]
-[  779.903005]  cfg80211_stop_offchan_radar_detection+0x7c/0x8c [cfg80211]
-[  779.909616]  __cfg80211_leave+0x2c/0x190 [cfg80211]
-[  779.914490]  cfg80211_register_netdevice+0x1c0/0x6d0 [cfg80211]
-[  779.920404]  raw_notifier_call_chain+0x50/0x70
-[  779.924841]  call_netdevice_notifiers_info+0x54/0xa0
-[  779.929796]  __dev_close_many+0x40/0x100
-[  779.933712]  __dev_change_flags+0x98/0x190
-[  779.937800]  dev_change_flags+0x20/0x60
-[  779.941628]  devinet_ioctl+0x534/0x6d0
-[  779.945370]  inet_ioctl+0x1bc/0x230
-[  779.948849]  sock_do_ioctl+0x44/0x200
-[  779.952502]  sock_ioctl+0x268/0x4c0
-[  779.955985]  __arm64_sys_ioctl+0xac/0xd0
-[  779.959900]  el0_svc_common.constprop.0+0x60/0x110
-[  779.964682]  do_el0_svc+0x1c/0x24
-[  779.967990]  el0_svc+0x10/0x1c
-[  779.971036]  el0_sync_handler+0x9c/0x120
-[  779.974950]  el0_sync+0x148/0x180
-[  779.978259] Code: a9bc7bfd 910003fd a90153f3 aa0003f3 (f9400000)
-[  779.984344] ---[ end trace 0e67b4f5d6cdeec7 ]---
-[  779.996400] Kernel panic - not syncing: Oops: Fatal exception
-[  780.002139] SMP: stopping secondary CPUs
-[  780.006057] Kernel Offset: disabled
-[  780.009537] CPU features: 0x0000002,04002004
-[  780.013796] Memory Limit: none
-
-Fixes: b8f5facf286b ("cfg80211: implement APIs for dedicated radar detection HW")
-Reported-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/c2e34c065bf8839c5ffa45498ae154021a72a520.1635958796.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -982,6 +982,9 @@ __cfg80211_offchan_cac_event(struct cfg8
- 
- 	lockdep_assert_wiphy(&rdev->wiphy);
- 
-+	if (!cfg80211_chandef_valid(chandef))
-+		return;
-+
- 	if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
- 		return;
- 
-@@ -1096,6 +1099,6 @@ void cfg80211_stop_offchan_radar_detecti
- 
- 	rdev_set_radar_offchan(rdev, NULL);
- 
--	__cfg80211_offchan_cac_event(rdev, NULL, NULL,
-+	__cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
- 				     NL80211_RADAR_CAC_ABORTED);
- }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/317-v5.17-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/317-v5.17-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch
deleted file mode 100644
index df7afef..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/317-v5.17-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch
+++ /dev/null
@@ -1,136 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Tue, 16 Nov 2021 12:41:52 +0100
-Subject: [PATCH] cfg80211: schedule offchan_cac_abort_wk in
- cfg80211_radar_event
-
-If necessary schedule offchan_cac_abort_wk work in cfg80211_radar_event
-routine adding offchan parameter to cfg80211_radar_event signature.
-Rename cfg80211_radar_event in __cfg80211_radar_event and introduce
-the two following inline helpers:
-- cfg80211_radar_event
-- cfg80211_offchan_radar_event
-Doing so the drv will not need to run cfg80211_offchan_cac_abort() after
-radar detection on the offchannel chain.
-
-Tested-by: Owen Peng <owen.peng@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/3ff583e021e3343a3ced54a7b09b5e184d1880dc.1637062727.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -7580,15 +7580,33 @@ void cfg80211_cqm_txe_notify(struct net_
- void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp);
- 
- /**
-- * cfg80211_radar_event - radar detection event
-+ * __cfg80211_radar_event - radar detection event
-  * @wiphy: the wiphy
-  * @chandef: chandef for the current channel
-+ * @offchan: the radar has been detected on the offchannel chain
-  * @gfp: context flags
-  *
-  * This function is called when a radar is detected on the current chanenl.
-  */
--void cfg80211_radar_event(struct wiphy *wiphy,
--			  struct cfg80211_chan_def *chandef, gfp_t gfp);
-+void __cfg80211_radar_event(struct wiphy *wiphy,
-+			    struct cfg80211_chan_def *chandef,
-+			    bool offchan, gfp_t gfp);
-+
-+static inline void
-+cfg80211_radar_event(struct wiphy *wiphy,
-+		     struct cfg80211_chan_def *chandef,
-+		     gfp_t gfp)
-+{
-+	__cfg80211_radar_event(wiphy, chandef, false, gfp);
-+}
-+
-+static inline void
-+cfg80211_offchan_radar_event(struct wiphy *wiphy,
-+			     struct cfg80211_chan_def *chandef,
-+			     gfp_t gfp)
-+{
-+	__cfg80211_radar_event(wiphy, chandef, true, gfp);
-+}
- 
- /**
-  * cfg80211_sta_opmode_change_notify - STA's ht/vht operation mode change event
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -905,13 +905,13 @@ void cfg80211_dfs_channels_update_work(s
- }
- 
- 
--void cfg80211_radar_event(struct wiphy *wiphy,
--			  struct cfg80211_chan_def *chandef,
--			  gfp_t gfp)
-+void __cfg80211_radar_event(struct wiphy *wiphy,
-+			    struct cfg80211_chan_def *chandef,
-+			    bool offchan, gfp_t gfp)
- {
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
- 
--	trace_cfg80211_radar_event(wiphy, chandef);
-+	trace_cfg80211_radar_event(wiphy, chandef, offchan);
- 
- 	/* only set the chandef supplied channel to unavailable, in
- 	 * case the radar is detected on only one of multiple channels
-@@ -919,6 +919,9 @@ void cfg80211_radar_event(struct wiphy *
- 	 */
- 	cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
- 
-+	if (offchan)
-+		queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
-+
- 	cfg80211_sched_dfs_chan_update(rdev);
- 
- 	nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
-@@ -926,7 +929,7 @@ void cfg80211_radar_event(struct wiphy *
- 	memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
- 	queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
- }
--EXPORT_SYMBOL(cfg80211_radar_event);
-+EXPORT_SYMBOL(__cfg80211_radar_event);
- 
- void cfg80211_cac_event(struct net_device *netdev,
- 			const struct cfg80211_chan_def *chandef,
-@@ -998,7 +1001,8 @@ __cfg80211_offchan_cac_event(struct cfg8
- 		rdev->offchan_radar_wdev = NULL;
- 		break;
- 	case NL80211_RADAR_CAC_ABORTED:
--		cancel_delayed_work(&rdev->offchan_cac_done_wk);
-+		if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
-+			return;
- 		wdev = rdev->offchan_radar_wdev;
- 		rdev->offchan_radar_wdev = NULL;
- 		break;
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -3022,18 +3022,21 @@ TRACE_EVENT(cfg80211_ch_switch_started_n
- );
- 
- TRACE_EVENT(cfg80211_radar_event,
--	TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
--	TP_ARGS(wiphy, chandef),
-+	TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
-+		 bool offchan),
-+	TP_ARGS(wiphy, chandef, offchan),
- 	TP_STRUCT__entry(
- 		WIPHY_ENTRY
- 		CHAN_DEF_ENTRY
-+		__field(bool, offchan)
- 	),
- 	TP_fast_assign(
- 		WIPHY_ASSIGN;
- 		CHAN_DEF_ASSIGN(chandef);
-+		__entry->offchan = offchan;
- 	),
--	TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
--		  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
-+	TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", offchan %d",
-+		  WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->offchan)
- );
- 
- TRACE_EVENT(cfg80211_cac_event,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-v5.17-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-v5.17-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch
deleted file mode 100644
index a1b6e3c..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/318-v5.17-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch
+++ /dev/null
@@ -1,220 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Tue, 16 Nov 2021 15:03:36 +0100
-Subject: [PATCH] cfg80211: allow continuous radar monitoring on offchannel
- chain
-
-Allow continuous radar detection on the offchannel chain in order
-to switch to the monitored channel whenever the underlying driver
-reports a radar pattern on the main channel.
-
-Tested-by: Owen Peng <owen.peng@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/d46217310a49b14ff0e9c002f0a6e0547d70fd2c.1637071350.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/chan.c
-+++ b/net/wireless/chan.c
-@@ -712,6 +712,19 @@ static bool cfg80211_is_wiphy_oper_chan(
- 	return false;
- }
- 
-+static bool
-+cfg80211_offchan_chain_is_active(struct cfg80211_registered_device *rdev,
-+				 struct ieee80211_channel *channel)
-+{
-+	if (!rdev->offchan_radar_wdev)
-+		return false;
-+
-+	if (!cfg80211_chandef_valid(&rdev->offchan_radar_chandef))
-+		return false;
-+
-+	return cfg80211_is_sub_chan(&rdev->offchan_radar_chandef, channel);
-+}
-+
- bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
- 				  struct ieee80211_channel *chan)
- {
-@@ -728,6 +741,9 @@ bool cfg80211_any_wiphy_oper_chan(struct
- 
- 		if (cfg80211_is_wiphy_oper_chan(&rdev->wiphy, chan))
- 			return true;
-+
-+		if (cfg80211_offchan_chain_is_active(rdev, chan))
-+			return true;
- 	}
- 
- 	return false;
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -988,7 +988,7 @@ __cfg80211_offchan_cac_event(struct cfg8
- 	if (!cfg80211_chandef_valid(chandef))
- 		return;
- 
--	if (event != NL80211_RADAR_CAC_STARTED && !rdev->offchan_radar_wdev)
-+	if (!rdev->offchan_radar_wdev)
- 		return;
- 
- 	switch (event) {
-@@ -998,17 +998,13 @@ __cfg80211_offchan_cac_event(struct cfg8
- 		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
- 		cfg80211_sched_dfs_chan_update(rdev);
- 		wdev = rdev->offchan_radar_wdev;
--		rdev->offchan_radar_wdev = NULL;
- 		break;
- 	case NL80211_RADAR_CAC_ABORTED:
- 		if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
- 			return;
- 		wdev = rdev->offchan_radar_wdev;
--		rdev->offchan_radar_wdev = NULL;
- 		break;
- 	case NL80211_RADAR_CAC_STARTED:
--		WARN_ON(!wdev);
--		rdev->offchan_radar_wdev = wdev;
- 		break;
- 	default:
- 		return;
-@@ -1024,7 +1020,8 @@ cfg80211_offchan_cac_event(struct cfg802
- 			   enum nl80211_radar_event event)
- {
- 	wiphy_lock(&rdev->wiphy);
--	__cfg80211_offchan_cac_event(rdev, NULL, chandef, event);
-+	__cfg80211_offchan_cac_event(rdev, rdev->offchan_radar_wdev,
-+				     chandef, event);
- 	wiphy_unlock(&rdev->wiphy);
- }
- 
-@@ -1071,7 +1068,13 @@ cfg80211_start_offchan_radar_detection(s
- 				     NL80211_EXT_FEATURE_RADAR_OFFCHAN))
- 		return -EOPNOTSUPP;
- 
--	if (rdev->offchan_radar_wdev)
-+	/* Offchannel chain already locked by another wdev */
-+	if (rdev->offchan_radar_wdev && rdev->offchan_radar_wdev != wdev)
-+		return -EBUSY;
-+
-+	/* CAC already in progress on the offchannel chain */
-+	if (rdev->offchan_radar_wdev == wdev &&
-+	    delayed_work_pending(&rdev->offchan_cac_done_wk))
- 		return -EBUSY;
- 
- 	err = rdev_set_radar_offchan(rdev, chandef);
-@@ -1083,6 +1086,8 @@ cfg80211_start_offchan_radar_detection(s
- 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
- 
- 	rdev->offchan_radar_chandef = *chandef;
-+	rdev->offchan_radar_wdev = wdev; /* Get offchain ownership */
-+
- 	__cfg80211_offchan_cac_event(rdev, wdev, chandef,
- 				     NL80211_RADAR_CAC_STARTED);
- 	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
-@@ -1102,6 +1107,7 @@ void cfg80211_stop_offchan_radar_detecti
- 		return;
- 
- 	rdev_set_radar_offchan(rdev, NULL);
-+	rdev->offchan_radar_wdev = NULL; /* Release offchain ownership */
- 
- 	__cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
- 				     NL80211_RADAR_CAC_ABORTED);
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -9278,42 +9278,60 @@ static int nl80211_start_radar_detection
- 	struct cfg80211_chan_def chandef;
- 	enum nl80211_dfs_regions dfs_region;
- 	unsigned int cac_time_ms;
--	int err;
-+	int err = -EINVAL;
-+
-+	flush_delayed_work(&rdev->dfs_update_channels_wk);
-+
-+	wiphy_lock(wiphy);
- 
- 	dfs_region = reg_get_dfs_region(wiphy);
- 	if (dfs_region == NL80211_DFS_UNSET)
--		return -EINVAL;
-+		goto unlock;
- 
- 	err = nl80211_parse_chandef(rdev, info, &chandef);
- 	if (err)
--		return err;
-+		goto unlock;
- 
- 	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
- 	if (err < 0)
--		return err;
-+		goto unlock;
- 
--	if (err == 0)
--		return -EINVAL;
-+	if (err == 0) {
-+		err = -EINVAL;
-+		goto unlock;
-+	}
- 
--	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
--		return -EINVAL;
-+	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
-+		err = -EINVAL;
-+		goto unlock;
-+	}
- 
--	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN]))
--		return cfg80211_start_offchan_radar_detection(rdev, wdev,
--							      &chandef);
-+	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN])) {
-+		err = cfg80211_start_offchan_radar_detection(rdev, wdev,
-+							     &chandef);
-+		goto unlock;
-+	}
- 
--	if (netif_carrier_ok(dev))
--		return -EBUSY;
-+	if (netif_carrier_ok(dev)) {
-+		err = -EBUSY;
-+		goto unlock;
-+	}
- 
--	if (wdev->cac_started)
--		return -EBUSY;
-+	if (wdev->cac_started) {
-+		err = -EBUSY;
-+		goto unlock;
-+	}
- 
- 	/* CAC start is offloaded to HW and can't be started manually */
--	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
--		return -EOPNOTSUPP;
-+	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
-+		err = -EOPNOTSUPP;
-+		goto unlock;
-+	}
- 
--	if (!rdev->ops->start_radar_detection)
--		return -EOPNOTSUPP;
-+	if (!rdev->ops->start_radar_detection) {
-+		err = -EOPNOTSUPP;
-+		goto unlock;
-+	}
- 
- 	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
- 	if (WARN_ON(!cac_time_ms))
-@@ -9326,6 +9344,9 @@ static int nl80211_start_radar_detection
- 		wdev->cac_start_time = jiffies;
- 		wdev->cac_time_ms = cac_time_ms;
- 	}
-+unlock:
-+	wiphy_unlock(wiphy);
-+
- 	return err;
- }
- 
-@@ -15961,7 +15982,8 @@ static const struct genl_small_ops nl802
- 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
- 		.doit = nl80211_start_radar_detection,
- 		.flags = GENL_UNS_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-+				  NL80211_FLAG_NO_WIPHY_MTX,
- 	},
- 	{
- 		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-v5.17-mac80211-introduce-set_radar_offchan-callback.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-v5.17-mac80211-introduce-set_radar_offchan-callback.patch
deleted file mode 100644
index 6197abd..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/319-v5.17-mac80211-introduce-set_radar_offchan-callback.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Sat, 23 Oct 2021 11:10:51 +0200
-Subject: [PATCH] mac80211: introduce set_radar_offchan callback
-
-Similar to cfg80211, introduce set_radar_offchan callback in mac80211_ops
-in order to configure a dedicated offchannel chain available on some hw
-(e.g. mt7915) to perform offchannel CAC detection and avoid tx/rx downtime.
-
-Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/201110606d4f3a7dfdf31440e351f2e2c375d4f0.1634979655.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -3937,6 +3937,14 @@ struct ieee80211_prep_tx_info {
-  *	twt structure.
-  * @twt_teardown_request: Update the hw with TWT teardown request received
-  *	from the peer.
-+ * @set_radar_offchan: Configure dedicated offchannel chain available for
-+ *	radar/CAC detection on some hw. This chain can't be used to transmit
-+ *	or receive frames and it is bounded to a running wdev.
-+ *	Offchannel radar/CAC detection allows to avoid the CAC downtime
-+ *	switching to a different channel during CAC detection on the selected
-+ *	radar channel.
-+ *	The caller is expected to set chandef pointer to NULL in order to
-+ *	disable offchannel CAC/radar detection.
-  * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
-  *	resolve a path for hardware flow offloading
-  */
-@@ -4267,6 +4275,8 @@ struct ieee80211_ops {
- 			      struct ieee80211_twt_setup *twt);
- 	void (*twt_teardown_request)(struct ieee80211_hw *hw,
- 				     struct ieee80211_sta *sta, u8 flowid);
-+	int (*set_radar_offchan)(struct ieee80211_hw *hw,
-+				 struct cfg80211_chan_def *chandef);
- #if LINUX_VERSION_IS_GEQ(5,10,0)
- 	int (*net_fill_forward_path)(struct ieee80211_hw *hw,
- 				     struct ieee80211_vif *vif,
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -4341,6 +4341,18 @@ out:
- 	return err;
- }
- 
-+static int
-+ieee80211_set_radar_offchan(struct wiphy *wiphy,
-+			    struct cfg80211_chan_def *chandef)
-+{
-+	struct ieee80211_local *local = wiphy_priv(wiphy);
-+
-+	if (!local->ops->set_radar_offchan)
-+		return -EOPNOTSUPP;
-+
-+	return local->ops->set_radar_offchan(&local->hw, chandef);
-+}
-+
- const struct cfg80211_ops mac80211_config_ops = {
- 	.add_virtual_intf = ieee80211_add_iface,
- 	.del_virtual_intf = ieee80211_del_iface,
-@@ -4445,4 +4457,5 @@ const struct cfg80211_ops mac80211_confi
- 	.reset_tid_config = ieee80211_reset_tid_config,
- 	.set_sar_specs = ieee80211_set_sar_specs,
- 	.color_change = ieee80211_color_change,
-+	.set_radar_offchan = ieee80211_set_radar_offchan,
- };
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-v5.17-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-v5.17-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch
deleted file mode 100644
index 608e724..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/320-v5.17-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch
+++ /dev/null
@@ -1,532 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Mon, 29 Nov 2021 14:11:24 +0100
-Subject: [PATCH] cfg80211: rename offchannel_chain structs to background_chain
- to avoid confusion with ETSI standard
-
-ETSI standard defines "Offchannel CAC" as:
-"Off-Channel CAC is performed by a number of non-continuous checks
-spread over a period in time. This period, which is required to
-determine the presence of radar signals, is defined as the Off-Channel
-CAC Time..
-Minimum Off-Channel CAC Time 6 minutes and Maximum Off-Channel CAC Time
-4 hours..".
-mac80211 implementation refers to a dedicated hw chain used for continuous
-radar monitoring. Rename offchannel_* references to background_* in
-order to avoid confusion with ETSI standard.
-
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/4204cc1d648d76b44557981713231e030a3bd991.1638190762.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -4058,14 +4058,14 @@ struct mgmt_frame_regs {
-  *
-  * @color_change: Initiate a color change.
-  *
-- * @set_radar_offchan: Configure dedicated offchannel chain available for
-+ * @set_radar_background: Configure dedicated offchannel chain available for
-  *	radar/CAC detection on some hw. This chain can't be used to transmit
-  *	or receive frames and it is bounded to a running wdev.
-- *	Offchannel radar/CAC detection allows to avoid the CAC downtime
-+ *	Background radar/CAC detection allows to avoid the CAC downtime
-  *	switching to a different channel during CAC detection on the selected
-  *	radar channel.
-  *	The caller is expected to set chandef pointer to NULL in order to
-- *	disable offchannel CAC/radar detection.
-+ *	disable background CAC/radar detection.
-  */
- struct cfg80211_ops {
- 	int	(*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
-@@ -4396,8 +4396,8 @@ struct cfg80211_ops {
- 	int	(*color_change)(struct wiphy *wiphy,
- 				struct net_device *dev,
- 				struct cfg80211_color_change_settings *params);
--	int	(*set_radar_offchan)(struct wiphy *wiphy,
--				     struct cfg80211_chan_def *chandef);
-+	int	(*set_radar_background)(struct wiphy *wiphy,
-+					struct cfg80211_chan_def *chandef);
- };
- 
- /*
-@@ -7601,9 +7601,9 @@ cfg80211_radar_event(struct wiphy *wiphy
- }
- 
- static inline void
--cfg80211_offchan_radar_event(struct wiphy *wiphy,
--			     struct cfg80211_chan_def *chandef,
--			     gfp_t gfp)
-+cfg80211_background_radar_event(struct wiphy *wiphy,
-+				struct cfg80211_chan_def *chandef,
-+				gfp_t gfp)
- {
- 	__cfg80211_radar_event(wiphy, chandef, true, gfp);
- }
-@@ -7638,13 +7638,13 @@ void cfg80211_cac_event(struct net_devic
- 			enum nl80211_radar_event event, gfp_t gfp);
- 
- /**
-- * cfg80211_offchan_cac_abort - Channel Availability Check offchan abort event
-+ * cfg80211_background_cac_abort - Channel Availability Check offchan abort event
-  * @wiphy: the wiphy
-  *
-  * This function is called by the driver when a Channel Availability Check
-  * (CAC) is aborted by a offchannel dedicated chain.
-  */
--void cfg80211_offchan_cac_abort(struct wiphy *wiphy);
-+void cfg80211_background_cac_abort(struct wiphy *wiphy);
- 
- /**
-  * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -3937,14 +3937,14 @@ struct ieee80211_prep_tx_info {
-  *	twt structure.
-  * @twt_teardown_request: Update the hw with TWT teardown request received
-  *	from the peer.
-- * @set_radar_offchan: Configure dedicated offchannel chain available for
-+ * @set_radar_background: Configure dedicated offchannel chain available for
-  *	radar/CAC detection on some hw. This chain can't be used to transmit
-  *	or receive frames and it is bounded to a running wdev.
-- *	Offchannel radar/CAC detection allows to avoid the CAC downtime
-+ *	Background radar/CAC detection allows to avoid the CAC downtime
-  *	switching to a different channel during CAC detection on the selected
-  *	radar channel.
-  *	The caller is expected to set chandef pointer to NULL in order to
-- *	disable offchannel CAC/radar detection.
-+ *	disable background CAC/radar detection.
-  * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
-  *	resolve a path for hardware flow offloading
-  */
-@@ -4275,8 +4275,8 @@ struct ieee80211_ops {
- 			      struct ieee80211_twt_setup *twt);
- 	void (*twt_teardown_request)(struct ieee80211_hw *hw,
- 				     struct ieee80211_sta *sta, u8 flowid);
--	int (*set_radar_offchan)(struct ieee80211_hw *hw,
--				 struct cfg80211_chan_def *chandef);
-+	int (*set_radar_background)(struct ieee80211_hw *hw,
-+				    struct cfg80211_chan_def *chandef);
- #if LINUX_VERSION_IS_GEQ(5,10,0)
- 	int (*net_fill_forward_path)(struct ieee80211_hw *hw,
- 				     struct ieee80211_vif *vif,
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -2608,10 +2608,10 @@ enum nl80211_commands {
-  *	Mandatory parameter for the transmitting interface to enable MBSSID.
-  *	Optional for the non-transmitting interfaces.
-  *
-- * @NL80211_ATTR_RADAR_OFFCHAN: Configure dedicated offchannel chain available for
-- *	radar/CAC detection on some hw. This chain can't be used to transmit
-- *	or receive frames and it is bounded to a running wdev.
-- *	Offchannel radar/CAC detection allows to avoid the CAC downtime
-+ * @NL80211_ATTR_RADAR_BACKGROUND: Configure dedicated offchannel chain
-+ *	available for radar/CAC detection on some hw. This chain can't be used
-+ *	to transmit or receive frames and it is bounded to a running wdev.
-+ *	Background radar/CAC detection allows to avoid the CAC downtime
-  *	switching on a different channel during CAC detection on the selected
-  *	radar channel.
-  *
-@@ -3121,7 +3121,7 @@ enum nl80211_attrs {
- 	NL80211_ATTR_MBSSID_CONFIG,
- 	NL80211_ATTR_MBSSID_ELEMS,
- 
--	NL80211_ATTR_RADAR_OFFCHAN,
-+	NL80211_ATTR_RADAR_BACKGROUND,
- 
- 	/* add attributes here, update the policy in nl80211.c */
- 
-@@ -6022,7 +6022,7 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-  *	detection and change announcemnts.
-  *
-- * @NL80211_EXT_FEATURE_RADAR_OFFCHAN: Device supports offchannel radar/CAC
-+ * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
-  *	detection.
-  *
-  * @NUM_NL80211_EXT_FEATURES: number of extended features.
-@@ -6090,7 +6090,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
- 	NL80211_EXT_FEATURE_BSS_COLOR,
--	NL80211_EXT_FEATURE_RADAR_OFFCHAN,
-+	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
- 
- 	/* add new features before the definition below */
- 	NUM_NL80211_EXT_FEATURES,
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -4342,15 +4342,15 @@ out:
- }
- 
- static int
--ieee80211_set_radar_offchan(struct wiphy *wiphy,
--			    struct cfg80211_chan_def *chandef)
-+ieee80211_set_radar_background(struct wiphy *wiphy,
-+			       struct cfg80211_chan_def *chandef)
- {
- 	struct ieee80211_local *local = wiphy_priv(wiphy);
- 
--	if (!local->ops->set_radar_offchan)
-+	if (!local->ops->set_radar_background)
- 		return -EOPNOTSUPP;
- 
--	return local->ops->set_radar_offchan(&local->hw, chandef);
-+	return local->ops->set_radar_background(&local->hw, chandef);
- }
- 
- const struct cfg80211_ops mac80211_config_ops = {
-@@ -4457,5 +4457,5 @@ const struct cfg80211_ops mac80211_confi
- 	.reset_tid_config = ieee80211_reset_tid_config,
- 	.set_sar_specs = ieee80211_set_sar_specs,
- 	.color_change = ieee80211_color_change,
--	.set_radar_offchan = ieee80211_set_radar_offchan,
-+	.set_radar_background = ieee80211_set_radar_background,
- };
---- a/net/wireless/chan.c
-+++ b/net/wireless/chan.c
-@@ -716,13 +716,13 @@ static bool
- cfg80211_offchan_chain_is_active(struct cfg80211_registered_device *rdev,
- 				 struct ieee80211_channel *channel)
- {
--	if (!rdev->offchan_radar_wdev)
-+	if (!rdev->background_radar_wdev)
- 		return false;
- 
--	if (!cfg80211_chandef_valid(&rdev->offchan_radar_chandef))
-+	if (!cfg80211_chandef_valid(&rdev->background_radar_chandef))
- 		return false;
- 
--	return cfg80211_is_sub_chan(&rdev->offchan_radar_chandef, channel);
-+	return cfg80211_is_sub_chan(&rdev->background_radar_chandef, channel);
- }
- 
- bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
---- a/net/wireless/core.c
-+++ b/net/wireless/core.c
-@@ -543,9 +543,10 @@ use_default_name:
- 	INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
- 	INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
- 	INIT_WORK(&rdev->event_work, cfg80211_event_work);
--	INIT_WORK(&rdev->offchan_cac_abort_wk, cfg80211_offchan_cac_abort_wk);
--	INIT_DELAYED_WORK(&rdev->offchan_cac_done_wk,
--			  cfg80211_offchan_cac_done_wk);
-+	INIT_WORK(&rdev->background_cac_abort_wk,
-+		  cfg80211_background_cac_abort_wk);
-+	INIT_DELAYED_WORK(&rdev->background_cac_done_wk,
-+			  cfg80211_background_cac_done_wk);
- 
- 	init_waitqueue_head(&rdev->dev_wait);
- 
-@@ -1055,13 +1056,13 @@ void wiphy_unregister(struct wiphy *wiph
- 	cancel_work_sync(&rdev->conn_work);
- 	flush_work(&rdev->event_work);
- 	cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
--	cancel_delayed_work_sync(&rdev->offchan_cac_done_wk);
-+	cancel_delayed_work_sync(&rdev->background_cac_done_wk);
- 	flush_work(&rdev->destroy_work);
- 	flush_work(&rdev->sched_scan_stop_wk);
- 	flush_work(&rdev->propagate_radar_detect_wk);
- 	flush_work(&rdev->propagate_cac_done_wk);
- 	flush_work(&rdev->mgmt_registrations_update_wk);
--	flush_work(&rdev->offchan_cac_abort_wk);
-+	flush_work(&rdev->background_cac_abort_wk);
- 
- #ifdef CONFIG_PM
- 	if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
-@@ -1210,7 +1211,7 @@ void __cfg80211_leave(struct cfg80211_re
- 
- 	cfg80211_pmsr_wdev_down(wdev);
- 
--	cfg80211_stop_offchan_radar_detection(wdev);
-+	cfg80211_stop_background_radar_detection(wdev);
- 
- 	switch (wdev->iftype) {
- 	case NL80211_IFTYPE_ADHOC:
---- a/net/wireless/core.h
-+++ b/net/wireless/core.h
-@@ -84,10 +84,10 @@ struct cfg80211_registered_device {
- 
- 	struct delayed_work dfs_update_channels_wk;
- 
--	struct wireless_dev *offchan_radar_wdev;
--	struct cfg80211_chan_def offchan_radar_chandef;
--	struct delayed_work offchan_cac_done_wk;
--	struct work_struct offchan_cac_abort_wk;
-+	struct wireless_dev *background_radar_wdev;
-+	struct cfg80211_chan_def background_radar_chandef;
-+	struct delayed_work background_cac_done_wk;
-+	struct work_struct background_cac_abort_wk;
- 
- 	/* netlink port which started critical protocol (0 means not started) */
- 	u32 crit_proto_nlportid;
-@@ -497,15 +497,15 @@ cfg80211_chandef_dfs_cac_time(struct wip
- void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
- 
- int
--cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
--				       struct wireless_dev *wdev,
--				       struct cfg80211_chan_def *chandef);
-+cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
-+					  struct wireless_dev *wdev,
-+					  struct cfg80211_chan_def *chandef);
- 
--void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev);
-+void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev);
- 
--void cfg80211_offchan_cac_done_wk(struct work_struct *work);
-+void cfg80211_background_cac_done_wk(struct work_struct *work);
- 
--void cfg80211_offchan_cac_abort_wk(struct work_struct *work);
-+void cfg80211_background_cac_abort_wk(struct work_struct *work);
- 
- bool cfg80211_any_wiphy_oper_chan(struct wiphy *wiphy,
- 				  struct ieee80211_channel *chan);
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -920,7 +920,7 @@ void __cfg80211_radar_event(struct wiphy
- 	cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
- 
- 	if (offchan)
--		queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
-+		queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
- 
- 	cfg80211_sched_dfs_chan_update(rdev);
- 
-@@ -975,10 +975,10 @@ void cfg80211_cac_event(struct net_devic
- EXPORT_SYMBOL(cfg80211_cac_event);
- 
- static void
--__cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
--			     struct wireless_dev *wdev,
--			     const struct cfg80211_chan_def *chandef,
--			     enum nl80211_radar_event event)
-+__cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
-+				struct wireless_dev *wdev,
-+				const struct cfg80211_chan_def *chandef,
-+				enum nl80211_radar_event event)
- {
- 	struct wiphy *wiphy = &rdev->wiphy;
- 	struct net_device *netdev;
-@@ -988,7 +988,7 @@ __cfg80211_offchan_cac_event(struct cfg8
- 	if (!cfg80211_chandef_valid(chandef))
- 		return;
- 
--	if (!rdev->offchan_radar_wdev)
-+	if (!rdev->background_radar_wdev)
- 		return;
- 
- 	switch (event) {
-@@ -997,12 +997,12 @@ __cfg80211_offchan_cac_event(struct cfg8
- 		memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
- 		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
- 		cfg80211_sched_dfs_chan_update(rdev);
--		wdev = rdev->offchan_radar_wdev;
-+		wdev = rdev->background_radar_wdev;
- 		break;
- 	case NL80211_RADAR_CAC_ABORTED:
--		if (!cancel_delayed_work(&rdev->offchan_cac_done_wk))
-+		if (!cancel_delayed_work(&rdev->background_cac_done_wk))
- 			return;
--		wdev = rdev->offchan_radar_wdev;
-+		wdev = rdev->background_radar_wdev;
- 		break;
- 	case NL80211_RADAR_CAC_STARTED:
- 		break;
-@@ -1015,49 +1015,49 @@ __cfg80211_offchan_cac_event(struct cfg8
- }
- 
- static void
--cfg80211_offchan_cac_event(struct cfg80211_registered_device *rdev,
--			   const struct cfg80211_chan_def *chandef,
--			   enum nl80211_radar_event event)
-+cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
-+			      const struct cfg80211_chan_def *chandef,
-+			      enum nl80211_radar_event event)
- {
- 	wiphy_lock(&rdev->wiphy);
--	__cfg80211_offchan_cac_event(rdev, rdev->offchan_radar_wdev,
--				     chandef, event);
-+	__cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
-+					chandef, event);
- 	wiphy_unlock(&rdev->wiphy);
- }
- 
--void cfg80211_offchan_cac_done_wk(struct work_struct *work)
-+void cfg80211_background_cac_done_wk(struct work_struct *work)
- {
- 	struct delayed_work *delayed_work = to_delayed_work(work);
- 	struct cfg80211_registered_device *rdev;
- 
- 	rdev = container_of(delayed_work, struct cfg80211_registered_device,
--			    offchan_cac_done_wk);
--	cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
--				   NL80211_RADAR_CAC_FINISHED);
-+			    background_cac_done_wk);
-+	cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
-+				      NL80211_RADAR_CAC_FINISHED);
- }
- 
--void cfg80211_offchan_cac_abort_wk(struct work_struct *work)
-+void cfg80211_background_cac_abort_wk(struct work_struct *work)
- {
- 	struct cfg80211_registered_device *rdev;
- 
- 	rdev = container_of(work, struct cfg80211_registered_device,
--			    offchan_cac_abort_wk);
--	cfg80211_offchan_cac_event(rdev, &rdev->offchan_radar_chandef,
--				   NL80211_RADAR_CAC_ABORTED);
-+			    background_cac_abort_wk);
-+	cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
-+				      NL80211_RADAR_CAC_ABORTED);
- }
- 
--void cfg80211_offchan_cac_abort(struct wiphy *wiphy)
-+void cfg80211_background_cac_abort(struct wiphy *wiphy)
- {
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
- 
--	queue_work(cfg80211_wq, &rdev->offchan_cac_abort_wk);
-+	queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
- }
--EXPORT_SYMBOL(cfg80211_offchan_cac_abort);
-+EXPORT_SYMBOL(cfg80211_background_cac_abort);
- 
- int
--cfg80211_start_offchan_radar_detection(struct cfg80211_registered_device *rdev,
--				       struct wireless_dev *wdev,
--				       struct cfg80211_chan_def *chandef)
-+cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rdev,
-+					  struct wireless_dev *wdev,
-+					  struct cfg80211_chan_def *chandef)
- {
- 	unsigned int cac_time_ms;
- 	int err;
-@@ -1065,19 +1065,19 @@ cfg80211_start_offchan_radar_detection(s
- 	lockdep_assert_wiphy(&rdev->wiphy);
- 
- 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
--				     NL80211_EXT_FEATURE_RADAR_OFFCHAN))
-+				     NL80211_EXT_FEATURE_RADAR_BACKGROUND))
- 		return -EOPNOTSUPP;
- 
- 	/* Offchannel chain already locked by another wdev */
--	if (rdev->offchan_radar_wdev && rdev->offchan_radar_wdev != wdev)
-+	if (rdev->background_radar_wdev && rdev->background_radar_wdev != wdev)
- 		return -EBUSY;
- 
- 	/* CAC already in progress on the offchannel chain */
--	if (rdev->offchan_radar_wdev == wdev &&
--	    delayed_work_pending(&rdev->offchan_cac_done_wk))
-+	if (rdev->background_radar_wdev == wdev &&
-+	    delayed_work_pending(&rdev->background_cac_done_wk))
- 		return -EBUSY;
- 
--	err = rdev_set_radar_offchan(rdev, chandef);
-+	err = rdev_set_radar_background(rdev, chandef);
- 	if (err)
- 		return err;
- 
-@@ -1085,30 +1085,31 @@ cfg80211_start_offchan_radar_detection(s
- 	if (!cac_time_ms)
- 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
- 
--	rdev->offchan_radar_chandef = *chandef;
--	rdev->offchan_radar_wdev = wdev; /* Get offchain ownership */
-+	rdev->background_radar_chandef = *chandef;
-+	rdev->background_radar_wdev = wdev; /* Get offchain ownership */
- 
--	__cfg80211_offchan_cac_event(rdev, wdev, chandef,
--				     NL80211_RADAR_CAC_STARTED);
--	queue_delayed_work(cfg80211_wq, &rdev->offchan_cac_done_wk,
-+	__cfg80211_background_cac_event(rdev, wdev, chandef,
-+					NL80211_RADAR_CAC_STARTED);
-+	queue_delayed_work(cfg80211_wq, &rdev->background_cac_done_wk,
- 			   msecs_to_jiffies(cac_time_ms));
- 
- 	return 0;
- }
- 
--void cfg80211_stop_offchan_radar_detection(struct wireless_dev *wdev)
-+void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
- {
- 	struct wiphy *wiphy = wdev->wiphy;
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
- 
- 	lockdep_assert_wiphy(wiphy);
- 
--	if (wdev != rdev->offchan_radar_wdev)
-+	if (wdev != rdev->background_radar_wdev)
- 		return;
- 
--	rdev_set_radar_offchan(rdev, NULL);
--	rdev->offchan_radar_wdev = NULL; /* Release offchain ownership */
-+	rdev_set_radar_background(rdev, NULL);
-+	rdev->background_radar_wdev = NULL; /* Release offchain ownership */
- 
--	__cfg80211_offchan_cac_event(rdev, wdev, &rdev->offchan_radar_chandef,
--				     NL80211_RADAR_CAC_ABORTED);
-+	__cfg80211_background_cac_event(rdev, wdev,
-+					&rdev->background_radar_chandef,
-+					NL80211_RADAR_CAC_ABORTED);
- }
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -801,7 +801,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_MBSSID_CONFIG] =
- 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
- 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
--	[NL80211_ATTR_RADAR_OFFCHAN] = { .type = NLA_FLAG },
-+	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
- };
- 
- /* policy for the key attributes */
-@@ -9306,9 +9306,9 @@ static int nl80211_start_radar_detection
- 		goto unlock;
- 	}
- 
--	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_OFFCHAN])) {
--		err = cfg80211_start_offchan_radar_detection(rdev, wdev,
--							     &chandef);
-+	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
-+		err = cfg80211_start_background_radar_detection(rdev, wdev,
-+								&chandef);
- 		goto unlock;
- 	}
- 
---- a/net/wireless/rdev-ops.h
-+++ b/net/wireless/rdev-ops.h
-@@ -1382,17 +1382,17 @@ static inline int rdev_color_change(stru
- }
- 
- static inline int
--rdev_set_radar_offchan(struct cfg80211_registered_device *rdev,
--		       struct cfg80211_chan_def *chandef)
-+rdev_set_radar_background(struct cfg80211_registered_device *rdev,
-+			  struct cfg80211_chan_def *chandef)
- {
- 	struct wiphy *wiphy = &rdev->wiphy;
- 	int ret;
- 
--	if (!rdev->ops->set_radar_offchan)
-+	if (!rdev->ops->set_radar_background)
- 		return -EOPNOTSUPP;
- 
--	trace_rdev_set_radar_offchan(wiphy, chandef);
--	ret = rdev->ops->set_radar_offchan(wiphy, chandef);
-+	trace_rdev_set_radar_background(wiphy, chandef);
-+	ret = rdev->ops->set_radar_background(wiphy, chandef);
- 	trace_rdev_return_int(wiphy, ret);
- 
- 	return ret;
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -3646,7 +3646,7 @@ TRACE_EVENT(cfg80211_bss_color_notify,
- 		  __entry->color_bitmap)
- );
- 
--TRACE_EVENT(rdev_set_radar_offchan,
-+TRACE_EVENT(rdev_set_radar_background,
- 	TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
- 
- 	TP_ARGS(wiphy, chandef),
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v5.16-mac80211-MBSSID-support-in-interface-handling.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v5.16-mac80211-MBSSID-support-in-interface-handling.patch
deleted file mode 100644
index a135e3d..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/323-v5.16-mac80211-MBSSID-support-in-interface-handling.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From: John Crispin <john@phrozen.org>
-Date: Wed, 15 Sep 2021 19:54:35 -0700
-Subject: [PATCH] mac80211: MBSSID support in interface handling
-
-Configure multiple BSSID and enhanced multi-BSSID advertisement (EMA)
-parameters in mac80211 for AP mode.
-
-For each interface, 'mbssid_tx_vif' points to the transmitting interface of
-the MBSSID set. The pointer is set to NULL if MBSSID is disabled.
-
-Function ieee80211_stop() is modified to always bring down all the
-non-transmitting interfaces first and the transmitting interface last.
-
-Signed-off-by: John Crispin <john@phrozen.org>
-Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
-Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
-Link: https://lore.kernel.org/r/20210916025437.29138-3-alokad@codeaurora.org
-[slightly change logic to be more obvious]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -1719,6 +1719,7 @@ enum ieee80211_offload_flags {
-  *	write-protected by sdata_lock and local->mtx so holding either is fine
-  *	for read access.
-  * @color_change_color: the bss color that will be used after the change.
-+ * @mbssid_tx_vif: Pointer to the transmitting interface if MBSSID is enabled.
-  */
- struct ieee80211_vif {
- 	enum nl80211_iftype type;
-@@ -1750,6 +1751,8 @@ struct ieee80211_vif {
- 	bool color_change_active;
- 	u8 color_change_color;
- 
-+	struct ieee80211_vif *mbssid_tx_vif;
-+
- 	/* must be last */
- 	u8 drv_priv[] __aligned(sizeof(void *));
- };
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -112,6 +112,36 @@ static int ieee80211_set_mon_options(str
- 	return 0;
- }
- 
-+static int ieee80211_set_ap_mbssid_options(struct ieee80211_sub_if_data *sdata,
-+					   struct cfg80211_mbssid_config params)
-+{
-+	struct ieee80211_sub_if_data *tx_sdata;
-+
-+	sdata->vif.mbssid_tx_vif = NULL;
-+	sdata->vif.bss_conf.bssid_index = 0;
-+	sdata->vif.bss_conf.nontransmitted = false;
-+	sdata->vif.bss_conf.ema_ap = false;
-+
-+	if (sdata->vif.type != NL80211_IFTYPE_AP || !params.tx_wdev)
-+		return -EINVAL;
-+
-+	tx_sdata = IEEE80211_WDEV_TO_SUB_IF(params.tx_wdev);
-+	if (!tx_sdata)
-+		return -EINVAL;
-+
-+	if (tx_sdata == sdata) {
-+		sdata->vif.mbssid_tx_vif = &sdata->vif;
-+	} else {
-+		sdata->vif.mbssid_tx_vif = &tx_sdata->vif;
-+		sdata->vif.bss_conf.nontransmitted = true;
-+		sdata->vif.bss_conf.bssid_index = params.index;
-+	}
-+	if (params.ema)
-+		sdata->vif.bss_conf.ema_ap = true;
-+
-+	return 0;
-+}
-+
- static struct wireless_dev *ieee80211_add_iface(struct wiphy *wiphy,
- 						const char *name,
- 						unsigned char name_assign_type,
-@@ -1107,6 +1137,14 @@ static int ieee80211_start_ap(struct wip
- 			changed |= BSS_CHANGED_HE_BSS_COLOR;
- 	}
- 
-+	if (sdata->vif.type == NL80211_IFTYPE_AP &&
-+	    params->mbssid_config.tx_wdev) {
-+		err = ieee80211_set_ap_mbssid_options(sdata,
-+						      params->mbssid_config);
-+		if (err)
-+			return err;
-+	}
-+
- 	mutex_lock(&local->mtx);
- 	err = ieee80211_vif_use_channel(sdata, &params->chandef,
- 					IEEE80211_CHANCTX_SHARED);
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -632,17 +632,46 @@ static void ieee80211_do_stop(struct iee
- 		ieee80211_add_virtual_monitor(local);
- }
- 
-+static void ieee80211_stop_mbssid(struct ieee80211_sub_if_data *sdata)
-+{
-+	struct ieee80211_sub_if_data *tx_sdata, *non_tx_sdata, *tmp_sdata;
-+	struct ieee80211_vif *tx_vif = sdata->vif.mbssid_tx_vif;
-+
-+	if (!tx_vif)
-+		return;
-+
-+	tx_sdata = vif_to_sdata(tx_vif);
-+	sdata->vif.mbssid_tx_vif = NULL;
-+
-+	list_for_each_entry_safe(non_tx_sdata, tmp_sdata,
-+				 &tx_sdata->local->interfaces, list) {
-+		if (non_tx_sdata != sdata && non_tx_sdata != tx_sdata &&
-+		    non_tx_sdata->vif.mbssid_tx_vif == tx_vif &&
-+		    ieee80211_sdata_running(non_tx_sdata)) {
-+			non_tx_sdata->vif.mbssid_tx_vif = NULL;
-+			dev_close(non_tx_sdata->wdev.netdev);
-+		}
-+	}
-+
-+	if (sdata != tx_sdata && ieee80211_sdata_running(tx_sdata)) {
-+		tx_sdata->vif.mbssid_tx_vif = NULL;
-+		dev_close(tx_sdata->wdev.netdev);
-+	}
-+}
-+
- static int ieee80211_stop(struct net_device *dev)
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 
--	/* close all dependent VLAN interfaces before locking wiphy */
-+	/* close dependent VLAN and MBSSID interfaces before locking wiphy */
- 	if (sdata->vif.type == NL80211_IFTYPE_AP) {
- 		struct ieee80211_sub_if_data *vlan, *tmpsdata;
- 
- 		list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
- 					 u.vlan.list)
- 			dev_close(vlan->dev);
-+
-+		ieee80211_stop_mbssid(sdata);
- 	}
- 
- 	wiphy_lock(sdata->local->hw.wiphy);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v5.18-mac80211-MBSSID-beacon-handling-in-AP-mode.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v5.18-mac80211-MBSSID-beacon-handling-in-AP-mode.patch
deleted file mode 100644
index a8fc02f..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/324-v5.18-mac80211-MBSSID-beacon-handling-in-AP-mode.patch
+++ /dev/null
@@ -1,326 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Thu, 24 Feb 2022 12:54:58 +0100
-Subject: [PATCH] mac80211: MBSSID beacon handling in AP mode
-
-Add new fields in struct beacon_data to store all MBSSID elements.
-Generate a beacon template which includes all MBSSID elements.
-Move CSA offset to reflect the MBSSID element length.
-
-Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
-Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
-Co-developed-by: John Crispin <john@phrozen.org>
-Signed-off-by: John Crispin <john@phrozen.org>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Tested-by: Money Wang <money.wang@mediatek.com>
-Link: https://lore.kernel.org/r/5322db3c303f431adaf191ab31c45e151dde5465.1645702516.git.lorenzo@kernel.org
-[small cleanups]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4938,12 +4938,14 @@ void ieee80211_report_low_ack(struct iee
-  * @cntdwn_counter_offs: array of IEEE80211_MAX_CNTDWN_COUNTERS_NUM offsets
-  *	to countdown counters.  This array can contain zero values which
-  *	should be ignored.
-+ * @mbssid_off: position of the multiple bssid element
-  */
- struct ieee80211_mutable_offsets {
- 	u16 tim_offset;
- 	u16 tim_length;
- 
- 	u16 cntdwn_counter_offs[IEEE80211_MAX_CNTDWN_COUNTERS_NUM];
-+	u16 mbssid_off;
- };
- 
- /**
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -989,11 +989,29 @@ static int ieee80211_set_ftm_responder_p
- 	return 0;
- }
- 
-+static int
-+ieee80211_copy_mbssid_beacon(u8 *pos, struct cfg80211_mbssid_elems *dst,
-+			     struct cfg80211_mbssid_elems *src)
-+{
-+	int i, offset = 0;
-+
-+	for (i = 0; i < src->cnt; i++) {
-+		memcpy(pos + offset, src->elem[i].data, src->elem[i].len);
-+		dst->elem[i].len = src->elem[i].len;
-+		dst->elem[i].data = pos + offset;
-+		offset += dst->elem[i].len;
-+	}
-+	dst->cnt = src->cnt;
-+
-+	return offset;
-+}
-+
- static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
- 				   struct cfg80211_beacon_data *params,
- 				   const struct ieee80211_csa_settings *csa,
- 				   const struct ieee80211_color_change_settings *cca)
- {
-+	struct cfg80211_mbssid_elems *mbssid = NULL;
- 	struct beacon_data *new, *old;
- 	int new_head_len, new_tail_len;
- 	int size, err;
-@@ -1021,6 +1039,17 @@ static int ieee80211_assign_beacon(struc
- 
- 	size = sizeof(*new) + new_head_len + new_tail_len;
- 
-+	/* new or old multiple BSSID elements? */
-+	if (params->mbssid_ies) {
-+		mbssid = params->mbssid_ies;
-+		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
-+		size += ieee80211_get_mbssid_beacon_len(mbssid);
-+	} else if (old && old->mbssid_ies) {
-+		mbssid = old->mbssid_ies;
-+		size += struct_size(new->mbssid_ies, elem, mbssid->cnt);
-+		size += ieee80211_get_mbssid_beacon_len(mbssid);
-+	}
-+
- 	new = kzalloc(size, GFP_KERNEL);
- 	if (!new)
- 		return -ENOMEM;
-@@ -1029,12 +1058,20 @@ static int ieee80211_assign_beacon(struc
- 
- 	/*
- 	 * pointers go into the block we allocated,
--	 * memory is | beacon_data | head | tail |
-+	 * memory is | beacon_data | head | tail | mbssid_ies
- 	 */
- 	new->head = ((u8 *) new) + sizeof(*new);
- 	new->tail = new->head + new_head_len;
- 	new->head_len = new_head_len;
- 	new->tail_len = new_tail_len;
-+	/* copy in optional mbssid_ies */
-+	if (mbssid) {
-+		u8 *pos = new->tail + new->tail_len;
-+
-+		new->mbssid_ies = (void *)pos;
-+		pos += struct_size(new->mbssid_ies, elem, mbssid->cnt);
-+		ieee80211_copy_mbssid_beacon(pos, new->mbssid_ies, mbssid);
-+	}
- 
- 	if (csa) {
- 		new->cntdwn_current_counter = csa->count;
-@@ -1332,8 +1369,11 @@ static int ieee80211_stop_ap(struct wiph
- 
- 	mutex_unlock(&local->mtx);
- 
--	kfree(sdata->u.ap.next_beacon);
--	sdata->u.ap.next_beacon = NULL;
-+	if (sdata->u.ap.next_beacon) {
-+		kfree(sdata->u.ap.next_beacon->mbssid_ies);
-+		kfree(sdata->u.ap.next_beacon);
-+		sdata->u.ap.next_beacon = NULL;
-+	}
- 
- 	/* turn off carrier for this interface and dependent VLANs */
- 	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-@@ -3126,12 +3166,24 @@ cfg80211_beacon_dup(struct cfg80211_beac
- 
- 	len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
- 	      beacon->proberesp_ies_len + beacon->assocresp_ies_len +
--	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;
-+	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len +
-+	      ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
- 
- 	new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
- 	if (!new_beacon)
- 		return NULL;
- 
-+	if (beacon->mbssid_ies && beacon->mbssid_ies->cnt) {
-+		new_beacon->mbssid_ies =
-+			kzalloc(struct_size(new_beacon->mbssid_ies,
-+					    elem, beacon->mbssid_ies->cnt),
-+				GFP_KERNEL);
-+		if (!new_beacon->mbssid_ies) {
-+			kfree(new_beacon);
-+			return NULL;
-+		}
-+	}
-+
- 	pos = (u8 *)(new_beacon + 1);
- 	if (beacon->head_len) {
- 		new_beacon->head_len = beacon->head_len;
-@@ -3169,6 +3221,10 @@ cfg80211_beacon_dup(struct cfg80211_beac
- 		memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
- 		pos += beacon->probe_resp_len;
- 	}
-+	if (beacon->mbssid_ies && beacon->mbssid_ies->cnt)
-+		pos += ieee80211_copy_mbssid_beacon(pos,
-+						    new_beacon->mbssid_ies,
-+						    beacon->mbssid_ies);
- 
- 	/* might copy -1, meaning no changes requested */
- 	new_beacon->ftm_responder = beacon->ftm_responder;
-@@ -3206,8 +3262,11 @@ static int ieee80211_set_after_csa_beaco
- 	case NL80211_IFTYPE_AP:
- 		err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
- 					      NULL, NULL);
--		kfree(sdata->u.ap.next_beacon);
--		sdata->u.ap.next_beacon = NULL;
-+		if (sdata->u.ap.next_beacon) {
-+			kfree(sdata->u.ap.next_beacon->mbssid_ies);
-+			kfree(sdata->u.ap.next_beacon);
-+			sdata->u.ap.next_beacon = NULL;
-+		}
- 
- 		if (err < 0)
- 			return err;
-@@ -3362,8 +3421,12 @@ static int ieee80211_set_csa_beacon(stru
- 		if ((params->n_counter_offsets_beacon >
- 		     IEEE80211_MAX_CNTDWN_COUNTERS_NUM) ||
- 		    (params->n_counter_offsets_presp >
--		     IEEE80211_MAX_CNTDWN_COUNTERS_NUM))
-+		     IEEE80211_MAX_CNTDWN_COUNTERS_NUM)) {
-+			kfree(sdata->u.ap.next_beacon->mbssid_ies);
-+			kfree(sdata->u.ap.next_beacon);
-+			sdata->u.ap.next_beacon = NULL;
- 			return -EINVAL;
-+		}
- 
- 		csa.counter_offsets_beacon = params->counter_offsets_beacon;
- 		csa.counter_offsets_presp = params->counter_offsets_presp;
-@@ -3373,7 +3436,9 @@ static int ieee80211_set_csa_beacon(stru
- 
- 		err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa, NULL);
- 		if (err < 0) {
-+			kfree(sdata->u.ap.next_beacon->mbssid_ies);
- 			kfree(sdata->u.ap.next_beacon);
-+			sdata->u.ap.next_beacon = NULL;
- 			return err;
- 		}
- 		*changed |= err;
-@@ -3460,8 +3525,11 @@ static int ieee80211_set_csa_beacon(stru
- static void ieee80211_color_change_abort(struct ieee80211_sub_if_data  *sdata)
- {
- 	sdata->vif.color_change_active = false;
--	kfree(sdata->u.ap.next_beacon);
--	sdata->u.ap.next_beacon = NULL;
-+	if (sdata->u.ap.next_beacon) {
-+		kfree(sdata->u.ap.next_beacon->mbssid_ies);
-+		kfree(sdata->u.ap.next_beacon);
-+		sdata->u.ap.next_beacon = NULL;
-+	}
- 
- 	cfg80211_color_change_aborted_notify(sdata->dev);
- }
-@@ -4199,8 +4267,11 @@ ieee80211_set_after_color_change_beacon(
- 
- 		ret = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
- 					      NULL, NULL);
--		kfree(sdata->u.ap.next_beacon);
--		sdata->u.ap.next_beacon = NULL;
-+		if (sdata->u.ap.next_beacon) {
-+			kfree(sdata->u.ap.next_beacon->mbssid_ies);
-+			kfree(sdata->u.ap.next_beacon);
-+			sdata->u.ap.next_beacon = NULL;
-+		}
- 
- 		if (ret < 0)
- 			return ret;
-@@ -4243,7 +4314,11 @@ ieee80211_set_color_change_beacon(struct
- 		err = ieee80211_assign_beacon(sdata, &params->beacon_color_change,
- 					      NULL, &color_change);
- 		if (err < 0) {
--			kfree(sdata->u.ap.next_beacon);
-+			if (sdata->u.ap.next_beacon) {
-+				kfree(sdata->u.ap.next_beacon->mbssid_ies);
-+				kfree(sdata->u.ap.next_beacon);
-+				sdata->u.ap.next_beacon = NULL;
-+			}
- 			return err;
- 		}
- 		*changed |= err;
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -261,6 +261,7 @@ struct beacon_data {
- 	struct ieee80211_meshconf_ie *meshconf;
- 	u16 cntdwn_counter_offsets[IEEE80211_MAX_CNTDWN_COUNTERS_NUM];
- 	u8 cntdwn_current_counter;
-+	struct cfg80211_mbssid_elems *mbssid_ies;
- 	struct rcu_head rcu_head;
- };
- 
-@@ -1082,6 +1083,20 @@ ieee80211_vif_get_shift(struct ieee80211
- 	return shift;
- }
- 
-+static inline int
-+ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems)
-+{
-+	int i, len = 0;
-+
-+	if (!elems)
-+		return 0;
-+
-+	for (i = 0; i < elems->cnt; i++)
-+		len += elems->elem[i].len;
-+
-+	return len;
-+}
-+
- enum {
- 	IEEE80211_RX_MSG	= 1,
- 	IEEE80211_TX_STATUS_MSG	= 2,
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -5041,6 +5041,19 @@ ieee80211_beacon_get_finish(struct ieee8
- 		       IEEE80211_TX_CTL_FIRST_FRAGMENT;
- }
- 
-+static void
-+ieee80211_beacon_add_mbssid(struct sk_buff *skb, struct beacon_data *beacon)
-+{
-+	int i;
-+
-+	if (!beacon->mbssid_ies)
-+		return;
-+
-+	for (i = 0; i < beacon->mbssid_ies->cnt; i++)
-+		skb_put_data(skb, beacon->mbssid_ies->elem[i].data,
-+			     beacon->mbssid_ies->elem[i].len);
-+}
-+
- static struct sk_buff *
- ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
- 			struct ieee80211_vif *vif,
-@@ -5054,6 +5067,7 @@ ieee80211_beacon_get_ap(struct ieee80211
- 	struct ieee80211_if_ap *ap = &sdata->u.ap;
- 	struct sk_buff *skb = NULL;
- 	u16 csa_off_base = 0;
-+	int mbssid_len;
- 
- 	if (beacon->cntdwn_counter_offsets[0]) {
- 		if (!is_template)
-@@ -5063,11 +5077,12 @@ ieee80211_beacon_get_ap(struct ieee80211
- 	}
- 
- 	/* headroom, head length,
--	 * tail length and maximum TIM length
-+	 * tail length, maximum TIM length and multiple BSSID length
- 	 */
-+	mbssid_len = ieee80211_get_mbssid_beacon_len(beacon->mbssid_ies);
- 	skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
- 			    beacon->tail_len + 256 +
--			    local->hw.extra_beacon_tailroom);
-+			    local->hw.extra_beacon_tailroom + mbssid_len);
- 	if (!skb)
- 		return NULL;
- 
-@@ -5081,6 +5096,11 @@ ieee80211_beacon_get_ap(struct ieee80211
- 		offs->tim_length = skb->len - beacon->head_len;
- 		offs->cntdwn_counter_offs[0] = beacon->cntdwn_counter_offsets[0];
- 
-+		if (mbssid_len) {
-+			ieee80211_beacon_add_mbssid(skb, beacon);
-+			offs->mbssid_off = skb->len - mbssid_len;
-+		}
-+
- 		/* for AP the csa offsets are from tail */
- 		csa_off_base = skb->len;
- 	}
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-v5.18-mac80211-MBSSID-channel-switch.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-v5.18-mac80211-MBSSID-channel-switch.patch
deleted file mode 100644
index 38b0de1..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/325-v5.18-mac80211-MBSSID-channel-switch.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From: John Crispin <john@phrozen.org>
-Date: Thu, 24 Feb 2022 12:54:59 +0100
-Subject: [PATCH] mac80211: MBSSID channel switch
-
-Trigger ieee80211_csa_finish() on the non-transmitting interfaces
-when channel switch concludes on the transmitting interface.
-
-Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
-Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
-Signed-off-by: John Crispin <john@phrozen.org>
-Link: https://lore.kernel.org/r/6fde4d7f9fa387494f46a7aa4a584478dcda06f1.1645702516.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -3247,9 +3247,31 @@ cfg80211_beacon_dup(struct cfg80211_beac
- void ieee80211_csa_finish(struct ieee80211_vif *vif)
- {
- 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-+	struct ieee80211_local *local = sdata->local;
- 
--	ieee80211_queue_work(&sdata->local->hw,
--			     &sdata->csa_finalize_work);
-+	rcu_read_lock();
-+
-+	if (vif->mbssid_tx_vif == vif) {
-+		/* Trigger ieee80211_csa_finish() on the non-transmitting
-+		 * interfaces when channel switch is received on
-+		 * transmitting interface
-+		 */
-+		struct ieee80211_sub_if_data *iter;
-+
-+		list_for_each_entry_rcu(iter, &local->interfaces, list) {
-+			if (!ieee80211_sdata_running(iter))
-+				continue;
-+
-+			if (iter == sdata || iter->vif.mbssid_tx_vif != vif)
-+				continue;
-+
-+			ieee80211_queue_work(&iter->local->hw,
-+					     &iter->csa_finalize_work);
-+		}
-+	}
-+	ieee80211_queue_work(&local->hw, &sdata->csa_finalize_work);
-+
-+	rcu_read_unlock();
- }
- EXPORT_SYMBOL(ieee80211_csa_finish);
- 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-v5.18-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-v5.18-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch
deleted file mode 100644
index 1955568..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/326-v5.18-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Thu, 24 Feb 2022 12:55:00 +0100
-Subject: [PATCH] mac80211: update bssid_indicator in
- ieee80211_assign_beacon
-
-Update bssid_indicator in ieee80211_bss_conf according to the
-number of bssid in the set.
-
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/f92317e002fca9933f05a445fcefb4f53291d601.1645702516.git.lorenzo@kernel.org
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1071,6 +1071,9 @@ static int ieee80211_assign_beacon(struc
- 		new->mbssid_ies = (void *)pos;
- 		pos += struct_size(new->mbssid_ies, elem, mbssid->cnt);
- 		ieee80211_copy_mbssid_beacon(pos, new->mbssid_ies, mbssid);
-+		/* update bssid_indicator */
-+		sdata->vif.bss_conf.bssid_indicator =
-+			ilog2(__roundup_pow_of_two(mbssid->cnt + 1));
- 	}
- 
- 	if (csa) {
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-v5.19-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-v5.19-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch
deleted file mode 100644
index f0150dd..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-v5.19-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 26 Mar 2022 23:58:35 +0100
-Subject: [PATCH] mac80211: do not wake queues on a vif that is being stopped
-
-When a vif is being removed and sdata->bss is cleared, __ieee80211_wake_txqs
-can still be called on it, which crashes as soon as sdata->bss is being
-dereferenced.
-To fix this properly, check for SDATA_STATE_RUNNING before waking queues,
-and take the fq lock when setting it (to ensure that __ieee80211_wake_txqs
-observes the change when running on a different CPU
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -377,7 +377,9 @@ static void ieee80211_do_stop(struct iee
- 	bool cancel_scan;
- 	struct cfg80211_nan_func *func;
- 
-+	spin_lock_bh(&local->fq.lock);
- 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
-+	spin_unlock_bh(&local->fq.lock);
- 
- 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
- 	if (cancel_scan)
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -301,6 +301,9 @@ static void __ieee80211_wake_txqs(struct
- 	local_bh_disable();
- 	spin_lock(&fq->lock);
- 
-+	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
-+		goto out;
-+
- 	if (sdata->vif.type == NL80211_IFTYPE_AP)
- 		ps = &sdata->bss->ps;
- 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-v6.0-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-v6.0-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch
deleted file mode 100644
index e59036f..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/330-v6.0-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch
+++ /dev/null
@@ -1,1249 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 19 Jun 2022 23:13:05 +0200
-Subject: [PATCH] mac80211: switch airtime fairness back to deficit round-robin
- scheduling
-
-This reverts commits 6a789ba679d652587532cec2a0e0274fda172f3b and
-2433647bc8d983a543e7d31b41ca2de1c7e2c198.
-
-The virtual time scheduler code has a number of issues:
-- queues slowed down by hardware/firmware powersave handling were not properly
-  handled.
-- on ath10k in push-pull mode, tx queues that the driver tries to pull from
-  were starved, causing excessive latency
-- delay between tx enqueue and reported airtime use were causing excessively
-  bursty tx behavior
-
-The bursty behavior may also be present on the round-robin scheduler, but there
-it is much easier to fix without introducing additional regressions
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -6666,6 +6666,9 @@ static inline void ieee80211_txq_schedul
- {
- }
- 
-+void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
-+			      struct ieee80211_txq *txq, bool force);
-+
- /**
-  * ieee80211_schedule_txq - schedule a TXQ for transmission
-  *
-@@ -6678,7 +6681,11 @@ static inline void ieee80211_txq_schedul
-  * The driver may call this function if it has buffered packets for
-  * this TXQ internally.
-  */
--void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
-+static inline void
-+ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
-+{
-+	__ieee80211_schedule_txq(hw, txq, true);
-+}
- 
- /**
-  * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
-@@ -6690,8 +6697,12 @@ void ieee80211_schedule_txq(struct ieee8
-  * The driver may set force=true if it has buffered packets for this TXQ
-  * internally.
-  */
--void ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
--			  bool force);
-+static inline void
-+ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
-+		     bool force)
-+{
-+	__ieee80211_schedule_txq(hw, txq, force);
-+}
- 
- /**
-  * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1554,38 +1554,6 @@ static void sta_apply_mesh_params(struct
- #endif
- }
- 
--static void sta_apply_airtime_params(struct ieee80211_local *local,
--				     struct sta_info *sta,
--				     struct station_parameters *params)
--{
--	u8 ac;
--
--	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		struct airtime_sched_info *air_sched = &local->airtime[ac];
--		struct airtime_info *air_info = &sta->airtime[ac];
--		struct txq_info *txqi;
--		u8 tid;
--
--		spin_lock_bh(&air_sched->lock);
--		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
--			if (air_info->weight == params->airtime_weight ||
--			    !sta->sta.txq[tid] ||
--			    ac != ieee80211_ac_from_tid(tid))
--				continue;
--
--			airtime_weight_set(air_info, params->airtime_weight);
--
--			txqi = to_txq_info(sta->sta.txq[tid]);
--			if (RB_EMPTY_NODE(&txqi->schedule_order))
--				continue;
--
--			ieee80211_update_airtime_weight(local, air_sched,
--							0, true);
--		}
--		spin_unlock_bh(&air_sched->lock);
--	}
--}
--
- static int sta_apply_parameters(struct ieee80211_local *local,
- 				struct sta_info *sta,
- 				struct station_parameters *params)
-@@ -1773,8 +1741,7 @@ static int sta_apply_parameters(struct i
- 		sta_apply_mesh_params(local, sta, params);
- 
- 	if (params->airtime_weight)
--		sta_apply_airtime_params(local, sta, params);
--
-+		sta->airtime_weight = params->airtime_weight;
- 
- 	/* set the STA state after all sta info from usermode has been set */
- 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) ||
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -216,14 +216,14 @@ static ssize_t aql_txq_limit_read(struct
- 			"VI	%u		%u\n"
- 			"BE	%u		%u\n"
- 			"BK	%u		%u\n",
--			local->airtime[IEEE80211_AC_VO].aql_txq_limit_low,
--			local->airtime[IEEE80211_AC_VO].aql_txq_limit_high,
--			local->airtime[IEEE80211_AC_VI].aql_txq_limit_low,
--			local->airtime[IEEE80211_AC_VI].aql_txq_limit_high,
--			local->airtime[IEEE80211_AC_BE].aql_txq_limit_low,
--			local->airtime[IEEE80211_AC_BE].aql_txq_limit_high,
--			local->airtime[IEEE80211_AC_BK].aql_txq_limit_low,
--			local->airtime[IEEE80211_AC_BK].aql_txq_limit_high);
-+			local->aql_txq_limit_low[IEEE80211_AC_VO],
-+			local->aql_txq_limit_high[IEEE80211_AC_VO],
-+			local->aql_txq_limit_low[IEEE80211_AC_VI],
-+			local->aql_txq_limit_high[IEEE80211_AC_VI],
-+			local->aql_txq_limit_low[IEEE80211_AC_BE],
-+			local->aql_txq_limit_high[IEEE80211_AC_BE],
-+			local->aql_txq_limit_low[IEEE80211_AC_BK],
-+			local->aql_txq_limit_high[IEEE80211_AC_BK]);
- 	return simple_read_from_buffer(user_buf, count, ppos,
- 				       buf, len);
- }
-@@ -255,11 +255,11 @@ static ssize_t aql_txq_limit_write(struc
- 	if (ac >= IEEE80211_NUM_ACS)
- 		return -EINVAL;
- 
--	q_limit_low_old = local->airtime[ac].aql_txq_limit_low;
--	q_limit_high_old = local->airtime[ac].aql_txq_limit_high;
-+	q_limit_low_old = local->aql_txq_limit_low[ac];
-+	q_limit_high_old = local->aql_txq_limit_high[ac];
- 
--	local->airtime[ac].aql_txq_limit_low = q_limit_low;
--	local->airtime[ac].aql_txq_limit_high = q_limit_high;
-+	local->aql_txq_limit_low[ac] = q_limit_low;
-+	local->aql_txq_limit_high[ac] = q_limit_high;
- 
- 	mutex_lock(&local->sta_mtx);
- 	list_for_each_entry(sta, &local->sta_list, list) {
-@@ -382,46 +382,6 @@ static const struct file_operations forc
- 	.llseek = default_llseek,
- };
- 
--static ssize_t airtime_read(struct file *file,
--			    char __user *user_buf,
--			    size_t count,
--			    loff_t *ppos)
--{
--	struct ieee80211_local *local = file->private_data;
--	char buf[200];
--	u64 v_t[IEEE80211_NUM_ACS];
--	u64 wt[IEEE80211_NUM_ACS];
--	int len = 0, ac;
--
--	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->airtime[ac].lock);
--		v_t[ac] = local->airtime[ac].v_t;
--		wt[ac] = local->airtime[ac].weight_sum;
--		spin_unlock_bh(&local->airtime[ac].lock);
--	}
--	len = scnprintf(buf, sizeof(buf),
--			"\tVO         VI         BE         BK\n"
--			"Virt-t\t%-10llu %-10llu %-10llu %-10llu\n"
--			"Weight\t%-10llu %-10llu %-10llu %-10llu\n",
--			v_t[0],
--			v_t[1],
--			v_t[2],
--			v_t[3],
--			wt[0],
--			wt[1],
--			wt[2],
--			wt[3]);
--
--	return simple_read_from_buffer(user_buf, count, ppos,
--				       buf, len);
--}
--
--static const struct file_operations airtime_ops = {
--	.read = airtime_read,
--	.open = simple_open,
--	.llseek = default_llseek,
--};
--
- #ifdef CONFIG_PM
- static ssize_t reset_write(struct file *file, const char __user *user_buf,
- 			   size_t count, loff_t *ppos)
-@@ -672,11 +632,7 @@ void debugfs_hw_add(struct ieee80211_loc
- 	if (local->ops->wake_tx_queue)
- 		DEBUGFS_ADD_MODE(aqm, 0600);
- 
--	if (wiphy_ext_feature_isset(local->hw.wiphy,
--				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
--		DEBUGFS_ADD_MODE(airtime, 0600);
--		DEBUGFS_ADD_MODE(airtime_flags, 0600);
--	}
-+	DEBUGFS_ADD_MODE(airtime_flags, 0600);
- 
- 	DEBUGFS_ADD(aql_txq_limit);
- 	debugfs_create_u32("aql_threshold", 0600,
---- a/net/mac80211/debugfs_netdev.c
-+++ b/net/mac80211/debugfs_netdev.c
-@@ -512,34 +512,6 @@ static ssize_t ieee80211_if_fmt_aqm(
- }
- IEEE80211_IF_FILE_R(aqm);
- 
--static ssize_t ieee80211_if_fmt_airtime(
--	const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
--{
--	struct ieee80211_local *local = sdata->local;
--	struct ieee80211_txq *txq = sdata->vif.txq;
--	struct airtime_info *air_info;
--	int len;
--
--	if (!txq)
--		return 0;
--
--	spin_lock_bh(&local->airtime[txq->ac].lock);
--	air_info = to_airtime_info(txq);
--	len = scnprintf(buf,
--			buflen,
--			"RX: %llu us\nTX: %llu us\nWeight: %u\n"
--			"Virt-T: %lld us\n",
--			air_info->rx_airtime,
--			air_info->tx_airtime,
--			air_info->weight,
--			air_info->v_t);
--	spin_unlock_bh(&local->airtime[txq->ac].lock);
--
--	return len;
--}
--
--IEEE80211_IF_FILE_R(airtime);
--
- IEEE80211_IF_FILE(multicast_to_unicast, u.ap.multicast_to_unicast, HEX);
- 
- /* IBSS attributes */
-@@ -685,10 +657,8 @@ static void add_common_files(struct ieee
- 
- 	if (sdata->local->ops->wake_tx_queue &&
- 	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
--	    sdata->vif.type != NL80211_IFTYPE_NAN) {
-+	    sdata->vif.type != NL80211_IFTYPE_NAN)
- 		DEBUGFS_ADD(aqm);
--		DEBUGFS_ADD(airtime);
--	}
- }
- 
- static void add_sta_files(struct ieee80211_sub_if_data *sdata)
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -202,7 +202,7 @@ static ssize_t sta_airtime_read(struct f
- 	size_t bufsz = 400;
- 	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
- 	u64 rx_airtime = 0, tx_airtime = 0;
--	u64 v_t[IEEE80211_NUM_ACS];
-+	s64 deficit[IEEE80211_NUM_ACS];
- 	ssize_t rv;
- 	int ac;
- 
-@@ -210,18 +210,18 @@ static ssize_t sta_airtime_read(struct f
- 		return -ENOMEM;
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->airtime[ac].lock);
-+		spin_lock_bh(&local->active_txq_lock[ac]);
- 		rx_airtime += sta->airtime[ac].rx_airtime;
- 		tx_airtime += sta->airtime[ac].tx_airtime;
--		v_t[ac] = sta->airtime[ac].v_t;
--		spin_unlock_bh(&local->airtime[ac].lock);
-+		deficit[ac] = sta->airtime[ac].deficit;
-+		spin_unlock_bh(&local->active_txq_lock[ac]);
- 	}
- 
- 	p += scnprintf(p, bufsz + buf - p,
- 		"RX: %llu us\nTX: %llu us\nWeight: %u\n"
--		"Virt-T: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
--		rx_airtime, tx_airtime, sta->airtime[0].weight,
--		v_t[0], v_t[1], v_t[2], v_t[3]);
-+		"Deficit: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
-+		rx_airtime, tx_airtime, sta->airtime_weight,
-+		deficit[0], deficit[1], deficit[2], deficit[3]);
- 
- 	rv = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
- 	kfree(buf);
-@@ -236,11 +236,11 @@ static ssize_t sta_airtime_write(struct
- 	int ac;
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->airtime[ac].lock);
-+		spin_lock_bh(&local->active_txq_lock[ac]);
- 		sta->airtime[ac].rx_airtime = 0;
- 		sta->airtime[ac].tx_airtime = 0;
--		sta->airtime[ac].v_t = 0;
--		spin_unlock_bh(&local->airtime[ac].lock);
-+		sta->airtime[ac].deficit = sta->airtime_weight;
-+		spin_unlock_bh(&local->active_txq_lock[ac]);
- 	}
- 
- 	return count;
-@@ -263,10 +263,10 @@ static ssize_t sta_aql_read(struct file
- 		return -ENOMEM;
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		spin_lock_bh(&local->airtime[ac].lock);
-+		spin_lock_bh(&local->active_txq_lock[ac]);
- 		q_limit_l[ac] = sta->airtime[ac].aql_limit_low;
- 		q_limit_h[ac] = sta->airtime[ac].aql_limit_high;
--		spin_unlock_bh(&local->airtime[ac].lock);
-+		spin_unlock_bh(&local->active_txq_lock[ac]);
- 		q_depth[ac] = atomic_read(&sta->airtime[ac].aql_tx_pending);
- 	}
- 
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -862,16 +862,20 @@ enum txq_info_flags {
-  * @def_flow: used as a fallback flow when a packet destined to @tin hashes to
-  *	a fq_flow which is already owned by a different tin
-  * @def_cvars: codel vars for @def_flow
-- * @schedule_order: used with ieee80211_local->active_txqs
-  * @frags: used to keep fragments created after dequeue
-+ * @schedule_order: used with ieee80211_local->active_txqs
-+ * @schedule_round: counter to prevent infinite loops on TXQ scheduling
-  */
- struct txq_info {
- 	struct fq_tin tin;
- 	struct codel_vars def_cvars;
- 	struct codel_stats cstats;
--	struct rb_node schedule_order;
-+
-+	u16 schedule_round;
-+	struct list_head schedule_order;
- 
- 	struct sk_buff_head frags;
-+
- 	unsigned long flags;
- 
- 	/* keep last! */
-@@ -948,8 +952,6 @@ struct ieee80211_sub_if_data {
- 	struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
- 	struct mac80211_qos_map __rcu *qos_map;
- 
--	struct airtime_info airtime[IEEE80211_NUM_ACS];
--
- 	struct work_struct csa_finalize_work;
- 	bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
- 	struct cfg80211_chan_def csa_chandef;
-@@ -1184,44 +1186,6 @@ enum mac80211_scan_state {
- 	SCAN_ABORT,
- };
- 
--/**
-- * struct airtime_sched_info - state used for airtime scheduling and AQL
-- *
-- * @lock: spinlock that protects all the fields in this struct
-- * @active_txqs: rbtree of currently backlogged queues, sorted by virtual time
-- * @schedule_pos: the current position maintained while a driver walks the tree
-- *                with ieee80211_next_txq()
-- * @active_list: list of struct airtime_info structs that were active within
-- *               the last AIRTIME_ACTIVE_DURATION (100 ms), used to compute
-- *               weight_sum
-- * @last_weight_update: used for rate limiting walking active_list
-- * @last_schedule_time: tracks the last time a transmission was scheduled; used
-- *                      for catching up v_t if no stations are eligible for
-- *                      transmission.
-- * @v_t: global virtual time; queues with v_t < this are eligible for
-- *       transmission
-- * @weight_sum: total sum of all active stations used for dividing airtime
-- * @weight_sum_reciprocal: reciprocal of weight_sum (to avoid divisions in fast
-- *                         path - see comment above
-- *                         IEEE80211_RECIPROCAL_DIVISOR_64)
-- * @aql_txq_limit_low: AQL limit when total outstanding airtime
-- *                     is < IEEE80211_AQL_THRESHOLD
-- * @aql_txq_limit_high: AQL limit when total outstanding airtime
-- *                      is > IEEE80211_AQL_THRESHOLD
-- */
--struct airtime_sched_info {
--	spinlock_t lock;
--	struct rb_root_cached active_txqs;
--	struct rb_node *schedule_pos;
--	struct list_head active_list;
--	u64 last_weight_update;
--	u64 last_schedule_activity;
--	u64 v_t;
--	u64 weight_sum;
--	u64 weight_sum_reciprocal;
--	u32 aql_txq_limit_low;
--	u32 aql_txq_limit_high;
--};
- DECLARE_STATIC_KEY_FALSE(aql_disable);
- 
- struct ieee80211_local {
-@@ -1235,8 +1199,13 @@ struct ieee80211_local {
- 	struct codel_params cparams;
- 
- 	/* protects active_txqs and txqi->schedule_order */
--	struct airtime_sched_info airtime[IEEE80211_NUM_ACS];
-+	spinlock_t active_txq_lock[IEEE80211_NUM_ACS];
-+	struct list_head active_txqs[IEEE80211_NUM_ACS];
-+	u16 schedule_round[IEEE80211_NUM_ACS];
-+
- 	u16 airtime_flags;
-+	u32 aql_txq_limit_low[IEEE80211_NUM_ACS];
-+	u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
- 	u32 aql_threshold;
- 	atomic_t aql_total_pending_airtime;
- 
-@@ -1660,125 +1629,6 @@ static inline bool txq_has_queue(struct
- 	return !(skb_queue_empty(&txqi->frags) && !txqi->tin.backlog_packets);
- }
- 
--static inline struct airtime_info *to_airtime_info(struct ieee80211_txq *txq)
--{
--	struct ieee80211_sub_if_data *sdata;
--	struct sta_info *sta;
--
--	if (txq->sta) {
--		sta = container_of(txq->sta, struct sta_info, sta);
--		return &sta->airtime[txq->ac];
--	}
--
--	sdata = vif_to_sdata(txq->vif);
--	return &sdata->airtime[txq->ac];
--}
--
--/* To avoid divisions in the fast path, we keep pre-computed reciprocals for
-- * airtime weight calculations. There are two different weights to keep track
-- * of: The per-station weight and the sum of weights per phy.
-- *
-- * For the per-station weights (kept in airtime_info below), we use 32-bit
-- * reciprocals with a devisor of 2^19. This lets us keep the multiplications and
-- * divisions for the station weights as 32-bit operations at the cost of a bit
-- * of rounding error for high weights; but the choice of divisor keeps rounding
-- * errors <10% for weights <2^15, assuming no more than 8ms of airtime is
-- * reported at a time.
-- *
-- * For the per-phy sum of weights the values can get higher, so we use 64-bit
-- * operations for those with a 32-bit divisor, which should avoid any
-- * significant rounding errors.
-- */
--#define IEEE80211_RECIPROCAL_DIVISOR_64 0x100000000ULL
--#define IEEE80211_RECIPROCAL_SHIFT_64 32
--#define IEEE80211_RECIPROCAL_DIVISOR_32 0x80000U
--#define IEEE80211_RECIPROCAL_SHIFT_32 19
--
--static inline void airtime_weight_set(struct airtime_info *air_info, u16 weight)
--{
--	if (air_info->weight == weight)
--		return;
--
--	air_info->weight = weight;
--	if (weight) {
--		air_info->weight_reciprocal =
--			IEEE80211_RECIPROCAL_DIVISOR_32 / weight;
--	} else {
--		air_info->weight_reciprocal = 0;
--	}
--}
--
--static inline void airtime_weight_sum_set(struct airtime_sched_info *air_sched,
--					  int weight_sum)
--{
--	if (air_sched->weight_sum == weight_sum)
--		return;
--
--	air_sched->weight_sum = weight_sum;
--	if (air_sched->weight_sum) {
--		air_sched->weight_sum_reciprocal = IEEE80211_RECIPROCAL_DIVISOR_64;
--		do_div(air_sched->weight_sum_reciprocal, air_sched->weight_sum);
--	} else {
--		air_sched->weight_sum_reciprocal = 0;
--	}
--}
--
--/* A problem when trying to enforce airtime fairness is that we want to divide
-- * the airtime between the currently *active* stations. However, basing this on
-- * the instantaneous queue state of stations doesn't work, as queues tend to
-- * oscillate very quickly between empty and occupied, leading to the scheduler
-- * thinking only a single station is active when deciding whether to allow
-- * transmission (and thus not throttling correctly).
-- *
-- * To fix this we use a timer-based notion of activity: a station is considered
-- * active if it has been scheduled within the last 100 ms; we keep a separate
-- * list of all the stations considered active in this manner, and lazily update
-- * the total weight of active stations from this list (filtering the stations in
-- * the list by their 'last active' time).
-- *
-- * We add one additional safeguard to guard against stations that manage to get
-- * scheduled every 100 ms but don't transmit a lot of data, and thus don't use
-- * up any airtime. Such stations would be able to get priority for an extended
-- * period of time if they do start transmitting at full capacity again, and so
-- * we add an explicit maximum for how far behind a station is allowed to fall in
-- * the virtual airtime domain. This limit is set to a relatively high value of
-- * 20 ms because the main mechanism for catching up idle stations is the active
-- * state as described above; i.e., the hard limit should only be hit in
-- * pathological cases.
-- */
--#define AIRTIME_ACTIVE_DURATION (100 * NSEC_PER_MSEC)
--#define AIRTIME_MAX_BEHIND 20000 /* 20 ms */
--
--static inline bool airtime_is_active(struct airtime_info *air_info, u64 now)
--{
--	return air_info->last_scheduled >= now - AIRTIME_ACTIVE_DURATION;
--}
--
--static inline void airtime_set_active(struct airtime_sched_info *air_sched,
--				      struct airtime_info *air_info, u64 now)
--{
--	air_info->last_scheduled = now;
--	air_sched->last_schedule_activity = now;
--	list_move_tail(&air_info->list, &air_sched->active_list);
--}
--
--static inline bool airtime_catchup_v_t(struct airtime_sched_info *air_sched,
--				       u64 v_t, u64 now)
--{
--	air_sched->v_t = v_t;
--	return true;
--}
--
--static inline void init_airtime_info(struct airtime_info *air_info,
--				     struct airtime_sched_info *air_sched)
--{
--	atomic_set(&air_info->aql_tx_pending, 0);
--	air_info->aql_limit_low = air_sched->aql_txq_limit_low;
--	air_info->aql_limit_high = air_sched->aql_txq_limit_high;
--	airtime_weight_set(air_info, IEEE80211_DEFAULT_AIRTIME_WEIGHT);
--	INIT_LIST_HEAD(&air_info->list);
--}
--
- static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
- {
- 	return ether_addr_equal(raddr, addr) ||
-@@ -2024,14 +1874,6 @@ int ieee80211_tx_control_port(struct wip
- 			      u64 *cookie);
- int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
- 			      const u8 *buf, size_t len);
--void ieee80211_resort_txq(struct ieee80211_hw *hw,
--			  struct ieee80211_txq *txq);
--void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
--			      struct ieee80211_txq *txq,
--			      bool purge);
--void ieee80211_update_airtime_weight(struct ieee80211_local *local,
--				     struct airtime_sched_info *air_sched,
--				     u64 now, bool force);
- 
- /* HT */
- void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -2192,9 +2192,6 @@ int ieee80211_if_add(struct ieee80211_lo
- 		}
- 	}
- 
--	for (i = 0; i < IEEE80211_NUM_ACS; i++)
--		init_airtime_info(&sdata->airtime[i], &local->airtime[i]);
--
- 	ieee80211_set_default_queues(sdata);
- 
- 	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -707,13 +707,10 @@ struct ieee80211_hw *ieee80211_alloc_hw_
- 	spin_lock_init(&local->queue_stop_reason_lock);
- 
- 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
--		struct airtime_sched_info *air_sched = &local->airtime[i];
--
--		air_sched->active_txqs = RB_ROOT_CACHED;
--		INIT_LIST_HEAD(&air_sched->active_list);
--		spin_lock_init(&air_sched->lock);
--		air_sched->aql_txq_limit_low = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
--		air_sched->aql_txq_limit_high =
-+		INIT_LIST_HEAD(&local->active_txqs[i]);
-+		spin_lock_init(&local->active_txq_lock[i]);
-+		local->aql_txq_limit_low[i] = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
-+		local->aql_txq_limit_high[i] =
- 			IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
- 	}
- 
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -1583,8 +1583,12 @@ static void sta_ps_start(struct sta_info
- 
- 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
- 		struct ieee80211_txq *txq = sta->sta.txq[tid];
-+		struct txq_info *txqi = to_txq_info(txq);
- 
--		ieee80211_unschedule_txq(&local->hw, txq, false);
-+		spin_lock(&local->active_txq_lock[txq->ac]);
-+		if (!list_empty(&txqi->schedule_order))
-+			list_del_init(&txqi->schedule_order);
-+		spin_unlock(&local->active_txq_lock[txq->ac]);
- 
- 		if (txq_has_queue(txq))
- 			set_bit(tid, &sta->txq_buffered_tids);
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -426,11 +426,15 @@ struct sta_info *sta_info_alloc(struct i
- 	if (sta_prepare_rate_control(local, sta, gfp))
- 		goto free_txq;
- 
-+	sta->airtime_weight = IEEE80211_DEFAULT_AIRTIME_WEIGHT;
- 
- 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
- 		skb_queue_head_init(&sta->ps_tx_buf[i]);
- 		skb_queue_head_init(&sta->tx_filtered[i]);
--		init_airtime_info(&sta->airtime[i], &local->airtime[i]);
-+		sta->airtime[i].deficit = sta->airtime_weight;
-+		atomic_set(&sta->airtime[i].aql_tx_pending, 0);
-+		sta->airtime[i].aql_limit_low = local->aql_txq_limit_low[i];
-+		sta->airtime[i].aql_limit_high = local->aql_txq_limit_high[i];
- 	}
- 
- 	for (i = 0; i < IEEE80211_NUM_TIDS; i++)
-@@ -1889,59 +1893,24 @@ void ieee80211_sta_set_buffered(struct i
- }
- EXPORT_SYMBOL(ieee80211_sta_set_buffered);
- 
--void ieee80211_register_airtime(struct ieee80211_txq *txq,
--				u32 tx_airtime, u32 rx_airtime)
-+void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
-+				    u32 tx_airtime, u32 rx_airtime)
- {
--	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
--	struct ieee80211_local *local = sdata->local;
--	u64 weight_sum, weight_sum_reciprocal;
--	struct airtime_sched_info *air_sched;
--	struct airtime_info *air_info;
-+	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
-+	struct ieee80211_local *local = sta->sdata->local;
-+	u8 ac = ieee80211_ac_from_tid(tid);
- 	u32 airtime = 0;
- 
--	air_sched = &local->airtime[txq->ac];
--	air_info = to_airtime_info(txq);
--
--	if (local->airtime_flags & AIRTIME_USE_TX)
-+	if (sta->local->airtime_flags & AIRTIME_USE_TX)
- 		airtime += tx_airtime;
--	if (local->airtime_flags & AIRTIME_USE_RX)
-+	if (sta->local->airtime_flags & AIRTIME_USE_RX)
- 		airtime += rx_airtime;
- 
--	/* Weights scale so the unit weight is 256 */
--	airtime <<= 8;
--
--	spin_lock_bh(&air_sched->lock);
--
--	air_info->tx_airtime += tx_airtime;
--	air_info->rx_airtime += rx_airtime;
--
--	if (air_sched->weight_sum) {
--		weight_sum = air_sched->weight_sum;
--		weight_sum_reciprocal = air_sched->weight_sum_reciprocal;
--	} else {
--		weight_sum = air_info->weight;
--		weight_sum_reciprocal = air_info->weight_reciprocal;
--	}
--
--	/* Round the calculation of global vt */
--	air_sched->v_t += (u64)((airtime + (weight_sum >> 1)) *
--				weight_sum_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_64;
--	air_info->v_t += (u32)((airtime + (air_info->weight >> 1)) *
--			       air_info->weight_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_32;
--	ieee80211_resort_txq(&local->hw, txq);
--
--	spin_unlock_bh(&air_sched->lock);
--}
--
--void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
--				    u32 tx_airtime, u32 rx_airtime)
--{
--	struct ieee80211_txq *txq = pubsta->txq[tid];
--
--	if (!txq)
--		return;
--
--	ieee80211_register_airtime(txq, tx_airtime, rx_airtime);
-+	spin_lock_bh(&local->active_txq_lock[ac]);
-+	sta->airtime[ac].tx_airtime += tx_airtime;
-+	sta->airtime[ac].rx_airtime += rx_airtime;
-+	sta->airtime[ac].deficit -= airtime;
-+	spin_unlock_bh(&local->active_txq_lock[ac]);
- }
- EXPORT_SYMBOL(ieee80211_sta_register_airtime);
- 
-@@ -2385,7 +2354,7 @@ void sta_set_sinfo(struct sta_info *sta,
- 	}
- 
- 	if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT))) {
--		sinfo->airtime_weight = sta->airtime[0].weight;
-+		sinfo->airtime_weight = sta->airtime_weight;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_AIRTIME_WEIGHT);
- 	}
- 
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -135,25 +135,18 @@ enum ieee80211_agg_stop_reason {
- #define AIRTIME_USE_TX		BIT(0)
- #define AIRTIME_USE_RX		BIT(1)
- 
--
- struct airtime_info {
- 	u64 rx_airtime;
- 	u64 tx_airtime;
--	u64 v_t;
--	u64 last_scheduled;
--	struct list_head list;
-+	s64 deficit;
- 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
- 	u32 aql_limit_low;
- 	u32 aql_limit_high;
--	u32 weight_reciprocal;
--	u16 weight;
- };
- 
- void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
- 					  struct sta_info *sta, u8 ac,
- 					  u16 tx_airtime, bool tx_completed);
--void ieee80211_register_airtime(struct ieee80211_txq *txq,
--				u32 tx_airtime, u32 rx_airtime);
- 
- struct sta_info;
- 
-@@ -523,6 +516,7 @@ struct ieee80211_fragment_cache {
-  * @tid_seq: per-TID sequence numbers for sending to this STA
-  * @airtime: per-AC struct airtime_info describing airtime statistics for this
-  *	station
-+ * @airtime_weight: station weight for airtime fairness calculation purposes
-  * @ampdu_mlme: A-MPDU state machine state
-  * @mesh: mesh STA information
-  * @debugfs_dir: debug filesystem directory dentry
-@@ -653,6 +647,7 @@ struct sta_info {
- 	u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
- 
- 	struct airtime_info airtime[IEEE80211_NUM_ACS];
-+	u16 airtime_weight;
- 
- 	/*
- 	 * Aggregation information, locked with lock.
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -983,25 +983,6 @@ static void __ieee80211_tx_status(struct
- 		if (!(info->flags & IEEE80211_TX_CTL_INJECTED) && acked)
- 			ieee80211_frame_acked(sta, skb);
- 
--	} else if (wiphy_ext_feature_isset(local->hw.wiphy,
--					   NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) {
--		struct ieee80211_sub_if_data *sdata;
--		struct ieee80211_txq *txq;
--		u32 airtime;
--
--		/* Account airtime to multicast queue */
--		sdata = ieee80211_sdata_from_skb(local, skb);
--
--		if (sdata && (txq = sdata->vif.txq)) {
--			airtime = info->status.tx_time ?:
--				ieee80211_calc_expected_tx_airtime(hw,
--								   &sdata->vif,
--								   NULL,
--								   skb->len,
--								   false);
--
--			ieee80211_register_airtime(txq, airtime, 0);
--		}
- 	}
- 
- 	/* SNMP counters
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -18,7 +18,6 @@
- #include <linux/bitmap.h>
- #include <linux/rcupdate.h>
- #include <linux/export.h>
--#include <linux/timekeeping.h>
- #include <net/net_namespace.h>
- #include <net/ieee80211_radiotap.h>
- #include <net/cfg80211.h>
-@@ -1480,7 +1479,7 @@ void ieee80211_txq_init(struct ieee80211
- 	codel_vars_init(&txqi->def_cvars);
- 	codel_stats_init(&txqi->cstats);
- 	__skb_queue_head_init(&txqi->frags);
--	RB_CLEAR_NODE(&txqi->schedule_order);
-+	INIT_LIST_HEAD(&txqi->schedule_order);
- 
- 	txqi->txq.vif = &sdata->vif;
- 
-@@ -1524,7 +1523,9 @@ void ieee80211_txq_purge(struct ieee8021
- 	ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
- 	spin_unlock_bh(&fq->lock);
- 
--	ieee80211_unschedule_txq(&local->hw, &txqi->txq, true);
-+	spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
-+	list_del_init(&txqi->schedule_order);
-+	spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
- }
- 
- void ieee80211_txq_set_params(struct ieee80211_local *local)
-@@ -3819,259 +3820,102 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
- struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
--	struct airtime_sched_info *air_sched;
--	u64 now = ktime_get_coarse_boottime_ns();
- 	struct ieee80211_txq *ret = NULL;
--	struct airtime_info *air_info;
--	struct txq_info *txqi = NULL;
--	struct rb_node *node;
--	bool first = false;
-+	struct txq_info *txqi = NULL, *head = NULL;
-+	bool found_eligible_txq = false;
- 
--	air_sched = &local->airtime[ac];
--	spin_lock_bh(&air_sched->lock);
-+	spin_lock_bh(&local->active_txq_lock[ac]);
- 
--	node = air_sched->schedule_pos;
--
--begin:
--	if (!node) {
--		node = rb_first_cached(&air_sched->active_txqs);
--		first = true;
--	} else {
--		node = rb_next(node);
--	}
--
--	if (!node)
--		goto out;
--
--	txqi = container_of(node, struct txq_info, schedule_order);
--	air_info = to_airtime_info(&txqi->txq);
--
--	if (air_info->v_t > air_sched->v_t &&
--	    (!first || !airtime_catchup_v_t(air_sched, air_info->v_t, now)))
-+ begin:
-+	txqi = list_first_entry_or_null(&local->active_txqs[ac],
-+					struct txq_info,
-+					schedule_order);
-+	if (!txqi)
- 		goto out;
- 
--	if (!ieee80211_txq_airtime_check(hw, &txqi->txq)) {
--		first = false;
--		goto begin;
--	}
--
--	air_sched->schedule_pos = node;
--	air_sched->last_schedule_activity = now;
--	ret = &txqi->txq;
--out:
--	spin_unlock_bh(&air_sched->lock);
--	return ret;
--}
--EXPORT_SYMBOL(ieee80211_next_txq);
--
--static void __ieee80211_insert_txq(struct rb_root_cached *root,
--				   struct txq_info *txqi)
--{
--	struct rb_node **new = &root->rb_root.rb_node;
--	struct airtime_info *old_air, *new_air;
--	struct rb_node *parent = NULL;
--	struct txq_info *__txqi;
--	bool leftmost = true;
--
--	while (*new) {
--		parent = *new;
--		__txqi = rb_entry(parent, struct txq_info, schedule_order);
--		old_air = to_airtime_info(&__txqi->txq);
--		new_air = to_airtime_info(&txqi->txq);
--
--		if (new_air->v_t <= old_air->v_t) {
--			new = &parent->rb_left;
--		} else {
--			new = &parent->rb_right;
--			leftmost = false;
--		}
-+	if (txqi == head) {
-+		if (!found_eligible_txq)
-+			goto out;
-+		else
-+			found_eligible_txq = false;
- 	}
- 
--	rb_link_node(&txqi->schedule_order, parent, new);
--	rb_insert_color_cached(&txqi->schedule_order, root, leftmost);
--}
--
--void ieee80211_resort_txq(struct ieee80211_hw *hw,
--			  struct ieee80211_txq *txq)
--{
--	struct airtime_info *air_info = to_airtime_info(txq);
--	struct ieee80211_local *local = hw_to_local(hw);
--	struct txq_info *txqi = to_txq_info(txq);
--	struct airtime_sched_info *air_sched;
--
--	air_sched = &local->airtime[txq->ac];
-+	if (!head)
-+		head = txqi;
- 
--	lockdep_assert_held(&air_sched->lock);
--
--	if (!RB_EMPTY_NODE(&txqi->schedule_order)) {
--		struct airtime_info *a_prev = NULL, *a_next = NULL;
--		struct txq_info *t_prev, *t_next;
--		struct rb_node *n_prev, *n_next;
-+	if (txqi->txq.sta) {
-+		struct sta_info *sta = container_of(txqi->txq.sta,
-+						    struct sta_info, sta);
-+		bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
-+		s64 deficit = sta->airtime[txqi->txq.ac].deficit;
- 
--		/* Erasing a node can cause an expensive rebalancing operation,
--		 * so we check the previous and next nodes first and only remove
--		 * and re-insert if the current node is not already in the
--		 * correct position.
--		 */
--		if ((n_prev = rb_prev(&txqi->schedule_order)) != NULL) {
--			t_prev = container_of(n_prev, struct txq_info,
--					      schedule_order);
--			a_prev = to_airtime_info(&t_prev->txq);
--		}
-+		if (aql_check)
-+			found_eligible_txq = true;
- 
--		if ((n_next = rb_next(&txqi->schedule_order)) != NULL) {
--			t_next = container_of(n_next, struct txq_info,
--					      schedule_order);
--			a_next = to_airtime_info(&t_next->txq);
-+		if (deficit < 0)
-+			sta->airtime[txqi->txq.ac].deficit +=
-+				sta->airtime_weight;
-+
-+		if (deficit < 0 || !aql_check) {
-+			list_move_tail(&txqi->schedule_order,
-+				       &local->active_txqs[txqi->txq.ac]);
-+			goto begin;
- 		}
--
--		if ((!a_prev || a_prev->v_t <= air_info->v_t) &&
--		    (!a_next || a_next->v_t > air_info->v_t))
--			return;
--
--		if (air_sched->schedule_pos == &txqi->schedule_order)
--			air_sched->schedule_pos = n_prev;
--
--		rb_erase_cached(&txqi->schedule_order,
--				&air_sched->active_txqs);
--		RB_CLEAR_NODE(&txqi->schedule_order);
--		__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
- 	}
--}
--
--void ieee80211_update_airtime_weight(struct ieee80211_local *local,
--				     struct airtime_sched_info *air_sched,
--				     u64 now, bool force)
--{
--	struct airtime_info *air_info, *tmp;
--	u64 weight_sum = 0;
--
--	if (unlikely(!now))
--		now = ktime_get_coarse_boottime_ns();
--
--	lockdep_assert_held(&air_sched->lock);
--
--	if (!force && (air_sched->last_weight_update <
--		       now - AIRTIME_ACTIVE_DURATION))
--		return;
--
--	list_for_each_entry_safe(air_info, tmp,
--				 &air_sched->active_list, list) {
--		if (airtime_is_active(air_info, now))
--			weight_sum += air_info->weight;
--		else
--			list_del_init(&air_info->list);
--	}
--	airtime_weight_sum_set(air_sched, weight_sum);
--	air_sched->last_weight_update = now;
--}
- 
--void ieee80211_schedule_txq(struct ieee80211_hw *hw,
--			    struct ieee80211_txq *txq)
--	__acquires(txq_lock) __releases(txq_lock)
--{
--	struct ieee80211_local *local = hw_to_local(hw);
--	struct txq_info *txqi = to_txq_info(txq);
--	struct airtime_sched_info *air_sched;
--	u64 now = ktime_get_coarse_boottime_ns();
--	struct airtime_info *air_info;
--	u8 ac = txq->ac;
--	bool was_active;
- 
--	air_sched = &local->airtime[ac];
--	air_info = to_airtime_info(txq);
--
--	spin_lock_bh(&air_sched->lock);
--	was_active = airtime_is_active(air_info, now);
--	airtime_set_active(air_sched, air_info, now);
--
--	if (!RB_EMPTY_NODE(&txqi->schedule_order))
-+	if (txqi->schedule_round == local->schedule_round[ac])
- 		goto out;
- 
--	/* If the station has been inactive for a while, catch up its v_t so it
--	 * doesn't get indefinite priority; see comment above the definition of
--	 * AIRTIME_MAX_BEHIND.
--	 */
--	if ((!was_active && air_info->v_t < air_sched->v_t) ||
--	    air_info->v_t < air_sched->v_t - AIRTIME_MAX_BEHIND)
--		air_info->v_t = air_sched->v_t;
--
--	ieee80211_update_airtime_weight(local, air_sched, now, !was_active);
--	__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
-+	list_del_init(&txqi->schedule_order);
-+	txqi->schedule_round = local->schedule_round[ac];
-+	ret = &txqi->txq;
- 
- out:
--	spin_unlock_bh(&air_sched->lock);
--}
--EXPORT_SYMBOL(ieee80211_schedule_txq);
--
--static void __ieee80211_unschedule_txq(struct ieee80211_hw *hw,
--				       struct ieee80211_txq *txq,
--				       bool purge)
--{
--	struct ieee80211_local *local = hw_to_local(hw);
--	struct txq_info *txqi = to_txq_info(txq);
--	struct airtime_sched_info *air_sched;
--	struct airtime_info *air_info;
--
--	air_sched = &local->airtime[txq->ac];
--	air_info = to_airtime_info(&txqi->txq);
--
--	lockdep_assert_held(&air_sched->lock);
--
--	if (purge) {
--		list_del_init(&air_info->list);
--		ieee80211_update_airtime_weight(local, air_sched, 0, true);
--	}
--
--	if (RB_EMPTY_NODE(&txqi->schedule_order))
--		return;
--
--	if (air_sched->schedule_pos == &txqi->schedule_order)
--		air_sched->schedule_pos = rb_prev(&txqi->schedule_order);
--
--	if (!purge)
--		airtime_set_active(air_sched, air_info,
--				   ktime_get_coarse_boottime_ns());
--
--	rb_erase_cached(&txqi->schedule_order,
--			&air_sched->active_txqs);
--	RB_CLEAR_NODE(&txqi->schedule_order);
-+	spin_unlock_bh(&local->active_txq_lock[ac]);
-+	return ret;
- }
-+EXPORT_SYMBOL(ieee80211_next_txq);
- 
--void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
-+void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
- 			      struct ieee80211_txq *txq,
--			      bool purge)
--	__acquires(txq_lock) __releases(txq_lock)
--{
--	struct ieee80211_local *local = hw_to_local(hw);
--
--	spin_lock_bh(&local->airtime[txq->ac].lock);
--	__ieee80211_unschedule_txq(hw, txq, purge);
--	spin_unlock_bh(&local->airtime[txq->ac].lock);
--}
--
--void ieee80211_return_txq(struct ieee80211_hw *hw,
--			  struct ieee80211_txq *txq, bool force)
-+			      bool force)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
- 	struct txq_info *txqi = to_txq_info(txq);
- 
--	spin_lock_bh(&local->airtime[txq->ac].lock);
-+	spin_lock_bh(&local->active_txq_lock[txq->ac]);
- 
--	if (!RB_EMPTY_NODE(&txqi->schedule_order) && !force &&
--	    !txq_has_queue(txq))
--		__ieee80211_unschedule_txq(hw, txq, false);
-+	if (list_empty(&txqi->schedule_order) &&
-+	    (force || !skb_queue_empty(&txqi->frags) ||
-+	     txqi->tin.backlog_packets)) {
-+		/* If airtime accounting is active, always enqueue STAs at the
-+		 * head of the list to ensure that they only get moved to the
-+		 * back by the airtime DRR scheduler once they have a negative
-+		 * deficit. A station that already has a negative deficit will
-+		 * get immediately moved to the back of the list on the next
-+		 * call to ieee80211_next_txq().
-+		 */
-+		if (txqi->txq.sta && local->airtime_flags &&
-+		    wiphy_ext_feature_isset(local->hw.wiphy,
-+					    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
-+			list_add(&txqi->schedule_order,
-+				 &local->active_txqs[txq->ac]);
-+		else
-+			list_add_tail(&txqi->schedule_order,
-+				      &local->active_txqs[txq->ac]);
-+	}
- 
--	spin_unlock_bh(&local->airtime[txq->ac].lock);
-+	spin_unlock_bh(&local->active_txq_lock[txq->ac]);
- }
--EXPORT_SYMBOL(ieee80211_return_txq);
-+EXPORT_SYMBOL(__ieee80211_schedule_txq);
- 
- DEFINE_STATIC_KEY_FALSE(aql_disable);
- 
- bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
- 				 struct ieee80211_txq *txq)
- {
--	struct airtime_info *air_info = to_airtime_info(txq);
-+	struct sta_info *sta;
- 	struct ieee80211_local *local = hw_to_local(hw);
- 
- 	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
-@@ -4086,12 +3930,15 @@ bool ieee80211_txq_airtime_check(struct
- 	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
- 		return true;
- 
--	if (atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_low)
-+	sta = container_of(txq->sta, struct sta_info, sta);
-+	if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
-+	    sta->airtime[txq->ac].aql_limit_low)
- 		return true;
- 
- 	if (atomic_read(&local->aql_total_pending_airtime) <
- 	    local->aql_threshold &&
--	    atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_high)
-+	    atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
-+	    sta->airtime[txq->ac].aql_limit_high)
- 		return true;
- 
- 	return false;
-@@ -4101,59 +3948,60 @@ EXPORT_SYMBOL(ieee80211_txq_airtime_chec
- bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
- 				struct ieee80211_txq *txq)
- {
--	struct txq_info *first_txqi = NULL, *txqi = to_txq_info(txq);
- 	struct ieee80211_local *local = hw_to_local(hw);
--	struct airtime_sched_info *air_sched;
--	struct airtime_info *air_info;
--	struct rb_node *node = NULL;
--	bool ret = false;
--	u64 now;
--
-+	struct txq_info *iter, *tmp, *txqi = to_txq_info(txq);
-+	struct sta_info *sta;
-+	u8 ac = txq->ac;
- 
--	if (!ieee80211_txq_airtime_check(hw, txq))
--		return false;
-+	spin_lock_bh(&local->active_txq_lock[ac]);
- 
--	air_sched = &local->airtime[txq->ac];
--	spin_lock_bh(&air_sched->lock);
-+	if (!txqi->txq.sta)
-+		goto out;
- 
--	if (RB_EMPTY_NODE(&txqi->schedule_order))
-+	if (list_empty(&txqi->schedule_order))
- 		goto out;
- 
--	now = ktime_get_coarse_boottime_ns();
-+	list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
-+				 schedule_order) {
-+		if (iter == txqi)
-+			break;
- 
--	/* Like in ieee80211_next_txq(), make sure the first station in the
--	 * scheduling order is eligible for transmission to avoid starvation.
--	 */
--	node = rb_first_cached(&air_sched->active_txqs);
--	if (node) {
--		first_txqi = container_of(node, struct txq_info,
--					  schedule_order);
--		air_info = to_airtime_info(&first_txqi->txq);
--
--		if (air_sched->v_t < air_info->v_t)
--			airtime_catchup_v_t(air_sched, air_info->v_t, now);
-+		if (!iter->txq.sta) {
-+			list_move_tail(&iter->schedule_order,
-+				       &local->active_txqs[ac]);
-+			continue;
-+		}
-+		sta = container_of(iter->txq.sta, struct sta_info, sta);
-+		if (sta->airtime[ac].deficit < 0)
-+			sta->airtime[ac].deficit += sta->airtime_weight;
-+		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
- 	}
- 
--	air_info = to_airtime_info(&txqi->txq);
--	if (air_info->v_t <= air_sched->v_t) {
--		air_sched->last_schedule_activity = now;
--		ret = true;
--	}
-+	sta = container_of(txqi->txq.sta, struct sta_info, sta);
-+	if (sta->airtime[ac].deficit >= 0)
-+		goto out;
-+
-+	sta->airtime[ac].deficit += sta->airtime_weight;
-+	list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
-+	spin_unlock_bh(&local->active_txq_lock[ac]);
- 
-+	return false;
- out:
--	spin_unlock_bh(&air_sched->lock);
--	return ret;
-+	if (!list_empty(&txqi->schedule_order))
-+		list_del_init(&txqi->schedule_order);
-+	spin_unlock_bh(&local->active_txq_lock[ac]);
-+
-+	return true;
- }
- EXPORT_SYMBOL(ieee80211_txq_may_transmit);
- 
- void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
--	struct airtime_sched_info *air_sched = &local->airtime[ac];
- 
--	spin_lock_bh(&air_sched->lock);
--	air_sched->schedule_pos = NULL;
--	spin_unlock_bh(&air_sched->lock);
-+	spin_lock_bh(&local->active_txq_lock[ac]);
-+	local->schedule_round[ac]++;
-+	spin_unlock_bh(&local->active_txq_lock[ac]);
- }
- EXPORT_SYMBOL(ieee80211_txq_schedule_start);
- 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/331-v6.0-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/331-v6.0-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch
deleted file mode 100644
index c006d37..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/331-v6.0-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 20 Jun 2022 14:53:04 +0200
-Subject: [PATCH] mac80211: make sta airtime deficit field s32 instead of
- s64
-
-32 bit is more than enough range for the airtime deficit
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -202,7 +202,7 @@ static ssize_t sta_airtime_read(struct f
- 	size_t bufsz = 400;
- 	char *buf = kzalloc(bufsz, GFP_KERNEL), *p = buf;
- 	u64 rx_airtime = 0, tx_airtime = 0;
--	s64 deficit[IEEE80211_NUM_ACS];
-+	s32 deficit[IEEE80211_NUM_ACS];
- 	ssize_t rv;
- 	int ac;
- 
-@@ -219,7 +219,7 @@ static ssize_t sta_airtime_read(struct f
- 
- 	p += scnprintf(p, bufsz + buf - p,
- 		"RX: %llu us\nTX: %llu us\nWeight: %u\n"
--		"Deficit: VO: %lld us VI: %lld us BE: %lld us BK: %lld us\n",
-+		"Deficit: VO: %d us VI: %d us BE: %d us BK: %d us\n",
- 		rx_airtime, tx_airtime, sta->airtime_weight,
- 		deficit[0], deficit[1], deficit[2], deficit[3]);
- 
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -138,7 +138,7 @@ enum ieee80211_agg_stop_reason {
- struct airtime_info {
- 	u64 rx_airtime;
- 	u64 tx_airtime;
--	s64 deficit;
-+	s32 deficit;
- 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
- 	u32 aql_limit_low;
- 	u32 aql_limit_high;
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3847,7 +3847,7 @@ struct ieee80211_txq *ieee80211_next_txq
- 		struct sta_info *sta = container_of(txqi->txq.sta,
- 						    struct sta_info, sta);
- 		bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
--		s64 deficit = sta->airtime[txqi->txq.ac].deficit;
-+		s32 deficit = sta->airtime[txqi->txq.ac].deficit;
- 
- 		if (aql_check)
- 			found_eligible_txq = true;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/332-v6.0-mac80211-consider-aql_tx_pending-when-checking-airti.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/332-v6.0-mac80211-consider-aql_tx_pending-when-checking-airti.patch
deleted file mode 100644
index c214294..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/332-v6.0-mac80211-consider-aql_tx_pending-when-checking-airti.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 20 Jun 2022 14:59:09 +0200
-Subject: [PATCH] mac80211: consider aql_tx_pending when checking airtime
- deficit
-
-When queueing packets for a station, deficit only gets added once the packets
-have been transmitted, which could be much later. During that time, a lot of
-temporary unfairness could happen, which could lead to bursty behavior.
-Fix this by subtracting the aql_tx_pending when checking the deficit in tx
-scheduling.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3817,6 +3817,13 @@ out:
- }
- EXPORT_SYMBOL(ieee80211_tx_dequeue);
- 
-+static inline s32 ieee80211_sta_deficit(struct sta_info *sta, u8 ac)
-+{
-+	struct airtime_info *air_info = &sta->airtime[ac];
-+
-+	return air_info->deficit - atomic_read(&air_info->aql_tx_pending);
-+}
-+
- struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
-@@ -3847,7 +3854,7 @@ struct ieee80211_txq *ieee80211_next_txq
- 		struct sta_info *sta = container_of(txqi->txq.sta,
- 						    struct sta_info, sta);
- 		bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
--		s32 deficit = sta->airtime[txqi->txq.ac].deficit;
-+		s32 deficit = ieee80211_sta_deficit(sta, txqi->txq.ac);
- 
- 		if (aql_check)
- 			found_eligible_txq = true;
-@@ -3972,7 +3979,7 @@ bool ieee80211_txq_may_transmit(struct i
- 			continue;
- 		}
- 		sta = container_of(iter->txq.sta, struct sta_info, sta);
--		if (sta->airtime[ac].deficit < 0)
-+		if (ieee80211_sta_deficit(sta, ac) < 0)
- 			sta->airtime[ac].deficit += sta->airtime_weight;
- 		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
- 	}
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-v6.0-mac80211-keep-recently-active-tx-queues-in-schedulin.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-v6.0-mac80211-keep-recently-active-tx-queues-in-schedulin.patch
deleted file mode 100644
index 317e4f0..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/333-v6.0-mac80211-keep-recently-active-tx-queues-in-schedulin.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 20 Jun 2022 20:52:50 +0200
-Subject: [PATCH] mac80211: keep recently active tx queues in scheduling
- list
-
-This allows proper deficit accounting to ensure that they don't carry their
-deficit until the next time they become active
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -83,6 +83,13 @@ extern const u8 ieee80211_ac_to_qos_mask
- 
- #define IEEE80211_MAX_NAN_INSTANCE_ID 255
- 
-+
-+/*
-+ * Keep a station's queues on the active list for deficit accounting purposes
-+ * if it was active or queued during the last 100ms
-+ */
-+#define AIRTIME_ACTIVE_DURATION (HZ / 10)
-+
- struct ieee80211_bss {
- 	u32 device_ts_beacon, device_ts_presp;
- 
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -138,6 +138,7 @@ enum ieee80211_agg_stop_reason {
- struct airtime_info {
- 	u64 rx_airtime;
- 	u64 tx_airtime;
-+	u32 last_active;
- 	s32 deficit;
- 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
- 	u32 aql_limit_low;
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3824,6 +3824,36 @@ static inline s32 ieee80211_sta_deficit(
- 	return air_info->deficit - atomic_read(&air_info->aql_tx_pending);
- }
- 
-+static void
-+ieee80211_txq_set_active(struct txq_info *txqi)
-+{
-+	struct sta_info *sta;
-+
-+	if (!txqi->txq.sta)
-+		return;
-+
-+	sta = container_of(txqi->txq.sta, struct sta_info, sta);
-+	sta->airtime[txqi->txq.ac].last_active = (u32)jiffies;
-+}
-+
-+static bool
-+ieee80211_txq_keep_active(struct txq_info *txqi)
-+{
-+	struct sta_info *sta;
-+	u32 diff;
-+
-+	if (!txqi->txq.sta)
-+		return false;
-+
-+	sta = container_of(txqi->txq.sta, struct sta_info, sta);
-+	if (ieee80211_sta_deficit(sta, txqi->txq.ac) >= 0)
-+		return false;
-+
-+	diff = (u32)jiffies - sta->airtime[txqi->txq.ac].last_active;
-+
-+	return diff <= AIRTIME_ACTIVE_DURATION;
-+}
-+
- struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
-@@ -3870,7 +3900,6 @@ struct ieee80211_txq *ieee80211_next_txq
- 		}
- 	}
- 
--
- 	if (txqi->schedule_round == local->schedule_round[ac])
- 		goto out;
- 
-@@ -3890,12 +3919,13 @@ void __ieee80211_schedule_txq(struct iee
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
- 	struct txq_info *txqi = to_txq_info(txq);
-+	bool has_queue;
- 
- 	spin_lock_bh(&local->active_txq_lock[txq->ac]);
- 
-+	has_queue = force || txq_has_queue(txq);
- 	if (list_empty(&txqi->schedule_order) &&
--	    (force || !skb_queue_empty(&txqi->frags) ||
--	     txqi->tin.backlog_packets)) {
-+	    (has_queue || ieee80211_txq_keep_active(txqi))) {
- 		/* If airtime accounting is active, always enqueue STAs at the
- 		 * head of the list to ensure that they only get moved to the
- 		 * back by the airtime DRR scheduler once they have a negative
-@@ -3903,7 +3933,7 @@ void __ieee80211_schedule_txq(struct iee
- 		 * get immediately moved to the back of the list on the next
- 		 * call to ieee80211_next_txq().
- 		 */
--		if (txqi->txq.sta && local->airtime_flags &&
-+		if (txqi->txq.sta && local->airtime_flags && has_queue &&
- 		    wiphy_ext_feature_isset(local->hw.wiphy,
- 					    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
- 			list_add(&txqi->schedule_order,
-@@ -3911,6 +3941,8 @@ void __ieee80211_schedule_txq(struct iee
- 		else
- 			list_add_tail(&txqi->schedule_order,
- 				      &local->active_txqs[txq->ac]);
-+		if (has_queue)
-+			ieee80211_txq_set_active(txqi);
- 	}
- 
- 	spin_unlock_bh(&local->active_txq_lock[txq->ac]);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/334-v6.0-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/334-v6.0-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch
deleted file mode 100644
index fb6fd6e..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/334-v6.0-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Mon, 20 Jun 2022 21:26:34 +0200
-Subject: [PATCH] mac80211: add a per-PHY AQL limit to improve fairness
-
-In order to maintain fairness, the amount of queueing needs to be limited
-beyond the simple per-station AQL budget, otherwise the driver can simply
-repeatedly do scheduling rounds until all queues that have not used their
-AQL budget become eligble.
-
-To be conservative, use the high AQL limit for the first txq and add half
-of the low AQL for each subsequent queue.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1215,6 +1215,7 @@ struct ieee80211_local {
- 	u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
- 	u32 aql_threshold;
- 	atomic_t aql_total_pending_airtime;
-+	atomic_t aql_ac_pending_airtime[IEEE80211_NUM_ACS];
- 
- 	const struct ieee80211_ops *ops;
- 
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -712,6 +712,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
- 		local->aql_txq_limit_low[i] = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
- 		local->aql_txq_limit_high[i] =
- 			IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
-+		atomic_set(&local->aql_ac_pending_airtime[i], 0);
- 	}
- 
- 	local->airtime_flags = AIRTIME_USE_TX | AIRTIME_USE_RX;
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -1929,6 +1929,7 @@ void ieee80211_sta_update_pending_airtim
- 				   &sta->airtime[ac].aql_tx_pending);
- 
- 		atomic_add(tx_airtime, &local->aql_total_pending_airtime);
-+		atomic_add(tx_airtime, &local->aql_ac_pending_airtime[ac]);
- 		return;
- 	}
- 
-@@ -1940,14 +1941,17 @@ void ieee80211_sta_update_pending_airtim
- 				       tx_pending, 0);
- 	}
- 
-+	atomic_sub(tx_airtime, &local->aql_total_pending_airtime);
- 	tx_pending = atomic_sub_return(tx_airtime,
--				       &local->aql_total_pending_airtime);
-+				       &local->aql_ac_pending_airtime[ac]);
- 	if (WARN_ONCE(tx_pending < 0,
- 		      "Device %s AC %d pending airtime underflow: %u, %u",
- 		      wiphy_name(local->hw.wiphy), ac, tx_pending,
--		      tx_airtime))
--		atomic_cmpxchg(&local->aql_total_pending_airtime,
-+		      tx_airtime)) {
-+		atomic_cmpxchg(&local->aql_ac_pending_airtime[ac],
- 			       tx_pending, 0);
-+		atomic_sub(tx_pending, &local->aql_total_pending_airtime);
-+	}
- }
- 
- int sta_info_move_state(struct sta_info *sta,
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3863,6 +3863,9 @@ struct ieee80211_txq *ieee80211_next_txq
- 
- 	spin_lock_bh(&local->active_txq_lock[ac]);
- 
-+	if (!local->schedule_round[ac])
-+		goto out;
-+
-  begin:
- 	txqi = list_first_entry_or_null(&local->active_txqs[ac],
- 					struct txq_info,
-@@ -3984,6 +3987,25 @@ bool ieee80211_txq_airtime_check(struct
- }
- EXPORT_SYMBOL(ieee80211_txq_airtime_check);
- 
-+static bool
-+ieee80211_txq_schedule_airtime_check(struct ieee80211_local *local, u8 ac)
-+{
-+	unsigned int num_txq = 0;
-+	struct txq_info *txq;
-+	u32 aql_limit;
-+
-+	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
-+		return true;
-+
-+	list_for_each_entry(txq, &local->active_txqs[ac], schedule_order)
-+		num_txq++;
-+
-+	aql_limit = (num_txq - 1) * local->aql_txq_limit_low[ac] / 2 +
-+		    local->aql_txq_limit_high[ac];
-+
-+	return atomic_read(&local->aql_ac_pending_airtime[ac]) < aql_limit;
-+}
-+
- bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
- 				struct ieee80211_txq *txq)
- {
-@@ -4000,6 +4022,9 @@ bool ieee80211_txq_may_transmit(struct i
- 	if (list_empty(&txqi->schedule_order))
- 		goto out;
- 
-+	if (!ieee80211_txq_schedule_airtime_check(local, ac))
-+		goto out;
-+
- 	list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
- 				 schedule_order) {
- 		if (iter == txqi)
-@@ -4039,7 +4064,15 @@ void ieee80211_txq_schedule_start(struct
- 	struct ieee80211_local *local = hw_to_local(hw);
- 
- 	spin_lock_bh(&local->active_txq_lock[ac]);
--	local->schedule_round[ac]++;
-+
-+	if (ieee80211_txq_schedule_airtime_check(local, ac)) {
-+		local->schedule_round[ac]++;
-+		if (!local->schedule_round[ac])
-+			local->schedule_round[ac]++;
-+	} else {
-+		local->schedule_round[ac] = 0;
-+	}
-+
- 	spin_unlock_bh(&local->active_txq_lock[ac]);
- }
- EXPORT_SYMBOL(ieee80211_txq_schedule_start);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/335-v6.0-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/335-v6.0-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch
deleted file mode 100644
index df45a52..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/335-v6.0-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 25 Jun 2022 21:25:40 +0200
-Subject: [PATCH] mac80211: add debugfs file to display per-phy AQL pending
- airtime
-
-Now that the global pending airtime is more relevant for airtime fairness,
-it makes sense to make it accessible via debugfs for debugging
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -201,6 +201,36 @@ static const struct file_operations airt
- 	.llseek = default_llseek,
- };
- 
-+static ssize_t aql_pending_read(struct file *file,
-+				char __user *user_buf,
-+				size_t count, loff_t *ppos)
-+{
-+	struct ieee80211_local *local = file->private_data;
-+	char buf[400];
-+	int len = 0;
-+
-+	len = scnprintf(buf, sizeof(buf),
-+			"AC     AQL pending\n"
-+			"VO     %u us\n"
-+			"VI     %u us\n"
-+			"BE     %u us\n"
-+			"BK     %u us\n"
-+			"total  %u us\n",
-+			atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_VO]),
-+			atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_VI]),
-+			atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_BE]),
-+			atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_BK]),
-+			atomic_read(&local->aql_total_pending_airtime));
-+	return simple_read_from_buffer(user_buf, count, ppos,
-+				       buf, len);
-+}
-+
-+static const struct file_operations aql_pending_ops = {
-+	.read = aql_pending_read,
-+	.open = simple_open,
-+	.llseek = default_llseek,
-+};
-+
- static ssize_t aql_txq_limit_read(struct file *file,
- 				  char __user *user_buf,
- 				  size_t count,
-@@ -628,6 +658,7 @@ void debugfs_hw_add(struct ieee80211_loc
- 	DEBUGFS_ADD(hw_conf);
- 	DEBUGFS_ADD_MODE(force_tx_status, 0600);
- 	DEBUGFS_ADD_MODE(aql_enable, 0600);
-+	DEBUGFS_ADD(aql_pending);
- 
- 	if (local->ops->wake_tx_queue)
- 		DEBUGFS_ADD_MODE(aqm, 0600);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/336-v6.0-mac80211-only-accumulate-airtime-deficit-for-active-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/336-v6.0-mac80211-only-accumulate-airtime-deficit-for-active-.patch
deleted file mode 100644
index 35f07c1..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/336-v6.0-mac80211-only-accumulate-airtime-deficit-for-active-.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 25 Jun 2022 23:10:19 +0200
-Subject: [PATCH] mac80211: only accumulate airtime deficit for active
- clients
-
-When a client does not generate any local tx activity, accumulating airtime
-deficit for the round-robin scheduler can be harmful. If this goes on for too
-long, the deficit could grow quite large, which might cause unreasonable
-initial latency once the client becomes active
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -1900,6 +1900,7 @@ void ieee80211_sta_register_airtime(stru
- 	struct ieee80211_local *local = sta->sdata->local;
- 	u8 ac = ieee80211_ac_from_tid(tid);
- 	u32 airtime = 0;
-+	u32 diff;
- 
- 	if (sta->local->airtime_flags & AIRTIME_USE_TX)
- 		airtime += tx_airtime;
-@@ -1909,7 +1910,11 @@ void ieee80211_sta_register_airtime(stru
- 	spin_lock_bh(&local->active_txq_lock[ac]);
- 	sta->airtime[ac].tx_airtime += tx_airtime;
- 	sta->airtime[ac].rx_airtime += rx_airtime;
--	sta->airtime[ac].deficit -= airtime;
-+
-+	diff = (u32)jiffies - sta->airtime[ac].last_active;
-+	if (diff <= AIRTIME_ACTIVE_DURATION)
-+		sta->airtime[ac].deficit -= airtime;
-+
- 	spin_unlock_bh(&local->active_txq_lock[ac]);
- }
- EXPORT_SYMBOL(ieee80211_sta_register_airtime);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/339-v6.0-mac80211-exclude-multicast-packets-from-AQL-pending-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/339-v6.0-mac80211-exclude-multicast-packets-from-AQL-pending-.patch
deleted file mode 100644
index 43c3e75..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/339-v6.0-mac80211-exclude-multicast-packets-from-AQL-pending-.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 13 Jul 2022 07:32:26 +0200
-Subject: [PATCH] mac80211: exclude multicast packets from AQL pending airtime
-
-In AP mode, multicast traffic is handled very differently from normal traffic,
-especially if at least one client is in powersave mode.
-This means that multicast packets can be buffered a lot longer than normal
-unicast packets, and can eat up the AQL budget very quickly because of the low
-data rate.
-Along with the recent change to maintain a global PHY AQL limit, this can lead
-to significant latency spikes for unicast traffic.
-
-Since queueing multicast to hardware is currently not constrained by AQL limits
-anyway, let's just exclude it from the AQL pending airtime calculation entirely.
-
-Fixes: 8e4bac067105 ("wifi: mac80211: add a per-PHY AQL limit to improve fairness")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -3792,7 +3792,7 @@ begin:
- encap_out:
- 	IEEE80211_SKB_CB(skb)->control.vif = vif;
- 
--	if (vif &&
-+	if (tx.sta &&
- 	    wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
- 		bool ampdu = txq->ac != IEEE80211_AC_VO;
- 		u32 airtime;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/340-v5.19-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/340-v5.19-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch
deleted file mode 100644
index 82243f1..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/340-v5.19-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From aa40d5a43526cca9439a2b45fcfdcd016594dece Mon Sep 17 00:00:00 2001
-From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Date: Sun, 17 Jul 2022 21:21:52 +0900
-Subject: [PATCH] wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1],
-for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif
-that is being stopped") guards clear_bit() using fq.lock even before
-fq_init() from ieee80211_txq_setup_flows() initializes this spinlock.
-
-According to discussion [2], Toke was not happy with expanding usage of
-fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we
-can instead use synchronize_rcu() for flushing ieee80211_wake_txqs().
-
-Link: https://syzkaller.appspot.com/bug?extid=eceab52db7c4b961e9d6 [1]
-Link: https://lkml.kernel.org/r/874k0zowh2.fsf@toke.dk [2]
-Reported-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
-Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Fixes: f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
-Tested-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
-Acked-by: Toke Høiland-Jørgensen <toke@kernel.org>
-Signed-off-by: Kalle Valo <kvalo@kernel.org>
-Link: https://lore.kernel.org/r/9cc9b81d-75a3-3925-b612-9d0ad3cab82b@I-love.SAKURA.ne.jp
-[ pick up commit 3598cb6e1862 ("wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()") from -next]
-Link: https://lore.kernel.org/all/87o7xcq6qt.fsf@kernel.org/
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
----
- net/mac80211/iface.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -377,9 +377,8 @@ static void ieee80211_do_stop(struct iee
- 	bool cancel_scan;
- 	struct cfg80211_nan_func *func;
- 
--	spin_lock_bh(&local->fq.lock);
- 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
--	spin_unlock_bh(&local->fq.lock);
-+	synchronize_rcu(); /* flush _ieee80211_wake_txqs() */
- 
- 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
- 	if (cancel_scan)
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/341-v6.0-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/341-v6.0-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch
deleted file mode 100644
index 8c56acb..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/341-v6.0-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From: Alexander Wetzel <alexander@wetzel-home.de>
-Date: Thu, 15 Sep 2022 14:41:20 +0200
-Subject: [PATCH] mac80211: Fix deadlock: Don't start TX while holding
- fq->lock
-
-ieee80211_txq_purge() calls fq_tin_reset() and
-ieee80211_purge_tx_queue(); Both are then calling
-ieee80211_free_txskb(). Which can decide to TX the skb again.
-
-There are at least two ways to get a deadlock:
-
-1) When we have a TDLS teardown packet queued in either tin or frags
-   ieee80211_tdls_td_tx_handle() will call ieee80211_subif_start_xmit()
-   while we still hold fq->lock. ieee80211_txq_enqueue() will thus
-   deadlock.
-
-2) A variant of the above happens if aggregation is up and running:
-   In that case ieee80211_iface_work() will deadlock with the original
-   task: The original tasks already holds fq->lock and tries to get
-   sta->lock after kicking off ieee80211_iface_work(). But the worker
-   can get sta->lock prior to the original task and will then spin for
-   fq->lock.
-
-Avoid these deadlocks by not sending out any skbs when called via
-ieee80211_free_txskb().
-
-Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
----
-
---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -698,7 +698,7 @@ static void ieee80211_report_used_skb(st
- 
- 		if (!sdata) {
- 			skb->dev = NULL;
--		} else {
-+		} else if (!dropped) {
- 			unsigned int hdr_size =
- 				ieee80211_hdrlen(hdr->frame_control);
- 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/342-v6.0-mac80211-Ensure-vif-queues-are-operational-after-sta.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/342-v6.0-mac80211-Ensure-vif-queues-are-operational-after-sta.patch
deleted file mode 100644
index 4310329..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/342-v6.0-mac80211-Ensure-vif-queues-are-operational-after-sta.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From: Alexander Wetzel <alexander@wetzel-home.de>
-Date: Thu, 15 Sep 2022 15:09:46 +0200
-Subject: [PATCH] mac80211: Ensure vif queues are operational after start
-
-Make sure local->queue_stop_reasons and vif.txqs_stopped stay in sync.
-
-When a new vif is created the queues may end up in an inconsistent state
-and be inoperable:
-Communication not using iTXQ will work, allowing to e.g. complete the
-association. But the 4-way handshake will time out. The sta will not
-send out any skbs queued in iTXQs.
-
-All normal attempts to start the queues will fail when reaching this
-state.
-local->queue_stop_reasons will have marked all queues as operational but
-vif.txqs_stopped will still be set, creating an inconsistent internal
-state.
-
-In reality this seems to be race between the mac80211 function
-ieee80211_do_open() setting SDATA_STATE_RUNNING and the wake_txqs_tasklet:
-Depending on the driver and the timing the queues may end up to be
-operational or not.
-
-Cc: stable@vger.kernel.org
-Fixes: f856373e2f31 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
-Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
----
-
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -301,14 +301,14 @@ static void __ieee80211_wake_txqs(struct
- 	local_bh_disable();
- 	spin_lock(&fq->lock);
- 
-+	sdata->vif.txqs_stopped[ac] = false;
-+
- 	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
- 		goto out;
- 
- 	if (sdata->vif.type == NL80211_IFTYPE_AP)
- 		ps = &sdata->bss->ps;
- 
--	sdata->vif.txqs_stopped[ac] = false;
--
- 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
- 		if (sdata != sta->sdata)
- 			continue;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/343-v6.1-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/343-v6.1-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch
deleted file mode 100644
index 0246785..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/343-v6.1-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 28 Sep 2022 13:50:34 +0200
-Subject: [PATCH] wifi: mac80211: fix decap offload for stations on AP_VLAN
- interfaces
-
-Since AP_VLAN interfaces are not passed to the driver, check offload_flags
-on the bss vif instead.
-
-Reported-by: Howard Hsu <howard-yh.hsu@mediatek.com>
-Fixes: 80a915ec4427 ("mac80211: add rx decapsulation offload support")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -4267,6 +4267,7 @@ void ieee80211_check_fast_rx(struct sta_
- 		.vif_type = sdata->vif.type,
- 		.control_port_protocol = sdata->control_port_protocol,
- 	}, *old, *new = NULL;
-+	u32 offload_flags;
- 	bool set_offload = false;
- 	bool assign = false;
- 	bool offload;
-@@ -4382,10 +4383,10 @@ void ieee80211_check_fast_rx(struct sta_
- 	if (assign)
- 		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
- 
--	offload = assign &&
--		  (sdata->vif.offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED);
-+	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
-+	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
- 
--	if (offload)
-+	if (assign && offload)
- 		set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
- 	else
- 		set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/344-v6.1-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/344-v6.1-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch
deleted file mode 100644
index 161c7d6..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/344-v6.1-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 7 Oct 2022 10:54:47 +0200
-Subject: [PATCH] wifi: cfg80211: fix ieee80211_data_to_8023_exthdr
- handling of small packets
-
-STP topology change notification packets only have a payload of 7 bytes,
-so they get dropped due to the skb->len < hdrlen + 8 check.
-Fix this by removing skb->len based checks and instead check the return code
-on the skb_copy_bits calls.
-
-Fixes: 2d1c304cb2d5 ("cfg80211: add function for 802.3 conversion with separate output buffer")
-Reported-by: Chad Monroe <chad.monroe@smartrg.com>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -557,7 +557,7 @@ int ieee80211_data_to_8023_exthdr(struct
- 		return -1;
- 
- 	hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
--	if (skb->len < hdrlen + 8)
-+	if (skb->len < hdrlen)
- 		return -1;
- 
- 	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
-@@ -572,8 +572,9 @@ int ieee80211_data_to_8023_exthdr(struct
- 	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
- 	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
- 
--	if (iftype == NL80211_IFTYPE_MESH_POINT)
--		skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
-+	if (iftype == NL80211_IFTYPE_MESH_POINT &&
-+	    skb_copy_bits(skb, hdrlen, &mesh_flags, 1) < 0)
-+		return -1;
- 
- 	mesh_flags &= MESH_FLAGS_AE;
- 
-@@ -593,11 +594,12 @@ int ieee80211_data_to_8023_exthdr(struct
- 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
- 			if (mesh_flags == MESH_FLAGS_AE_A4)
- 				return -1;
--			if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
--				skb_copy_bits(skb, hdrlen +
--					offsetof(struct ieee80211s_hdr, eaddr1),
--					tmp.h_dest, 2 * ETH_ALEN);
--			}
-+			if (mesh_flags == MESH_FLAGS_AE_A5_A6 &&
-+			    skb_copy_bits(skb, hdrlen +
-+					  offsetof(struct ieee80211s_hdr, eaddr1),
-+					  tmp.h_dest, 2 * ETH_ALEN) < 0)
-+				return -1;
-+
- 			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
- 		}
- 		break;
-@@ -611,10 +613,11 @@ int ieee80211_data_to_8023_exthdr(struct
- 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
- 			if (mesh_flags == MESH_FLAGS_AE_A5_A6)
- 				return -1;
--			if (mesh_flags == MESH_FLAGS_AE_A4)
--				skb_copy_bits(skb, hdrlen +
--					offsetof(struct ieee80211s_hdr, eaddr1),
--					tmp.h_source, ETH_ALEN);
-+			if (mesh_flags == MESH_FLAGS_AE_A4 &&
-+			    skb_copy_bits(skb, hdrlen +
-+					  offsetof(struct ieee80211s_hdr, eaddr1),
-+					  tmp.h_source, ETH_ALEN) < 0)
-+				return -1;
- 			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
- 		}
- 		break;
-@@ -626,18 +629,18 @@ int ieee80211_data_to_8023_exthdr(struct
- 		break;
- 	}
- 
--	skb_copy_bits(skb, hdrlen, &payload, sizeof(payload));
--	tmp.h_proto = payload.proto;
--
--	if (likely((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
--		    tmp.h_proto != htons(ETH_P_AARP) &&
--		    tmp.h_proto != htons(ETH_P_IPX)) ||
--		   ether_addr_equal(payload.hdr, bridge_tunnel_header)))
-+	if (likely(skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
-+	           ((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
-+		     payload.proto != htons(ETH_P_AARP) &&
-+		     payload.proto != htons(ETH_P_IPX)) ||
-+		    ether_addr_equal(payload.hdr, bridge_tunnel_header)))) {
- 		/* remove RFC1042 or Bridge-Tunnel encapsulation and
- 		 * replace EtherType */
- 		hdrlen += ETH_ALEN + 2;
--	else
-+		tmp.h_proto = payload.proto;
-+	} else {
- 		tmp.h_proto = htons(skb->len - hdrlen);
-+	}
- 
- 	pskb_pull(skb, hdrlen);
- 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch
deleted file mode 100644
index 23047f6..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 7 Oct 2022 10:58:26 +0200
-Subject: [PATCH] wifi: mac80211: do not drop packets smaller than the
- LLC-SNAP header on fast-rx
-
-Since STP TCN frames are only 7 bytes, the pskb_may_pull call returns an error.
-Instead of dropping those packets, bump them back to the slow path for proper
-processing.
-
-Fixes: 49ddf8e6e234 ("mac80211: add fast-rx path")
-Reported-by: Chad Monroe <chad.monroe@smartrg.com>
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -4603,7 +4603,7 @@ static bool ieee80211_invoke_fast_rx(str
- 
- 	if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
- 		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
--			goto drop;
-+			return false;
- 
- 		payload = (void *)(skb->data + snap_offs);
- 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch
deleted file mode 100644
index 7185a7f..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Fri, 1 Jul 2022 19:06:11 +0530
-Subject: [PATCH] wifi: mac80211: fix mesh airtime link metric estimating
-
-ieee80211s_update_metric function uses sta_set_rate_info_tx
-function to get struct rate_info data from ieee80211_tx_rate
-struct, present in ieee80211_sta->deflink.tx_stats. However,
-drivers can skip tx rate calculation by setting rate idx as
--1. Such drivers provides rate_info directly and hence
-ieee80211s metric is updated incorrectly since ieee80211_tx_rate
-has inconsistent data.
-
-Add fix to use rate_info directly if present instead of
-sta_set_rate_info_tx for updating ieee80211s metric.
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Link: https://lore.kernel.org/r/20220701133611.544-1-quic_adisi@quicinc.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/mesh_hwmp.c
-+++ b/net/mac80211/mesh_hwmp.c
-@@ -310,7 +310,12 @@ void ieee80211s_update_metric(struct iee
- 			LINK_FAIL_THRESH)
- 		mesh_plink_broken(sta);
- 
--	sta_set_rate_info_tx(sta, &sta->tx_stats.last_rate, &rinfo);
-+	/* use rate info set by the driver directly if present */
-+	if (st->rate)
-+		rinfo = sta->tx_stats.last_rate_info;
-+	else
-+		sta_set_rate_info_tx(sta, &sta->tx_stats.last_rate, &rinfo);
-+
- 	ewma_mesh_tx_rate_avg_add(&sta->mesh->tx_rate_avg,
- 				  cfg80211_calculate_bitrate(&rinfo));
- }
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/363-v5.19-bss-color-collision.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/363-v5.19-bss-color-collision.patch
deleted file mode 100644
index edee4b3..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/363-v5.19-bss-color-collision.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From 6d945a33f2b0aa24fc210dadaa0af3e8218e7002 Mon Sep 17 00:00:00 2001
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Fri, 25 Mar 2022 11:42:41 +0100
-Subject: [PATCH] mac80211: introduce BSS color collision detection
-
-Add ieee80211_rx_check_bss_color_collision routine in order to introduce
-BSS color collision detection in mac80211 if it is not supported in HW/FW
-(e.g. for mt7915 chipset).
-Add IEEE80211_HW_DETECTS_COLOR_COLLISION flag to let the driver notify
-BSS color collision detection is supported in HW/FW. Set this for ath11k
-which apparently didn't need this code.
-
-Tested-by: Peter Chiu <Chui-Hao.Chiu@mediatek.com>
-Co-developed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://lore.kernel.org/r/a05eeeb1841a84560dc5aaec77894fcb69a54f27.1648204871.git.lorenzo@kernel.org
-[clarify commit message a bit, move flag to mac80211]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
- drivers/net/wireless/ath/ath11k/mac.c |  5 ++-
- include/net/mac80211.h                |  4 +++
- net/mac80211/debugfs.c                |  1 +
- net/mac80211/rx.c                     | 46 +++++++++++++++++++++++++++
- 4 files changed, 55 insertions(+), 1 deletion(-)
-
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -2418,6 +2418,9 @@ struct ieee80211_txq {
-  *	usage and 802.11 frames with %RX_FLAG_ONLY_MONITOR set for monitor to
-  *	the stack.
-  *
-+ * @IEEE80211_HW_DETECTS_COLOR_COLLISION: HW/driver has support for BSS color
-+ *	collision detection and doesn't need it in software.
-+ *
-  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
-  */
- enum ieee80211_hw_flags {
-@@ -2473,6 +2476,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD,
- 	IEEE80211_HW_SUPPORTS_RX_DECAP_OFFLOAD,
- 	IEEE80211_HW_SUPPORTS_CONC_MON_RX_DECAP,
-+	IEEE80211_HW_DETECTS_COLOR_COLLISION,
- 
- 	/* keep last, obviously */
- 	NUM_IEEE80211_HW_FLAGS
---- a/net/mac80211/debugfs.c
-+++ b/net/mac80211/debugfs.c
-@@ -494,6 +494,7 @@ static const char *hw_flag_names[] = {
- 	FLAG(SUPPORTS_TX_ENCAP_OFFLOAD),
- 	FLAG(SUPPORTS_RX_DECAP_OFFLOAD),
- 	FLAG(SUPPORTS_CONC_MON_RX_DECAP),
-+	FLAG(DETECTS_COLOR_COLLISION),
- #undef FLAG
- };
- 
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -3182,6 +3182,49 @@ static void ieee80211_process_sa_query_r
- 	ieee80211_tx_skb(sdata, skb);
- }
- 
-+static void
-+ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
-+{
-+	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
-+	const struct element *ie;
-+	size_t baselen;
-+
-+	if (!wiphy_ext_feature_isset(rx->local->hw.wiphy,
-+				     NL80211_EXT_FEATURE_BSS_COLOR))
-+		return;
-+
-+	if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
-+		return;
-+
-+	if (rx->sdata->vif.csa_active)
-+		return;
-+
-+	baselen = mgmt->u.beacon.variable - rx->skb->data;
-+	if (baselen > rx->skb->len)
-+		return;
-+
-+	ie = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION,
-+				    mgmt->u.beacon.variable,
-+				    rx->skb->len - baselen);
-+	if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
-+	    ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) {
-+		struct ieee80211_bss_conf *bss_conf = &rx->sdata->vif.bss_conf;
-+		const struct ieee80211_he_operation *he_oper;
-+		u8 color;
-+
-+		he_oper = (void *)(ie->data + 1);
-+		if (le32_get_bits(he_oper->he_oper_params,
-+				  IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
-+			return;
-+
-+		color = le32_get_bits(he_oper->he_oper_params,
-+				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
-+		if (color == bss_conf->he_bss_color.color)
-+			ieeee80211_obss_color_collision_notify(&rx->sdata->vif,
-+							       BIT_ULL(color));
-+	}
-+}
-+
- static ieee80211_rx_result debug_noinline
- ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
- {
-@@ -3207,6 +3250,9 @@ ieee80211_rx_h_mgmt_check(struct ieee802
- 	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
- 		int sig = 0;
- 
-+		/* sw bss color collision detection */
-+		ieee80211_rx_check_bss_color_collision(rx);
-+
- 		if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
- 		    !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
- 			sig = status->signal;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/400-allow-ibss-mixed.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/400-allow-ibss-mixed.patch
index f0f850d..c38fa13 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/400-allow-ibss-mixed.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/400-allow-ibss-mixed.patch
@@ -16,7 +16,7 @@
 
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
-@@ -625,21 +625,6 @@ static int wiphy_verify_combinations(str
+@@ -614,21 +614,6 @@ static int wiphy_verify_combinations(str
  				    c->limits[j].max > 1))
  				return -EINVAL;
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
index 962ae93..13b374a 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
@@ -1,6 +1,6 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3869,6 +3869,7 @@ struct mgmt_frame_regs {
+@@ -4081,6 +4081,7 @@ struct mgmt_frame_regs {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -8,7 +8,7 @@
   *
   * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
   *	functions to adjust rfkill hw state
-@@ -4202,6 +4203,7 @@ struct cfg80211_ops {
+@@ -4431,6 +4432,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
@@ -18,7 +18,7 @@
  
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1566,6 +1566,7 @@ enum ieee80211_smps_mode {
+@@ -1645,6 +1645,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1586,6 +1587,7 @@ enum ieee80211_smps_mode {
+@@ -1665,6 +1666,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -36,19 +36,19 @@
  	u8 ps_dtim_period;
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -2615,6 +2615,9 @@ enum nl80211_commands {
-  *	switching on a different channel during CAC detection on the selected
-  *	radar channel.
-  *
+@@ -2749,6 +2749,9 @@ enum nl80211_commands {
+  *	When used with %NL80211_CMD_FRAME_TX_STATUS, indicates the ack RX
+  *	timestamp. When used with %NL80211_CMD_FRAME RX notification, indicates
+  *	the incoming frame RX timestamp.
 + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce
 + *	transmit power to stay within regulatory limits. u32, dBi.
 + *
   * @NUM_NL80211_ATTR: total number of nl80211_attrs available
   * @NL80211_ATTR_MAX: highest attribute number currently defined
   * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3123,6 +3126,8 @@ enum nl80211_attrs {
- 
- 	NL80211_ATTR_RADAR_BACKGROUND,
+@@ -3277,6 +3280,8 @@ enum nl80211_attrs {
+ 	NL80211_ATTR_TX_HW_TIMESTAMP,
+ 	NL80211_ATTR_RX_HW_TIMESTAMP,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2812,6 +2812,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2998,6 +2998,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static void ieee80211_rfkill_poll(struct wiphy *wiphy)
  {
  	struct ieee80211_local *local = wiphy_priv(wiphy);
-@@ -4513,6 +4526,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -4881,6 +4894,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1447,6 +1447,7 @@ struct ieee80211_local {
+@@ -1521,6 +1521,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -119,7 +119,7 @@
  	if (local->hw.conf.power_level != power) {
  		changed |= IEEE80211_CONF_CHANGE_POWER;
  		local->hw.conf.power_level = power;
-@@ -679,6 +685,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -762,6 +768,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  					 IEEE80211_RADIOTAP_MCS_HAVE_BW;
  	local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
  					 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
@@ -129,15 +129,15 @@
  	local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -802,6 +802,7 @@ static const struct nla_policy nl80211_p
- 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
- 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
- 	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
+@@ -799,6 +799,7 @@ static const struct nla_policy nl80211_p
+ 	[NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
+ 	[NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -3391,6 +3392,22 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -3511,6 +3512,22 @@ static int nl80211_set_wiphy(struct sk_b
  		if (result)
  			goto out;
  	}
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/783-sync-nl80211.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/783-sync-nl80211.patch
deleted file mode 100644
index dc2b05b..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/783-sync-nl80211.patch
+++ /dev/null
@@ -1,22 +0,0 @@
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -6027,6 +6027,11 @@ enum nl80211_feature_flags {
-  * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision
-  *	detection and change announcemnts.
-  *
-+ * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD: Driver running in AP mode supports
-+ *	FILS encryption and decryption for (Re)Association Request and Response
-+ *	frames. Userspace has to share FILS AAD details to the driver by using
-+ *	@NL80211_CMD_SET_FILS_AAD.
-+ *
-  * @NL80211_EXT_FEATURE_RADAR_BACKGROUND: Device supports background radar/CAC
-  *	detection.
-  *
-@@ -6095,6 +6100,7 @@ enum nl80211_ext_feature_index {
- 	NL80211_EXT_FEATURE_SECURE_RTT,
- 	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE,
- 	NL80211_EXT_FEATURE_BSS_COLOR,
-+	NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD,
- 	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
- 
- 	/* add new features before the definition below */
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch
index a17d6f6..56cc523 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch
@@ -18,7 +18,7 @@
 
 --- a/net/mac80211/agg-rx.c
 +++ b/net/mac80211/agg-rx.c
-@@ -251,7 +251,11 @@ static void ieee80211_send_addba_resp(st
+@@ -254,7 +254,11 @@ static void ieee80211_send_addba_resp(st
  	mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
  	mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
index d26fe38..e9b5544 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch
@@ -1,7 +1,7 @@
-From 78275901240835e58b0f883065061f90c7fba310 Mon Sep 17 00:00:00 2001
+From ad3c58a67fd28755ae75ac995ae404eb5c6c21b0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 18 Jan 2022 20:29:44 +0800
-Subject: [PATCH 900/911] mac80211: mtk: do not setup twt when twt responder is
+Subject: [PATCH 900/908] mac80211: mtk: do not setup twt when twt responder is
  false
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index b991151..eb16838 100644
+index ba21e7c..02a0387 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -3283,6 +3283,9 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
+@@ -3298,6 +3298,9 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
  	if (sdata->vif.type != NL80211_IFTYPE_AP)
  		return false;
  
@@ -23,5 +23,5 @@
  		return false;
  
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
index 6702727..57d18b4 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch
@@ -1,7 +1,7 @@
-From fbe3cb1d42673c431f0f933620d0a1ec86a41113 Mon Sep 17 00:00:00 2001
+From 7b24c04be43656f0d305473119ba534a5720bc47 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 29 Mar 2022 16:06:30 +0800
-Subject: [PATCH 901/911] nl80211: mtk: extend CAC time for weather radar
+Subject: [PATCH 901/908] nl80211: mtk: extend CAC time for weather radar
  channels
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 7 insertions(+)
 
 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index bc6b5ac..3c6c1df 100644
+index 84bf9e8..d3b03ab 100644
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -9354,6 +9354,13 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
+@@ -9807,6 +9807,13 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
  	if (WARN_ON(!cac_time_ms))
  		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
  
@@ -26,7 +26,7 @@
 +
  	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
  	if (!err) {
- 		wdev->chandef = chandef;
+ 		wdev->links[0].ap.chandef = chandef;
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
index da34346..46a18f7 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch
@@ -1,7 +1,7 @@
-From 0bc1d2e42f5424d5f784d89a9e65cb9cac494269 Mon Sep 17 00:00:00 2001
+From e66fda08e681b11aa6a10bd7fd750d210cb22745 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 1 Apr 2022 09:15:21 +0800
-Subject: [PATCH 902/911] mac80211: mtk: it's invalid case when frag_threshold
+Subject: [PATCH 902/908] mac80211: mtk: it's invalid case when frag_threshold
  is greater than 2346
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index 3c6c1df..1292634 100644
+index d3b03ab..aa04e11 100644
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -3495,6 +3495,9 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
+@@ -3615,6 +3615,9 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
  			goto out;
  		}
  
@@ -24,5 +24,5 @@
  			/*
  			 * Fragments (apart from the last one) are required to
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/903-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
similarity index 77%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/903-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
index 68976b2..0f72cb9 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/903-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch
@@ -1,7 +1,7 @@
-From 9a01b1fb748c13c9b3e6b670de80d9e41909f917 Mon Sep 17 00:00:00 2001
+From 9556fba48d305893fa27e6f0765c1e7985ac734c Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 19 Oct 2022 13:42:43 +0800
-Subject: [PATCH 904/911] mac80211: mtk: airtime_flags depends on
+Subject: [PATCH 903/908] mac80211: mtk: airtime_flags depends on
  NL80211_EXT_FEATURE
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index 09e5bf1..8c005f1 100644
+index 83a1482..f6fb626 100644
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -721,8 +721,9 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+@@ -804,8 +804,9 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
  			IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
  		atomic_set(&local->aql_ac_pending_airtime[i], 0);
  	}
@@ -26,5 +26,5 @@
  	atomic_set(&local->aql_total_pending_airtime, 0);
  
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch
deleted file mode 100644
index d64a09b..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 82549ae647667d825f49e67b8f21fa39db67ec13 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
-Date: Mon, 7 Mar 2022 15:18:00 +0800
-Subject: [PATCH 903/911] mac80211: mtk: correct legacy rates check in
- ieee80211_calc_rx_airtime
-
-There are no legacy rates on 60GHz or sub-1Ghz band, so modify the check.
-
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
----
- net/mac80211/airtime.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/net/mac80211/airtime.c b/net/mac80211/airtime.c
-index 26d2f8b..c0e58eb 100644
---- a/net/mac80211/airtime.c
-+++ b/net/mac80211/airtime.c
-@@ -477,7 +477,9 @@ u32 ieee80211_calc_rx_airtime(struct ieee80211_hw *hw,
- 		bool sp = status->enc_flags & RX_ENC_FLAG_SHORTPRE;
- 		bool cck;
- 
--		if (WARN_ON_ONCE(status->band > NL80211_BAND_5GHZ))
-+		/* on 60GHz or sub-1Ghz band, there are no legacy rates */
-+		if (WARN_ON_ONCE(status->band == NL80211_BAND_60GHZ ||
-+				 status->band == NL80211_BAND_S1GHZ))
- 			return 0;
- 
- 		sband = hw->wiphy->bands[status->band];
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/904-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
similarity index 69%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/904-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
index 04614d9..cb7dbde 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/904-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch
@@ -1,7 +1,7 @@
-From 31e449f812b7ca3f4bdea98c63f2d98bc740a112 Mon Sep 17 00:00:00 2001
+From 2b41cfa0a72422f95b4c69be8141bb8579a87450 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 19 Oct 2022 13:45:42 +0800
-Subject: [PATCH 905/911] mac80211: mtk: add support for runtime set inband
+Subject: [PATCH 904/908] mac80211: mtk: add support for runtime set inband
  discovery
 
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
@@ -9,15 +9,15 @@
  include/net/cfg80211.h       |  1 +
  include/net/mac80211.h       |  1 +
  include/uapi/linux/nl80211.h |  1 +
- net/mac80211/cfg.c           | 32 +++++++++++++++++++++++++++++++-
+ net/mac80211/cfg.c           | 33 ++++++++++++++++++++++++++++++++-
  net/wireless/nl80211.c       | 31 +++++++++++++++++++++++++++----
- 5 files changed, 61 insertions(+), 5 deletions(-)
+ 5 files changed, 62 insertions(+), 5 deletions(-)
 
 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index 8e05f55..ae2af09 100644
+index 118cd40..9728bf8 100644
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -1158,6 +1158,7 @@ struct cfg80211_fils_discovery {
+@@ -1268,6 +1268,7 @@ struct cfg80211_fils_discovery {
  	u32 max_interval;
  	size_t tmpl_len;
  	const u8 *tmpl;
@@ -26,10 +26,10 @@
  
  /**
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 4d3cfb1..66fedf6 100644
+index 6b16d6c..4485cfa 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -505,6 +505,7 @@ struct ieee80211_ftm_responder_params {
+@@ -525,6 +525,7 @@ struct ieee80211_ftm_responder_params {
  struct ieee80211_fils_discovery {
  	u32 min_interval;
  	u32 max_interval;
@@ -38,10 +38,10 @@
  
  /**
 diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
-index 019f065..e674aa7 100644
+index ba4aa09..1293d30 100644
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -7242,6 +7242,7 @@ enum nl80211_fils_discovery_attributes {
+@@ -7504,6 +7504,7 @@ enum nl80211_fils_discovery_attributes {
  	NL80211_FILS_DISCOVERY_ATTR_INT_MIN,
  	NL80211_FILS_DISCOVERY_ATTR_INT_MAX,
  	NL80211_FILS_DISCOVERY_ATTR_TMPL,
@@ -50,33 +50,32 @@
  	/* keep last */
  	__NL80211_FILS_DISCOVERY_ATTR_LAST,
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index abe7318..bf71594 100644
+index c15e72d..cd5444e 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -906,6 +906,7 @@ static int ieee80211_set_fils_discovery(struct ieee80211_sub_if_data *sdata,
- 	fd = &sdata->vif.bss_conf.fils_discovery;
+@@ -983,6 +983,7 @@ static int ieee80211_set_fils_discovery(struct ieee80211_sub_if_data *sdata,
+ 	fd = &link_conf->fils_discovery;
  	fd->min_interval = params->min_interval;
  	fd->max_interval = params->max_interval;
 +	fd->disable = params->disable;
  
- 	old = sdata_dereference(sdata->u.ap.fils_discovery, sdata);
+ 	old = sdata_dereference(link->u.ap.fils_discovery, sdata);
  	new = kzalloc(sizeof(*new) + params->tmpl_len, GFP_KERNEL);
-@@ -1316,6 +1317,9 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
- {
- 	struct ieee80211_sub_if_data *sdata;
+@@ -1403,6 +1404,9 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	struct ieee80211_link_data *link;
  	struct beacon_data *old;
 +	struct cfg80211_ap_settings *ap_params;
 +	struct ieee80211_supported_band *sband;
 +	u32 changed;
  	int err;
+ 	struct ieee80211_bss_conf *link_conf;
  
- 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-@@ -1334,7 +1338,33 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
- 	err = ieee80211_assign_beacon(sdata, params, NULL, NULL);
- 	if (err < 0)
- 		return err;
--	ieee80211_bss_info_change_notify(sdata, err);
-+
+@@ -1434,7 +1438,34 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
+ 		err |= BSS_CHANGED_HE_BSS_COLOR;
+ 	}
+ 
+-	ieee80211_link_info_change_notify(sdata, link, err);
 +	changed = err;
 +
 +	sband = ieee80211_get_sband(sdata);
@@ -88,13 +87,15 @@
 +
 +		if(ap_params->unsol_bcast_probe_resp.interval) {
 +			err = ieee80211_set_unsol_bcast_probe_resp(sdata,
-+								   &ap_params->unsol_bcast_probe_resp);
++								   &ap_params->unsol_bcast_probe_resp,
++								   link, link_conf);
 +			if (err < 0)
 +				return err;
 +			changed |= BSS_CHANGED_UNSOL_BCAST_PROBE_RESP;
 +		} else {
 +			err = ieee80211_set_fils_discovery(sdata,
-+							   &ap_params->fils_discovery);
++							   &ap_params->fils_discovery,
++							   link, link_conf);
 +
 +			if (err < 0)
 +				return err;
@@ -107,18 +108,18 @@
  }
  
 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index 1292634..a20aba5 100644
+index aa04e11..202f802 100644
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -421,6 +421,7 @@ nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
- 	[NL80211_FILS_DISCOVERY_ATTR_TMPL] = { .type = NLA_BINARY,
- 					       .len = IEEE80211_MAX_DATA_LEN },
- #endif
+@@ -423,6 +423,7 @@ nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
+ 	[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
+ 	[NL80211_FILS_DISCOVERY_ATTR_TMPL] =
+ 			NLA_POLICY_BINARY_RANGE(NL80211_FILS_DISCOVERY_TMPL_MIN_LEN, IEEE80211_MAX_DATA_LEN),
 +	[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INTE] = NLA_POLICY_MAX(NLA_U32, 20),
  };
  
  static const struct nla_policy
-@@ -5364,6 +5365,8 @@ static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
+@@ -5603,6 +5604,8 @@ static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
  	fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
  	fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
  	fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
@@ -127,8 +128,8 @@
  
  	return 0;
  }
-@@ -5769,7 +5772,8 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
- 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
+@@ -6082,7 +6085,8 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
+ 	unsigned int link_id = nl80211_link_id(info->attrs);
  	struct net_device *dev = info->user_ptr[1];
  	struct wireless_dev *wdev = dev->ieee80211_ptr;
 -	struct cfg80211_beacon_data params;
@@ -137,8 +138,8 @@
  	int err;
  
  	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-@@ -5782,16 +5786,35 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
- 	if (!wdev->beacon_interval)
+@@ -6095,16 +6099,35 @@ static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
+ 	if (!wdev->links[link_id].ap.beacon_interval)
  		return -EINVAL;
  
 -	err = nl80211_parse_beacon(rdev, info->attrs, &params);
@@ -177,5 +178,5 @@
  }
  
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/908-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/905-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
similarity index 85%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/908-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/905-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
index 9fe63f2..86125b4 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/908-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/905-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch
@@ -1,7 +1,7 @@
-From 7f8cf0873db7d96ceba1dc30804ff16a86e81e6b Mon Sep 17 00:00:00 2001
+From deb128a1f5fba61b131394729373e51a7afd0ec6 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 19 Oct 2022 13:49:21 +0800
-Subject: [PATCH 908/911] mac80211: mtk: remove timerout handle for ax210 iot
+Subject: [PATCH 905/908] mac80211: mtk: remove timerout handle for ax210 iot
  issue
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
@@ -13,7 +13,7 @@
 diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
 old mode 100644
 new mode 100755
-index 1deb3d8..c30f02d
+index 07c892a..1f46561
 --- a/net/mac80211/agg-tx.c
 +++ b/net/mac80211/agg-tx.c
 @@ -568,10 +568,9 @@ static void sta_tx_agg_session_timer_expired(struct timer_list *t)
@@ -31,5 +31,5 @@
  	ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
  	       sta->sta.addr, tid);
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/909-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/906-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
similarity index 87%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/909-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/906-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
index b2c2cff..f1b0542 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/909-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/906-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch
@@ -1,38 +1,38 @@
-From 6d245b62cf147bb813898da2ccb43a14ae0fac5c Mon Sep 17 00:00:00 2001
+From e9dbde98d01f963121febafa51f6e7bb68bef135 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 22 Sep 2022 14:27:41 +0800
-Subject: [PATCH 909/911] cfg80211: mtk: implement DFS status show, cac and nop
+Subject: [PATCH 906/908] cfg80211: mtk: implement DFS status show, cac and nop
  skip command via debugfs
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  include/net/cfg80211.h  |   1 +
- net/mac80211/cfg.c      |  19 +++
+ net/mac80211/cfg.c      |  20 +++
  net/wireless/core.h     |   3 +
  net/wireless/debugfs.c  | 270 ++++++++++++++++++++++++++++++++++++++--
  net/wireless/mlme.c     |   6 +
  net/wireless/rdev-ops.h |  14 +++
  net/wireless/trace.h    |  12 ++
- 7 files changed, 318 insertions(+), 7 deletions(-)
+ 7 files changed, 319 insertions(+), 7 deletions(-)
 
 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index ae2af09..b97ddbd 100644
+index 9728bf8..f9c2cc3 100644
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -4401,6 +4401,7 @@ struct cfg80211_ops {
- 				struct cfg80211_color_change_settings *params);
- 	int	(*set_radar_background)(struct wiphy *wiphy,
- 					struct cfg80211_chan_def *chandef);
+@@ -4641,6 +4641,7 @@ struct cfg80211_ops {
+ 				    struct link_station_parameters *params);
+ 	int	(*del_link_station)(struct wiphy *wiphy, struct net_device *dev,
+ 				    struct link_station_del_parameters *params);
 +	void	(*skip_cac)(struct wireless_dev *wdev);
  };
  
  /*
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index bf71594..97c5e5d 100644
+index cd5444e..5718c56 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4504,6 +4504,24 @@ ieee80211_set_radar_background(struct wiphy *wiphy,
- 	return local->ops->set_radar_background(&local->hw, chandef);
+@@ -4870,6 +4870,25 @@ ieee80211_del_link_station(struct wiphy *wiphy, struct net_device *dev,
+ 	return ret;
  }
  
 +static void
@@ -40,15 +40,16 @@
 +{
 +	struct net_device *dev = wdev->netdev;
 +	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++	struct cfg80211_chan_def chandef = sdata->deflink.conf->chandef;
 +	unsigned int cac_time_ms;
 +
-+	cancel_delayed_work(&sdata->dfs_cac_timer_work);
++	cancel_delayed_work(&sdata->deflink.dfs_cac_timer_work);
 +	if (wdev->cac_started) {
-+		ieee80211_vif_release_channel(sdata);
++		ieee80211_link_release_channel(&sdata->deflink);
 +		cac_time_ms = wdev->cac_time_ms;
 +		wdev->cac_start_time = jiffies -
 +				       msecs_to_jiffies(cac_time_ms + 1);
-+		cfg80211_cac_event(wdev->netdev, &wdev->chandef,
++		cfg80211_cac_event(wdev->netdev, &chandef,
 +				   NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
 +	}
 +}
@@ -56,14 +57,14 @@
  const struct cfg80211_ops mac80211_config_ops = {
  	.add_virtual_intf = ieee80211_add_iface,
  	.del_virtual_intf = ieee80211_del_iface,
-@@ -4610,4 +4628,5 @@ const struct cfg80211_ops mac80211_config_ops = {
- 	.set_sar_specs = ieee80211_set_sar_specs,
- 	.color_change = ieee80211_color_change,
- 	.set_radar_background = ieee80211_set_radar_background,
+@@ -4981,4 +5000,5 @@ const struct cfg80211_ops mac80211_config_ops = {
+ 	.add_link_station = ieee80211_add_link_station,
+ 	.mod_link_station = ieee80211_mod_link_station,
+ 	.del_link_station = ieee80211_del_link_station,
 +	.skip_cac = ieee80211_skip_cac,
  };
 diff --git a/net/wireless/core.h b/net/wireless/core.h
-index b588e5a..10e8981 100644
+index f4d3b83..b1bc314 100644
 --- a/net/wireless/core.h
 +++ b/net/wireless/core.h
 @@ -86,6 +86,9 @@ struct cfg80211_registered_device {
@@ -77,7 +78,7 @@
  	struct work_struct background_cac_abort_wk;
  
 diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
-index 0878b16..ea50cc7 100644
+index 0878b16..e0fcb59 100644
 --- a/net/wireless/debugfs.c
 +++ b/net/wireless/debugfs.c
 @@ -9,6 +9,7 @@
@@ -141,7 +142,7 @@
 +				unsigned int buf_size, unsigned int offset)
 +{
 +	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
-+	struct cfg80211_chan_def *chandef = &wdev->chandef;
++	struct cfg80211_chan_def *chandef = &wdev->links[0].ap.chandef;
 +	struct cfg80211_chan_def *background_chandef = &rdev->background_radar_chandef;
 +	enum nl80211_band band;
 +	struct ieee80211_supported_band *sband;
@@ -170,7 +171,7 @@
 +				if (remain_time > wait_time_ms)
 +					remain_time = 0;
 +			} else if (chan->dfs_state == NL80211_DFS_USABLE) {
-+				if (wdev->cac_started && cfg80211_is_sub_chan(chandef, chan)) {
++				if (wdev->cac_started && cfg80211_is_sub_chan(chandef, chan, false)) {
 +					jiffies_passed = jiffies - wdev->cac_start_time;
 +					wait_time_ms = wdev->cac_time_ms;
 +					remain_time = (wait_time_ms -
@@ -179,7 +180,7 @@
 +
 +				if (rdev->background_radar_wdev == wdev &&
 +				    rdev->background_cac_started &&
-+				    cfg80211_is_sub_chan(background_chandef, chan)) {
++				    cfg80211_is_sub_chan(background_chandef, chan, false)) {
 +					jiffies_passed = jiffies - rdev->background_cac_start_time;
 +					wait_time_ms = rdev->background_cac_time_ms;
 +					remain_time = (wait_time_ms -
@@ -192,7 +193,7 @@
 +
 +			} else {
 +				if (rdev->background_radar_wdev == wdev &&
-+				    cfg80211_is_sub_chan(background_chandef, chan))
++				    cfg80211_is_sub_chan(background_chandef, chan, false))
 +					is_background = true;
 +			}
 +
@@ -311,8 +312,8 @@
 +		return 0;
 +
 +	list_for_each_entry(wdev, &wiphy->wdev_list, list) {
-+		if ((skip_mode & CAC_SKIP_MASK) && wdev->chandef.chan) {
-+			chandef = &wdev->chandef;
++		if ((skip_mode & CAC_SKIP_MASK) && wdev->links[0].ap.chandef.chan) {
++			chandef = &wdev->links[0].ap.chandef;
 +			chan = chandef->chan;
 +
 +			if ((chan->flags & IEEE80211_CHAN_RADAR) &&
@@ -368,10 +369,10 @@
 +	DEBUGFS_ADD(dfs_skip_cac, 0600);
  }
 diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
-index 00370ca..205c1bc 100644
+index 5a63dba..57b9bde 100644
 --- a/net/wireless/mlme.c
 +++ b/net/wireless/mlme.c
-@@ -998,13 +998,16 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
+@@ -1030,13 +1030,16 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
  		queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
  		cfg80211_sched_dfs_chan_update(rdev);
  		wdev = rdev->background_radar_wdev;
@@ -388,7 +389,7 @@
  		break;
  	default:
  		return;
-@@ -1024,6 +1027,7 @@ cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
+@@ -1056,6 +1059,7 @@ cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
  					chandef, event);
  	wiphy_unlock(&rdev->wiphy);
  }
@@ -396,7 +397,7 @@
  
  void cfg80211_background_cac_done_wk(struct work_struct *work)
  {
-@@ -1085,8 +1089,10 @@ cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rde
+@@ -1117,8 +1121,10 @@ cfg80211_start_background_radar_detection(struct cfg80211_registered_device *rde
  	if (!cac_time_ms)
  		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
  
@@ -408,10 +409,10 @@
  	__cfg80211_background_cac_event(rdev, wdev, chandef,
  					NL80211_RADAR_CAC_STARTED);
 diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
-index 8555468..26f4604 100644
+index ca29892..ce83152 100644
 --- a/net/wireless/rdev-ops.h
 +++ b/net/wireless/rdev-ops.h
-@@ -1398,4 +1398,18 @@ rdev_set_radar_background(struct cfg80211_registered_device *rdev,
+@@ -1494,4 +1494,18 @@ rdev_del_link_station(struct cfg80211_registered_device *rdev,
  	return ret;
  }
  
@@ -431,11 +432,11 @@
 +
  #endif /* __CFG80211_RDEV_OPS */
 diff --git a/net/wireless/trace.h b/net/wireless/trace.h
-index 97a2937..eadabfa 100644
+index 8e7c00f..d3a98e8 100644
 --- a/net/wireless/trace.h
 +++ b/net/wireless/trace.h
-@@ -3665,6 +3665,18 @@ TRACE_EVENT(rdev_set_radar_background,
- 		  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
+@@ -3901,6 +3901,18 @@ TRACE_EVENT(rdev_del_link_station,
+ 		  __entry->link_id)
  );
  
 +TRACE_EVENT(rdev_skip_cac,
@@ -454,5 +455,5 @@
  
  #undef TRACE_INCLUDE_PATH
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch
deleted file mode 100644
index 3e40887..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From ae2162e1fe69af7ecc0c0ab5e8c2411ed2d5e77b Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 8 Jun 2022 10:26:39 +0800
-Subject: [PATCH 906/911] mac80211: mtk: add s1g category to
- _ieee80211_is_robust_mgmt_frame
-
-Unprotected S1G with code 22 is not robust mgmt frame.
----
- include/linux/ieee80211.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
-index 00ed7c1..59de3dc 100644
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -3700,6 +3700,7 @@ static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
- 			*category != WLAN_CATEGORY_SELF_PROTECTED &&
- 			*category != WLAN_CATEGORY_UNPROT_DMG &&
- 			*category != WLAN_CATEGORY_VHT &&
-+			*category != WLAN_CATEGORY_S1G &&
- 			*category != WLAN_CATEGORY_VENDOR_SPECIFIC;
- 	}
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/910-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/907-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
similarity index 82%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/910-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/907-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
index 515ed03..6f5adfd 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/910-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/907-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch
@@ -1,7 +1,7 @@
-From e70aa68fef1e04812c3a3ba57ad1f525302accd7 Mon Sep 17 00:00:00 2001
+From 4781823ccaaca6cb075013aa8bbb2e733ddffb5f Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 4 Oct 2022 10:47:05 +0800
-Subject: [PATCH 910/911] mac80211: mtk: Set TWT Information Frame Disabled bit
+Subject: [PATCH 907/908] mac80211: mtk: Set TWT Information Frame Disabled bit
  as 1.
 
 This modification means that current implementation do not support twt information frame.
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/net/mac80211/s1g.c b/net/mac80211/s1g.c
-index 4141bc8..82da404 100644
+index c1f964e..d9d84db 100644
 --- a/net/mac80211/s1g.c
 +++ b/net/mac80211/s1g.c
 @@ -101,6 +101,7 @@ ieee80211_s1g_rx_twt_setup(struct ieee80211_sub_if_data *sdata,
@@ -22,5 +22,5 @@
  	/* broadcast TWT not supported yet */
  	if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) {
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/907-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/907-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch
deleted file mode 100644
index abf673b..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/907-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 59a306cfe40a251e8c5deaa30367aa56cfc81d4b Mon Sep 17 00:00:00 2001
-From: Lian Chen <lian.chen@mediatek.com>
-Date: Thu, 14 Jul 2022 16:33:58 +0800
-Subject: [PATCH 907/911] mac80211: mtk: make 4addr null frames using min_rate
- for WDS
-
-WDS needs 4addr packets to trigger AP for wlan0.sta creation.
-However, the 4addr null frame is sent at a high rate
-so that AP can't receive it.
-This PATCHES switches to use min_rate.
-
-Signed-off-by: Lian Chen <lian.chen@mediatek.com>
----
- net/mac80211/mlme.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index cc6d38a..f97bf2b 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -1133,6 +1133,7 @@ void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
- 	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
- 
- 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
- 	ieee80211_tx_skb(sdata, skb);
- }
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/911-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/908-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
similarity index 71%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/911-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/908-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
index 1199df9..fdb863e 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/911-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/908-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch
@@ -1,12 +1,12 @@
-From c3fa5e627f8c552852ee25ab366b4035c203aab3 Mon Sep 17 00:00:00 2001
+From 5fcae1d998339e7d0632c8ae5781232f9e6e4b14 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 5 Oct 2022 19:13:43 +0800
-Subject: [PATCH 911/911] mac80211: mtk: fix the issue of AP and STA starting
+Subject: [PATCH 908/908] mac80211: mtk: fix the issue of AP and STA starting
  on DFS channel concurrently
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- include/net/cfg80211.h       | 21 +++++++++++++++++
+ include/net/cfg80211.h       | 22 ++++++++++++++++++
  include/uapi/linux/nl80211.h |  2 +-
  net/mac80211/cfg.c           | 44 ++++++++++++++++++++++++++++++++++++
  net/mac80211/chan.c          |  2 +-
@@ -14,13 +14,13 @@
  net/wireless/nl80211.c       |  8 +++++++
  net/wireless/rdev-ops.h      | 16 +++++++++++++
  net/wireless/trace.h         | 15 ++++++++++++
- 8 files changed, 109 insertions(+), 5 deletions(-)
+ 8 files changed, 110 insertions(+), 5 deletions(-)
 
 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
-index b97ddbd..c4c0926 100644
+index f9c2cc3..84e769b 100644
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -800,6 +800,24 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
+@@ -888,6 +888,24 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
  		chandef1->center_freq2 == chandef2->center_freq2);
  }
  
@@ -45,28 +45,29 @@
  /**
   * cfg80211_chandef_is_edmg - check if chandef represents an EDMG channel
   *
-@@ -4402,6 +4420,8 @@ struct cfg80211_ops {
- 	int	(*set_radar_background)(struct wiphy *wiphy,
- 					struct cfg80211_chan_def *chandef);
+@@ -4642,6 +4660,8 @@ struct cfg80211_ops {
+ 	int	(*del_link_station)(struct wiphy *wiphy, struct net_device *dev,
+ 				    struct link_station_del_parameters *params);
  	void	(*skip_cac)(struct wireless_dev *wdev);
 +	void	(*check_cac_skip)(struct wiphy *wiphy,
 +				  struct cfg80211_chan_def *chandef);
  };
  
  /*
-@@ -5555,6 +5575,7 @@ struct wireless_dev {
- 	struct work_struct pmsr_free_wk;
- 
- 	unsigned long unprot_beacon_reported;
+@@ -5847,6 +5867,8 @@ struct wireless_dev {
+ 		};
+ 	} links[IEEE80211_MLD_MAX_NUM_LINKS];
+ 	u16 valid_links;
++
 +	bool start_disabled;
  };
  
- static inline u8 *wdev_address(struct wireless_dev *wdev)
+ static inline const u8 *wdev_address(struct wireless_dev *wdev)
 diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
-index e674aa7..ada8288 100644
+index 1293d30..db9d0a8 100644
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -3129,7 +3129,7 @@ enum nl80211_attrs {
+@@ -3283,7 +3283,7 @@ enum nl80211_attrs {
  	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
  
  	/* add attributes here, update the policy in nl80211.c */
@@ -76,10 +77,10 @@
  	NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
  	NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 97c5e5d..d726410 100644
+index 5718c56..9da02d9 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4522,6 +4522,49 @@ ieee80211_skip_cac(struct wireless_dev *wdev)
+@@ -4889,6 +4889,49 @@ ieee80211_skip_cac(struct wireless_dev *wdev)
  	}
  }
  
@@ -108,7 +109,7 @@
 +
 +		list_for_each_entry(s2, &local->interfaces, list) {
 +			wdev = &s2->wdev;
-+			chan = wdev->chandef.chan;
++			chan = wdev->links[0].ap.chandef.chan;
 +			if (chan) {
 +				if (!(chan->flags & IEEE80211_CHAN_RADAR))
 +					continue;
@@ -129,61 +130,64 @@
  const struct cfg80211_ops mac80211_config_ops = {
  	.add_virtual_intf = ieee80211_add_iface,
  	.del_virtual_intf = ieee80211_del_iface,
-@@ -4629,4 +4672,5 @@ const struct cfg80211_ops mac80211_config_ops = {
- 	.color_change = ieee80211_color_change,
- 	.set_radar_background = ieee80211_set_radar_background,
+@@ -5001,4 +5044,5 @@ const struct cfg80211_ops mac80211_config_ops = {
+ 	.mod_link_station = ieee80211_mod_link_station,
+ 	.del_link_station = ieee80211_del_link_station,
  	.skip_cac = ieee80211_skip_cac,
 +	.check_cac_skip = ieee80211_check_cac_skip,
  };
 diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
-index 63e15f5..5e57e4a 100644
+index e72cf07..94496d7 100644
 --- a/net/mac80211/chan.c
 +++ b/net/mac80211/chan.c
-@@ -505,7 +505,7 @@ bool ieee80211_is_radar_required(struct ieee80211_local *local)
+@@ -567,7 +567,7 @@ bool ieee80211_is_radar_required(struct ieee80211_local *local)
  
- 	rcu_read_lock();
- 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
--		if (sdata->radar_required) {
-+		if (sdata->radar_required && sdata->wdev.cac_started) {
- 			rcu_read_unlock();
- 			return true;
- 		}
+ 			link = rcu_dereference(sdata->link[link_id]);
+ 
+-			if (link && link->radar_required) {
++			if (link && link->radar_required && sdata->wdev.cac_started) {
+ 				rcu_read_unlock();
+ 				return true;
+ 			}
 diff --git a/net/wireless/chan.c b/net/wireless/chan.c
-index 5f50ac4..067ed79 100644
+index 29b5c2f..bf21f99 100644
 --- a/net/wireless/chan.c
 +++ b/net/wireless/chan.c
-@@ -664,13 +664,13 @@ bool cfg80211_beaconing_iface_active(struct wireless_dev *wdev)
- 	switch (wdev->iftype) {
+@@ -719,16 +719,16 @@ bool cfg80211_beaconing_iface_active(struct wireless_dev *wdev)
  	case NL80211_IFTYPE_AP:
  	case NL80211_IFTYPE_P2P_GO:
--		active = wdev->beacon_interval != 0;
-+		active = wdev->beacon_interval != 0 || wdev->start_disabled;
+ 		for_each_valid_link(wdev, link) {
+-			if (wdev->links[link].ap.beacon_interval)
++			if (wdev->links[link].ap.beacon_interval || wdev->start_disabled)
+ 				return true;
+ 		}
  		break;
  	case NL80211_IFTYPE_ADHOC:
--		active = wdev->ssid_len != 0;
-+		active = wdev->ssid_len != 0 || wdev->start_disabled;
+-		if (wdev->u.ibss.ssid_len)
++		if (wdev->u.ibss.ssid_len || wdev->start_disabled)
+ 			return true;
  		break;
  	case NL80211_IFTYPE_MESH_POINT:
--		active = wdev->mesh_id_len != 0;
-+		active = wdev->mesh_id_len != 0 || wdev->start_disabled;
+-		if (wdev->u.mesh.id_len)
++		if (wdev->u.mesh.id_len || wdev->start_disabled)
+ 			return true;
  		break;
  	case NL80211_IFTYPE_STATION:
- 	case NL80211_IFTYPE_OCB:
 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index a20aba5..8dc928d 100644
+index 202f802..7ce76e7 100644
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -803,6 +803,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+@@ -789,6 +789,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
  			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
  	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
  	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
 +	[NL80211_ATTR_START_DISABLED] = { .type = NLA_FLAG },
- 	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
- };
- 
-@@ -5547,6 +5548,12 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
- 
- 	memset(&params, 0, sizeof(params));
+ 	[NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
+ 	[NL80211_ATTR_EHT_CAPABILITY] =
+ 		NLA_POLICY_BINARY_RANGE(NL80211_EHT_MIN_CAPABILITY_LEN, NL80211_EHT_MAX_CAPABILITY_LEN),
+@@ -5803,6 +5804,12 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
+ 	if (wdev->links[link_id].ap.beacon_interval)
+ 		return -EALREADY;
  
 +	if (info->attrs[NL80211_ATTR_START_DISABLED]) {
 +		wdev->start_disabled = nla_get_flag(info->attrs[NL80211_ATTR_START_DISABLED]);
@@ -194,19 +198,19 @@
  	/* these are required for START_AP */
  	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
  	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
-@@ -9393,6 +9400,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
+@@ -9846,6 +9853,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
  		wdev->cac_started = true;
  		wdev->cac_start_time = jiffies;
  		wdev->cac_time_ms = cac_time_ms;
-+		err = rdev_check_cac_skip(rdev, &wdev->chandef);
++		err = rdev_check_cac_skip(rdev, &wdev->links[0].ap.chandef);
  	}
  unlock:
  	wiphy_unlock(wiphy);
 diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
-index 26f4604..c38aea1 100644
+index ce83152..ffa504a 100644
 --- a/net/wireless/rdev-ops.h
 +++ b/net/wireless/rdev-ops.h
-@@ -1412,4 +1412,20 @@ rdev_skip_cac(struct cfg80211_registered_device *rdev,
+@@ -1508,4 +1508,20 @@ rdev_skip_cac(struct cfg80211_registered_device *rdev,
  	return 0;
  }
  
@@ -228,10 +232,10 @@
 +
  #endif /* __CFG80211_RDEV_OPS */
 diff --git a/net/wireless/trace.h b/net/wireless/trace.h
-index eadabfa..a7b0c82 100644
+index d3a98e8..72c8f0e 100644
 --- a/net/wireless/trace.h
 +++ b/net/wireless/trace.h
-@@ -3677,6 +3677,21 @@ TRACE_EVENT(rdev_skip_cac,
+@@ -3913,6 +3913,21 @@ TRACE_EVENT(rdev_skip_cac,
  	    TP_printk(WDEV_PR_FMT, WDEV_PR_ARG)
  );
  
@@ -254,5 +258,5 @@
  
  #undef TRACE_INCLUDE_PATH
 -- 
-2.36.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99900-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99900-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch
new file mode 100644
index 0000000..8ffd6f5
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99900-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch
@@ -0,0 +1,158 @@
+From 447d620689b705b1e6e382a8bae59930e74e257c Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Wed, 18 May 2022 15:10:22 +0800
+Subject: [PATCH 99900/99901] mac80211: mtk: add fill receive path ops to get
+ wed idx
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ include/net/mac80211.h    | 15 +++++++++++++--
+ net/mac80211/driver-ops.h | 13 +++++++++++++
+ net/mac80211/iface.c      | 24 ++++++++++++++++++++++++
+ net/mac80211/util.c       |  9 +++++++++
+ 4 files changed, 59 insertions(+), 2 deletions(-)
+ mode change 100644 => 100755 net/mac80211/util.c
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 4485cfa..fe686a4 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1354,7 +1354,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
+  * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
+  * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
+  *	(&struct ieee80211_radiotap_he, mac80211 will fill in
+- *	
++ *
+  *	 - DATA3_DATA_MCS
+  *	 - DATA3_DATA_DCM
+  *	 - DATA3_CODING
+@@ -1362,7 +1362,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
+  *	 - DATA5_DATA_BW_RU_ALLOC
+  *	 - DATA6_NSTS
+  *	 - DATA3_STBC
+- *	
++ *
+  *	from the RX info data, so leave those zeroed when building this data)
+  * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
+  *	(&struct ieee80211_radiotap_he_mu)
+@@ -1911,6 +1911,12 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
+  */
+ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif);
+ 
++/**
++ * ieee80211_vif_to_wdev - return a net_device struct from a vif
++ * @vif: the vif to get the net_device for
++ */
++struct net_device *ieee80211_vif_to_netdev(struct ieee80211_vif *vif);
++
+ /**
+  * lockdep_vif_mutex_held - for lockdep checks on link poiners
+  * @vif: the interface to check
+@@ -4173,6 +4179,8 @@ struct ieee80211_prep_tx_info {
+  *	Note that a sta can also be inserted or removed with valid links,
+  *	i.e. passed to @sta_add/@sta_state with sta->valid_links not zero.
+  *	In fact, cannot change from having valid_links and not having them.
++ * @net_fill_receive_path: Called from .ndo_fill_receive_path in order to
++ *	get a path for hardware flow offloading
+  */
+ struct ieee80211_ops {
+ 	void (*tx)(struct ieee80211_hw *hw,
+@@ -4528,6 +4536,9 @@ struct ieee80211_ops {
+ 				struct ieee80211_vif *vif,
+ 				struct ieee80211_sta *sta,
+ 				u16 old_links, u16 new_links);
++	int (*net_fill_receive_path)(struct ieee80211_hw *hw,
++				     struct net_device_path_ctx *ctx,
++				     struct net_device_path *path);
+ };
+ 
+ /**
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index 3d16b09..bbecd2e 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1479,4 +1479,17 @@ int drv_change_sta_links(struct ieee80211_local *local,
+ 			 struct ieee80211_sta *sta,
+ 			 u16 old_links, u16 new_links);
+ 
++static inline int drv_net_fill_receive_path(struct ieee80211_local *local,
++					    struct net_device_path_ctx *ctx,
++					    struct net_device_path *path)
++{
++	int ret = -EOPNOTSUPP;
++
++	if (local->ops->net_fill_receive_path)
++		ret = local->ops->net_fill_receive_path(&local->hw,
++							ctx, path);
++
++	return ret;
++}
++
+ #endif /* __MAC80211_DRIVER_OPS */
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 674b749..af8d96b 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -918,6 +918,29 @@ out:
+ 	return ret;
+ }
+ 
++static int ieee80211_netdev_fill_receive_path(struct net_device_path_ctx *ctx,
++					      struct net_device_path *path)
++{
++	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_local *local;
++	int ret = -ENOENT;
++
++	sdata = IEEE80211_DEV_TO_SUB_IF(ctx->dev);
++	local = sdata->local;
++
++	if (!local->ops->net_fill_receive_path)
++		return -EOPNOTSUPP;
++
++	rcu_read_lock();
++
++	ret = drv_net_fill_receive_path(local, ctx, path);
++
++	rcu_read_unlock();
++
++	return ret;
++}
++
++
+ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ 	.ndo_open		= ieee80211_open,
+ 	.ndo_stop		= ieee80211_stop,
+@@ -927,6 +950,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ 	.ndo_set_mac_address	= ieee80211_change_mac,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
++	.ndo_fill_receive_path = ieee80211_netdev_fill_receive_path,
+ };
+ 
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+old mode 100644
+new mode 100755
+index 005a730..189ab8a
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -914,6 +914,15 @@ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
+ }
+ EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
+ 
++struct net_device *ieee80211_vif_to_netdev(struct ieee80211_vif *vif)
++{
++	if (!vif)
++		return NULL;
++
++	return vif_to_sdata(vif)->dev;
++}
++EXPORT_SYMBOL_GPL(ieee80211_vif_to_netdev);
++
+ /*
+  * Nothing should have been stuffed into the workqueue during
+  * the suspend->resume cycle. Since we can't check each caller
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch
deleted file mode 100644
index a2d862c..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From d364b3a664a76fdb9b0e95e84e092d41d4f2ddd5 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 11 Mar 2022 11:34:11 +0800
-Subject: [PATCH 99900/99901] mac80211: mtk: mask kernel version limitation and
- fill forward path in kernel 5.4
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- include/net/mac80211.h    | 2 --
- net/mac80211/driver-ops.h | 2 --
- net/mac80211/iface.c      | 4 ----
- net/mac80211/trace.h      | 2 --
- 4 files changed, 10 deletions(-)
-
-diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index 66fedf6..95e5e66 100644
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4292,13 +4292,11 @@ struct ieee80211_ops {
- 				     struct ieee80211_sta *sta, u8 flowid);
- 	int (*set_radar_background)(struct ieee80211_hw *hw,
- 				    struct cfg80211_chan_def *chandef);
--#if LINUX_VERSION_IS_GEQ(5,10,0)
- 	int (*net_fill_forward_path)(struct ieee80211_hw *hw,
- 				     struct ieee80211_vif *vif,
- 				     struct ieee80211_sta *sta,
- 				     struct net_device_path_ctx *ctx,
- 				     struct net_device_path *path);
--#endif
- };
- 
- /**
-diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
-index 2df420b..d2b68ef 100644
---- a/net/mac80211/driver-ops.h
-+++ b/net/mac80211/driver-ops.h
-@@ -1486,7 +1486,6 @@ static inline void drv_twt_teardown_request(struct ieee80211_local *local,
- 	trace_drv_return_void(local);
- }
- 
--#if LINUX_VERSION_IS_GEQ(5,10,0)
- static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
- 					    struct ieee80211_sub_if_data *sdata,
- 					    struct ieee80211_sta *sta,
-@@ -1508,6 +1507,5 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
- 
- 	return ret;
- }
--#endif
- 
- #endif /* __MAC80211_DRIVER_OPS */
-diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 717dfda..455791f 100644
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -852,7 +852,6 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
- 
- };
- 
--#if LINUX_VERSION_IS_GEQ(5,10,0)
- static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,
- 					      struct net_device_path *path)
- {
-@@ -910,7 +909,6 @@ out:
- 
- 	return ret;
- }
--#endif
- 
- static const struct net_device_ops ieee80211_dataif_8023_ops = {
- #if LINUX_VERSION_IS_LESS(4,10,0)
-@@ -929,9 +927,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
- #else
- 	.ndo_get_stats64 = bp_ieee80211_get_stats64,
- #endif
--#if LINUX_VERSION_IS_GEQ(5,10,0)
- 	.ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
--#endif
- };
- 
- static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
-diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
-index bbda9e9..d91498f 100644
---- a/net/mac80211/trace.h
-+++ b/net/mac80211/trace.h
-@@ -2892,14 +2892,12 @@ TRACE_EVENT(drv_twt_teardown_request,
- 	)
- );
- 
--#if LINUX_VERSION_IS_GEQ(5,10,0)
- DEFINE_EVENT(sta_event, drv_net_fill_forward_path,
- 	TP_PROTO(struct ieee80211_local *local,
- 		 struct ieee80211_sub_if_data *sdata,
- 		 struct ieee80211_sta *sta),
- 	TP_ARGS(local, sdata, sta)
- );
--#endif
- 
- #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99901-fix-build-failed.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99901-fix-build-failed.patch
new file mode 100644
index 0000000..6731827
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99901-fix-build-failed.patch
@@ -0,0 +1,97 @@
+From 58619705cdbd28520ddf730eba94c3f5dfca04dc Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 12 Dec 2022 15:08:10 +0800
+Subject: [PATCH 99901/99901] fix build failed
+
+---
+ include/linux/ieee80211.h          | 8 +++-----
+ net/mac80211/rc80211_minstrel_ht.c | 2 ++
+ net/mac80211/wpa.c                 | 4 ++--
+ net/wireless/nl80211.c             | 4 ++++
+ 4 files changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 7969093..6f70394 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -310,11 +310,9 @@ static inline u16 ieee80211_sn_sub(u16 sn1, u16 sn2)
+ struct ieee80211_hdr {
+ 	__le16 frame_control;
+ 	__le16 duration_id;
+-	struct_group(addrs,
+-		u8 addr1[ETH_ALEN];
+-		u8 addr2[ETH_ALEN];
+-		u8 addr3[ETH_ALEN];
+-	);
++	u8 addr1[ETH_ALEN];
++	u8 addr2[ETH_ALEN];
++	u8 addr3[ETH_ALEN];
+ 	__le16 seq_ctrl;
+ 	u8 addr4[ETH_ALEN];
+ } __packed __aligned(2);
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 33001ec..277fec9 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -10,7 +10,9 @@
+ #include <linux/random.h>
+ #include <linux/moduleparam.h>
+ #include <linux/ieee80211.h>
++#if LINUX_VERSION_IS_GEQ(5,10,0)
+ #include <linux/minmax.h>
++#endif
+ #include <net/mac80211.h>
+ #include "rate.h"
+ #include "sta_info.h"
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index 20f742b..93ec2f3 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -351,7 +351,7 @@ static u8 ccmp_gcmp_aad(struct sk_buff *skb, u8 *aad)
+ 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
+ 	put_unaligned_be16(len_a, &aad[0]);
+ 	put_unaligned(mask_fc, (__le16 *)&aad[2]);
+-	memcpy(&aad[4], &hdr->addrs, 3 * ETH_ALEN);
++	memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
+ 
+ 	/* Mask Seq#, leave Frag# */
+ 	aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
+@@ -792,7 +792,7 @@ static void bip_aad(struct sk_buff *skb, u8 *aad)
+ 				IEEE80211_FCTL_MOREDATA);
+ 	put_unaligned(mask_fc, (__le16 *) &aad[0]);
+ 	/* A1 || A2 || A3 */
+-	memcpy(aad + 2, &hdr->addrs, 3 * ETH_ALEN);
++	memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN);
+ }
+ 
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 7ce76e7..d6f836d 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -16449,9 +16449,11 @@ static const struct genl_ops nl80211_ops[] = {
+ 		/* can be retrieved by unprivileged users */
+ 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
+ 	},
++#if LINUX_VERSION_IS_GEQ(5,10,0)
+ };
+ 
+ static const struct genl_small_ops nl80211_small_ops[] = {
++#endif
+ 	{
+ 		.cmd = NL80211_CMD_SET_WIPHY,
+ 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+@@ -17288,8 +17290,10 @@ static struct genl_family nl80211_fam __genl_ro_after_init = {
+ 	.module = THIS_MODULE,
+ 	.ops = nl80211_ops,
+ 	.n_ops = ARRAY_SIZE(nl80211_ops),
++#if LINUX_VERSION_IS_GEQ(5,10,0)
+ 	.small_ops = nl80211_small_ops,
+ 	.n_small_ops = ARRAY_SIZE(nl80211_small_ops),
++#endif
+ #if LINUX_VERSION_IS_GEQ(6,1,0)
+ 	.resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
+ #endif
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch
deleted file mode 100644
index 6d58e48..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From f1d42518adad5791f668a46d3cad3a5efc5f0a30 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Wed, 18 May 2022 15:10:22 +0800
-Subject: [PATCH 99901/99901] mac80211: mtk: add fill receive path ops to get
- wed idx
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- include/net/mac80211.h    | 12 ++++++++++++
- net/mac80211/driver-ops.h | 13 +++++++++++++
- net/mac80211/iface.c      | 24 ++++++++++++++++++++++++
- net/mac80211/util.c       |  9 +++++++++
- 4 files changed, 58 insertions(+)
- mode change 100644 => 100755 include/net/mac80211.h
- mode change 100644 => 100755 net/mac80211/util.c
-
-diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-old mode 100644
-new mode 100755
-index 95e5e66..9a38b9f
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -1796,6 +1796,13 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
-  */
- struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif);
- 
-+/**
-+ * ieee80211_vif_to_wdev - return a net_device struct from a vif
-+ * @vif: the vif to get the net_device for
-+ */
-+struct net_device *ieee80211_vif_to_netdev(struct ieee80211_vif *vif);
-+
-+
- /**
-  * enum ieee80211_key_flags - key flags
-  *
-@@ -3962,6 +3969,8 @@ struct ieee80211_prep_tx_info {
-  *	disable background CAC/radar detection.
-  * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
-  *	resolve a path for hardware flow offloading
-+ * @net_fill_receive_path: Called from .ndo_fill_receive_path in order to
-+ *	get a path for hardware flow offloading
-  */
- struct ieee80211_ops {
- 	void (*tx)(struct ieee80211_hw *hw,
-@@ -4297,6 +4306,9 @@ struct ieee80211_ops {
- 				     struct ieee80211_sta *sta,
- 				     struct net_device_path_ctx *ctx,
- 				     struct net_device_path *path);
-+	int (*net_fill_receive_path)(struct ieee80211_hw *hw,
-+				     struct net_device_path_ctx *ctx,
-+				     struct net_device_path *path);
- };
- 
- /**
-diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
-index d2b68ef..27da75e 100644
---- a/net/mac80211/driver-ops.h
-+++ b/net/mac80211/driver-ops.h
-@@ -1508,4 +1508,17 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
- 	return ret;
- }
- 
-+static inline int drv_net_fill_receive_path(struct ieee80211_local *local,
-+					    struct net_device_path_ctx *ctx,
-+					    struct net_device_path *path)
-+{
-+	int ret = -EOPNOTSUPP;
-+
-+	if (local->ops->net_fill_receive_path)
-+		ret = local->ops->net_fill_receive_path(&local->hw,
-+							ctx, path);
-+
-+	return ret;
-+}
-+
- #endif /* __MAC80211_DRIVER_OPS */
-diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 455791f..98b2369 100644
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -910,6 +910,29 @@ out:
- 	return ret;
- }
- 
-+static int ieee80211_netdev_fill_receive_path(struct net_device_path_ctx *ctx,
-+					      struct net_device_path *path)
-+{
-+	struct ieee80211_sub_if_data *sdata;
-+	struct ieee80211_local *local;
-+	int ret = -ENOENT;
-+
-+	sdata = IEEE80211_DEV_TO_SUB_IF(ctx->dev);
-+	local = sdata->local;
-+
-+	if (!local->ops->net_fill_receive_path)
-+		return -EOPNOTSUPP;
-+
-+	rcu_read_lock();
-+
-+	ret = drv_net_fill_receive_path(local, ctx, path);
-+
-+	rcu_read_unlock();
-+
-+	return ret;
-+}
-+
-+
- static const struct net_device_ops ieee80211_dataif_8023_ops = {
- #if LINUX_VERSION_IS_LESS(4,10,0)
- 	.ndo_change_mtu = __change_mtu,
-@@ -928,6 +951,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
- 	.ndo_get_stats64 = bp_ieee80211_get_stats64,
- #endif
- 	.ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
-+	.ndo_fill_receive_path = ieee80211_netdev_fill_receive_path,
- };
- 
- static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
-diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-old mode 100644
-new mode 100755
-index 8d36b05..d26a2b8
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -898,6 +898,15 @@ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
- }
- EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
- 
-+struct net_device *ieee80211_vif_to_netdev(struct ieee80211_vif *vif)
-+{
-+	if (!vif)
-+		return NULL;
-+
-+	return vif_to_sdata(vif)->dev;
-+}
-+EXPORT_SYMBOL_GPL(ieee80211_vif_to_netdev);
-+
- /*
-  * Nothing should have been stuffed into the workqueue during
-  * the suspend->resume cycle. Since we can't check each caller
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
index 355e6bd..ba3c731 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -2,65 +2,30 @@
 SRC_URI_append = " \
     file://110-mac80211_keep_keys_on_stop_ap.patch \
     file://120-cfg80211_allow_perm_addr_change.patch \
-    file://150-disable_addr_notifier.patch \
     file://210-ap_scan.patch \
     file://301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch \
-    file://303-v5.16-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch \
-    file://306-v5.17-mac80211-use-coarse-boottime-for-airtime-fairness-co.patch \
-    file://307-mac80211_hwsim-make-6-GHz-channels-usable.patch \
-    file://308-v5.17-mac80211-add-support-for-.ndo_fill_forward_path.patch \
-    file://309-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch \
-    file://310-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch \
-    file://311-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch \
-    file://312-v5.16-mac80211-split-beacon-retrieval-functions.patch \
-    file://313-v5.16-nl80211-MBSSID-and-EMA-support-in-AP-mode.patch \
-    file://314-v5.17-cfg80211-implement-APIs-for-dedicated-radar-detectio.patch \
-    file://315-v5.17-cfg80211-move-offchan_cac_event-to-a-dedicated-work.patch \
-    file://316-v5.17-cfg80211-fix-possible-NULL-pointer-dereference-in-cf.patch \
-    file://317-v5.17-cfg80211-schedule-offchan_cac_abort_wk-in-cfg80211_r.patch \
-    file://318-v5.17-cfg80211-allow-continuous-radar-monitoring-on-offcha.patch \
-    file://319-v5.17-mac80211-introduce-set_radar_offchan-callback.patch \
-    file://320-v5.17-cfg80211-rename-offchannel_chain-structs-to-backgrou.patch \
-    file://323-v5.16-mac80211-MBSSID-support-in-interface-handling.patch \
-    file://324-v5.18-mac80211-MBSSID-beacon-handling-in-AP-mode.patch \
-    file://325-v5.18-mac80211-MBSSID-channel-switch.patch \
-    file://326-v5.18-mac80211-update-bssid_indicator-in-ieee80211_assign_.patch \
-    file://328-v5.19-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch \
-    file://330-v6.0-mac80211-switch-airtime-fairness-back-to-deficit-rou.patch \
-    file://331-v6.0-mac80211-make-sta-airtime-deficit-field-s32-instead-.patch \
-    file://332-v6.0-mac80211-consider-aql_tx_pending-when-checking-airti.patch \
-    file://333-v6.0-mac80211-keep-recently-active-tx-queues-in-schedulin.patch \
-    file://334-v6.0-mac80211-add-a-per-PHY-AQL-limit-to-improve-fairness.patch \
-    file://335-v6.0-mac80211-add-debugfs-file-to-display-per-phy-AQL-pen.patch \
-    file://336-v6.0-mac80211-only-accumulate-airtime-deficit-for-active-.patch \
-    file://337-mac80211-increase-quantum-for-airtime-scheduler.patch \
-    file://339-v6.0-mac80211-exclude-multicast-packets-from-AQL-pending-.patch \
-    file://340-v5.19-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch \
-    file://341-v6.0-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch \
-    file://342-v6.0-mac80211-Ensure-vif-queues-are-operational-after-sta.patch \
-    file://343-v6.1-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch \
-    file://344-v6.1-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch \
-    file://345-v6.1-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch \
-    file://346-v6.0-wifi-mac80211-fix-mesh-airtime-link-metric-estimatin.patch \
-    file://363-v5.19-bss-color-collision.patch \
-    file://364-mac80211-add-support-for-restricting-netdev-features.patch \
+    file://302-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch \
+    file://303-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch \
+    file://304-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch \
+    file://305-mac80211-increase-quantum-for-airtime-scheduler.patch \
+    file://306-01-wifi-mac80211-add-internal-handler-for-wake_tx_queue.patch \
+    file://306-02-wifi-mac80211-add-wake_tx_queue-callback-to-drivers.patch \
+    file://306-03-wifi-mac80211-Drop-support-for-TX-push-path.patch \
+    file://306-04-wifi-realtek-remove-duplicated-wake_tx_queue.patch \
+    file://310-mac80211-add-support-for-restricting-netdev-features.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
-    file://783-sync-nl80211.patch \
     file://800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch \
     file://900-mac80211-mtk-do-not-setup-twt-when-twt-responder-is-.patch \
     file://901-nl80211-mtk-extend-CAC-time-for-weather-radar-channe.patch \
     file://902-mac80211-mtk-it-s-invalid-case-when-frag_threshold-i.patch \
-    file://903-mac80211-mtk-correct-legacy-rates-check-in-ieee80211.patch \
-    file://904-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch \
-    file://905-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch \
-    file://906-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robus.patch \
-    file://907-mac80211-mtk-make-4addr-null-frames-using-min_rate-f.patch \
-    file://908-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch \
-    file://909-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
-    file://910-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
-    file://911-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch \
-    file://99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch \
-    file://99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch \
+    file://903-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FE.patch \
+    file://904-mac80211-mtk-add-support-for-runtime-set-inband-disc.patch \
+    file://905-mac80211-mtk-remove-timerout-handle-for-ax210-iot-is.patch \
+    file://906-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-s.patch \
+    file://907-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-.patch \
+    file://908-mac80211-mtk-fix-the-issue-of-AP-and-STA-starting-on.patch \
+    file://99900-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch \
+    file://99901-fix-build-failed.patch \
     "
diff --git a/recipes-wifi/linux-mac80211/linux-mac80211_6.%.bb b/recipes-wifi/linux-mac80211/linux-mac80211_6.%.bb
index 2d0fec2..895269c 100644
--- a/recipes-wifi/linux-mac80211/linux-mac80211_6.%.bb
+++ b/recipes-wifi/linux-mac80211/linux-mac80211_6.%.bb
@@ -6,14 +6,14 @@
 
 inherit module
 
-PV = "6.1-rc7"
+PV = "6.1-rc8"
 
 SRC_URI = " \
-    https://cdn.kernel.org/pub/linux/kernel/projects/backports/stable/v${PV}/backports-${PV}-1.tar.xz \
+    http://mirror2.openwrt.org/sources/backports-${PV}.tar.xz \
     file://config \
     file://0001-rdkb-fix_build_issue-mac80211-without_depmod.patch;apply=no \
     "
-SRC_URI[sha256sum] = "5227d3c35ccebacfaee6b8180b3a87b9910f3c94ee768ebc5c0fef3c86b6146d"
+SRC_URI[sha256sum] = "7f3d96c2573183cd79d6a3ebe5e1b7b73c19d1326d443c85b69c4181f14e6e2b"
 
 DEPENDS += "virtual/kernel"
 DEPENDS += "bison-native coreutils-native flex-native"
@@ -27,7 +27,7 @@
 SRC_URI_remove = "${@bb.utils.contains('DISTRO_FEATURES', 'flow_offload', '', 'file://99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch', d)}"
 SRC_URI_remove = "${@bb.utils.contains('DISTRO_FEATURES', 'flow_offload', '', 'file://99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch', d)}"
 
-S = "${WORKDIR}/backports-${PV}-1"
+S = "${WORKDIR}/backports-${PV}"
 
 do_filogic_patches() {
     cd ${S}
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0000-mt76-sync-to-master-lastest-commit.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0000-mt76-sync-to-master-lastest-commit.patch
deleted file mode 100644
index dc307c3..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0000-mt76-sync-to-master-lastest-commit.patch
+++ /dev/null
@@ -1,3283 +0,0 @@
-From fd9a307422024d5c6e953634129cc2b61425e93f Mon Sep 17 00:00:00 2001
-From: Ryder Lee <ryder.lee@mediatek.com>
-Date: Mon, 14 Nov 2022 10:17:47 +0800
-Subject: [PATCH] mt76: sync to master lastest commit
-
-wifi: mt76: mt7915: fix uninitialized irq_mask
-wifi: mt76: mt7921: introduce remain_on_channel support
-wifi: mt76: connac: rework macros for unified command
-wifi: mt76: connac: update struct sta_rec_phy
-wifi: mt76: connac: rework fields for larger bandwidth support in sta_rec_bf
-wifi: mt76: connac: add more unified command IDs
-wifi: mt76: connac: introduce unified event table
-wifi: mt76: connac: add more bss info command tags
-wifi: mt76: connac: add more starec command tags
-wifi: mt76: connac: introduce helper for mt7996 chipset
-wifi: mt76: mt7921: fix wrong power after multiple SAR set
-wifi: mt76: mt7915: add missing MODULE_PARM_DESC
-wifi: mt76: mt7915: add support to configure spatial reuse parameter set
-wifi: mt76: introduce rxwi and rx token utility routines
-wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf
-wifi: mt76: add WED RX support to mt76_dma_rx_fill
-wifi: mt76: add WED RX support to dma queue alloc
-wifi: mt76: add info parameter to rx_skb signature
-wifi: mt76: connac: introduce mt76_connac_mcu_sta_wed_update utility routine
-wifi: mt76: mt7915: enable WED RX support
-wifi: mt76: mt7915: enable WED RX stats
-wifi: mt76: mt7915: add basedband Txpower info into debugfs
-wifi: mt76: mt7915: enable .sta_set_txpwr support
-wifi: mt76: mt7915: fix band_idx usage
----
- dma.c             | 244 +++++++++++++++++++++++++-------
- dma.h             |   8 ++
- mac80211.c        |  10 +-
- mt76.h            |  26 +++-
- mt7603/dma.c      |   2 +-
- mt7603/mt7603.h   |   2 +-
- mt7615/mac.c      |   2 +-
- mt7615/mt7615.h   |   2 +-
- mt76_connac.h     |   5 +
- mt76_connac_mcu.c |  25 +++-
- mt76_connac_mcu.h |  70 ++++++++-
- mt76x02.h         |   2 +-
- mt76x02_txrx.c    |   2 +-
- mt7915/coredump.c |   1 +
- mt7915/debugfs.c  |  29 ++--
- mt7915/dma.c      |  26 +++-
- mt7915/init.c     |   3 +
- mt7915/mac.c      |  60 ++++++--
- mt7915/main.c     |  84 ++++++++---
- mt7915/mcu.c      | 354 ++++++++++++++++++++++++++++++++++++++++------
- mt7915/mcu.h      |  30 ++++
- mt7915/mmio.c     | 320 +++++++++++++++++++++++++++++------------
- mt7915/mt7915.h   |  13 +-
- mt7915/regs.h     |  11 ++
- mt7915/testmode.c |  18 +--
- mt7921/init.c     |  64 +++++++++
- mt7921/mac.c      |   2 +-
- mt7921/main.c     | 118 ++++++++++++++++
- mt7921/mcu.c      |  24 ++++
- mt7921/mt7921.h   |  52 ++++++-
- mt7921/pci.c      |  33 ++++-
- mt7921/sdio.c     |  23 ++-
- mt7921/usb.c      |  12 +-
- sdio.c            |   2 +-
- tx.c              |  30 ++++
- usb.c             |   2 +-
- 36 files changed, 1438 insertions(+), 273 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 4b181305..ae22b959 100644
---- a/dma.c
-+++ b/dma.c
-@@ -59,6 +59,19 @@ mt76_alloc_txwi(struct mt76_dev *dev)
- 	return t;
- }
- 
-+static struct mt76_txwi_cache *
-+mt76_alloc_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *t;
-+
-+	t = kzalloc(L1_CACHE_ALIGN(sizeof(*t)), GFP_ATOMIC);
-+	if (!t)
-+		return NULL;
-+
-+	t->ptr = NULL;
-+	return t;
-+}
-+
- static struct mt76_txwi_cache *
- __mt76_get_txwi(struct mt76_dev *dev)
- {
-@@ -75,6 +88,22 @@ __mt76_get_txwi(struct mt76_dev *dev)
- 	return t;
- }
- 
-+static struct mt76_txwi_cache *
-+__mt76_get_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *t = NULL;
-+
-+	spin_lock(&dev->wed_lock);
-+	if (!list_empty(&dev->rxwi_cache)) {
-+		t = list_first_entry(&dev->rxwi_cache, struct mt76_txwi_cache,
-+				     list);
-+		list_del(&t->list);
-+	}
-+	spin_unlock(&dev->wed_lock);
-+
-+	return t;
-+}
-+
- static struct mt76_txwi_cache *
- mt76_get_txwi(struct mt76_dev *dev)
- {
-@@ -86,6 +115,18 @@ mt76_get_txwi(struct mt76_dev *dev)
- 	return mt76_alloc_txwi(dev);
- }
- 
-+struct mt76_txwi_cache *
-+mt76_get_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *t = __mt76_get_rxwi(dev);
-+
-+	if (t)
-+		return t;
-+
-+	return mt76_alloc_rxwi(dev);
-+}
-+EXPORT_SYMBOL_GPL(mt76_get_rxwi);
-+
- void
- mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
- {
-@@ -98,6 +139,18 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
- }
- EXPORT_SYMBOL_GPL(mt76_put_txwi);
- 
-+void
-+mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
-+{
-+	if (!t)
-+		return;
-+
-+	spin_lock(&dev->wed_lock);
-+	list_add(&t->list, &dev->rxwi_cache);
-+	spin_unlock(&dev->wed_lock);
-+}
-+EXPORT_SYMBOL_GPL(mt76_put_rxwi);
-+
- static void
- mt76_free_pending_txwi(struct mt76_dev *dev)
- {
-@@ -112,6 +165,20 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
- 	local_bh_enable();
- }
- 
-+static void
-+mt76_free_pending_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *t;
-+
-+	local_bh_disable();
-+	while ((t = __mt76_get_rxwi(dev)) != NULL) {
-+		if (t->ptr)
-+			skb_free_frag(t->ptr);
-+		kfree(t);
-+	}
-+	local_bh_enable();
-+}
-+
- static void
- mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
- {
-@@ -148,11 +215,6 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 	u32 ctrl;
- 	int i, idx = -1;
- 
--	if (txwi) {
--		q->entry[q->head].txwi = DMA_DUMMY_DATA;
--		q->entry[q->head].skip_buf0 = true;
--	}
--
- 	for (i = 0; i < nbufs; i += 2, buf += 2) {
- 		u32 buf0 = buf[0].addr, buf1 = 0;
- 
-@@ -162,28 +224,48 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 		desc = &q->desc[idx];
- 		entry = &q->entry[idx];
- 
--		if (buf[0].skip_unmap)
--			entry->skip_buf0 = true;
--		entry->skip_buf1 = i == nbufs - 1;
--
--		entry->dma_addr[0] = buf[0].addr;
--		entry->dma_len[0] = buf[0].len;
--
--		ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
--		if (i < nbufs - 1) {
--			entry->dma_addr[1] = buf[1].addr;
--			entry->dma_len[1] = buf[1].len;
--			buf1 = buf[1].addr;
--			ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
--			if (buf[1].skip_unmap)
--				entry->skip_buf1 = true;
-+		if ((q->flags & MT_QFLAG_WED) &&
-+		    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
-+			struct mt76_txwi_cache *t = txwi;
-+			int rx_token;
-+
-+			if (!t)
-+				return -ENOMEM;
-+
-+			rx_token = mt76_rx_token_consume(dev, (void *)skb, t,
-+							 buf[0].addr);
-+			buf1 |= FIELD_PREP(MT_DMA_CTL_TOKEN, rx_token);
-+			ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len) |
-+			       MT_DMA_CTL_TO_HOST;
-+		} else {
-+			if (txwi) {
-+				q->entry[q->head].txwi = DMA_DUMMY_DATA;
-+				q->entry[q->head].skip_buf0 = true;
-+			}
-+
-+			if (buf[0].skip_unmap)
-+				entry->skip_buf0 = true;
-+			entry->skip_buf1 = i == nbufs - 1;
-+
-+			entry->dma_addr[0] = buf[0].addr;
-+			entry->dma_len[0] = buf[0].len;
-+
-+			ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
-+			if (i < nbufs - 1) {
-+				entry->dma_addr[1] = buf[1].addr;
-+				entry->dma_len[1] = buf[1].len;
-+				buf1 = buf[1].addr;
-+				ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
-+				if (buf[1].skip_unmap)
-+					entry->skip_buf1 = true;
-+			}
-+
-+			if (i == nbufs - 1)
-+				ctrl |= MT_DMA_CTL_LAST_SEC0;
-+			else if (i == nbufs - 2)
-+				ctrl |= MT_DMA_CTL_LAST_SEC1;
- 		}
- 
--		if (i == nbufs - 1)
--			ctrl |= MT_DMA_CTL_LAST_SEC0;
--		else if (i == nbufs - 2)
--			ctrl |= MT_DMA_CTL_LAST_SEC1;
--
- 		WRITE_ONCE(desc->buf0, cpu_to_le32(buf0));
- 		WRITE_ONCE(desc->buf1, cpu_to_le32(buf1));
- 		WRITE_ONCE(desc->info, cpu_to_le32(info));
-@@ -272,33 +354,60 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
- 
- static void *
- mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
--		 int *len, u32 *info, bool *more)
-+		 int *len, u32 *info, bool *more, bool *drop)
- {
- 	struct mt76_queue_entry *e = &q->entry[idx];
- 	struct mt76_desc *desc = &q->desc[idx];
--	dma_addr_t buf_addr;
--	void *buf = e->buf;
--	int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
-+	void *buf;
- 
--	buf_addr = e->dma_addr[0];
- 	if (len) {
--		u32 ctl = le32_to_cpu(READ_ONCE(desc->ctrl));
--		*len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctl);
--		*more = !(ctl & MT_DMA_CTL_LAST_SEC0);
-+		u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-+		*len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctrl);
-+		*more = !(ctrl & MT_DMA_CTL_LAST_SEC0);
- 	}
- 
- 	if (info)
- 		*info = le32_to_cpu(desc->info);
- 
--	dma_unmap_single(dev->dma_dev, buf_addr, buf_len, DMA_FROM_DEVICE);
--	e->buf = NULL;
-+	if ((q->flags & MT_QFLAG_WED) &&
-+	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
-+		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
-+				      le32_to_cpu(desc->buf1));
-+		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
-+
-+		if (!t)
-+			return NULL;
-+
-+		dma_unmap_single(dev->dma_dev, t->dma_addr,
-+				 SKB_WITH_OVERHEAD(q->buf_size),
-+				 DMA_FROM_DEVICE);
-+
-+		buf = t->ptr;
-+		t->dma_addr = 0;
-+		t->ptr = NULL;
-+
-+		mt76_put_rxwi(dev, t);
-+
-+		if (drop) {
-+			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-+
-+			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
-+					   MT_DMA_CTL_DROP));
-+		}
-+	} else {
-+		buf = e->buf;
-+		e->buf = NULL;
-+		dma_unmap_single(dev->dma_dev, e->dma_addr[0],
-+				 SKB_WITH_OVERHEAD(q->buf_size),
-+				 DMA_FROM_DEVICE);
-+	}
- 
- 	return buf;
- }
- 
- static void *
- mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
--		 int *len, u32 *info, bool *more)
-+		 int *len, u32 *info, bool *more, bool *drop)
- {
- 	int idx = q->tail;
- 
-@@ -314,7 +423,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
- 	q->tail = (q->tail + 1) % q->ndesc;
- 	q->queued--;
- 
--	return mt76_dma_get_buf(dev, q, idx, len, info, more);
-+	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
- }
- 
- static int
-@@ -441,14 +550,26 @@ free_skb:
- 	return ret;
- }
- 
-+static struct page_frag_cache *
-+mt76_dma_rx_get_frag_cache(struct mt76_dev *dev, struct mt76_queue *q)
-+{
-+	struct page_frag_cache *rx_page = &q->rx_page;
-+
-+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+	if ((q->flags & MT_QFLAG_WED) &&
-+	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX)
-+		rx_page = &dev->mmio.wed.rx_buf_ring.rx_page;
-+#endif
-+	return rx_page;
-+}
-+
- static int
- mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- {
--	dma_addr_t addr;
--	void *buf;
--	int frames = 0;
-+	struct page_frag_cache *rx_page = mt76_dma_rx_get_frag_cache(dev, q);
- 	int len = SKB_WITH_OVERHEAD(q->buf_size);
--	int offset = q->buf_offset;
-+	int frames = 0, offset = q->buf_offset;
-+	dma_addr_t addr;
- 
- 	if (!q->ndesc)
- 		return 0;
-@@ -456,9 +577,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	spin_lock_bh(&q->lock);
- 
- 	while (q->queued < q->ndesc - 1) {
-+		struct mt76_txwi_cache *t = NULL;
- 		struct mt76_queue_buf qbuf;
-+		void *buf = NULL;
- 
--		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+		if ((q->flags & MT_QFLAG_WED) &&
-+		    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
-+			t = mt76_get_rxwi(dev);
-+			if (!t)
-+				break;
-+		}
-+
-+		buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
- 		if (!buf)
- 			break;
- 
-@@ -471,7 +601,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		qbuf.addr = addr + offset;
- 		qbuf.len = len - offset;
- 		qbuf.skip_unmap = false;
--		mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL);
-+		mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, t);
- 		frames++;
- 	}
- 
-@@ -517,6 +647,11 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 		if (!ret)
- 			q->wed_regs = wed->txfree_ring.reg_base;
- 		break;
-+	case MT76_WED_Q_RX:
-+		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
-+		if (!ret)
-+			q->wed_regs = wed->rx_ring[ring].reg_base;
-+		break;
- 	default:
- 		ret = -EINVAL;
- 	}
-@@ -574,7 +709,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
- 
- 	spin_lock_bh(&q->lock);
- 	do {
--		buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more);
-+		buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL);
- 		if (!buf)
- 			break;
- 
-@@ -615,7 +750,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
- 
- static void
- mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
--		  int len, bool more)
-+		  int len, bool more, u32 info)
- {
- 	struct sk_buff *skb = q->rx_head;
- 	struct skb_shared_info *shinfo = skb_shinfo(skb);
-@@ -635,7 +770,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
- 
- 	q->rx_head = NULL;
- 	if (nr_frags < ARRAY_SIZE(shinfo->frags))
--		dev->drv->rx_skb(dev, q - dev->q_rx, skb);
-+		dev->drv->rx_skb(dev, q - dev->q_rx, skb, &info);
- 	else
- 		dev_kfree_skb(skb);
- }
-@@ -656,6 +791,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 	}
- 
- 	while (done < budget) {
-+		bool drop = false;
- 		u32 info;
- 
- 		if (check_ddone) {
-@@ -666,10 +802,14 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 				break;
- 		}
- 
--		data = mt76_dma_dequeue(dev, q, false, &len, &info, &more);
-+		data = mt76_dma_dequeue(dev, q, false, &len, &info, &more,
-+					&drop);
- 		if (!data)
- 			break;
- 
-+		if (drop)
-+			goto free_frag;
-+
- 		if (q->rx_head)
- 			data_len = q->buf_size;
- 		else
-@@ -682,7 +822,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 		}
- 
- 		if (q->rx_head) {
--			mt76_add_fragment(dev, q, data, len, more);
-+			mt76_add_fragment(dev, q, data, len, more, info);
- 			continue;
- 		}
- 
-@@ -706,7 +846,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 			continue;
- 		}
- 
--		dev->drv->rx_skb(dev, q - dev->q_rx, skb);
-+		dev->drv->rx_skb(dev, q - dev->q_rx, skb, &info);
- 		continue;
- 
- free_frag:
-@@ -803,11 +943,15 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
- 		mt76_dma_tx_cleanup(dev, dev->q_mcu[i], true);
- 
- 	mt76_for_each_q_rx(dev, i) {
-+		struct mt76_queue *q = &dev->q_rx[i];
-+
- 		netif_napi_del(&dev->napi[i]);
--		mt76_dma_rx_cleanup(dev, &dev->q_rx[i]);
-+		if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags))
-+			mt76_dma_rx_cleanup(dev, q);
- 	}
- 
- 	mt76_free_pending_txwi(dev);
-+	mt76_free_pending_rxwi(dev);
- 
- 	if (mtk_wed_device_active(&dev->mmio.wed))
- 		mtk_wed_device_detach(&dev->mmio.wed);
-diff --git a/dma.h b/dma.h
-index fdf786f9..53c6ce25 100644
---- a/dma.h
-+++ b/dma.h
-@@ -15,6 +15,14 @@
- #define MT_DMA_CTL_SD_LEN0		GENMASK(29, 16)
- #define MT_DMA_CTL_LAST_SEC0		BIT(30)
- #define MT_DMA_CTL_DMA_DONE		BIT(31)
-+#define MT_DMA_CTL_TO_HOST		BIT(8)
-+#define MT_DMA_CTL_TO_HOST_A		BIT(12)
-+#define MT_DMA_CTL_DROP			BIT(14)
-+#define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
-+
-+#define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
-+#define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
-+#define MT_DMA_INFO_PPE_VLD		BIT(31)
- 
- #define MT_DMA_HDR_LEN			4
- #define MT_RX_INFO_LEN			4
-diff --git a/mac80211.c b/mac80211.c
-index 30c1bc56..acac04ef 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -572,6 +572,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
- 	spin_lock_init(&dev->lock);
- 	spin_lock_init(&dev->cc_lock);
- 	spin_lock_init(&dev->status_lock);
-+	spin_lock_init(&dev->wed_lock);
- 	mutex_init(&dev->mutex);
- 	init_waitqueue_head(&dev->tx_wait);
- 
-@@ -594,9 +595,13 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
- 	spin_lock_init(&dev->token_lock);
- 	idr_init(&dev->token);
- 
-+	spin_lock_init(&dev->rx_token_lock);
-+	idr_init(&dev->rx_token);
-+
- 	INIT_LIST_HEAD(&dev->wcid_list);
- 
- 	INIT_LIST_HEAD(&dev->txwi_cache);
-+	INIT_LIST_HEAD(&dev->rxwi_cache);
- 	dev->token_size = dev->drv->token_size;
- 
- 	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
-@@ -1292,7 +1297,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
- 
- 	while ((skb = __skb_dequeue(&dev->rx_skb[q])) != NULL) {
- 		mt76_check_sta(dev, skb);
--		mt76_rx_aggr_reorder(skb, &frames);
-+		if (mtk_wed_device_active(&dev->mmio.wed))
-+			__skb_queue_tail(&frames, skb);
-+		else
-+			mt76_rx_aggr_reorder(skb, &frames);
- 	}
- 
- 	mt76_rx_complete(dev, &frames, napi);
-diff --git a/mt76.h b/mt76.h
-index a2bccf6b..33f87e51 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -35,6 +35,7 @@
- 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
- 				 FIELD_PREP(MT_QFLAG_WED_RING, _n))
- #define MT_WED_Q_TX(_n)		__MT_WED_Q(MT76_WED_Q_TX, _n)
-+#define MT_WED_Q_RX(_n)		__MT_WED_Q(MT76_WED_Q_RX, _n)
- #define MT_WED_Q_TXFREE		__MT_WED_Q(MT76_WED_Q_TXFREE, 0)
- 
- struct mt76_dev;
-@@ -56,6 +57,7 @@ enum mt76_bus_type {
- enum mt76_wed_type {
- 	MT76_WED_Q_TX,
- 	MT76_WED_Q_TXFREE,
-+	MT76_WED_Q_RX,
- };
- 
- struct mt76_bus_ops {
-@@ -271,9 +273,15 @@ struct mt76_sta_stats {
- 	u64 tx_nss[4];		/* 1, 2, 3, 4 */
- 	u64 tx_mcs[16];		/* mcs idx */
- 	u64 tx_bytes;
-+	/* WED TX */
- 	u32 tx_packets;
- 	u32 tx_retries;
- 	u32 tx_failed;
-+	/* WED RX */
-+	u64 rx_bytes;
-+	u32 rx_packets;
-+	u32 rx_errors;
-+	u32 rx_drops;
- };
- 
- enum mt76_wcid_flags {
-@@ -339,7 +347,10 @@ struct mt76_txwi_cache {
- 	struct list_head list;
- 	dma_addr_t dma_addr;
- 
--	struct sk_buff *skb;
-+	union {
-+		struct sk_buff *skb;
-+		void *ptr;
-+	};
- };
- 
- struct mt76_rx_tid {
-@@ -439,7 +450,7 @@ struct mt76_driver_ops {
- 	bool (*rx_check)(struct mt76_dev *dev, void *data, int len);
- 
- 	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
--		       struct sk_buff *skb);
-+		       struct sk_buff *skb, u32 *info);
- 
- 	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
- 
-@@ -728,6 +739,7 @@ struct mt76_dev {
- 
- 	struct ieee80211_hw *hw;
- 
-+	spinlock_t wed_lock;
- 	spinlock_t lock;
- 	spinlock_t cc_lock;
- 
-@@ -754,6 +766,7 @@ struct mt76_dev {
- 	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
- 
- 	struct list_head txwi_cache;
-+	struct list_head rxwi_cache;
- 	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
- 	struct mt76_queue q_rx[__MT_RXQ_MAX];
- 	const struct mt76_queue_ops *queue_ops;
-@@ -768,6 +781,10 @@ struct mt76_dev {
- 	u16 token_count;
- 	u16 token_size;
- 
-+	spinlock_t rx_token_lock;
-+	struct idr rx_token;
-+	u16 rx_token_size;
-+
- 	wait_queue_head_t tx_wait;
- 	/* spinclock used to protect wcid pktid linked list */
- 	spinlock_t status_lock;
-@@ -1247,6 +1264,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
- }
- 
- void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
-+void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
-+struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
- void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
- 		      struct napi_struct *napi);
- void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1391,6 +1410,9 @@ struct mt76_txwi_cache *
- mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
- int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
- void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
-+struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
-+int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
-+			  struct mt76_txwi_cache *r, dma_addr_t phys);
- 
- static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
- {
-diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9d..06a9e6ec 100644
---- a/mt7603/dma.c
-+++ b/mt7603/dma.c
-@@ -69,7 +69,7 @@ free:
- }
- 
- void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 *info)
- {
- 	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d90..7c3be596 100644
---- a/mt7603/mt7603.h
-+++ b/mt7603/mt7603.h
-@@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- void mt7603_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e);
- 
- void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 *info);
- void mt7603_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
- void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
-diff --git a/mt7615/mac.c b/mt7615/mac.c
-index 305bf182..a9560247 100644
---- a/mt7615/mac.c
-+++ b/mt7615/mac.c
-@@ -1666,7 +1666,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
- EXPORT_SYMBOL_GPL(mt7615_rx_check);
- 
- void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 *info)
- {
- 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 1080d202..43739ecf 100644
---- a/mt7615/mt7615.h
-+++ b/mt7615/mt7615.h
-@@ -514,7 +514,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
- void mt7615_tx_token_put(struct mt7615_dev *dev);
- bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 *info);
- void mt7615_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 		       struct ieee80211_sta *sta);
-diff --git a/mt76_connac.h b/mt76_connac.h
-index 0915eb57..8ba883b0 100644
---- a/mt76_connac.h
-+++ b/mt76_connac.h
-@@ -187,6 +187,11 @@ static inline bool is_mt7986(struct mt76_dev *dev)
- 	return mt76_chip(dev) == 0x7986;
- }
- 
-+static inline bool is_mt7996(struct mt76_dev *dev)
-+{
-+	return mt76_chip(dev) == 0x7990;
-+}
-+
- static inline bool is_mt7622(struct mt76_dev *dev)
- {
- 	if (!IS_ENABLED(CONFIG_MT7622_WMAC))
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index dfec416e..c65267b4 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -65,7 +65,8 @@ int mt76_connac_mcu_init_download(struct mt76_dev *dev, u32 addr, u32 len,
- 	int cmd;
- 
- 	if ((!is_connac_v1(dev) && addr == MCU_PATCH_ADDRESS) ||
--	    (is_mt7921(dev) && addr == 0x900000))
-+	    (is_mt7921(dev) && addr == 0x900000) ||
-+	    (is_mt7996(dev) && addr == 0x900000))
- 		cmd = MCU_CMD(PATCH_START_REQ);
- 	else
- 		cmd = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
-@@ -1183,6 +1184,16 @@ void mt76_connac_mcu_sta_ba_tlv(struct sk_buff *skb,
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba_tlv);
- 
-+int mt76_connac_mcu_sta_wed_update(struct mt76_dev *dev, struct sk_buff *skb)
-+{
-+	if (!mtk_wed_device_active(&dev->mmio.wed))
-+		return 0;
-+
-+	return mtk_wed_device_update_msg(&dev->mmio.wed, WED_WO_STA_REC,
-+					 skb->data, skb->len);
-+}
-+EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_wed_update);
-+
- int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 			   struct ieee80211_ampdu_params *params,
- 			   int cmd, bool enable, bool tx)
-@@ -1208,6 +1219,10 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 	mt76_connac_mcu_wtbl_ba_tlv(dev, skb, params, enable, tx, sta_wtbl,
- 				    wtbl_hdr);
- 
-+	ret = mt76_connac_mcu_sta_wed_update(dev, skb);
-+	if (ret)
-+		return ret;
-+
- 	ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
- 	if (ret)
- 		return ret;
-@@ -1218,6 +1233,10 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 
- 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
- 
-+	ret = mt76_connac_mcu_sta_wed_update(dev, skb);
-+	if (ret)
-+		return ret;
-+
- 	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
-@@ -2658,6 +2677,10 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
- 	if (ret)
- 		return ret;
- 
-+	ret = mt76_connac_mcu_sta_wed_update(dev, skb);
-+	if (ret)
-+		return ret;
-+
- 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 87c65d25..72d235a1 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -63,7 +63,7 @@ struct mt76_connac2_mcu_txd {
- } __packed __aligned(4);
- 
- /**
-- * struct mt76_connac2_mcu_uni_txd - mcu command descriptor for firmware v3
-+ * struct mt76_connac2_mcu_uni_txd - mcu command descriptor for connac2 and connac3
-  * @txd: hardware descriptor
-  * @len: total length not including txd
-  * @cid: command identifier
-@@ -393,7 +393,8 @@ struct sta_rec_phy {
- 	u8 ampdu;
- 	u8 rts_policy;
- 	u8 rcpi;
--	u8 rsv[2];
-+	u8 max_ampdu_len; /* connac3 */
-+	u8 rsv[1];
- } __packed;
- 
- struct sta_rec_he_6g_capa {
-@@ -454,8 +455,8 @@ struct sta_rec_bf {
- 	u8 ibf_dbw;
- 	u8 ibf_ncol;
- 	u8 ibf_nrow;
--	u8 nrow_bw160;
--	u8 ncol_bw160;
-+	u8 nrow_gt_bw80;
-+	u8 ncol_gt_bw80;
- 	u8 ru_start_idx;
- 	u8 ru_end_idx;
- 
-@@ -781,6 +782,8 @@ enum {
- 	STA_REC_BFEE,
- 	STA_REC_PHY = 0x15,
- 	STA_REC_HE_6G = 0x17,
-+	STA_REC_HDRT = 0x28,
-+	STA_REC_HDR_TRANS = 0x2B,
- 	STA_REC_MAX_NUM
- };
- 
-@@ -986,6 +989,17 @@ enum {
- 	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
- };
- 
-+/* unified event table */
-+enum {
-+	MCU_UNI_EVENT_RESULT = 0x01,
-+	MCU_UNI_EVENT_FW_LOG_2_HOST = 0x04,
-+	MCU_UNI_EVENT_IE_COUNTDOWN = 0x09,
-+	MCU_UNI_EVENT_RDD_REPORT = 0x11,
-+};
-+
-+#define MCU_UNI_CMD_EVENT			BIT(1)
-+#define MCU_UNI_CMD_UNSOLICITED_EVENT		BIT(2)
-+
- enum {
- 	MCU_Q_QUERY,
- 	MCU_Q_SET,
-@@ -1068,10 +1082,11 @@ enum {
- 
- #define MCU_CMD_ACK				BIT(0)
- #define MCU_CMD_UNI				BIT(1)
--#define MCU_CMD_QUERY				BIT(2)
-+#define MCU_CMD_SET				BIT(2)
- 
- #define MCU_CMD_UNI_EXT_ACK			(MCU_CMD_ACK | MCU_CMD_UNI | \
--						 MCU_CMD_QUERY)
-+						 MCU_CMD_SET)
-+#define MCU_CMD_UNI_QUERY_ACK			(MCU_CMD_ACK | MCU_CMD_UNI)
- 
- #define __MCU_CMD_FIELD_ID			GENMASK(7, 0)
- #define __MCU_CMD_FIELD_EXT_ID			GENMASK(15, 8)
-@@ -1079,6 +1094,7 @@ enum {
- #define __MCU_CMD_FIELD_UNI			BIT(17)
- #define __MCU_CMD_FIELD_CE			BIT(18)
- #define __MCU_CMD_FIELD_WA			BIT(19)
-+#define __MCU_CMD_FIELD_WM			BIT(20)
- 
- #define MCU_CMD(_t)				FIELD_PREP(__MCU_CMD_FIELD_ID,		\
- 							   MCU_CMD_##_t)
-@@ -1100,6 +1116,16 @@ enum {
- 						 FIELD_PREP(__MCU_CMD_FIELD_EXT_ID, \
- 							    MCU_WA_PARAM_CMD_##_t))
- 
-+#define MCU_WM_UNI_CMD(_t)			(MCU_UNI_CMD(_t) |		\
-+						 __MCU_CMD_FIELD_WM)
-+#define MCU_WM_UNI_CMD_QUERY(_t)		(MCU_UNI_CMD(_t) |		\
-+						 __MCU_CMD_FIELD_QUERY |	\
-+						 __MCU_CMD_FIELD_WM)
-+#define MCU_WA_UNI_CMD(_t)			(MCU_UNI_CMD(_t) |		\
-+						 __MCU_CMD_FIELD_WA)
-+#define MCU_WMWA_UNI_CMD(_t)			(MCU_WM_UNI_CMD(_t) |		\
-+						 __MCU_CMD_FIELD_WA)
-+
- enum {
- 	MCU_EXT_CMD_EFUSE_ACCESS = 0x01,
- 	MCU_EXT_CMD_RF_REG_ACCESS = 0x02,
-@@ -1153,11 +1179,33 @@ enum {
- 	MCU_UNI_CMD_DEV_INFO_UPDATE = 0x01,
- 	MCU_UNI_CMD_BSS_INFO_UPDATE = 0x02,
- 	MCU_UNI_CMD_STA_REC_UPDATE = 0x03,
-+	MCU_UNI_CMD_EDCA_UPDATE = 0x04,
- 	MCU_UNI_CMD_SUSPEND = 0x05,
- 	MCU_UNI_CMD_OFFLOAD = 0x06,
- 	MCU_UNI_CMD_HIF_CTRL = 0x07,
-+	MCU_UNI_CMD_BAND_CONFIG = 0x08,
-+	MCU_UNI_CMD_REPT_MUAR = 0x09,
-+	MCU_UNI_CMD_WSYS_CONFIG = 0x0b,
-+	MCU_UNI_CMD_REG_ACCESS = 0x0d,
-+	MCU_UNI_CMD_POWER_CREL = 0x0f,
-+	MCU_UNI_CMD_RX_HDR_TRANS = 0x12,
-+	MCU_UNI_CMD_SER = 0x13,
-+	MCU_UNI_CMD_TWT = 0x14,
-+	MCU_UNI_CMD_RDD_CTRL = 0x19,
-+	MCU_UNI_CMD_GET_MIB_INFO = 0x22,
- 	MCU_UNI_CMD_SNIFFER = 0x24,
-+	MCU_UNI_CMD_SR = 0x25,
- 	MCU_UNI_CMD_ROC = 0x27,
-+	MCU_UNI_CMD_TXPOWER = 0x2b,
-+	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
-+	MCU_UNI_CMD_RA = 0x2f,
-+	MCU_UNI_CMD_MURU = 0x31,
-+	MCU_UNI_CMD_BF = 0x33,
-+	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
-+	MCU_UNI_CMD_THERMAL = 0x35,
-+	MCU_UNI_CMD_VOW = 0x37,
-+	MCU_UNI_CMD_RRO = 0x57,
-+	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
- };
- 
- enum {
-@@ -1207,14 +1255,23 @@ enum {
- 
- enum {
- 	UNI_BSS_INFO_BASIC = 0,
-+	UNI_BSS_INFO_RA = 1,
- 	UNI_BSS_INFO_RLM = 2,
- 	UNI_BSS_INFO_BSS_COLOR = 4,
- 	UNI_BSS_INFO_HE_BASIC = 5,
- 	UNI_BSS_INFO_BCN_CONTENT = 7,
-+	UNI_BSS_INFO_BCN_CSA = 8,
-+	UNI_BSS_INFO_BCN_BCC = 9,
-+	UNI_BSS_INFO_BCN_MBSSID = 10,
-+	UNI_BSS_INFO_RATE = 11,
- 	UNI_BSS_INFO_QBSS = 15,
-+	UNI_BSS_INFO_SEC = 16,
-+	UNI_BSS_INFO_TXCMD = 18,
- 	UNI_BSS_INFO_UAPSD = 19,
- 	UNI_BSS_INFO_PS = 21,
- 	UNI_BSS_INFO_BCNFT = 22,
-+	UNI_BSS_INFO_OFFLOAD = 25,
-+	UNI_BSS_INFO_MLD = 26,
- };
- 
- enum {
-@@ -1823,6 +1880,7 @@ int mt76_connac_mcu_set_pm(struct mt76_dev *dev, int band, int enter);
- int mt76_connac_mcu_restart(struct mt76_dev *dev);
- int mt76_connac_mcu_rdd_cmd(struct mt76_dev *dev, int cmd, u8 index,
- 			    u8 rx_sel, u8 val);
-+int mt76_connac_mcu_sta_wed_update(struct mt76_dev *dev, struct sk_buff *skb);
- int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
- 			  const char *fw_wa);
- int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name);
-diff --git a/mt76x02.h b/mt76x02.h
-index 849c2644..3f2a9b7f 100644
---- a/mt76x02.h
-+++ b/mt76x02.h
-@@ -187,7 +187,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
- void mt76x02_remove_hdr_pad(struct sk_buff *skb, int len);
- bool mt76x02_tx_status_data(struct mt76_dev *mdev, u8 *update);
- void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb);
-+			  struct sk_buff *skb, u32 *info);
- void mt76x02_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
- irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
- void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
-diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 3a313075..d8bc4ae1 100644
---- a/mt76x02_txrx.c
-+++ b/mt76x02_txrx.c
-@@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
- EXPORT_SYMBOL_GPL(mt76x02_tx);
- 
- void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb)
-+			  struct sk_buff *skb, u32 *info)
- {
- 	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
- 	void *rxwi = skb->data;
-diff --git a/mt7915/coredump.c b/mt7915/coredump.c
-index bb4b7040..d097a56d 100644
---- a/mt7915/coredump.c
-+++ b/mt7915/coredump.c
-@@ -9,6 +9,7 @@
- 
- static bool coredump_memdump;
- module_param(coredump_memdump, bool, 0644);
-+MODULE_PARM_DESC(coredump_memdump, "Optional ability to dump firmware memory");
- 
- static const struct mt7915_mem_region mt7915_mem_regions[] = {
- 	{
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 766e6208..30f8f18b 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -51,7 +51,7 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
- {
- 	struct mt7915_phy *phy = file->private_data;
- 	struct mt7915_dev *dev = phy->dev;
--	bool ext_phy = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	char buf[16];
- 	int ret = 0;
- 	u16 val;
-@@ -83,7 +83,7 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
- 	 * 8: trigger firmware crash.
- 	 */
- 	case SER_QUERY:
--		ret = mt7915_mcu_set_ser(dev, 0, 0, ext_phy);
-+		ret = mt7915_mcu_set_ser(dev, 0, 0, band);
- 		break;
- 	case SER_SET_RECOVER_L1:
- 	case SER_SET_RECOVER_L2:
-@@ -91,17 +91,17 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
- 	case SER_SET_RECOVER_L3_TX_ABORT:
- 	case SER_SET_RECOVER_L3_TX_DISABLE:
- 	case SER_SET_RECOVER_L3_BF:
--		ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), ext_phy);
-+		ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), band);
- 		if (ret)
- 			return ret;
- 
--		ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, ext_phy);
-+		ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, band);
- 		break;
- 
- 	/* enable full chip reset */
- 	case SER_SET_RECOVER_FULL:
- 		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, MT_MCU_CMD_WDT_MASK);
--		ret = mt7915_mcu_set_ser(dev, 1, 3, ext_phy);
-+		ret = mt7915_mcu_set_ser(dev, 1, 3, band);
- 		if (ret)
- 			return ret;
- 
-@@ -967,11 +967,18 @@ mt7915_rate_txpower_show(struct seq_file *file, void *data)
- 		"RU484/SU40", "RU996/SU80", "RU2x996/SU160"
- 	};
- 	struct mt7915_phy *phy = file->private;
-+	struct mt7915_dev *dev = phy->dev;
- 	s8 txpower[MT7915_SKU_RATE_NUM], *buf;
--	int i;
-+	u32 reg;
-+	int i, ret;
-+
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower));
-+	if (ret)
-+		return ret;
-+
-+	/* Txpower propagation path: TMAC -> TXV -> BBP */
-+	seq_printf(file, "\nPhy %d\n", phy != &dev->phy);
- 
--	seq_printf(file, "\nBand %d\n", phy != &phy->dev->phy);
--	mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower));
- 	for (i = 0, buf = txpower; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
- 		u8 mcs_num = mt7915_sku_group_len[i];
- 
-@@ -982,6 +989,12 @@ mt7915_rate_txpower_show(struct seq_file *file, void *data)
- 		buf += mt7915_sku_group_len[i];
- 	}
- 
-+	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_TPC_CTRL_STAT(phy->band_idx) :
-+	      MT_WF_PHY_TPC_CTRL_STAT_MT7916(phy->band_idx);
-+
-+	seq_printf(file, "\nBaseband transmit power %ld\n",
-+		   mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER));
-+
- 	return 0;
- }
- 
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 9a57ad8f..27b67800 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -361,11 +361,18 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
- 
- 	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
- 		u32 wed_irq_mask = irq_mask;
-+		int ret;
- 
- 		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
- 		if (!is_mt7986(&dev->mt76))
- 			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
--		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
-+		else
-+			mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
-+
-+		ret = mt7915_mcu_wed_enable_rx_stats(dev);
-+		if (ret)
-+			return ret;
-+
- 		mtk_wed_device_start(&dev->mt76.mmio.wed, wed_irq_mask);
- 	}
- 
-@@ -401,6 +408,9 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1,
- 					   wed_control_rx1));
-+			if (is_mt7915(mdev))
-+				mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
-+					 MT_WFDMA0_EXT0_RXWB_KEEP);
- 		}
- 	} else {
- 		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
-@@ -473,6 +483,13 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 
- 	/* rx data queue for band0 */
- 	if (!dev->phy.band_idx) {
-+		if (mtk_wed_device_active(&mdev->mmio.wed) &&
-+		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
-+			dev->mt76.q_rx[MT_RXQ_MAIN].flags =
-+				MT_WED_Q_RX(MT7915_RXQ_BAND0);
-+			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
-+		}
-+
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
- 				       MT_RXQ_ID(MT_RXQ_MAIN),
- 				       MT7915_RX_RING_SIZE,
-@@ -503,6 +520,13 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 	}
- 
- 	if (dev->dbdc_support || dev->phy.band_idx) {
-+		if (mtk_wed_device_active(&mdev->mmio.wed) &&
-+		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
-+			dev->mt76.q_rx[MT_RXQ_BAND1].flags =
-+				MT_WED_Q_RX(MT7915_RXQ_BAND1);
-+			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
-+		}
-+
- 		/* rx data queue for band1 */
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
- 				       MT_RXQ_ID(MT_RXQ_BAND1),
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 0a5f7d85..9e69ab82 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -355,6 +355,9 @@ mt7915_init_wiphy(struct ieee80211_hw *hw)
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_DISCOVERY);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
- 
-+	if (!is_mt7915(&dev->mt76))
-+		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STA_TX_PWR);
-+
- 	if (!mdev->dev->of_node ||
- 	    !of_property_read_bool(mdev->dev->of_node,
- 				   "mediatek,disable-radar-background"))
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 99123e77..97a19bdb 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -165,9 +165,9 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
- 		sta = container_of((void *)msta, struct ieee80211_sta,
- 				   drv_priv);
- 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
--			u8 q = mt76_connac_lmac_mapping(i);
--			u32 tx_cur = tx_time[q];
--			u32 rx_cur = rx_time[q];
-+			u8 queue = mt76_connac_lmac_mapping(i);
-+			u32 tx_cur = tx_time[queue];
-+			u32 rx_cur = rx_time[queue];
- 			u8 tid = ac_to_tid[i];
- 
- 			if (!tx_cur && !rx_cur)
-@@ -245,8 +245,38 @@ void mt7915_mac_enable_rtscts(struct mt7915_dev *dev,
- 		mt76_clear(dev, addr, BIT(5));
- }
- 
-+static void
-+mt7915_wed_check_ppe(struct mt7915_dev *dev, struct mt76_queue *q,
-+		     struct mt7915_sta *msta, struct sk_buff *skb,
-+		     u32 info)
-+{
-+	struct ieee80211_vif *vif;
-+	struct wireless_dev *wdev;
-+	u32 hash, reason;
-+
-+	if (!msta || !msta->vif)
-+		return;
-+
-+	if (!(q->flags & MT_QFLAG_WED) ||
-+	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) != MT76_WED_Q_RX)
-+		return;
-+
-+	if (!(info & MT_DMA_INFO_PPE_VLD))
-+		return;
-+
-+	vif = container_of((void *)msta->vif, struct ieee80211_vif,
-+			   drv_priv);
-+	wdev = ieee80211_vif_to_wdev(vif);
-+	skb->dev = wdev->netdev;
-+
-+	reason = FIELD_GET(MT_DMA_PPE_CPU_REASON, info);
-+	hash = FIELD_GET(MT_DMA_PPE_ENTRY, info);
-+	mtk_wed_device_ppe_check(&dev->mt76.mmio.wed, skb, reason, hash);
-+}
-+
- static int
--mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
-+mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
-+		   enum mt76_rxq_id q, u32 *info)
- {
- 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
- 	struct mt76_phy *mphy = &dev->mt76.phy;
-@@ -513,6 +543,8 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
- 		}
- 	} else {
- 		status->flag |= RX_FLAG_8023;
-+		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
-+				     *info);
- 	}
- 
- 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
-@@ -1096,7 +1128,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
- }
- 
- void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 *info)
- {
- 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-@@ -1130,7 +1162,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
- 		dev_kfree_skb(skb);
- 		break;
- 	case PKT_TYPE_NORMAL:
--		if (!mt7915_mac_fill_rx(dev, skb)) {
-+		if (!mt7915_mac_fill_rx(dev, skb, q, info)) {
- 			mt76_rx(&dev->mt76, q, skb);
- 			return;
- 		}
-@@ -1228,18 +1260,18 @@ void mt7915_mac_set_timing(struct mt7915_phy *phy)
- 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
- }
- 
--void mt7915_mac_enable_nf(struct mt7915_dev *dev, bool ext_phy)
-+void mt7915_mac_enable_nf(struct mt7915_dev *dev, bool band)
- {
- 	u32 reg;
- 
--	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RXTD12(ext_phy) :
--		MT_WF_PHY_RXTD12_MT7916(ext_phy);
-+	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RXTD12(band) :
-+				      MT_WF_PHY_RXTD12_MT7916(band);
- 	mt76_set(dev, reg,
- 		 MT_WF_PHY_RXTD12_IRPI_SW_CLR_ONLY |
- 		 MT_WF_PHY_RXTD12_IRPI_SW_CLR);
- 
--	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RX_CTRL1(ext_phy) :
--		MT_WF_PHY_RX_CTRL1_MT7916(ext_phy);
-+	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RX_CTRL1(band) :
-+				      MT_WF_PHY_RX_CTRL1_MT7916(band);
- 	mt76_set(dev, reg, FIELD_PREP(MT_WF_PHY_RX_CTRL1_IPI_EN, 0x5));
- }
- 
-@@ -1354,7 +1386,6 @@ mt7915_mac_restart(struct mt7915_dev *dev)
- 	struct mt76_phy *ext_phy;
- 	struct mt76_dev *mdev = &dev->mt76;
- 	int i, ret;
--	u32 irq_mask;
- 
- 	ext_phy = dev->mt76.phys[MT_BAND1];
- 	phy2 = ext_phy ? ext_phy->priv : NULL;
-@@ -1412,7 +1443,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
- 	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
- 
- 	if (dev->hif2) {
--		mt76_wr(dev, MT_INT1_MASK_CSR, irq_mask);
-+		mt76_wr(dev, MT_INT1_MASK_CSR, dev->mt76.mmio.irqmask);
- 		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
- 	}
- 	if (dev_is_pci(mdev->dev)) {
-@@ -1949,7 +1980,6 @@ void mt7915_mac_update_stats(struct mt7915_phy *phy)
- static void mt7915_mac_severe_check(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
--	bool ext_phy = phy != &dev->phy;
- 	u32 trb;
- 
- 	if (!phy->omac_mask)
-@@ -1967,7 +1997,7 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
- 	     FIELD_GET(MT_TRB_RXPSR0_RX_WTBL_PTR, phy->trb_ts)) &&
- 	    trb == phy->trb_ts)
- 		mt7915_mcu_set_ser(dev, SER_RECOVER, SER_SET_RECOVER_L3_RX_ABORT,
--				   ext_phy);
-+				   phy->band_idx);
- 
- 	phy->trb_ts = trb;
- }
-diff --git a/mt7915/main.c b/mt7915/main.c
-index fe5ec166..2505fa7e 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -30,31 +30,31 @@ int mt7915_run(struct ieee80211_hw *hw)
- 	running = mt7915_dev_running(dev);
- 
- 	if (!running) {
--		ret = mt76_connac_mcu_set_pm(&dev->mt76, 0, 0);
-+		ret = mt76_connac_mcu_set_pm(&dev->mt76, dev->phy.band_idx, 0);
- 		if (ret)
- 			goto out;
- 
--		ret = mt7915_mcu_set_mac(dev, 0, true, true);
-+		ret = mt7915_mcu_set_mac(dev, dev->phy.band_idx, true, true);
- 		if (ret)
- 			goto out;
- 
--		mt7915_mac_enable_nf(dev, 0);
-+		mt7915_mac_enable_nf(dev, dev->phy.band_idx);
- 	}
- 
--	if (phy != &dev->phy || phy->band_idx) {
--		ret = mt76_connac_mcu_set_pm(&dev->mt76, 1, 0);
-+	if (phy != &dev->phy) {
-+		ret = mt76_connac_mcu_set_pm(&dev->mt76, phy->band_idx, 0);
- 		if (ret)
- 			goto out;
- 
--		ret = mt7915_mcu_set_mac(dev, 1, true, true);
-+		ret = mt7915_mcu_set_mac(dev, phy->band_idx, true, true);
- 		if (ret)
- 			goto out;
- 
--		mt7915_mac_enable_nf(dev, 1);
-+		mt7915_mac_enable_nf(dev, phy->band_idx);
- 	}
- 
- 	ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, 0x92b,
--					     phy != &dev->phy);
-+					     phy->band_idx);
- 	if (ret)
- 		goto out;
- 
-@@ -107,13 +107,13 @@ static void mt7915_stop(struct ieee80211_hw *hw)
- 	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
- 
- 	if (phy != &dev->phy) {
--		mt76_connac_mcu_set_pm(&dev->mt76, 1, 1);
--		mt7915_mcu_set_mac(dev, 1, false, false);
-+		mt76_connac_mcu_set_pm(&dev->mt76, phy->band_idx, 1);
-+		mt7915_mcu_set_mac(dev, phy->band_idx, false, false);
- 	}
- 
- 	if (!mt7915_dev_running(dev)) {
--		mt76_connac_mcu_set_pm(&dev->mt76, 0, 1);
--		mt7915_mcu_set_mac(dev, 0, false, false);
-+		mt76_connac_mcu_set_pm(&dev->mt76, dev->phy.band_idx, 1);
-+		mt7915_mcu_set_mac(dev, dev->phy.band_idx, false, false);
- 	}
- 
- 	mutex_unlock(&dev->mt76.mutex);
-@@ -440,7 +440,6 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
- {
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
- 	int ret;
- 
- 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-@@ -468,6 +467,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
- 
- 	if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
- 		bool enabled = !!(hw->conf.flags & IEEE80211_CONF_MONITOR);
-+		bool band = phy->band_idx;
- 
- 		if (!enabled)
- 			phy->rxfilter |= MT_WF_RFCR_DROP_OTHER_UC;
-@@ -505,7 +505,7 @@ static void mt7915_configure_filter(struct ieee80211_hw *hw,
- {
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	u32 ctl_flags = MT_WF_RFCR1_DROP_ACK |
- 			MT_WF_RFCR1_DROP_BF_POLL |
- 			MT_WF_RFCR1_DROP_BA |
-@@ -600,10 +600,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
- 		mt7915_mcu_add_sta(dev, vif, NULL, join);
- 	}
- 
--	if (changed & BSS_CHANGED_ASSOC) {
-+	if (changed & BSS_CHANGED_ASSOC)
- 		mt7915_mcu_add_bss_info(phy, vif, info->assoc);
--		mt7915_mcu_add_obss_spr(dev, vif, info->he_obss_pd.enable);
--	}
- 
- 	if (changed & BSS_CHANGED_ERP_CTS_PROT)
- 		mt7915_mac_enable_rtscts(dev, vif, info->use_cts_prot);
-@@ -627,7 +625,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
- 		mt7915_mcu_set_tx(dev, vif);
- 
- 	if (changed & BSS_CHANGED_HE_OBSS_PD)
--		mt7915_mcu_add_obss_spr(dev, vif, info->he_obss_pd.enable);
-+		mt7915_mcu_add_obss_spr(phy, vif, &info->he_obss_pd);
- 
- 	if (changed & BSS_CHANGED_HE_BSS_COLOR)
- 		mt7915_update_bss_color(hw, vif, &info->he_bss_color);
-@@ -744,7 +742,7 @@ static int mt7915_set_rts_threshold(struct ieee80211_hw *hw, u32 val)
- 	int ret;
- 
- 	mutex_lock(&dev->mt76.mutex);
--	ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, val, phy != &dev->phy);
-+	ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, val, phy->band_idx);
- 	mutex_unlock(&dev->mt76.mutex);
- 
- 	return ret;
-@@ -847,7 +845,7 @@ u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif)
- {
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -892,7 +890,7 @@ mt7915_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -923,7 +921,7 @@ mt7915_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -1036,6 +1034,14 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
- 
- 		sinfo->tx_retries = msta->wcid.stats.tx_retries;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
-+
-+		if (mtk_wed_get_rx_capa(&phy->dev->mt76.mmio.wed)) {
-+			sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
-+			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
-+
-+			sinfo->rx_packets = msta->wcid.stats.rx_packets;
-+			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
-+		}
- 	}
- 
- 	sinfo->ack_signal = (s8)msta->ack_signal;
-@@ -1127,6 +1133,39 @@ static void mt7915_sta_set_decap_offload(struct ieee80211_hw *hw,
- 	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
- }
- 
-+static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
-+				struct ieee80211_vif *vif,
-+				struct ieee80211_sta *sta)
-+{
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-+	s16 txpower = sta->txpwr.power;
-+	int ret;
-+
-+	if (sta->txpwr.type == NL80211_TX_POWER_AUTOMATIC)
-+		txpower = 0;
-+
-+	mutex_lock(&dev->mt76.mutex);
-+
-+	/* NOTE: temporarily use 0 as minimum limit, which is a
-+	 * global setting and will be applied to all stations.
-+	 */
-+	ret = mt7915_mcu_set_txpower_frame_min(phy, 0);
-+	if (ret)
-+		goto out;
-+
-+	/* This only applies to data frames while pushing traffic,
-+	 * whereas the management frames or other packets that are
-+	 * using fixed rate can be configured via TxD.
-+	 */
-+	ret = mt7915_mcu_set_txpower_frame(phy, vif, sta, txpower);
-+
-+out:
-+	mutex_unlock(&dev->mt76.mutex);
-+
-+	return ret;
-+}
-+
- static const char mt7915_gstrings_stats[][ETH_GSTRING_LEN] = {
- 	"tx_ampdu_cnt",
- 	"tx_stop_q_empty_cnt",
-@@ -1492,6 +1531,7 @@ const struct ieee80211_ops mt7915_ops = {
- 	.set_bitrate_mask = mt7915_set_bitrate_mask,
- 	.set_coverage_class = mt7915_set_coverage_class,
- 	.sta_statistics = mt7915_sta_statistics,
-+	.sta_set_txpwr = mt7915_sta_set_txpwr,
- 	.sta_set_4addr = mt7915_sta_set_4addr,
- 	.sta_set_decap_offload = mt7915_sta_set_decap_offload,
- 	.add_twt_setup = mt7915_mac_add_twt_setup,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 09e3dd8e..36c21596 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -32,6 +32,10 @@
- #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
- #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
- 
-+static bool sr_scene_detect = true;
-+module_param(sr_scene_detect, bool, 0644);
-+MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
-+
- static u8
- mt7915_mcu_get_sta_nss(u16 mcs_map)
- {
-@@ -595,7 +599,7 @@ mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 		.mode = !!mask || enable,
- 		.entry_count = 1,
- 		.write = 1,
--		.band = phy != &dev->phy,
-+		.band = phy->band_idx,
- 		.index = idx * 2 + bssid,
- 	};
- 
-@@ -1131,7 +1135,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
- 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
- 
--		bf->ncol_bw160 = nss_mcs;
-+		bf->ncol_gt_bw80 = nss_mcs;
- 	}
- 
- 	if (pe->phy_cap_info[0] &
-@@ -1139,10 +1143,10 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
- 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
- 
--		if (bf->ncol_bw160)
--			bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
-+		if (bf->ncol_gt_bw80)
-+			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
- 		else
--			bf->ncol_bw160 = nss_mcs;
-+			bf->ncol_gt_bw80 = nss_mcs;
- 	}
- 
- 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
-@@ -1150,7 +1154,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
- 		     pe->phy_cap_info[4]);
- 
--	bf->nrow_bw160 = min_t(int, snd_dim, sts);
-+	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
- }
- 
- static void
-@@ -1677,10 +1681,32 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 		return ret;
- 	}
- out:
-+	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
-+	if (ret)
-+		return ret;
-+
- 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
- }
- 
-+int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
-+{
-+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
-+	struct {
-+		__le32 args[2];
-+	} req = {
-+		.args[0] = cpu_to_le32(1),
-+		.args[1] = cpu_to_le32(6),
-+	};
-+
-+	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
-+					 &req, sizeof(req));
-+#else
-+	return 0;
-+#endif
-+}
-+
- int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
- 			    struct ieee80211_vif *vif, bool enable)
- {
-@@ -1689,7 +1715,7 @@ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
- 	struct {
- 		struct req_hdr {
- 			u8 omac_idx;
--			u8 dbdc_idx;
-+			u8 band_idx;
- 			__le16 tlv_num;
- 			u8 is_tlv_append;
- 			u8 rsv[3];
-@@ -1698,13 +1724,13 @@ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
- 			__le16 tag;
- 			__le16 len;
- 			u8 active;
--			u8 dbdc_idx;
-+			u8 band_idx;
- 			u8 omac_addr[ETH_ALEN];
- 		} __packed tlv;
- 	} data = {
- 		.hdr = {
- 			.omac_idx = mvif->mt76.omac_idx,
--			.dbdc_idx = mvif->mt76.band_idx,
-+			.band_idx = mvif->mt76.band_idx,
- 			.tlv_num = cpu_to_le16(1),
- 			.is_tlv_append = 1,
- 		},
-@@ -1712,7 +1738,7 @@ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
- 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
- 			.len = cpu_to_le16(sizeof(struct req_tlv)),
- 			.active = enable,
--			.dbdc_idx = mvif->mt76.band_idx,
-+			.band_idx = mvif->mt76.band_idx,
- 		},
- 	};
- 
-@@ -2559,7 +2585,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
- 		req.monitor_central_chan =
- 			ieee80211_frequency_to_channel(chandef->center_freq1);
- 		req.monitor_bw = mt76_connac_chan_bw(chandef);
--		req.band_idx = phy != &dev->phy;
-+		req.band_idx = phy->band_idx;
- 		req.scan_mode = 1;
- 		break;
- 	}
-@@ -2567,7 +2593,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
- 		req.monitor_chan = chandef->chan->hw_value;
- 		req.monitor_central_chan =
- 			ieee80211_frequency_to_channel(chandef->center_freq1);
--		req.band_idx = phy != &dev->phy;
-+		req.band_idx = phy->band_idx;
- 		req.scan_mode = 2;
- 		break;
- 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
-@@ -2971,7 +2997,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
- 	}
- 
- 	for (i = 0; i < 5; i++) {
--		req[i].band = cpu_to_le32(phy != &dev->phy);
-+		req[i].band = cpu_to_le32(phy->band_idx);
- 		req[i].offs = cpu_to_le32(offs[i + start]);
- 
- 		if (!is_mt7915(&dev->mt76) && i == 3)
-@@ -3016,11 +3042,11 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
- 	struct {
- 		u8 ctrl_id;
- 		u8 action;
--		u8 dbdc_idx;
-+		u8 band_idx;
- 		u8 rsv[5];
- 	} req = {
- 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
--		.dbdc_idx = phy != &dev->phy,
-+		.band_idx = phy->band_idx,
- 	};
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
-@@ -3079,6 +3105,88 @@ out:
- 				 &req, sizeof(req), false);
- }
- 
-+int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 format_id;
-+		u8 rsv;
-+		u8 band_idx;
-+		s8 txpower_min;
-+	} __packed req = {
-+		.format_id = TX_POWER_LIMIT_FRAME_MIN,
-+		.band_idx = phy->band_idx,
-+		.txpower_min = txpower * 2, /* 0.5db */
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76,
-+				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
-+				 sizeof(req), true);
-+}
-+
-+int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
-+				 struct ieee80211_vif *vif,
-+				 struct ieee80211_sta *sta, s8 txpower)
-+{
-+	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_phy *mphy = phy->mt76;
-+	struct {
-+		u8 format_id;
-+		u8 rsv[3];
-+		u8 band_idx;
-+		s8 txpower_max;
-+		__le16 wcid;
-+		s8 txpower_offs[48];
-+	} __packed req = {
-+		.format_id = TX_POWER_LIMIT_FRAME,
-+		.band_idx = phy->band_idx,
-+		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
-+		.wcid = cpu_to_le16(msta->wcid.idx),
-+	};
-+	int ret, n_chains = hweight8(mphy->antenna_mask);
-+	s8 txpower_sku[MT7915_SKU_RATE_NUM];
-+
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
-+	if (ret)
-+		return ret;
-+
-+	txpower = txpower * 2 - mt76_tx_power_nss_delta(n_chains);
-+	if (txpower > mphy->txpower_cur || txpower < 0)
-+		return -EINVAL;
-+
-+	if (txpower) {
-+		u32 offs, len, i;
-+
-+		if (sta->ht_cap.ht_supported) {
-+			const u8 *sku_len = mt7915_sku_group_len;
-+
-+			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
-+			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
-+
-+			if (sta->vht_cap.vht_supported) {
-+				offs += len;
-+				len = sku_len[SKU_VHT_BW20] * 4;
-+
-+				if (sta->he_cap.has_he) {
-+					offs += len + sku_len[SKU_HE_RU26] * 3;
-+					len = sku_len[SKU_HE_RU242] * 4;
-+				}
-+			}
-+		} else {
-+			return -EINVAL;
-+		}
-+
-+		for (i = 0; i < len; i++, offs++)
-+			req.txpower_offs[i] =
-+				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
-+	}
-+
-+	return mt76_mcu_send_msg(&dev->mt76,
-+				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
-+				 sizeof(req), true);
-+}
-+
- int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
-@@ -3087,11 +3195,11 @@ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
- 	struct mt7915_sku_val {
- 		u8 format_id;
- 		u8 limit_type;
--		u8 dbdc_idx;
-+		u8 band_idx;
- 		s8 val[MT7915_SKU_RATE_NUM];
- 	} __packed req = {
--		.format_id = 4,
--		.dbdc_idx = phy != &dev->phy,
-+		.format_id = TX_POWER_LIMIT_TABLE,
-+		.band_idx = phy->band_idx,
- 	};
- 	struct mt76_power_limits limits_array;
- 	s8 *la = (s8 *)&limits_array;
-@@ -3137,14 +3245,14 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
- 	struct {
- 		u8 format_id;
- 		u8 category;
--		u8 band;
-+		u8 band_idx;
- 		u8 _rsv;
- 	} __packed req = {
--		.format_id = 7,
-+		.format_id = TX_POWER_LIMIT_INFO,
- 		.category = RATE_POWER_INFO,
--		.band = phy != &dev->phy,
-+		.band_idx = phy->band_idx,
- 	};
--	s8 res[MT7915_SKU_RATE_NUM][2];
-+	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
- 	struct sk_buff *skb;
- 	int ret, i;
- 
-@@ -3154,9 +3262,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
- 	if (ret)
- 		return ret;
- 
--	memcpy(res, skb->data + 4, sizeof(res));
-+	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
- 	for (i = 0; i < len; i++)
--		txpower[i] = res[i][req.band];
-+		txpower[i] = txpower_sku[i][req.band_idx];
- 
- 	dev_kfree_skb(skb);
- 
-@@ -3191,11 +3299,11 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
- 	struct mt7915_sku {
- 		u8 format_id;
- 		u8 sku_enable;
--		u8 dbdc_idx;
-+		u8 band_idx;
- 		u8 rsv;
- 	} __packed req = {
--		.format_id = 0,
--		.dbdc_idx = phy != &dev->phy,
-+		.format_id = TX_POWER_LIMIT_ENABLE,
-+		.band_idx = phy->band_idx,
- 		.sku_enable = enable,
- 	};
- 
-@@ -3270,31 +3378,193 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
- 				 sizeof(req), true);
- }
- 
--int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
--			    bool enable)
-+static int
-+mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_mcu_sr_ctrl req = {
-+		.action = action,
-+		.argnum = 1,
-+		.band_idx = phy->band_idx,
-+		.val = cpu_to_le32(val),
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
-+				 sizeof(req), true);
-+}
-+
-+static int
-+mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
-+			   struct ieee80211_he_obss_pd *he_obss_pd)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		struct mt7915_mcu_sr_ctrl ctrl;
-+		struct {
-+			u8 pd_th_non_srg;
-+			u8 pd_th_srg;
-+			u8 period_offs;
-+			u8 rcpi_src;
-+			__le16 obss_pd_min;
-+			__le16 obss_pd_min_srg;
-+			u8 resp_txpwr_mode;
-+			u8 txpwr_restrict_mode;
-+			u8 txpwr_ref;
-+			u8 rsv[3];
-+		} __packed param;
-+	} __packed req = {
-+		.ctrl = {
-+			.action = SPR_SET_PARAM,
-+			.argnum = 9,
-+			.band_idx = phy->band_idx,
-+		},
-+	};
-+	int ret;
-+	u8 max_th = 82, non_srg_max_th = 62;
-+
-+	/* disable firmware dynamical PD asjustment */
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
-+	if (ret)
-+		return ret;
-+
-+	if (he_obss_pd->sr_ctrl &
-+	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
-+		req.param.pd_th_non_srg = max_th;
-+	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
-+		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
-+	else
-+		req.param.pd_th_non_srg  = non_srg_max_th;
-+
-+	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
-+		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
-+
-+	req.param.obss_pd_min = 82;
-+	req.param.obss_pd_min_srg = 82;
-+	req.param.txpwr_restrict_mode = 2;
-+	req.param.txpwr_ref = 21;
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
-+				 sizeof(req), true);
-+}
-+
-+static int
-+mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
-+			     struct ieee80211_he_obss_pd *he_obss_pd)
- {
--#define MT_SPR_ENABLE		1
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mt7915_dev *dev = phy->dev;
-+	u8 omac = mvif->mt76.omac_idx;
- 	struct {
--		u8 action;
--		u8 arg_num;
--		u8 band_idx;
--		u8 status;
--		u8 drop_tx_idx;
--		u8 sta_idx;	/* 256 sta */
--		u8 rsv[2];
--		__le32 val;
-+		struct mt7915_mcu_sr_ctrl ctrl;
-+		struct {
-+			u8 omac;
-+			u8 rsv[3];
-+			u8 flag[20];
-+		} __packed siga;
- 	} __packed req = {
--		.action = MT_SPR_ENABLE,
--		.arg_num = 1,
--		.band_idx = mvif->mt76.band_idx,
--		.val = cpu_to_le32(enable),
-+		.ctrl = {
-+			.action = SPR_SET_SIGA,
-+			.argnum = 1,
-+			.band_idx = phy->band_idx,
-+		},
-+		.siga = {
-+			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
-+		},
- 	};
-+	int ret;
-+
-+	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
-+		req.siga.flag[req.siga.omac] = 0xf;
-+	else
-+		return 0;
-+
-+	/* switch to normal AP mode */
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
-+	if (ret)
-+		return ret;
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
- 				 sizeof(req), true);
- }
- 
-+static int
-+mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
-+			       struct ieee80211_he_obss_pd *he_obss_pd)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		struct mt7915_mcu_sr_ctrl ctrl;
-+		struct {
-+			__le32 color_l[2];
-+			__le32 color_h[2];
-+			__le32 bssid_l[2];
-+			__le32 bssid_h[2];
-+		} __packed bitmap;
-+	} __packed req = {
-+		.ctrl = {
-+			.action = SPR_SET_SRG_BITMAP,
-+			.argnum = 4,
-+			.band_idx = phy->band_idx,
-+		},
-+	};
-+	u32 bitmap;
-+
-+	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
-+	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
-+
-+	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
-+	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
-+
-+	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
-+	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
-+
-+	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
-+	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
-+				 sizeof(req), true);
-+}
-+
-+int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
-+			    struct ieee80211_he_obss_pd *he_obss_pd)
-+{
-+	int ret;
-+
-+	/* enable firmware scene detection algorithms */
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
-+	if (ret)
-+		return ret;
-+
-+	/* enable spatial reuse */
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
-+	if (ret)
-+		return ret;
-+
-+	if (!he_obss_pd->enable)
-+		return 0;
-+
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
-+	if (ret)
-+		return ret;
-+
-+	/* firmware dynamically adjusts PD threshold so skip manual control */
-+	if (sr_scene_detect)
-+		return 0;
-+
-+	/* set SRG/non-SRG OBSS PD threshold */
-+	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
-+	if (ret)
-+		return ret;
-+
-+	/* Set SR prohibit */
-+	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
-+	if (ret)
-+		return ret;
-+
-+	/* set SRG BSS color/BSSID bitmap */
-+	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
-+}
-+
- int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 			   struct ieee80211_sta *sta, struct rate_info *rate)
- {
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c19b5d66..46c517e5 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -129,6 +129,17 @@ struct mt7915_mcu_background_chain_ctrl {
- 	u8 rsv[2];
- } __packed;
- 
-+struct mt7915_mcu_sr_ctrl {
-+	u8 action;
-+	u8 argnum;
-+	u8 band_idx;
-+	u8 status;
-+	u8 drop_ta_idx;
-+	u8 sta_idx;	/* 256 sta */
-+	u8 rsv[2];
-+	__le32 val;
-+} __packed;
-+
- struct mt7915_mcu_eeprom {
- 	u8 buffer_mode;
- 	u8 format;
-@@ -408,6 +419,25 @@ enum {
- #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
- #define RATE_CFG_HE_LTF			GENMASK(31, 28)
- 
-+enum {
-+	TX_POWER_LIMIT_ENABLE,
-+	TX_POWER_LIMIT_TABLE = 0x4,
-+	TX_POWER_LIMIT_INFO = 0x7,
-+	TX_POWER_LIMIT_FRAME = 0x11,
-+	TX_POWER_LIMIT_FRAME_MIN = 0x12,
-+};
-+
-+enum {
-+	SPR_ENABLE = 0x1,
-+	SPR_ENABLE_SD = 0x3,
-+	SPR_ENABLE_MODE = 0x5,
-+	SPR_ENABLE_DPD = 0x23,
-+	SPR_ENABLE_TX = 0x25,
-+	SPR_SET_SRG_BITMAP = 0x80,
-+	SPR_SET_PARAM = 0xc2,
-+	SPR_SET_SIGA = 0xdc,
-+};
-+
- enum {
- 	THERMAL_PROTECT_PARAMETER_CTRL,
- 	THERMAL_PROTECT_BASIC_INFO,
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 3c840853..3b4ede3b 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -9,107 +9,112 @@
- #include "mt7915.h"
- #include "mac.h"
- #include "../trace.h"
-+#include "../dma.h"
- 
- static bool wed_enable;
- module_param(wed_enable, bool, 0644);
-+MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
- 
- static const u32 mt7915_reg[] = {
--	[INT_SOURCE_CSR]	= 0xd7010,
--	[INT_MASK_CSR]		= 0xd7014,
--	[INT1_SOURCE_CSR]	= 0xd7088,
--	[INT1_MASK_CSR]		= 0xd708c,
--	[INT_MCU_CMD_SOURCE]	= 0xd51f0,
--	[INT_MCU_CMD_EVENT]	= 0x3108,
--	[WFDMA0_ADDR]		= 0xd4000,
--	[WFDMA0_PCIE1_ADDR]	= 0xd8000,
--	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
--	[CBTOP1_PHY_END]	= 0x77ffffff,
--	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
--	[FW_ASSERT_STAT_ADDR]	= 0x219848,
--	[FW_EXCEPT_TYPE_ADDR]	= 0x21987c,
--	[FW_EXCEPT_COUNT_ADDR]	= 0x219848,
--	[FW_CIRQ_COUNT_ADDR]	= 0x216f94,
--	[FW_CIRQ_IDX_ADDR]	= 0x216ef8,
--	[FW_CIRQ_LISR_ADDR]	= 0x2170ac,
--	[FW_TASK_ID_ADDR]	= 0x216f90,
--	[FW_TASK_IDX_ADDR]	= 0x216f9c,
--	[FW_TASK_QID1_ADDR]	= 0x219680,
--	[FW_TASK_QID2_ADDR]	= 0x219760,
--	[FW_TASK_START_ADDR]	= 0x219558,
--	[FW_TASK_END_ADDR]	= 0x219554,
--	[FW_TASK_SIZE_ADDR]	= 0x219560,
--	[FW_LAST_MSG_ID_ADDR]	= 0x216f70,
--	[FW_EINT_INFO_ADDR]	= 0x219818,
--	[FW_SCHED_INFO_ADDR]	= 0x219828,
--	[SWDEF_BASE_ADDR]	= 0x41f200,
--	[TXQ_WED_RING_BASE]	= 0xd7300,
--	[RXQ_WED_RING_BASE]	= 0xd7410,
-+	[INT_SOURCE_CSR]		= 0xd7010,
-+	[INT_MASK_CSR]			= 0xd7014,
-+	[INT1_SOURCE_CSR]		= 0xd7088,
-+	[INT1_MASK_CSR]			= 0xd708c,
-+	[INT_MCU_CMD_SOURCE]		= 0xd51f0,
-+	[INT_MCU_CMD_EVENT]		= 0x3108,
-+	[WFDMA0_ADDR]			= 0xd4000,
-+	[WFDMA0_PCIE1_ADDR]		= 0xd8000,
-+	[WFDMA_EXT_CSR_ADDR]		= 0xd7000,
-+	[CBTOP1_PHY_END]		= 0x77ffffff,
-+	[INFRA_MCU_ADDR_END]		= 0x7c3fffff,
-+	[FW_ASSERT_STAT_ADDR]		= 0x219848,
-+	[FW_EXCEPT_TYPE_ADDR]		= 0x21987c,
-+	[FW_EXCEPT_COUNT_ADDR]		= 0x219848,
-+	[FW_CIRQ_COUNT_ADDR]		= 0x216f94,
-+	[FW_CIRQ_IDX_ADDR]		= 0x216ef8,
-+	[FW_CIRQ_LISR_ADDR]		= 0x2170ac,
-+	[FW_TASK_ID_ADDR]		= 0x216f90,
-+	[FW_TASK_IDX_ADDR]		= 0x216f9c,
-+	[FW_TASK_QID1_ADDR]		= 0x219680,
-+	[FW_TASK_QID2_ADDR]		= 0x219760,
-+	[FW_TASK_START_ADDR]		= 0x219558,
-+	[FW_TASK_END_ADDR]		= 0x219554,
-+	[FW_TASK_SIZE_ADDR]		= 0x219560,
-+	[FW_LAST_MSG_ID_ADDR]		= 0x216f70,
-+	[FW_EINT_INFO_ADDR]		= 0x219818,
-+	[FW_SCHED_INFO_ADDR]		= 0x219828,
-+	[SWDEF_BASE_ADDR]		= 0x41f200,
-+	[TXQ_WED_RING_BASE]		= 0xd7300,
-+	[RXQ_WED_RING_BASE]		= 0xd7410,
-+	[RXQ_WED_DATA_RING_BASE]	= 0xd4500,
- };
- 
- static const u32 mt7916_reg[] = {
--	[INT_SOURCE_CSR]	= 0xd4200,
--	[INT_MASK_CSR]		= 0xd4204,
--	[INT1_SOURCE_CSR]	= 0xd8200,
--	[INT1_MASK_CSR]		= 0xd8204,
--	[INT_MCU_CMD_SOURCE]	= 0xd41f0,
--	[INT_MCU_CMD_EVENT]	= 0x2108,
--	[WFDMA0_ADDR]		= 0xd4000,
--	[WFDMA0_PCIE1_ADDR]	= 0xd8000,
--	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
--	[CBTOP1_PHY_END]	= 0x7fffffff,
--	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
--	[FW_ASSERT_STAT_ADDR]	= 0x02204c14,
--	[FW_EXCEPT_TYPE_ADDR]	= 0x022051a4,
--	[FW_EXCEPT_COUNT_ADDR]	= 0x022050bc,
--	[FW_CIRQ_COUNT_ADDR]	= 0x022001ac,
--	[FW_CIRQ_IDX_ADDR]	= 0x02204f84,
--	[FW_CIRQ_LISR_ADDR]	= 0x022050d0,
--	[FW_TASK_ID_ADDR]	= 0x0220406c,
--	[FW_TASK_IDX_ADDR]	= 0x0220500c,
--	[FW_TASK_QID1_ADDR]	= 0x022028c8,
--	[FW_TASK_QID2_ADDR]	= 0x02202a38,
--	[FW_TASK_START_ADDR]	= 0x0220286c,
--	[FW_TASK_END_ADDR]	= 0x02202870,
--	[FW_TASK_SIZE_ADDR]	= 0x02202878,
--	[FW_LAST_MSG_ID_ADDR]	= 0x02204fe8,
--	[FW_EINT_INFO_ADDR]	= 0x0220525c,
--	[FW_SCHED_INFO_ADDR]	= 0x0220516c,
--	[SWDEF_BASE_ADDR]	= 0x411400,
--	[TXQ_WED_RING_BASE]	= 0xd7300,
--	[RXQ_WED_RING_BASE]	= 0xd7410,
-+	[INT_SOURCE_CSR]		= 0xd4200,
-+	[INT_MASK_CSR]			= 0xd4204,
-+	[INT1_SOURCE_CSR]		= 0xd8200,
-+	[INT1_MASK_CSR]			= 0xd8204,
-+	[INT_MCU_CMD_SOURCE]		= 0xd41f0,
-+	[INT_MCU_CMD_EVENT]		= 0x2108,
-+	[WFDMA0_ADDR]			= 0xd4000,
-+	[WFDMA0_PCIE1_ADDR]		= 0xd8000,
-+	[WFDMA_EXT_CSR_ADDR]		= 0xd7000,
-+	[CBTOP1_PHY_END]		= 0x7fffffff,
-+	[INFRA_MCU_ADDR_END]		= 0x7c085fff,
-+	[FW_ASSERT_STAT_ADDR]		= 0x02204c14,
-+	[FW_EXCEPT_TYPE_ADDR]		= 0x022051a4,
-+	[FW_EXCEPT_COUNT_ADDR]		= 0x022050bc,
-+	[FW_CIRQ_COUNT_ADDR]		= 0x022001ac,
-+	[FW_CIRQ_IDX_ADDR]		= 0x02204f84,
-+	[FW_CIRQ_LISR_ADDR]		= 0x022050d0,
-+	[FW_TASK_ID_ADDR]		= 0x0220406c,
-+	[FW_TASK_IDX_ADDR]		= 0x0220500c,
-+	[FW_TASK_QID1_ADDR]		= 0x022028c8,
-+	[FW_TASK_QID2_ADDR]		= 0x02202a38,
-+	[FW_TASK_START_ADDR]		= 0x0220286c,
-+	[FW_TASK_END_ADDR]		= 0x02202870,
-+	[FW_TASK_SIZE_ADDR]		= 0x02202878,
-+	[FW_LAST_MSG_ID_ADDR]		= 0x02204fe8,
-+	[FW_EINT_INFO_ADDR]		= 0x0220525c,
-+	[FW_SCHED_INFO_ADDR]		= 0x0220516c,
-+	[SWDEF_BASE_ADDR]		= 0x411400,
-+	[TXQ_WED_RING_BASE]		= 0xd7300,
-+	[RXQ_WED_RING_BASE]		= 0xd7410,
-+	[RXQ_WED_DATA_RING_BASE]	= 0xd4540,
- };
- 
- static const u32 mt7986_reg[] = {
--	[INT_SOURCE_CSR]	= 0x24200,
--	[INT_MASK_CSR]		= 0x24204,
--	[INT1_SOURCE_CSR]	= 0x28200,
--	[INT1_MASK_CSR]		= 0x28204,
--	[INT_MCU_CMD_SOURCE]	= 0x241f0,
--	[INT_MCU_CMD_EVENT]	= 0x54000108,
--	[WFDMA0_ADDR]		= 0x24000,
--	[WFDMA0_PCIE1_ADDR]	= 0x28000,
--	[WFDMA_EXT_CSR_ADDR]	= 0x27000,
--	[CBTOP1_PHY_END]	= 0x7fffffff,
--	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
--	[FW_ASSERT_STAT_ADDR]	= 0x02204b54,
--	[FW_EXCEPT_TYPE_ADDR]	= 0x022050dc,
--	[FW_EXCEPT_COUNT_ADDR]	= 0x02204ffc,
--	[FW_CIRQ_COUNT_ADDR]	= 0x022001ac,
--	[FW_CIRQ_IDX_ADDR]	= 0x02204ec4,
--	[FW_CIRQ_LISR_ADDR]	= 0x02205010,
--	[FW_TASK_ID_ADDR]	= 0x02204fac,
--	[FW_TASK_IDX_ADDR]	= 0x02204f4c,
--	[FW_TASK_QID1_ADDR]	= 0x02202814,
--	[FW_TASK_QID2_ADDR]	= 0x02202984,
--	[FW_TASK_START_ADDR]	= 0x022027b8,
--	[FW_TASK_END_ADDR]	= 0x022027bc,
--	[FW_TASK_SIZE_ADDR]	= 0x022027c4,
--	[FW_LAST_MSG_ID_ADDR]	= 0x02204f28,
--	[FW_EINT_INFO_ADDR]	= 0x02205194,
--	[FW_SCHED_INFO_ADDR]	= 0x022051a4,
--	[SWDEF_BASE_ADDR]	= 0x411400,
--	[TXQ_WED_RING_BASE]	= 0x24420,
--	[RXQ_WED_RING_BASE]	= 0x24520,
-+	[INT_SOURCE_CSR]		= 0x24200,
-+	[INT_MASK_CSR]			= 0x24204,
-+	[INT1_SOURCE_CSR]		= 0x28200,
-+	[INT1_MASK_CSR]			= 0x28204,
-+	[INT_MCU_CMD_SOURCE]		= 0x241f0,
-+	[INT_MCU_CMD_EVENT]		= 0x54000108,
-+	[WFDMA0_ADDR]			= 0x24000,
-+	[WFDMA0_PCIE1_ADDR]		= 0x28000,
-+	[WFDMA_EXT_CSR_ADDR]		= 0x27000,
-+	[CBTOP1_PHY_END]		= 0x7fffffff,
-+	[INFRA_MCU_ADDR_END]		= 0x7c085fff,
-+	[FW_ASSERT_STAT_ADDR]		= 0x02204b54,
-+	[FW_EXCEPT_TYPE_ADDR]		= 0x022050dc,
-+	[FW_EXCEPT_COUNT_ADDR]		= 0x02204ffc,
-+	[FW_CIRQ_COUNT_ADDR]		= 0x022001ac,
-+	[FW_CIRQ_IDX_ADDR]		= 0x02204ec4,
-+	[FW_CIRQ_LISR_ADDR]		= 0x02205010,
-+	[FW_TASK_ID_ADDR]		= 0x02204fac,
-+	[FW_TASK_IDX_ADDR]		= 0x02204f4c,
-+	[FW_TASK_QID1_ADDR]		= 0x02202814,
-+	[FW_TASK_QID2_ADDR]		= 0x02202984,
-+	[FW_TASK_START_ADDR]		= 0x022027b8,
-+	[FW_TASK_END_ADDR]		= 0x022027bc,
-+	[FW_TASK_SIZE_ADDR]		= 0x022027c4,
-+	[FW_LAST_MSG_ID_ADDR]		= 0x02204f28,
-+	[FW_EINT_INFO_ADDR]		= 0x02205194,
-+	[FW_SCHED_INFO_ADDR]		= 0x022051a4,
-+	[SWDEF_BASE_ADDR]		= 0x411400,
-+	[TXQ_WED_RING_BASE]		= 0x24420,
-+	[RXQ_WED_RING_BASE]		= 0x24520,
-+	[RXQ_WED_DATA_RING_BASE]	= 0x24540,
- };
- 
- static const u32 mt7915_offs[] = {
-@@ -585,6 +590,105 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
- 		mt76_clear(dev, MT_AGG_ACR4(phy->band_idx),
- 			   MT_AGG_ACR_PPDU_TXS2H);
- }
-+
-+static void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
-+{
-+	struct mt7915_dev *dev;
-+	struct page *page;
-+	int i;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	for (i = 0; i < dev->mt76.rx_token_size; i++) {
-+		struct mt76_txwi_cache *t;
-+
-+		t = mt76_rx_token_release(&dev->mt76, i);
-+		if (!t || !t->ptr)
-+			continue;
-+
-+		dma_unmap_single(dev->mt76.dma_dev, t->dma_addr,
-+				 wed->wlan.rx_size, DMA_FROM_DEVICE);
-+		skb_free_frag(t->ptr);
-+		t->ptr = NULL;
-+
-+		mt76_put_rxwi(&dev->mt76, t);
-+	}
-+
-+	if (!wed->rx_buf_ring.rx_page.va)
-+		return;
-+
-+	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
-+	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
-+	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
-+}
-+
-+static u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
-+{
-+	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
-+	struct mt7915_dev *dev;
-+	u32 length;
-+	int i;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
-+				sizeof(struct skb_shared_info));
-+
-+	for (i = 0; i < size; i++) {
-+		struct mt76_txwi_cache *t = mt76_get_rxwi(&dev->mt76);
-+		dma_addr_t phy_addr;
-+		int token;
-+		void *ptr;
-+
-+		ptr = page_frag_alloc(&wed->rx_buf_ring.rx_page, length,
-+				      GFP_KERNEL);
-+		if (!ptr)
-+			goto unmap;
-+
-+		phy_addr = dma_map_single(dev->mt76.dma_dev, ptr,
-+					  wed->wlan.rx_size,
-+					  DMA_TO_DEVICE);
-+		if (unlikely(dma_mapping_error(dev->mt76.dev, phy_addr))) {
-+			skb_free_frag(ptr);
-+			goto unmap;
-+		}
-+
-+		desc->buf0 = cpu_to_le32(phy_addr);
-+		token = mt76_rx_token_consume(&dev->mt76, ptr, t, phy_addr);
-+		desc->token |= cpu_to_le32(FIELD_PREP(MT_DMA_CTL_TOKEN,
-+						      token));
-+		desc++;
-+	}
-+
-+	return 0;
-+
-+unmap:
-+	mt7915_wed_release_rx_buf(wed);
-+	return -ENOMEM;
-+}
-+
-+static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
-+					    struct mtk_wed_wo_rx_stats *stats)
-+{
-+	int idx = le16_to_cpu(stats->wlan_idx);
-+	struct mt7915_dev *dev;
-+	struct mt76_wcid *wcid;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+
-+	if (idx >= mt7915_wtbl_size(dev))
-+		return;
-+
-+	rcu_read_lock();
-+
-+	wcid = rcu_dereference(dev->mt76.wcid[idx]);
-+	if (wcid) {
-+		wcid->stats.rx_bytes += le32_to_cpu(stats->rx_byte_cnt);
-+		wcid->stats.rx_packets += le32_to_cpu(stats->rx_pkt_cnt);
-+		wcid->stats.rx_errors += le32_to_cpu(stats->rx_err_cnt);
-+		wcid->stats.rx_drops += le32_to_cpu(stats->rx_drop_cnt);
-+	}
-+
-+	rcu_read_unlock();
-+}
- #endif
- 
- int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
-@@ -602,6 +706,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 		wed->wlan.pci_dev = pci_dev;
- 		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
-+		wed->wlan.base = devm_ioremap(dev->mt76.dev,
-+					      pci_resource_start(pci_dev, 0),
-+					      pci_resource_len(pci_dev, 0));
-+		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
- 		wed->wlan.wpdma_int = pci_resource_start(pci_dev, 0) +
- 				      MT_INT_WED_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = pci_resource_start(pci_dev, 0) +
-@@ -612,6 +720,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 				     MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
- 					 MT_RXQ_WED_RING_BASE;
-+		wed->wlan.wpdma_rx_glo = pci_resource_start(pci_dev, 0) +
-+					 MT_WPDMA_GLO_CFG;
-+		wed->wlan.wpdma_rx = pci_resource_start(pci_dev, 0) +
-+				     MT_RXQ_WED_DATA_RING_BASE;
- 	} else {
- 		struct platform_device *plat_dev = pdev_ptr;
- 		struct resource *res;
-@@ -622,19 +734,45 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 		wed->wlan.platform_dev = plat_dev;
- 		wed->wlan.bus_type = MTK_WED_BUS_AXI;
-+		wed->wlan.base = devm_ioremap(dev->mt76.dev, res->start,
-+					      resource_size(res));
-+		wed->wlan.phy_base = res->start;
- 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
- 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
-+		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
-+		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
- 	}
- 	wed->wlan.nbuf = 4096;
- 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
- 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
--	wed->wlan.txfree_tbit = is_mt7915(&dev->mt76) ? 1 : 2;
-+	wed->wlan.txfree_tbit = is_mt7986(&dev->mt76) ? 2 : 1;
- 	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
-+	wed->wlan.wcid_512 = !is_mt7915(&dev->mt76);
-+
-+	wed->wlan.rx_nbuf = 65536;
-+	wed->wlan.rx_npkt = MT7915_WED_RX_TOKEN_SIZE;
-+	wed->wlan.rx_size = SKB_WITH_OVERHEAD(MT_RX_BUF_SIZE);
-+	if (is_mt7915(&dev->mt76)) {
-+		wed->wlan.rx_tbit[0] = 16;
-+		wed->wlan.rx_tbit[1] = 17;
-+	} else if (is_mt7986(&dev->mt76)) {
-+		wed->wlan.rx_tbit[0] = 22;
-+		wed->wlan.rx_tbit[1] = 23;
-+	} else {
-+		wed->wlan.rx_tbit[0] = 18;
-+		wed->wlan.rx_tbit[1] = 19;
-+	}
-+
- 	wed->wlan.init_buf = mt7915_wed_init_buf;
- 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
- 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
-+	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
-+	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
-+	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
-+
-+	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
- 
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9cb680e7..42f21343 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -68,6 +68,8 @@
- #define MT7915_MIN_TWT_DUR 64
- #define MT7915_MAX_QUEUE		(MT_RXQ_BAND2 + __MT_MCUQ_MAX + 2)
- 
-+#define MT7915_WED_RX_TOKEN_SIZE	12288
-+
- struct mt7915_vif;
- struct mt7915_sta;
- struct mt7915_dfs_pulse;
-@@ -501,8 +503,8 @@ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vi
- 				struct cfg80211_he_bss_color *he_bss_color);
- int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			  int enable, u32 changed);
--int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
--                            bool enable);
-+int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
-+			    struct ieee80211_he_obss_pd *he_obss_pd);
- int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 			     struct ieee80211_sta *sta, bool changed);
- int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
-@@ -526,6 +528,10 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
- int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
- int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
- int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
-+int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower);
-+int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
-+				 struct ieee80211_vif *vif,
-+				 struct ieee80211_sta *sta, s8 txpower);
- int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action);
- int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val);
- int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
-@@ -617,7 +623,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 			  struct mt76_tx_info *tx_info);
- void mt7915_tx_token_put(struct mt7915_dev *dev);
- void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 *info);
- bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- void mt7915_stats_work(struct work_struct *work);
-@@ -628,6 +634,7 @@ void mt7915_set_stream_vht_txbf_caps(struct mt7915_phy *phy);
- void mt7915_update_channel(struct mt76_phy *mphy);
- int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enable);
- int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms);
-+int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev);
- int mt7915_init_debugfs(struct mt7915_phy *phy);
- void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int len);
- bool mt7915_debugfs_rx_log(struct mt7915_dev *dev, const void *data, int len);
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 0c61f125..aca1b2f1 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -43,6 +43,7 @@ enum reg_rev {
- 	SWDEF_BASE_ADDR,
- 	TXQ_WED_RING_BASE,
- 	RXQ_WED_RING_BASE,
-+	RXQ_WED_DATA_RING_BASE,
- 	__MT_REG_MAX,
- };
- 
-@@ -588,9 +589,14 @@ enum offs_rev {
- #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
- 
- #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
-+
-+#define MT_WFDMA0_EXT0_CFG		MT_WFDMA0(0x2b0)
-+#define MT_WFDMA0_EXT0_RXWB_KEEP	BIT(10)
-+
- #define MT_WFDMA0_PRI_DLY_INT_CFG0	MT_WFDMA0(0x2f0)
- #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
- #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
-+#define MT_WPDMA_GLO_CFG		MT_WFDMA0(0x208)
- 
- /* WFDMA1 */
- #define MT_WFDMA1_BASE			0xd5000
-@@ -686,6 +692,7 @@ enum offs_rev {
- 
- #define MT_TXQ_WED_RING_BASE		__REG(TXQ_WED_RING_BASE)
- #define MT_RXQ_WED_RING_BASE		__REG(RXQ_WED_RING_BASE)
-+#define MT_RXQ_WED_DATA_RING_BASE	__REG(RXQ_WED_DATA_RING_BASE)
- 
- #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
- #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
-@@ -1179,6 +1186,10 @@ enum offs_rev {
- #define MT_WF_PHY_RXTD12_IRPI_SW_CLR_ONLY	BIT(18)
- #define MT_WF_PHY_RXTD12_IRPI_SW_CLR		BIT(29)
- 
-+#define MT_WF_PHY_TPC_CTRL_STAT(_phy)		MT_WF_PHY(0xe7a0 + ((_phy) << 16))
-+#define MT_WF_PHY_TPC_CTRL_STAT_MT7916(_phy)	MT_WF_PHY(0xe7a0 + ((_phy) << 20))
-+#define MT_WF_PHY_TPC_POWER			GENMASK(15, 8)
-+
- #define MT_MCU_WM_CIRQ_BASE			0x89010000
- #define MT_MCU_WM_CIRQ(ofs)			(MT_MCU_WM_CIRQ_BASE + (ofs))
- #define MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR	MT_MCU_WM_CIRQ(0x80)
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index a979460f..7ace05e0 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -44,14 +44,14 @@ mt7915_tm_set_tx_power(struct mt7915_phy *phy)
- 	int ret;
- 	struct {
- 		u8 format_id;
--		u8 dbdc_idx;
-+		u8 band_idx;
- 		s8 tx_power;
- 		u8 ant_idx;	/* Only 0 is valid */
- 		u8 center_chan;
- 		u8 rsv[3];
- 	} __packed req = {
- 		.format_id = 0xf,
--		.dbdc_idx = phy != &dev->phy,
-+		.band_idx = phy->band_idx,
- 		.center_chan = ieee80211_frequency_to_channel(freq),
- 	};
- 	u8 *tx_power = NULL;
-@@ -77,7 +77,7 @@ mt7915_tm_set_freq_offset(struct mt7915_phy *phy, bool en, u32 val)
- 	struct mt7915_tm_cmd req = {
- 		.testmode_en = en,
- 		.param_idx = MCU_ATE_SET_FREQ_OFFSET,
--		.param.freq.band = phy != &dev->phy,
-+		.param.freq.band = phy->band_idx,
- 		.param.freq.freq_offset = cpu_to_le32(val),
- 	};
- 
-@@ -111,7 +111,7 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
- 		.param_idx = MCU_ATE_SET_TRX,
- 		.param.trx.type = type,
- 		.param.trx.enable = en,
--		.param.trx.band = phy != &dev->phy,
-+		.param.trx.band = phy->band_idx,
- 	};
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-@@ -126,7 +126,7 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
- 		.testmode_en = 1,
- 		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
- 		.param.clean.wcid = wcid,
--		.param.clean.band = phy != &dev->phy,
-+		.param.clean.band = phy->band_idx,
- 	};
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-@@ -144,7 +144,7 @@ mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
- 		.param.slot.sifs = sifs,
- 		.param.slot.rifs = 2,
- 		.param.slot.eifs = cpu_to_le16(60),
--		.param.slot.band = phy != &dev->phy,
-+		.param.slot.band = phy->band_idx,
- 	};
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-@@ -488,7 +488,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
- 		mt7915_tm_update_channel(phy);
- 
- 		/* read-clear */
--		mt76_rr(dev, MT_MIB_SDR3(phy != &dev->phy));
-+		mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
- 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
- 	}
- }
-@@ -526,7 +526,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
- 	tx_cont->control_ch = chandef->chan->hw_value;
- 	tx_cont->center_ch = freq1;
- 	tx_cont->tx_ant = td->tx_antenna_mask;
--	tx_cont->band = phy != &dev->phy;
-+	tx_cont->band = phy->band_idx;
- 
- 	switch (chandef->width) {
- 	case NL80211_CHAN_WIDTH_40:
-@@ -558,7 +558,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
- 	}
- 
- 	if (!en) {
--		req.op.rf.param.func_data = cpu_to_le32(phy != &dev->phy);
-+		req.op.rf.param.func_data = cpu_to_le32(phy->band_idx);
- 		goto out;
- 	}
- 
-diff --git a/mt7921/init.c b/mt7921/init.c
-index 739d18fc..e42cb6be 100644
---- a/mt7921/init.c
-+++ b/mt7921/init.c
-@@ -2,6 +2,7 @@
- /* Copyright (C) 2020 MediaTek Inc. */
- 
- #include <linux/etherdevice.h>
-+#include <linux/firmware.h>
- #include "mt7921.h"
- #include "mac.h"
- #include "mcu.h"
-@@ -37,6 +38,7 @@ mt7921_regd_notifier(struct wiphy *wiphy,
- 
- 	memcpy(dev->mt76.alpha2, request->alpha2, sizeof(dev->mt76.alpha2));
- 	dev->mt76.region = request->dfs_region;
-+	dev->country_ie_env = request->country_ie_env;
- 
- 	mt7921_mutex_acquire(dev);
- 	mt7921_mcu_set_clc(dev, request->alpha2, request->country_ie_env);
-@@ -65,12 +67,18 @@ mt7921_init_wiphy(struct ieee80211_hw *hw)
- 	hw->sta_data_size = sizeof(struct mt7921_sta);
- 	hw->vif_data_size = sizeof(struct mt7921_vif);
- 
-+	if (dev->fw_features & MT7921_FW_CAP_CNM)
-+		wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
-+	else
-+		wiphy->flags &= ~WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
-+
- 	wiphy->iface_combinations = if_comb;
- 	wiphy->flags &= ~(WIPHY_FLAG_IBSS_RSN | WIPHY_FLAG_4ADDR_AP |
- 			  WIPHY_FLAG_4ADDR_STATION);
- 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
- 				 BIT(NL80211_IFTYPE_AP);
- 	wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
-+	wiphy->max_remain_on_channel_duration = 5000;
- 	wiphy->max_scan_ie_len = MT76_CONNAC_SCAN_IE_LEN;
- 	wiphy->max_scan_ssids = 4;
- 	wiphy->max_sched_scan_plan_interval =
-@@ -129,6 +137,58 @@ mt7921_mac_init_band(struct mt7921_dev *dev, u8 band)
- 	mt76_clear(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN);
- }
- 
-+u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm)
-+{
-+	struct mt7921_fw_features *features = NULL;
-+	const struct mt76_connac2_fw_trailer *hdr;
-+	struct mt7921_realease_info *rel_info;
-+	const struct firmware *fw;
-+	int ret, i, offset = 0;
-+	const u8 *data, *end;
-+
-+	ret = request_firmware(&fw, fw_wm, dev);
-+	if (ret)
-+		return ret;
-+
-+	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
-+		dev_err(dev, "Invalid firmware\n");
-+		return -EINVAL;
-+	}
-+
-+	data = fw->data;
-+	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
-+
-+	for (i = 0; i < hdr->n_region; i++) {
-+		const struct mt76_connac2_fw_region *region;
-+
-+		region = (const void *)((const u8 *)hdr -
-+					(hdr->n_region - i) * sizeof(*region));
-+		offset += le32_to_cpu(region->len);
-+	}
-+
-+	data += offset + 16;
-+	rel_info = (struct mt7921_realease_info *)data;
-+	data += sizeof(*rel_info);
-+	end = data + le16_to_cpu(rel_info->len);
-+
-+	while (data < end) {
-+		rel_info = (struct mt7921_realease_info *)data;
-+		data += sizeof(*rel_info);
-+
-+		if (rel_info->tag == MT7921_FW_TAG_FEATURE) {
-+			features = (struct mt7921_fw_features *)data;
-+			break;
-+		}
-+
-+		data += le16_to_cpu(rel_info->len) + rel_info->pad_len;
-+	}
-+
-+	release_firmware(fw);
-+
-+	return features ? features->data : 0;
-+}
-+EXPORT_SYMBOL_GPL(mt7921_check_offload_capability);
-+
- int mt7921_mac_init(struct mt7921_dev *dev)
- {
- 	int i;
-@@ -278,6 +338,10 @@ int mt7921_register_device(struct mt7921_dev *dev)
- 	INIT_WORK(&dev->reset_work, mt7921_mac_reset_work);
- 	INIT_WORK(&dev->init_work, mt7921_init_work);
- 
-+	INIT_WORK(&dev->phy.roc_work, mt7921_roc_work);
-+	timer_setup(&dev->phy.roc_timer, mt7921_roc_timer, 0);
-+	init_waitqueue_head(&dev->phy.roc_wait);
-+
- 	dev->pm.idle_timeout = MT7921_PM_TIMEOUT;
- 	dev->pm.stats.last_wake_event = jiffies;
- 	dev->pm.stats.last_doze_event = jiffies;
-diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 7b15193c..639614b0 100644
---- a/mt7921/mac.c
-+++ b/mt7921/mac.c
-@@ -692,7 +692,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
- EXPORT_SYMBOL_GPL(mt7921_rx_check);
- 
- void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 *info)
- {
- 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7921/main.c b/mt7921/main.c
-index 00085b12..1b7219e3 100644
---- a/mt7921/main.c
-+++ b/mt7921/main.c
-@@ -385,6 +385,116 @@ static void mt7921_remove_interface(struct ieee80211_hw *hw,
- 	mt76_packet_id_flush(&dev->mt76, &msta->wcid);
- }
- 
-+static void mt7921_roc_iter(void *priv, u8 *mac,
-+			    struct ieee80211_vif *vif)
-+{
-+	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
-+	struct mt7921_phy *phy = priv;
-+
-+	mt7921_mcu_abort_roc(phy, mvif, phy->roc_token_id);
-+}
-+
-+void mt7921_roc_work(struct work_struct *work)
-+{
-+	struct mt7921_phy *phy;
-+
-+	phy = (struct mt7921_phy *)container_of(work, struct mt7921_phy,
-+						roc_work);
-+
-+	if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
-+		return;
-+
-+	mt7921_mutex_acquire(phy->dev);
-+	ieee80211_iterate_active_interfaces(phy->mt76->hw,
-+					    IEEE80211_IFACE_ITER_RESUME_ALL,
-+					    mt7921_roc_iter, phy);
-+	mt7921_mutex_release(phy->dev);
-+	ieee80211_remain_on_channel_expired(phy->mt76->hw);
-+}
-+
-+void mt7921_roc_timer(struct timer_list *timer)
-+{
-+	struct mt7921_phy *phy = from_timer(phy, timer, roc_timer);
-+
-+	ieee80211_queue_work(phy->mt76->hw, &phy->roc_work);
-+}
-+
-+static int mt7921_abort_roc(struct mt7921_phy *phy, struct mt7921_vif *vif)
-+{
-+	int err;
-+
-+	if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
-+		return 0;
-+
-+	del_timer_sync(&phy->roc_timer);
-+	cancel_work_sync(&phy->roc_work);
-+	err = mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id);
-+	clear_bit(MT76_STATE_ROC, &phy->mt76->state);
-+
-+	return err;
-+}
-+
-+static int mt7921_set_roc(struct mt7921_phy *phy,
-+			  struct mt7921_vif *vif,
-+			  struct ieee80211_channel *chan,
-+			  int duration,
-+			  enum mt7921_roc_req type)
-+{
-+	int err;
-+
-+	if (test_and_set_bit(MT76_STATE_ROC, &phy->mt76->state))
-+		return -EBUSY;
-+
-+	phy->roc_grant = false;
-+
-+	err = mt7921_mcu_set_roc(phy, vif, chan, duration, type,
-+				 ++phy->roc_token_id);
-+	if (err < 0) {
-+		clear_bit(MT76_STATE_ROC, &phy->mt76->state);
-+		goto out;
-+	}
-+
-+	if (!wait_event_timeout(phy->roc_wait, phy->roc_grant, HZ)) {
-+		mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id);
-+		clear_bit(MT76_STATE_ROC, &phy->mt76->state);
-+		err = -ETIMEDOUT;
-+	}
-+
-+out:
-+	return err;
-+}
-+
-+static int mt7921_remain_on_channel(struct ieee80211_hw *hw,
-+				    struct ieee80211_vif *vif,
-+				    struct ieee80211_channel *chan,
-+				    int duration,
-+				    enum ieee80211_roc_type type)
-+{
-+	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
-+	struct mt7921_phy *phy = mt7921_hw_phy(hw);
-+	int err;
-+
-+	mt7921_mutex_acquire(phy->dev);
-+	err = mt7921_set_roc(phy, mvif, chan, duration, MT7921_ROC_REQ_ROC);
-+	mt7921_mutex_release(phy->dev);
-+
-+	return err;
-+}
-+
-+static int mt7921_cancel_remain_on_channel(struct ieee80211_hw *hw,
-+					   struct ieee80211_vif *vif)
-+{
-+	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
-+	struct mt7921_phy *phy = mt7921_hw_phy(hw);
-+	int err;
-+
-+	mt7921_mutex_acquire(phy->dev);
-+	err = mt7921_abort_roc(phy, mvif);
-+	mt7921_mutex_release(phy->dev);
-+
-+	return err;
-+}
-+
- static int mt7921_set_channel(struct mt7921_phy *phy)
- {
- 	struct mt7921_dev *dev = phy->dev;
-@@ -1503,7 +1613,13 @@ static int mt7921_set_sar_specs(struct ieee80211_hw *hw,
- 	int err;
- 
- 	mt7921_mutex_acquire(dev);
-+	err = mt7921_mcu_set_clc(dev, dev->mt76.alpha2,
-+				 dev->country_ie_env);
-+	if (err < 0)
-+		goto out;
-+
- 	err = mt7921_set_tx_sar_pwr(hw, sar);
-+out:
- 	mt7921_mutex_release(dev);
- 
- 	return err;
-@@ -1621,6 +1737,8 @@ const struct ieee80211_ops mt7921_ops = {
- #endif /* CONFIG_PM */
- 	.flush = mt7921_flush,
- 	.set_sar_specs = mt7921_set_sar_specs,
-+	.remain_on_channel = mt7921_remain_on_channel,
-+	.cancel_remain_on_channel = mt7921_cancel_remain_on_channel,
- };
- EXPORT_SYMBOL_GPL(mt7921_ops);
- 
-diff --git a/mt7921/mcu.c b/mt7921/mcu.c
-index 104da7e1..b7ed744f 100644
---- a/mt7921/mcu.c
-+++ b/mt7921/mcu.c
-@@ -154,6 +154,29 @@ void mt7921_mcu_set_suspend_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
- 
- #endif /* CONFIG_PM */
- 
-+static void
-+mt7921_mcu_uni_roc_event(struct mt7921_dev *dev, struct sk_buff *skb)
-+{
-+	struct mt7921_roc_grant_tlv *grant;
-+	struct mt76_connac2_mcu_rxd *rxd;
-+	int duration;
-+
-+	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
-+	grant = (struct mt7921_roc_grant_tlv *)(rxd->tlv + 4);
-+
-+	/* should never happen */
-+	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
-+
-+	if (grant->reqtype == MT7921_ROC_REQ_ROC)
-+		ieee80211_ready_on_channel(dev->mt76.phy.hw);
-+
-+	dev->phy.roc_grant = true;
-+	wake_up(&dev->phy.roc_wait);
-+	duration = le32_to_cpu(grant->max_interval);
-+	mod_timer(&dev->phy.roc_timer,
-+		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
-+}
-+
- static void
- mt7921_mcu_scan_event(struct mt7921_dev *dev, struct sk_buff *skb)
- {
-@@ -295,6 +318,7 @@ mt7921_mcu_uni_rx_unsolicited_event(struct mt7921_dev *dev,
- 
- 	switch (rxd->eid) {
- 	case MCU_UNI_EVENT_ROC:
-+		mt7921_mcu_uni_roc_event(dev, skb);
- 		break;
- 	default:
- 		break;
-diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index d9d78f6b..e915dfce 100644
---- a/mt7921/mt7921.h
-+++ b/mt7921/mt7921.h
-@@ -32,6 +32,9 @@
- #define MT7921_MCU_INIT_RETRY_COUNT	10
- #define MT7921_WFSYS_INIT_RETRY_COUNT	2
- 
-+#define MT7921_FW_TAG_FEATURE		4
-+#define MT7921_FW_CAP_CNM		BIT(7)
-+
- #define MT7921_FIRMWARE_WM		"mediatek/WIFI_RAM_CODE_MT7961_1.bin"
- #define MT7921_ROM_PATCH		"mediatek/WIFI_MT7961_patch_mcu_1_2_hdr.bin"
- 
-@@ -67,6 +70,41 @@ enum mt7921_roc_req {
- 	MT7921_ROC_REQ_NUM
- };
- 
-+enum {
-+	UNI_EVENT_ROC_GRANT = 0,
-+	UNI_EVENT_ROC_TAG_NUM
-+};
-+
-+struct mt7921_realease_info {
-+	__le16 len;
-+	u8 pad_len;
-+	u8 tag;
-+} __packed;
-+
-+struct mt7921_fw_features {
-+	u8 segment;
-+	u8 data;
-+	u8 rsv[14];
-+} __packed;
-+
-+struct mt7921_roc_grant_tlv {
-+	__le16 tag;
-+	__le16 len;
-+	u8 bss_idx;
-+	u8 tokenid;
-+	u8 status;
-+	u8 primarychannel;
-+	u8 rfsco;
-+	u8 rfband;
-+	u8 channelwidth;
-+	u8 centerfreqseg1;
-+	u8 centerfreqseg2;
-+	u8 reqtype;
-+	u8 dbdcband;
-+	u8 rsv[1];
-+	__le32 max_interval;
-+} __packed;
-+
- enum mt7921_sdio_pkt_type {
- 	MT7921_SDIO_TXD,
- 	MT7921_SDIO_DATA,
-@@ -214,6 +252,12 @@ struct mt7921_phy {
- #endif
- 
- 	struct mt7921_clc *clc[MT7921_CLC_MAX_NUM];
-+
-+	struct work_struct roc_work;
-+	struct timer_list roc_timer;
-+	wait_queue_head_t roc_wait;
-+	u8 roc_token_id;
-+	bool roc_grant;
- };
- 
- #define mt7921_init_reset(dev)		((dev)->hif_ops->init_reset(dev))
-@@ -250,6 +294,7 @@ struct mt7921_dev {
- 	struct work_struct init_work;
- 
- 	u8 fw_debug;
-+	u8 fw_features;
- 
- 	struct mt76_connac_pm pm;
- 	struct mt76_connac_coredump coredump;
-@@ -258,6 +303,8 @@ struct mt7921_dev {
- 	struct work_struct ipv6_ns_work;
- 	/* IPv6 addresses for WoWLAN */
- 	struct sk_buff_head ipv6_ns_list;
-+
-+	enum environment_cap country_ie_env;
- };
- 
- enum {
-@@ -422,7 +469,7 @@ void mt7921_tx_worker(struct mt76_worker *w);
- void mt7921_tx_token_put(struct mt7921_dev *dev);
- bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 *info);
- void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- void mt7921_stats_work(struct work_struct *work);
- void mt7921_set_stream_he_caps(struct mt7921_phy *phy);
-@@ -439,6 +486,8 @@ int mt7921_mcu_uni_rx_ba(struct mt7921_dev *dev,
- 			 struct ieee80211_ampdu_params *params,
- 			 bool enable);
- void mt7921_scan_work(struct work_struct *work);
-+void mt7921_roc_work(struct work_struct *work);
-+void mt7921_roc_timer(struct timer_list *timer);
- int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif);
- int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev);
- int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev);
-@@ -527,4 +576,5 @@ int mt7921_mcu_set_roc(struct mt7921_phy *phy, struct mt7921_vif *vif,
- 		       enum mt7921_roc_req type, u8 token_id);
- int mt7921_mcu_abort_roc(struct mt7921_phy *phy, struct mt7921_vif *vif,
- 			 u8 token_id);
-+u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm);
- #endif
-diff --git a/mt7921/pci.c b/mt7921/pci.c
-index 4f34cb9e..fbb06f04 100644
---- a/mt7921/pci.c
-+++ b/mt7921/pci.c
-@@ -13,10 +13,14 @@
- #include "../trace.h"
- 
- static const struct pci_device_id mt7921_pci_device_table[] = {
--	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7961) },
--	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7922) },
--	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0608) },
--	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0616) },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7961),
-+		.driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7922),
-+		.driver_data = (kernel_ulong_t)MT7922_FIRMWARE_WM },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0608),
-+		.driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0616),
-+		.driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
- 	{ },
- };
- 
-@@ -253,9 +257,11 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
- 		.fw_own = mt7921e_mcu_fw_pmctrl,
- 	};
- 
-+	struct ieee80211_ops *ops;
- 	struct mt76_bus_ops *bus_ops;
- 	struct mt7921_dev *dev;
- 	struct mt76_dev *mdev;
-+	u8 features;
- 	int ret;
- 
- 	ret = pcim_enable_device(pdev);
-@@ -279,8 +285,21 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
- 	if (mt7921_disable_aspm)
- 		mt76_pci_disable_aspm(pdev);
- 
--	mdev = mt76_alloc_device(&pdev->dev, sizeof(*dev), &mt7921_ops,
--				 &drv_ops);
-+	features = mt7921_check_offload_capability(&pdev->dev, (const char *)
-+						   id->driver_data);
-+	ops = devm_kmemdup(&pdev->dev, &mt7921_ops, sizeof(mt7921_ops),
-+			   GFP_KERNEL);
-+	if (!ops) {
-+		ret = -ENOMEM;
-+		goto err_free_pci_vec;
-+	}
-+
-+	if (!(features & MT7921_FW_CAP_CNM)) {
-+		ops->remain_on_channel = NULL;
-+		ops->cancel_remain_on_channel = NULL;
-+	}
-+
-+	mdev = mt76_alloc_device(&pdev->dev, sizeof(*dev), ops, &drv_ops);
- 	if (!mdev) {
- 		ret = -ENOMEM;
- 		goto err_free_pci_vec;
-@@ -289,8 +308,8 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
- 	pci_set_drvdata(pdev, mdev);
- 
- 	dev = container_of(mdev, struct mt7921_dev, mt76);
-+	dev->fw_features = features;
- 	dev->hif_ops = &mt7921_pcie_ops;
--
- 	mt76_mmio_init(&dev->mt76, pcim_iomap_table(pdev)[0]);
- 	tasklet_init(&dev->irq_tasklet, mt7921_irq_tasklet, (unsigned long)dev);
- 
-diff --git a/mt7921/sdio.c b/mt7921/sdio.c
-index 031d99d4..f6b35087 100644
---- a/mt7921/sdio.c
-+++ b/mt7921/sdio.c
-@@ -17,7 +17,8 @@
- #include "mcu.h"
- 
- static const struct sdio_device_id mt7921s_table[] = {
--	{ SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7901) },
-+	{ SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7901),
-+		.driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
- 	{ }	/* Terminating entry */
- };
- 
-@@ -122,18 +123,32 @@ static int mt7921s_probe(struct sdio_func *func,
- 		.fw_own = mt7921s_mcu_fw_pmctrl,
- 	};
- 
-+	struct ieee80211_ops *ops;
- 	struct mt7921_dev *dev;
- 	struct mt76_dev *mdev;
-+	u8 features;
- 	int ret;
- 
--	mdev = mt76_alloc_device(&func->dev, sizeof(*dev), &mt7921_ops,
--				 &drv_ops);
-+	features = mt7921_check_offload_capability(&func->dev, (const char *)
-+						   id->driver_data);
-+
-+	ops = devm_kmemdup(&func->dev, &mt7921_ops, sizeof(mt7921_ops),
-+			   GFP_KERNEL);
-+	if (!ops)
-+		return -ENOMEM;
-+
-+	if (!(features & MT7921_FW_CAP_CNM)) {
-+		ops->remain_on_channel = NULL;
-+		ops->cancel_remain_on_channel = NULL;
-+	}
-+
-+	mdev = mt76_alloc_device(&func->dev, sizeof(*dev), ops, &drv_ops);
- 	if (!mdev)
- 		return -ENOMEM;
- 
- 	dev = container_of(mdev, struct mt7921_dev, mt76);
-+	dev->fw_features = features;
- 	dev->hif_ops = &mt7921_sdio_ops;
--
- 	sdio_set_drvdata(func, dev);
- 
- 	ret = mt76s_init(mdev, func, &mt7921s_ops);
-diff --git a/mt7921/usb.c b/mt7921/usb.c
-index 89249f0b..8a49d3de 100644
---- a/mt7921/usb.c
-+++ b/mt7921/usb.c
-@@ -13,7 +13,8 @@
- #include "mac.h"
- 
- static const struct usb_device_id mt7921u_device_table[] = {
--	{ USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x7961, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x7961, 0xff, 0xff, 0xff),
-+		.driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM },
- 	{ },
- };
- 
-@@ -204,13 +205,21 @@ static int mt7921u_probe(struct usb_interface *usb_intf,
- 	struct ieee80211_hw *hw;
- 	struct mt7921_dev *dev;
- 	struct mt76_dev *mdev;
-+	u8 features;
- 	int ret;
- 
-+	features = mt7921_check_offload_capability(&usb_intf->dev, (const char *)
-+						   id->driver_info);
- 	ops = devm_kmemdup(&usb_intf->dev, &mt7921_ops, sizeof(mt7921_ops),
- 			   GFP_KERNEL);
- 	if (!ops)
- 		return -ENOMEM;
- 
-+	if (!(features & MT7921_FW_CAP_CNM)) {
-+		ops->remain_on_channel = NULL;
-+		ops->cancel_remain_on_channel = NULL;
-+	}
-+
- 	ops->stop = mt7921u_stop;
- 
- 	mdev = mt76_alloc_device(&usb_intf->dev, sizeof(*dev), ops, &drv_ops);
-@@ -218,6 +227,7 @@ static int mt7921u_probe(struct usb_interface *usb_intf,
- 		return -ENOMEM;
- 
- 	dev = container_of(mdev, struct mt7921_dev, mt76);
-+	dev->fw_features = features;
- 	dev->hif_ops = &hif_ops;
- 
- 	udev = usb_get_dev(udev);
-diff --git a/sdio.c b/sdio.c
-index 0ec308f9..228bc7d4 100644
---- a/sdio.c
-+++ b/sdio.c
-@@ -395,7 +395,7 @@ mt76s_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
- 		if (!e || !e->skb)
- 			break;
- 
--		dev->drv->rx_skb(dev, MT_RXQ_MAIN, e->skb);
-+		dev->drv->rx_skb(dev, MT_RXQ_MAIN, e->skb, NULL);
- 		e->skb = NULL;
- 		nframes++;
- 	}
-diff --git a/tx.c b/tx.c
-index 65e2b7c1..c8d78b0a 100644
---- a/tx.c
-+++ b/tx.c
-@@ -751,6 +751,23 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
- }
- EXPORT_SYMBOL_GPL(mt76_token_consume);
- 
-+int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
-+			  struct mt76_txwi_cache *t, dma_addr_t phys)
-+{
-+	int token;
-+
-+	spin_lock_bh(&dev->rx_token_lock);
-+	token = idr_alloc(&dev->rx_token, t, 0, dev->rx_token_size,
-+			  GFP_ATOMIC);
-+	spin_unlock_bh(&dev->rx_token_lock);
-+
-+	t->ptr = ptr;
-+	t->dma_addr = phys;
-+
-+	return token;
-+}
-+EXPORT_SYMBOL_GPL(mt76_rx_token_consume);
-+
- struct mt76_txwi_cache *
- mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
- {
-@@ -779,3 +796,16 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
- 	return txwi;
- }
- EXPORT_SYMBOL_GPL(mt76_token_release);
-+
-+struct mt76_txwi_cache *
-+mt76_rx_token_release(struct mt76_dev *dev, int token)
-+{
-+	struct mt76_txwi_cache *t;
-+
-+	spin_lock_bh(&dev->rx_token_lock);
-+	t = idr_remove(&dev->rx_token, token);
-+	spin_unlock_bh(&dev->rx_token_lock);
-+
-+	return t;
-+}
-+EXPORT_SYMBOL_GPL(mt76_rx_token_release);
-diff --git a/usb.c b/usb.c
-index 50d07d91..369c27ab 100644
---- a/usb.c
-+++ b/usb.c
-@@ -547,7 +547,7 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb,
- 		len -= data_len;
- 		nsgs++;
- 	}
--	dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb);
-+	dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb, NULL);
- 
- 	return nsgs;
- }
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch
deleted file mode 100644
index 24b1240..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 23 Nov 2021 17:01:45 +0100
-Subject: [PATCH] Revert "of: net: pass the dst buffer to of_get_mac_address()"
-
-This reverts commit 4932c5d80153c336c77dbe8d7af9f8fdd879d01f.
----
-
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -105,9 +105,15 @@ mt76_eeprom_override(struct mt76_phy *ph
- {
- 	struct mt76_dev *dev = phy->dev;
- 
-+#ifdef CONFIG_OF
- 	struct device_node *np = dev->dev->of_node;
-+	const u8 *mac = NULL;
- 
--	of_get_mac_address(np, phy->macaddr);
-+	if (np)
-+		mac = of_get_mac_address(np);
-+	if (!IS_ERR_OR_NULL(mac))
-+		ether_addr_copy(phy->macaddr, mac);
-+#endif
- 
- 	if (!is_valid_ether_addr(phy->macaddr)) {
- 		eth_random_addr(phy->macaddr);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index d1fa706..e194f7d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,7 +1,7 @@
-From 6f3fdaaef8dcd1d95017aaf1755cf001168d0836 Mon Sep 17 00:00:00 2001
+From b9974cb5e246a0b7f999e16c1e6dc48bb65737f2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1001/1010] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    7 +
@@ -22,10 +22,10 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 72d235a1..ff733f9f 100644
+index f1e942b9..9d0d6130 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1135,6 +1135,7 @@ enum {
+@@ -1146,6 +1146,7 @@ enum {
  	MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
  	MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_CMD_TXBF_ACTION = 0x1e,
@@ -33,7 +33,7 @@
  	MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
  	MCU_EXT_CMD_THERMAL_PROT = 0x23,
  	MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
-@@ -1158,6 +1159,12 @@ enum {
+@@ -1169,6 +1170,12 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
@@ -60,7 +60,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 30f8f18b..092d8434 100644
+index 5a46813a..f1f3f2f3 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -137,7 +137,7 @@
  	return mt7915_fw_debug_wm_set(dev, dev->fw.debug_wm);
  }
  
-@@ -1103,6 +1133,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1257,6 +1287,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	if (!ext_phy)
  		dev->debugfs_dir = dir;
  
@@ -149,7 +149,7 @@
  	return 0;
  }
  
-@@ -1143,17 +1178,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
+@@ -1297,17 +1332,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -204,10 +204,10 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 97a19bdb..0b13375e 100644
+index f0d5a360..149527df 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -301,6 +301,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -300,6 +300,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	__le16 fc = 0;
  	int idx;
  
@@ -217,8 +217,8 @@
 +#endif
  	memset(status, 0, sizeof(*status));
  
- 	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->band_idx) {
-@@ -484,6 +488,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+ 	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->mt76->band_idx) {
+@@ -483,6 +487,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	}
  
  	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
@@ -229,7 +229,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		struct ieee80211_vif *vif;
  		int err;
-@@ -821,6 +829,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -820,6 +828,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -243,10 +243,10 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2505fa7e..b6e5f97c 100644
+index 0511d6a5..b44507f4 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -58,7 +58,11 @@ int mt7915_run(struct ieee80211_hw *hw)
+@@ -62,7 +62,11 @@ int mt7915_run(struct ieee80211_hw *hw)
  	if (ret)
  		goto out;
  
@@ -259,7 +259,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 36c21596..5af6de5d 100644
+index 35441dcb..56e5ea55 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -274,7 +274,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3307,6 +3312,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3323,6 +3328,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -283,7 +283,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3744,6 +3751,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3760,6 +3767,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -327,7 +327,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -3772,3 +3816,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3788,3 +3832,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -351,10 +351,10 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 46c517e5..b7e8ba2e 100644
+index 29b5434b..aa89106e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -271,6 +271,10 @@ enum {
+@@ -278,6 +278,10 @@ enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
  	MCU_WA_PARAM_RED = 0x0e,
@@ -366,7 +366,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 42f21343..2f91020c 100644
+index 6351feba..7c129f7f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -377,7 +377,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -368,6 +369,29 @@ struct mt7915_dev {
+@@ -367,6 +368,29 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -407,7 +407,7 @@
  };
  
  enum {
-@@ -645,4 +669,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -644,4 +668,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -4721,7 +4721,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 00000000..145fe785
+index 00000000..143dae26
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4742,7 +4742,7 @@
 +		u8 _rsv;
 +	} __packed req = {
 +		.format_id = 1,
-+		.band = phy->band_idx,
++		.band = phy->mt76->band_idx,
 +		.val = !!drop_level,
 +	};
 +	int ret;
@@ -4891,5 +4891,5 @@
  	return ret;
  }
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
index cc9e5ed..5f2a8e3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,7 +1,7 @@
-From 3913add871ba0d7b4b6a997109ee2acb6d7e5ed3 Mon Sep 17 00:00:00 2001
+From 60ac6480474b349c21c256f4d720baa2c6622b2f Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 1002/1010] mt76: mt7915: csi: implement csi support
+Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -17,10 +17,10 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ff733f9f..3f35c6fb 100644
+index 9d0d6130..26e7cf6f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -987,6 +987,7 @@ enum {
+@@ -998,6 +998,7 @@ enum {
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
@@ -28,7 +28,7 @@
  };
  
  /* unified event table */
-@@ -1180,6 +1181,7 @@ enum {
+@@ -1191,6 +1192,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -53,12 +53,12 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 9e69ab82..34ace7c9 100644
+index 6fd5c63e..79080aee 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -574,6 +574,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -645,6 +645,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
- 	mt7915_init_wiphy(mphy->hw);
+ 	mt7915_init_wiphy(phy);
  
 +#ifdef CONFIG_MTK_VENDOR
 +	INIT_LIST_HEAD(&phy->csi.csi_list);
@@ -69,7 +69,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1079,6 +1085,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1151,6 +1157,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -95,7 +95,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1087,6 +1112,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1159,6 +1184,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -106,7 +106,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1099,6 +1128,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1171,6 +1200,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -117,7 +117,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1141,6 +1174,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1212,6 +1245,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -127,11 +127,11 @@
 +	mt7915_vendor_register(&dev->phy);
 +#endif
 +
- 	/* init led callbacks */
- 	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
- 		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
+ 	ret = mt76_register_device(&dev->mt76, true, mt76_rates,
+ 				   ARRAY_SIZE(mt76_rates));
+ 	if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5af6de5d..e6cd1e2c 100644
+index 56e5ea55..f483d443 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
@@ -145,7 +145,7 @@
  static u8
  mt7915_mcu_get_sta_nss(u16 mcs_map)
  {
-@@ -355,6 +359,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -371,6 +375,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_FW_LOG_2_HOST:
  		mt7915_mcu_rx_log_message(dev, skb);
  		break;
@@ -157,7 +157,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3751,6 +3760,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3767,6 +3776,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -219,7 +219,7 @@
 +	SET_CSI_DATA(ts);
 +
 +	SET_CSI_DATA(band);
-+	if (csi->band && !phy->band_idx)
++	if (csi->band && !phy->mt76->band_idx)
 +		phy = mt7915_ext_phy(dev);
 +#undef SET_CSI_DATA
 +
@@ -267,12 +267,12 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b7e8ba2e..50bf4cb6 100644
+index aa89106e..f3dedd5b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -513,4 +513,80 @@ enum {
- 					 sizeof(struct bss_info_bcn_cont) + \
- 					 sizeof(struct bss_info_inband_discovery))
+@@ -532,4 +532,80 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
+ 	return txpower;
+ }
  
 +#ifdef CONFIG_MTK_VENDOR
 +struct mt7915_mcu_csi {
@@ -352,10 +352,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2f91020c..8b6c95ef 100644
+index 7c129f7f..8bb6d091 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -289,6 +289,20 @@ struct mt7915_phy {
+@@ -288,6 +288,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -376,7 +376,7 @@
  };
  
  struct mt7915_dev {
-@@ -669,6 +683,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -668,6 +682,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -914,5 +914,5 @@
 +
 +#endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
index 1cd5dc0..1e6158a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,7 +1,7 @@
-From 8d44ea8b90c3fa7020f6d7e31c5d30232fef262c Mon Sep 17 00:00:00 2001
+From 088b6c6f35ed5213deae1b4515375632457ec90f Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1003/1010] mt76: mt7915: air monitor support
+Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 3f35c6fb..55c9fcd5 100644
+index 26e7cf6f..841fcdec 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1181,6 +1181,8 @@ enum {
+@@ -1192,6 +1192,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,10 +26,10 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0b13375e..f1c61578 100644
+index 149527df..015f2705 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -549,6 +549,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -548,6 +548,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
  			qos_ctl = *ieee80211_get_qos_ctl(hdr);
  		}
@@ -41,10 +41,10 @@
  		status->flag |= RX_FLAG_8023;
  		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b6e5f97c..11efcadc 100644
+index b44507f4..33db7202 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -686,6 +686,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -691,6 +691,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,7 +55,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8b6c95ef..bb21433a 100644
+index 8bb6d091..33ca8e8c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -244,6 +244,35 @@ struct mt7915_hif {
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -302,6 +331,8 @@ struct mt7915_phy {
+@@ -301,6 +330,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -687,6 +718,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -686,6 +717,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 4b30a6e..378e0a3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,21 +1,21 @@
-From d59ea5f5af1478aa25b8723f9c8064c244175a50 Mon Sep 17 00:00:00 2001
+From f942dbe1374ccf688477a532226dc55caa2ac72d Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
-Subject: [PATCH 1004/1010] mt76: mt7915: add support for muru_onoff via
+Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
  debugfs
 
 ---
  mt7915/init.c        |  1 +
- mt7915/mcu.c         |  9 +++++++--
+ mt7915/mcu.c         | 11 ++++++++---
  mt7915/mcu.h         |  6 ++++++
  mt7915/mtk_debugfs.c | 33 +++++++++++++++++++++++++++++++++
- 4 files changed, 47 insertions(+), 2 deletions(-)
+ 4 files changed, 48 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 34ace7c9..d4105835 100644
+index 79080aee..172bdcf2 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -609,6 +609,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -680,6 +680,7 @@ static void mt7915_init_work(struct work_struct *work)
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
  	mt7915_txbf_init(dev);
@@ -24,19 +24,20 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e6cd1e2c..2ee4afe9 100644
+index f483d443..e0e25a91 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -860,13 +860,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -876,13 +876,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  
  	muru = (struct sta_rec_muru *)tlv;
  
 -	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
-+	muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
- 			       mvif->cap.vht_mu_ebfer ||
+-			       mvif->cap.vht_mu_ebfer ||
 -			       mvif->cap.vht_mu_ebfee;
-+			       mvif->cap.vht_mu_ebfee) &&
-+				   !!(dev->dbg.muru_onoff & MUMIMO_DL);
++	muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
++			        mvif->cap.vht_mu_ebfer ||
++			        mvif->cap.vht_mu_ebfee) &&
++			       !!(dev->dbg.muru_onoff & MUMIMO_DL);
  	if (!is_mt7915(&dev->mt76))
  		muru->cfg.mimo_ul_en = true;
  	muru->cfg.ofdma_dl_en = true;
@@ -45,14 +46,14 @@
 +	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
 +	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
 +
- 	if (sta->vht_cap.vht_supported)
+ 	if (sta->deflink.vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
- 			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
+ 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 50bf4cb6..aa07e426 100644
+index f3dedd5b..b6840b22 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -589,4 +589,10 @@ struct csi_data {
+@@ -608,4 +608,10 @@ struct csi_data {
  };
  #endif
  
@@ -115,5 +116,5 @@
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
index 209d039..1ead9ba 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From b9b4a77af1657e0b71a6f57dc8c8c2d50c37a946 Mon Sep 17 00:00:00 2001
+From 2da7ca62781e48d7775df06318bc975182ec11e6 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1005/1010] mt76: mt7915: certification patches
+Subject: [PATCH 1005/1009] mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -16,10 +16,10 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 55c9fcd5..0d4d466f 100644
+index 841fcdec..18ae3acb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1183,6 +1183,7 @@ enum {
+@@ -1194,6 +1194,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f1c61578..cf119cf4 100644
+index 015f2705..229e68c3 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -2020,6 +2021,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2021,6 +2022,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2042,6 +2058,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -2043,6 +2059,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 11efcadc..75073363 100644
+index 33db7202..3d309bc0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -662,6 +662,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -667,6 +667,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -689,7 +692,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -694,7 +697,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -109,10 +109,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2ee4afe9..fe314bf2 100644
+index e0e25a91..4e36910c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3865,6 +3865,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3881,6 +3881,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -586,10 +586,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aa07e426..6d4580bf 100644
+index b6840b22..d7322fe8 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -408,10 +408,14 @@ enum {
+@@ -415,10 +415,14 @@ enum {
  	RATE_PARAM_FIXED = 3,
  	RATE_PARAM_MMPS_UPDATE = 5,
  	RATE_PARAM_FIXED_HE_LTF = 7,
@@ -605,7 +605,7 @@
  };
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -423,6 +427,9 @@ enum {
+@@ -430,6 +434,9 @@ enum {
  #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
  #define RATE_CFG_HE_LTF			GENMASK(31, 28)
  
@@ -615,7 +615,7 @@
  enum {
  	TX_POWER_LIMIT_ENABLE,
  	TX_POWER_LIMIT_TABLE = 0x4,
-@@ -594,5 +601,203 @@ struct csi_data {
+@@ -613,5 +620,203 @@ struct csi_data {
  #define OFDMA_UL                       BIT(1)
  #define MUMIMO_DL                      BIT(2)
  #define MUMIMO_UL                      BIT(3)
@@ -820,10 +820,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index bb21433a..e6c000a7 100644
+index 33ca8e8c..415fe82a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -715,6 +715,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -714,6 +714,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -1134,5 +1134,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 5f9e051..2c4fbe8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,7 +1,7 @@
-From d29700d24b6b117341d5e3597fdf9e652e836032 Mon Sep 17 00:00:00 2001
+From f481ab038d6087eef48f89e097b0d821d4640d1b Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
-Subject: [PATCH 1006/1010] mt76: mt7915:add support for runtime set in-band
+Subject: [PATCH 1006/1009] mt76: mt7915:add support for runtime set in-band
  discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fe314bf2..cb6195f6 100644
+index 4e36910c..47dee76e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1977,8 +1977,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -1993,8 +1993,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	u8 *buf, interval;
  	int len;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2013,7 +2012,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2029,7 +2028,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
@@ -33,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 402e888..18262bf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,7 +1,7 @@
-From 5aa7362344f0cd6ef9c045e0d9be98f4d679010c Mon Sep 17 00:00:00 2001
+From 18accd0fdefb61e9edd2d425b7ca8a363402f0df Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
-Subject: [PATCH 1007/1010] mt76: mt7915: add mt76 vendor muru onoff command
+Subject: [PATCH 1007/1009] mt76: mt7915: add mt76 vendor muru onoff command
 
 ---
  mt7915/mcu.c    |  7 +++++++
@@ -11,10 +11,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index cb6195f6..696ca11b 100644
+index 47dee76e..ec306f01 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3884,6 +3884,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3900,6 +3900,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,10 +29,10 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 6d4580bf..e7ad0560 100644
+index d7322fe8..eaadd331 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -415,6 +415,7 @@ enum {
+@@ -422,6 +422,7 @@ enum {
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
  	RATE_PARAM_FIXED_OFDMA = 31,
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
index b1c8a6f..6eff0ae 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,17 +1,17 @@
-From 830e283fe7f3f7b4514fae3de01b0c728ea0ecfb Mon Sep 17 00:00:00 2001
+From 8c5a000a492457202b6fe8518f42a2515238b528 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 1008/1010] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 1008/1009] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index cf119cf4..28c6ab35 100644
+index 229e68c3..fc7b7903 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -762,6 +762,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -761,6 +761,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info)
  {
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
@@ -20,7 +20,7 @@
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -792,6 +794,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -791,6 +793,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
@@ -32,5 +32,5 @@
  	if (id < 0)
  		return id;
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
index 078dad5..4af0e5b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,7 +1,7 @@
-From e024583e77c3eedc2e3dcfb52d179a20ebb08e86 Mon Sep 17 00:00:00 2001
+From eba9059676a9a0012aed63fbc800e1f6b2a2a381 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH 1009/1010] mt76: mt7915: add fw_version dump
+Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
 
 ---
  mt76.h               |  4 ++++
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 33f87e51..84d49c2b 100644
+index 1037d23b..beea57d5 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -835,6 +835,10 @@ struct mt76_dev {
+@@ -837,6 +837,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,10 +25,10 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index c65267b4..a48903ca 100644
+index 5a047e63..cf6ec55f 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2927,6 +2927,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2968,6 +2968,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
  
@@ -38,7 +38,7 @@
  	release_firmware(fw);
  
  	if (!fw_wa)
-@@ -2952,6 +2955,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2993,6 +2996,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -48,7 +48,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -3022,6 +3028,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -3063,6 +3069,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
@@ -96,5 +96,5 @@
  }
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
index 50c491b..4b36dae 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,4 +1,4 @@
-From 62514b545ba99ba75fbed0ece763009b583473dc Mon Sep 17 00:00:00 2001
+From 41e8c107e1e3e4ecc5b99d9066702b9b560abf6e Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
 Subject: [PATCH 1111/1128] mt76: mt7915: rework testmode init registers
@@ -17,10 +17,10 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index acac04ef..9a908c9a 100644
+index 7fe7f68a..19d9efb3 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -761,7 +761,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -775,7 +775,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -31,7 +31,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 84d49c2b..0d87f135 100644
+index beea57d5..4822ffb7 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -637,6 +637,8 @@ struct mt76_testmode_ops {
@@ -61,10 +61,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 0d4d466f..172a926a 100644
+index 18ae3acb..18d6c669 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1177,6 +1177,7 @@ enum {
+@@ -1188,6 +1188,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -73,7 +73,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index e7ad0560..6a145aef 100644
+index eaadd331..2e97db7b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -85,7 +85,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 3b4ede3b..19518cb5 100644
+index afa558c9..07de3cbd 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
@@ -105,7 +105,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index aca1b2f1..688f7dee 100644
+index c8e478a5..d6a05f13 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -48,6 +48,7 @@ enum reg_rev {
@@ -153,7 +153,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 7ace05e0..931d1db2 100644
+index 0d76ae31..46939191 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -187,16 +187,16 @@
  static int
  mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
  {
-@@ -335,7 +350,7 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+@@ -336,7 +351,7 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
  {
  	int n_regs = ARRAY_SIZE(reg_backup_list);
  	struct mt7915_dev *dev = phy->dev;
 -	u32 *b = phy->test.reg_backup;
 +	u32 *b = phy->test.reg_backup, val;
+ 	u8 band = phy->mt76->band_idx;
  	int i;
  
- 	REG_BAND_IDX(reg_backup_list[0], AGG_PCR0, 0);
-@@ -347,18 +362,28 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+@@ -349,18 +364,28 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
  	REG_BAND(reg_backup_list[6], AGG_MRCR);
  	REG_BAND(reg_backup_list[7], TMAC_TFCR0);
  	REG_BAND(reg_backup_list[8], TMAC_TCR0);
@@ -219,15 +219,15 @@
 +	REG_BAND(reg_backup_list[17], WF_RFCR1);
 +
 +	if (is_mt7916(&dev->mt76)) {
-+		reg_backup_list[18].band[phy->band_idx] = MT_MDP_TOP_DBG_WDT_CTRL;
-+		reg_backup_list[19].band[phy->band_idx] = MT_MDP_TOP_DBG_CTRL;
++		reg_backup_list[18].band[band] = MT_MDP_TOP_DBG_WDT_CTRL;
++		reg_backup_list[19].band[band] = MT_MDP_TOP_DBG_CTRL;
 +	}
  
  	if (phy->mt76->test.state == MT76_TM_STATE_OFF) {
 -		for (i = 0; i < n_regs; i++)
--			mt76_wr(dev, reg_backup_list[i].band[phy->band_idx], b[i]);
+-			mt76_wr(dev, reg_backup_list[i].band[band], b[i]);
 +		for (i = 0; i < n_regs; i++) {
-+			u8 reg = reg_backup_list[i].band[phy->band_idx];
++			u8 reg = reg_backup_list[i].band[band];
 +
 +			if (reg)
 +				mt76_wr(dev, reg, b[i]);
@@ -235,11 +235,11 @@
  		return;
  	}
  
-@@ -378,8 +403,13 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+@@ -380,8 +405,13 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
  		   MT_AGG_PCR0_BW40_PROT | MT_AGG_PCR0_BW80_PROT);
- 	mt76_set(dev, MT_AGG_PCR0(phy->band_idx, 0), MT_AGG_PCR0_PTA_WIN_DIS);
+ 	mt76_set(dev, MT_AGG_PCR0(band, 0), MT_AGG_PCR0_PTA_WIN_DIS);
  
--	mt76_wr(dev, MT_AGG_PCR0(phy->band_idx, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
+-	mt76_wr(dev, MT_AGG_PCR0(band, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
 -		MT_AGG_PCR1_RTS0_LEN_THRES);
 +	if (is_mt7915(&dev->mt76))
 +		val = MT_AGG_PCR1_RTS0_NUM_THRES | MT_AGG_PCR1_RTS0_LEN_THRES;
@@ -247,19 +247,19 @@
 +		val = MT_AGG_PCR1_RTS0_NUM_THRES_MT7916 |
 +		      MT_AGG_PCR1_RTS0_LEN_THRES_MT7916;
 +
-+	mt76_wr(dev, MT_AGG_PCR0(phy->band_idx, 1), val);
++	mt76_wr(dev, MT_AGG_PCR0(band, 1), val);
  
- 	mt76_clear(dev, MT_AGG_MRCR(phy->band_idx), MT_AGG_MRCR_BAR_CNT_LIMIT |
+ 	mt76_clear(dev, MT_AGG_MRCR(band), MT_AGG_MRCR_BAR_CNT_LIMIT |
  		   MT_AGG_MRCR_LAST_RTS_CTS_RN | MT_AGG_MRCR_RTS_FAIL_LIMIT |
-@@ -392,10 +422,19 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+@@ -394,10 +424,19 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
  
- 	mt76_wr(dev, MT_TMAC_TFCR0(phy->band_idx), 0);
- 	mt76_clear(dev, MT_TMAC_TCR0(phy->band_idx), MT_TMAC_TCR0_TBTT_STOP_CTRL);
-+	mt76_set(dev, MT_TMAC_TCR2(phy->band_idx), MT_TMAC_TCR2_SCH_DET_DIS);
+ 	mt76_wr(dev, MT_TMAC_TFCR0(band), 0);
+ 	mt76_clear(dev, MT_TMAC_TCR0(band), MT_TMAC_TCR0_TBTT_STOP_CTRL);
++	mt76_set(dev, MT_TMAC_TCR2(band), MT_TMAC_TCR2_SCH_DET_DIS);
  
  	/* config rx filter for testmode rx */
- 	mt76_wr(dev, MT_WF_RFCR(phy->band_idx), 0xcf70a);
- 	mt76_wr(dev, MT_WF_RFCR1(phy->band_idx), 0);
+ 	mt76_wr(dev, MT_WF_RFCR(band), 0xcf70a);
+ 	mt76_wr(dev, MT_WF_RFCR1(band), 0);
 +
 +	if (is_mt7916(&dev->mt76)) {
 +		/* enable MDP Tx block mode */
@@ -271,7 +271,7 @@
  }
  
  static void
-@@ -415,6 +454,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -417,6 +456,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
  	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
  
@@ -280,7 +280,7 @@
  	if (!en)
  		mt7915_tm_set_tam_arb(phy, en, 0);
  }
-@@ -477,18 +518,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -479,18 +520,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
  
@@ -298,7 +298,7 @@
 +		u8 _rsv[2];
 +	} __packed req = {
 +		.format_id = CMD_RX_STAT_BAND,
-+		.band = phy != &dev->phy,
++		.band = phy->mt76->band_idx,
 +	};
 +	int ret;
 +
@@ -337,7 +337,7 @@
  		mt7915_tm_update_channel(phy);
  
  		/* read-clear */
--		mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
+-		mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
 +		mt7915_tm_get_rx_stats(phy, true);
 +
 +		/* clear fw count */
@@ -347,7 +347,7 @@
  		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
  	}
  }
-@@ -718,12 +804,8 @@ static int
+@@ -721,12 +807,8 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -360,15 +360,15 @@
  
  	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
  	if (!rx)
-@@ -767,15 +849,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -770,15 +852,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
--	cnt = mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
+-	cnt = mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
 -	fcs_err = is_mt7915(&dev->mt76) ? FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK, cnt) :
 -		FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK_MT7916, cnt);
 -
--	q = phy->band_idx ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
+-	q = phy->mt76->band_idx ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
 -	mphy->test.rx_stats.packets[q] += fcs_err;
 -	mphy->test.rx_stats.fcs_error[q] += fcs_err;
 -
@@ -474,5 +474,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
index 31cddf7..bc80d3f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
@@ -1,4 +1,4 @@
-From b797f4107d893a697b20cfe77ad82a4c8348c397 Mon Sep 17 00:00:00 2001
+From 26061a276c620654542fb96064f6537070e3f278 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
 Subject: [PATCH 1112/1128] mt76: testmode: additional supports
@@ -18,19 +18,19 @@
  mt7915/mmio.c     |    2 +
  mt7915/mt7915.h   |   14 +-
  mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1170 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.c | 1172 ++++++++++++++++++++++++++++++++++++++++++---
  mt7915/testmode.h |  278 +++++++++++
  testmode.c        |  275 +++++++++--
  testmode.h        |   75 +++
  tools/fields.c    |   80 ++++
  tx.c              |    3 +-
- 19 files changed, 1962 insertions(+), 146 deletions(-)
+ 19 files changed, 1963 insertions(+), 147 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index ae22b959..d2891c64 100644
+index fc24b353..dc8d8882 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -535,8 +535,7 @@ free:
+@@ -539,8 +539,7 @@ free:
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index 9a908c9a..f8ca7ba1 100644
+index 19d9efb3..2e0e011d 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,7 +71,7 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 0d87f135..32e2dea0 100644
+index 4822ffb7..58258e19 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -635,6 +635,21 @@ struct mt76_testmode_ops {
@@ -152,7 +152,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1132,6 +1169,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1135,6 +1172,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -212,7 +212,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1142,7 +1232,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1145,7 +1235,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -222,7 +222,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1244,7 +1335,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1247,7 +1338,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -233,7 +233,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index a48903ca..4f17954e 100644
+index cf6ec55f..291a7c12 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
@@ -255,10 +255,10 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 172a926a..e10e92b6 100644
+index 18d6c669..a8ce98c9 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -983,6 +983,7 @@ enum {
+@@ -994,6 +994,7 @@ enum {
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
@@ -266,7 +266,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1184,6 +1185,7 @@ enum {
+@@ -1195,6 +1196,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -275,10 +275,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index d4105835..2f3453b0 100644
+index 172bdcf2..3f0a9d93 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -603,7 +603,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -674,7 +674,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -288,10 +288,10 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 28c6ab35..3b144ad0 100644
+index fc7b7903..0746e4b3 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -629,16 +629,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -628,16 +628,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  {
  #ifdef CONFIG_NL80211_TESTMODE
  	struct mt76_testmode_data *td = &phy->mt76->test;
@@ -333,7 +333,7 @@
  
  	switch (td->tx_rate_mode) {
  	case MT76_TM_TX_MODE_HT:
-@@ -728,13 +750,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -727,13 +749,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  	if (mode >= MT_PHY_TYPE_HE_SU)
  		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
  
@@ -361,12 +361,12 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 75073363..e84d6132 100644
+index 3d309bc0..8527b90a 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -223,7 +223,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -227,7 +227,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mvif->phy = phy;
- 	mvif->mt76.band_idx = phy->band_idx;
+ 	mvif->mt76.band_idx = phy->mt76->band_idx;
  
 -	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
 +	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP && vif->type != NL80211_IFTYPE_MONITOR);
@@ -374,10 +374,10 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 696ca11b..5687e136 100644
+index ec306f01..d4336f69 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -367,6 +367,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -383,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -389,7 +389,7 @@
  	default:
  		break;
  	}
-@@ -398,6 +403,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -414,6 +419,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
  	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
  	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
@@ -397,7 +397,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2781,14 +2787,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2798,14 +2804,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -415,7 +415,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 6a145aef..4bc58c98 100644
+index 2e97db7b..4d86c7f1 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -434,7 +434,7 @@
  };
  
  struct mt7915_mcu_thermal_ctrl {
-@@ -464,6 +469,12 @@ enum {
+@@ -471,6 +476,12 @@ enum {
  
  enum {
  	MT_BF_SOUNDING_ON = 1,
@@ -447,7 +447,7 @@
  	MT_BF_TYPE_UPDATE = 20,
  	MT_BF_MODULE_UPDATE = 25
  };
-@@ -698,10 +709,19 @@ struct mt7915_muru {
+@@ -717,10 +728,19 @@ struct mt7915_muru {
  #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
  
  /* Common Config */
@@ -472,7 +472,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 19518cb5..fef4b126 100644
+index 07de3cbd..26881fdc 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
@@ -492,10 +492,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e6c000a7..cf7fcdfc 100644
+index 415fe82a..6206c7f5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -316,6 +316,9 @@ struct mt7915_phy {
+@@ -315,6 +315,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -505,7 +505,7 @@
  	} test;
  #endif
  
-@@ -415,6 +418,14 @@ struct mt7915_dev {
+@@ -414,6 +417,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -520,7 +520,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -586,7 +597,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -585,7 +596,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -529,7 +529,7 @@
  int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -623,6 +634,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -622,6 +633,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -538,7 +538,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 688f7dee..ae4695ae 100644
+index d6a05f13..e8768488 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -559,7 +559,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 931d1db2..d9d43cb7 100644
+index 46939191..e0ba088f 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -635,7 +635,7 @@
  		.testmode_en = 1,
  		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
 -		.param.clean.wcid = wcid,
- 		.param.clean.band = phy->band_idx,
+ 		.param.clean.band = phy->mt76->band_idx,
  	};
  
 -	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
@@ -654,6 +654,15 @@
  }
  
  static int
+@@ -141,7 +189,7 @@ mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
+ 		.testmode_en = 1,
+ 		.param_idx = MCU_ATE_SET_PHY_COUNT,
+ 		.param.cfg.enable = control,
+-		.param.cfg.band = phy != &dev->phy,
++		.param.cfg.band = phy->mt76->band_idx,
+ 	};
+ 
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
 @@ -182,12 +230,738 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
  	return mt7915_mcu_set_muru_ctrl(dev, MURU_SET_ARB_OP_MODE, op_mode);
  }
@@ -673,7 +682,7 @@
 +		.testmode_en = !(phy->mt76->test.state == MT76_TM_STATE_OFF),
 +		.param_idx = cfg_cmd[td->cfg.type],
 +		.param.cfg.enable = td->cfg.enable,
-+		.param.cfg.band = phy->band_idx,
++		.param.cfg.band = phy->mt76->band_idx,
 +	};
 +
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
@@ -775,12 +784,12 @@
 +	}
 +
 +	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
-+		memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
++		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
 +	if (td->tx_rate_mode >= MT76_TM_TX_MODE_VHT)
-+		memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
++		memcpy(&sta->deflink.vht_cap, &sband->vht_cap, sizeof(sta->deflink.vht_cap));
 +	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_SU)
-+		memcpy(&sta->he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
-+		       sizeof(sta->he_cap));
++		memcpy(&sta->deflink.he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
++		       sizeof(sta->deflink.he_cap));
 +	sta->aid = aid;
 +	sta->wme = 1;
 +
@@ -956,7 +965,7 @@
 +		.category = MT_BF_IBF_PHASE_COMP,
 +		.bw = val[0],
 +		.jp_band = (val[2] == 1) ? 1 : 0,
-+		.dbdc_idx = phy->band_idx,
++		.dbdc_idx = phy->mt76->band_idx,
 +		.read_from_e2p = val[3],
 +		.disable = val[4],
 +	};
@@ -1395,7 +1404,7 @@
  	struct edca *e = &req.edca[0];
  
  	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
-@@ -262,7 +1036,8 @@ done:
+@@ -263,7 +1037,8 @@ done:
  
  	return mt7915_tm_set_wmm_qid(phy,
  				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
@@ -1405,7 +1414,7 @@
  }
  
  static int
-@@ -338,7 +1113,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+@@ -339,7 +1114,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
  	bitrate = cfg80211_calculate_bitrate(&rate);
  	tx_len = bitrate * tx_time / 10 / 8;
  
@@ -1414,7 +1423,7 @@
  	if (ret)
  		return ret;
  
-@@ -456,64 +1231,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -458,64 +1233,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  
  	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
  
@@ -1554,7 +1563,7 @@
 +		u8 _rsv[2];
 +		__le32 tx_count;
 +	} __packed req = {
-+		.band = phy != &dev->phy,
++		.band = phy->mt76->band_idx,
 +		.enable = enable,
 +		.tx_count = enable ? cpu_to_le32(tx_count) : 0,
 +	};
@@ -1673,7 +1682,7 @@
  
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
-@@ -542,10 +1480,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -544,10 +1482,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  		return ret;
  
  	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
@@ -1684,7 +1693,7 @@
  
  	if (!clear) {
  		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
-@@ -560,13 +1494,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -562,13 +1496,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  	return 0;
  }
  
@@ -1699,7 +1708,7 @@
 +		u8 _rsv;
 +		__le16 wlan_idx;
 +	} __packed req = {
-+		.band = phy->band_idx,
++		.band = phy->mt76->band_idx,
 +	};
 +
 +	mt76_tm_for_each_entry(phy->mt76, wcid, ed)
@@ -1722,7 +1731,7 @@
 +	struct mt7915_tm_cmd req = {
 +		.testmode_en = 1,
 +		.param_idx = MCU_ATE_SET_MU_RX_AID,
-+		.param.rx_aid.band = cpu_to_le32(phy->band_idx),
++		.param.rx_aid.band = cpu_to_le32(phy->mt76->band_idx),
 +		.param.rx_aid.aid = cpu_to_le16(aid),
 +	};
 +
@@ -1747,7 +1756,7 @@
  
  		/* read-clear */
  		mt7915_tm_get_rx_stats(phy, true);
-@@ -574,9 +1556,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -576,9 +1558,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  		/* clear fw count */
  		mt7915_tm_set_phy_count(phy, 0);
  		mt7915_tm_set_phy_count(phy, 1);
@@ -1762,9 +1771,9 @@
  }
  
  static int
-@@ -614,34 +1599,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+@@ -617,34 +1602,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  	tx_cont->tx_ant = td->tx_antenna_mask;
- 	tx_cont->band = phy->band_idx;
+ 	tx_cont->band = band;
  
 -	switch (chandef->width) {
 -	case NL80211_CHAN_WIDTH_40:
@@ -1797,8 +1806,8 @@
 +	tx_cont->bw = mt7915_tm_chan_bw(chandef->width);
  
  	if (!en) {
- 		req.op.rf.param.func_data = cpu_to_le32(phy->band_idx);
-@@ -725,6 +1683,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ 		req.op.rf.param.func_data = cpu_to_le32(band);
+@@ -728,6 +1686,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
  	if (changed & BIT(TM_CHANGED_TXPOWER))
  		mt7915_tm_set_tx_power(phy);
@@ -1811,7 +1820,7 @@
  }
  
  static int
-@@ -804,6 +1768,7 @@ static int
+@@ -807,6 +1771,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1819,7 +1828,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -849,11 +1814,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -852,11 +1817,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -2902,10 +2911,10 @@
  };
  
 diff --git a/tx.c b/tx.c
-index c8d78b0a..c7cd842c 100644
+index 1f309d05..6d55566f 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
+@@ -250,8 +250,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -2916,5 +2925,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
index a9882c1..676491e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
@@ -1,4 +1,4 @@
-From 2ae175cba8bc0192c251c380d00448fb08a709a5 Mon Sep 17 00:00:00 2001
+From 0efb01a98e1abbe39c141df4f7ab6aa2bbb55ad8 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
 Subject: [PATCH 1113/1128] mt76: testmode: add pre-cal support
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 1e41b94d..e083964b 100644
+index 0a88048b..cb6ff17a 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,7 +37,7 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 32e2dea0..2beb1056 100644
+index 58258e19..89c85709 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -636,6 +636,7 @@ struct mt76_testmode_ops {
@@ -49,10 +49,10 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e10e92b6..4e489244 100644
+index a8ce98c9..f42946ec 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -979,6 +979,7 @@ enum {
+@@ -990,6 +990,7 @@ enum {
  
  /* ext event table */
  enum {
@@ -114,10 +114,10 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5687e136..d1ff73a9 100644
+index d4336f69..92bae4f7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -371,6 +371,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -387,6 +387,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BF_STATUS_READ:
  		mt7915_tm_txbf_status_read(dev, skb);
  		break;
@@ -127,7 +127,7 @@
  #endif
  	default:
  		break;
-@@ -2882,7 +2885,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2901,7 +2904,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -136,7 +136,7 @@
  		return 0;
  
  	/*
-@@ -2962,11 +2965,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -2981,11 +2984,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index cf7fcdfc..cafd4389 100644
+index 6206c7f5..ed1469d6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -402,6 +402,10 @@ struct mt7915_dev {
+@@ -401,6 +401,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -635,6 +639,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -634,6 +638,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index d9d43cb7..c6a5837e 100644
+index e0ba088f..a9e57e4b 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -203,7 +203,7 @@
  
  enum {
  	TM_CHANGED_TXPOWER,
-@@ -1578,17 +1579,15 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
+@@ -1580,18 +1581,16 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
  static int
  mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  {
@@ -216,6 +216,7 @@
 -	u32 func_idx = en ? TX_CONT_START : TX_CONT_STOP;
 +	u32 func_idx = en ? RF_TEST_TX_CONT_START : RF_TEST_TX_CONT_STOP;
  	u8 rate_idx = td->tx_rate_idx, mode;
+ 	u8 band = phy->mt76->band_idx;
  	u16 rateval;
  	struct mt7915_tm_rf_test req = {
 -		.action = 1,
@@ -223,7 +224,7 @@
  		.icap_len = 120,
  		.op.rf.func_idx = cpu_to_le32(func_idx),
  	};
-@@ -1673,6 +1672,316 @@ out:
+@@ -1676,6 +1675,316 @@ out:
  				 sizeof(req), true);
  }
  
@@ -277,7 +278,7 @@
 +		}
 +		dev_info(dev->mt76.dev, "Group Pre-Cal:\n");
 +		for (i = 0; i < (group_size / sizeof(u32)); i += 4) {
-+			dev_info(dev->mt76.dev, "[0x%08x] 0x%8x 0x%8x 0x%8x 0x%8x\n",
++			dev_info(dev->mt76.dev, "[0x%08lx] 0x%8x 0x%8x 0x%8x 0x%8x\n",
 +				 i * sizeof(u32), pre_cal[i], pre_cal[i + 1],
 +				 pre_cal[i + 2], pre_cal[i + 3]);
 +		}
@@ -404,7 +405,7 @@
 +		}
 +
 +		req.op.rf.param.cal_param.func_data = func_data;
-+		req.op.rf.param.cal_param.band_idx = phy->band_idx;
++		req.op.rf.param.cal_param.band_idx = phy->mt76->band_idx;
 +
 +		memcpy(&chan_backup, chandef->chan, sizeof(struct ieee80211_channel));
 +		memcpy(&chandef_backup, chandef, sizeof(struct cfg80211_chan_def));
@@ -458,7 +459,7 @@
 +		dev_info(dev->mt76.dev, "DPD Pre-Cal:\n");
 +		for (i = 0; i < dpd_size / sizeof(u32); i += 4) {
 +			j = i + (group_size / sizeof(u32));
-+			dev_info(dev->mt76.dev, "[0x%08x] 0x%8x 0x%8x 0x%8x 0x%8x\n",
++			dev_info(dev->mt76.dev, "[0x%08lx] 0x%8x 0x%8x 0x%8x 0x%8x\n",
 +				 j * sizeof(u32), pre_cal[j], pre_cal[j + 1],
 +				 pre_cal[j + 2], pre_cal[j + 3]);
 +		}
@@ -540,7 +541,7 @@
  static void
  mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  {
-@@ -1712,6 +2021,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -1715,6 +2024,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	else if (prev_state == MT76_TM_STATE_OFF ||
  		 state == MT76_TM_STATE_OFF)
  		mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
@@ -551,7 +552,7 @@
  
  	if ((state == MT76_TM_STATE_IDLE &&
  	     prev_state == MT76_TM_STATE_OFF) ||
-@@ -1873,9 +2186,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+@@ -1876,9 +2189,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
  	return ret;
  }
  
@@ -842,5 +843,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
index d37122d..87c53f9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,4 +1,4 @@
-From 872894745f05c7fb7c2928cd6bd8395af47933c1 Mon Sep 17 00:00:00 2001
+From 2a26fd854c3b09d271571505cb22075fef30ae36 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
 Subject: [PATCH 1114/1128] mt76: testmode: add iBF command mode support
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index c6a5837e..9de11e98 100644
+index a9e57e4b..99582d9c 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -88,7 +88,7 @@
  	default:
  		break;
  	};
-@@ -1071,7 +1080,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+@@ -1072,7 +1081,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
  		rate.legacy = sband->bitrates[rate.mcs].bitrate;
  		break;
  	case MT76_TM_TX_MODE_HT:
@@ -96,7 +96,7 @@
  		flags |= RATE_INFO_FLAGS_MCS;
  
  		if (td->tx_rate_sgi)
-@@ -1435,7 +1443,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1437,7 +1445,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  			if (duty_cycle < 100)
  				tx_time = duty_cycle * ipg / (100 - duty_cycle);
  		}
@@ -239,5 +239,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 5b05b06..9d0b040 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,4 +1,4 @@
-From 189f75c624438287c7228eb029f07e7a79cbccff Mon Sep 17 00:00:00 2001
+From 98bf3fe9efb60744e0de0cdbc16b6954d4586d2c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
 Subject: [PATCH 1115/1128] mt76: testmode: add ZWDFS test mode support
@@ -19,7 +19,7 @@
  10 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 2beb1056..8139b4ad 100644
+index 89c85709..2bacc1b4 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -719,6 +719,15 @@ struct mt76_testmode_data {
@@ -39,10 +39,10 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4e489244..c353341e 100644
+index f42946ec..7853e074 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1179,6 +1179,7 @@ enum {
+@@ -1190,6 +1190,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -50,7 +50,7 @@
  	MCU_EXT_CMD_RX_STAT = 0xa4,
  	MCU_EXT_CMD_SET_SPR = 0xa8,
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
-@@ -1189,6 +1190,7 @@ enum {
+@@ -1200,6 +1201,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
@@ -59,18 +59,18 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d1ff73a9..51ec151b 100644
+index 92bae4f7..87d2c0de 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2620,6 +2620,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+@@ -2636,6 +2636,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
  		req.monitor_chan = chandef->chan->hw_value;
  		req.monitor_central_chan =
  			ieee80211_frequency_to_channel(chandef->center_freq1);
 +		req.monitor_bw = mt76_connac_chan_bw(chandef);
- 		req.band_idx = phy->band_idx;
+ 		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4450,3 +4451,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4466,3 +4467,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -91,7 +91,7 @@
 +		u32 idle_power_cmd_type;
 +	} __packed req = {
 +		.ipi_hist_idx = cmd,
-+		.band_idx = phy->band_idx,
++		.band_idx = phy->mt76->band_idx,
 +	};
 +
 +	if (!wait_resp)
@@ -123,7 +123,7 @@
 +	} __packed req = {
 +		.mode = mode,
 +		.pd_setting = 1,
-+		.band_idx = phy->band_idx,
++		.band_idx = phy->mt76->band_idx,
 +	};
 +
 +	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(IPI_HIST_SCAN),
@@ -140,10 +140,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 4bc58c98..300b7834 100644
+index 4d86c7f1..9a485249 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -609,6 +609,52 @@ struct csi_data {
+@@ -628,6 +628,52 @@ struct csi_data {
  };
  #endif
  
@@ -197,10 +197,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index cafd4389..0cbd02e2 100644
+index ed1469d6..26bcb4e5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -304,6 +304,7 @@ struct mt7915_phy {
+@@ -303,6 +303,7 @@ struct mt7915_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -208,7 +208,7 @@
  
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
-@@ -753,6 +754,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -752,6 +753,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -219,10 +219,10 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index ae4695ae..6aa98812 100644
+index e8768488..f4b57099 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -1187,6 +1187,8 @@ enum offs_rev {
+@@ -1194,6 +1194,8 @@ enum offs_rev {
  #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
  #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
  
@@ -232,7 +232,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 9de11e98..6ce2c0e6 100644
+index 99582d9c..2ae6c07f 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -406,14 +406,14 @@
 +		if (self_idle_ratio <= td->ipi_threshold) {
 +			dev_info(dev->mt76.dev,
 +				 "band[%d]: self idle ratio = %d%%, idle ratio = %d%%\n",
-+				 phy->band_idx, self_idle_ratio, ipi_idle_ratio);
++				 phy->mt76->band_idx, self_idle_ratio, ipi_idle_ratio);
 +			return;
 +		}
 +
 +		channel_load = (100 * channel_load) / self_idle_ratio;
 +		dev_info(dev->mt76.dev,
 +			 "band[%d]: chan load = %d%%, self idle ratio = %d%%, idle ratio = %d%%\n",
-+			 phy->band_idx, channel_load, self_idle_ratio, ipi_idle_ratio);
++			 phy->mt76->band_idx, channel_load, self_idle_ratio, ipi_idle_ratio);
 +		antenna_idx++;
 +	}
 +}
@@ -429,7 +429,7 @@
 +	if (!is_mt7915(&dev->mt76)) {
 +		struct mt7915_mcu_rdd_ipi_scan data;
 +
-+		if (phy->band_idx)
++		if (phy->mt76->band_idx)
 +			start_antenna_idx = 4;
 +
 +		/* Use all antenna */
@@ -478,7 +478,7 @@
  static int
  mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
  		      u16 cw_max, u16 txop, u8 tx_cmd)
-@@ -1247,6 +1469,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -1249,6 +1471,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  		phy->mt76->test.tx_mpdu_len = 0;
  		phy->test.bf_en = 0;
  		mt7915_tm_set_entry(phy);
@@ -487,7 +487,7 @@
  	}
  }
  
-@@ -2005,6 +2229,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -2008,6 +2232,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_cfg(phy);
  	if (changed & BIT(TM_CHANGED_TXBF_ACT))
  		mt7915_tm_set_txbf(phy);
@@ -682,5 +682,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 9e4c950..18a49c0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,4 +1,4 @@
-From 5d6beb19bab77695d83719719a179437f7674806 Mon Sep 17 00:00:00 2001
+From 3a0e0ac5413c0705e0cb997c276f75360875b584 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
 Subject: [PATCH 1116/1128] mt76: mt7915: init rssi in WTBL when add station
@@ -8,10 +8,10 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index e84d6132..9180689e 100644
+index 8527b90a..0396031c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -671,6 +671,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy;
  #endif
  	int ret, idx;
@@ -19,7 +19,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -689,6 +690,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -694,6 +695,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 5331089..3a727dc 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,4 +1,4 @@
-From 540e6d1ba99002e4ac0cc0ae93022ee20592e5c4 Mon Sep 17 00:00:00 2001
+From 34332523e19b7689147f83936bac106934f935e0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
 Subject: [PATCH 1117/1128] mt76: mt7915: reduce TWT SP sent to FW for cert
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 51ec151b..8ebe38f0 100644
+index 87d2c0de..11732993 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3773,7 +3773,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3789,7 +3789,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
@@ -24,5 +24,5 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
index bcdd484..113fd2e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,4 +1,4 @@
-From bb596598ed5abff5cdf4ab659d77419573436baf Mon Sep 17 00:00:00 2001
+From b456d43fa8c053eb10dd20f29b61f0cdb25550a1 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
 Subject: [PATCH 1118/1128] mt76: connac: airtime fairness feature off in
@@ -9,10 +9,10 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index f8ca7ba1..7e0f0e0e 100644
+index 2e0e011d..de9ef237 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
+@@ -435,7 +435,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
  			WIPHY_FLAG_AP_UAPSD;
  
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
@@ -21,5 +21,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index 7bc97f8..df9eb33 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,4 +1,4 @@
-From 2118a1b7be90a8ab8894e0094fbe4e14e498c767 Mon Sep 17 00:00:00 2001
+From 6e7838964db8b046363f479ce898b18e09ed30fc Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
 Subject: [PATCH 1119/1128] mt76: mt7915: add mt7986 and mt7916 pre-calibration
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 0bce0ce5..0f5862e3 100644
+index 24efa280..7bdd4d52 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8ebe38f0..97b1cf3b 100644
+index 11732993..ca2e4029 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2884,7 +2884,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2903,7 +2903,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2922,9 +2923,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2941,9 +2942,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2932,34 +2933,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2951,34 +2952,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -2991,24 +3027,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3010,24 +3046,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
index 2012df4..d7cd7f4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,4 +1,4 @@
-From b7a732694ec0bffaa3ff2805cdd6600ba3b598a9 Mon Sep 17 00:00:00 2001
+From f93d67b6ae1b70d4fcf95db93951627362d174c8 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
 Subject: [PATCH 1120/1128] mt76: mt7915: add phy capability vendor command
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0cbd02e2..69f1b6b4 100644
+index 26bcb4e5..66695d5b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
index 940b835..7edac8d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
@@ -1,4 +1,4 @@
-From c33574d98607b2ff23a683fb30a8de2ebbc9c8f2 Mon Sep 17 00:00:00 2001
+From b36a1933047e93c0d3a048c53dfdd5a395a833cd Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
 Subject: [PATCH 1121/1128] mt76: mt7915: add vendor subcmd EDCCA ctrl
@@ -11,15 +11,15 @@
  mt7915/mcu.c      |  72 +++++++++++++++++++++++++
  mt7915/mcu.h      |  21 ++++++++
  mt7915/mt7915.h   |   3 +-
- mt7915/vendor.c   | 134 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.c   | 132 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7915/vendor.h   |  33 ++++++++++++
- 7 files changed, 266 insertions(+), 1 deletion(-)
+ 7 files changed, 264 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c353341e..9339b711 100644
+index 7853e074..88bfd09f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1189,6 +1189,7 @@ enum {
+@@ -1200,6 +1200,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -28,10 +28,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 9180689e..83b97d23 100644
+index 0396031c..94b7a651 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -454,6 +454,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -458,6 +458,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  			mutex_unlock(&dev->mt76.mutex);
  		}
  #endif
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 97b1cf3b..cd6f3292 100644
+index ca2e4029..7507344a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4552,3 +4552,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4568,3 +4568,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -67,7 +67,7 @@
 +		u8 region;
 +		s8 thres_compensation;
 +	} __packed req = {
-+		.band_idx = phy->band_idx,
++		.band_idx = phy->mt76->band_idx,
 +		.cmd_idx = mode,
 +		.record_in_fw = false,
 +		.thres_compensation = compensation,
@@ -101,7 +101,7 @@
 +		u8 region;
 +		s8 thres_compensation;
 +	} __packed req = {
-+		.band_idx = phy->band_idx,
++		.band_idx = phy->mt76->band_idx,
 +		.cmd_idx = mode,
 +		.record_in_fw = false,
 +	};
@@ -122,10 +122,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 300b7834..de265d15 100644
+index 9a485249..33e33d89 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -866,6 +866,27 @@ enum {
+@@ -885,6 +885,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -154,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 69f1b6b4..aaab5f7a 100644
+index 66695d5b..5bffcff5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -754,7 +754,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -753,7 +753,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -168,7 +168,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..cd5c3b83 100644
+index 77d71e48..2484e25f 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -196,7 +196,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1015,6 +1033,110 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1015,6 +1033,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -266,9 +266,7 @@
 +{
 +	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 +	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
 +	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
-+	void *a;
 +	int len = EDCCA_THRES_NUM;
 +	int err;
 +	u8 edcca_mode;
@@ -307,7 +305,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1083,6 +1205,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1083,6 +1203,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_phy_capa_ctrl_dump,
  		.policy = phy_capa_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
@@ -378,5 +376,5 @@
  
  enum mtk_capi_control_changed {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
index 1357d9a..01962a8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,4 +1,4 @@
-From a811ab8ab270c406e6360910a3dc09255990b3aa Mon Sep 17 00:00:00 2001
+From 117480121b8833507a563ecd319bcf57c270b977 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
 Subject: [PATCH 1122/1128] mt76: mt7915: implement bin file mode
@@ -7,14 +7,14 @@
 ---
  eeprom.c             | 18 +++++++++++++++
  mt76.h               |  1 +
- mt7915/eeprom.c      | 52 ++++++++++++++++++++------------------------
- mt7915/eeprom.h      | 44 +++++++++++++++++++++++++++++++++++++
- mt7915/mt7915.h      | 17 ++++++++++++---
+ mt7915/eeprom.c      | 53 ++++++++++++++++++++------------------------
+ mt7915/eeprom.h      | 44 ++++++++++++++++++++++++++++++++++++
+ mt7915/mt7915.h      | 17 +++++++++++---
  mt7915/mtk_debugfs.c | 41 ++++++++++++++++++++++++++++++++++
- 6 files changed, 141 insertions(+), 32 deletions(-)
+ 6 files changed, 142 insertions(+), 32 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index e083964b..5b9faf7e 100644
+index cb6ff17a..aac70efb 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -43,10 +43,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 8139b4ad..db2075c3 100644
+index 2bacc1b4..d102333b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1027,6 +1027,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1029,6 +1029,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -55,7 +55,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 0f5862e3..4d2d9ca2 100644
+index 7bdd4d52..64a7750b 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -42,33 +42,6 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
@@ -112,15 +112,16 @@
  	} else {
  		u8 free_block_num;
  		u32 block_num, i;
-@@ -121,6 +98,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 		for (i = 0; i < block_num; i++)
- 			mt7915_mcu_get_eeprom(dev,
- 					      i * MT7915_EEPROM_BLOCK_SIZE);
+@@ -126,6 +103,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ 			if (ret < 0)
+ 				return ret;
+ 		}
++
 +		dev->eeprom_mode = EFUSE_MODE;
  	}
  
  	return mt7915_check_eeprom(dev);
-@@ -224,12 +202,28 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -231,12 +210,28 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
  
@@ -213,7 +214,7 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index aaab5f7a..5a206f7a 100644
+index 5bffcff5..239eef58 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -42,15 +42,24 @@
@@ -244,7 +245,7 @@
  #define MT7915_EEPROM_SIZE		3584
  #define MT7916_EEPROM_SIZE		4096
  
-@@ -397,6 +406,8 @@ struct mt7915_dev {
+@@ -396,6 +405,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -254,7 +255,7 @@
  	bool ibf;
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index d96f222a..9a9e0cb6 100644
+index d96f222a..376e5f89 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
@@ -274,10 +275,10 @@
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	struct mt76_dev *mdev = &dev->mt76;
 +#ifdef CONFIG_NL80211_TESTMODE
-+	char *mtd_name = mdev->test_mtd.name;
++	const char *mtd_name = mdev->test_mtd.name;
 +	u32 mtd_offset = mdev->test_mtd.offset;
 +#else
-+	char *mtd_name;
++	const char *mtd_name = NULL;
 +	u32 mtd_offset;
 +#endif
 +
@@ -320,5 +321,5 @@
  }
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
index d34181e..49d45f1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
@@ -1,4 +1,4 @@
-From 010250dee3f031e1de7edc5c867b2057454a61a0 Mon Sep 17 00:00:00 2001
+From 409f3949513cb8bf94d696401be9864d0363b22f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
 Subject: [PATCH 1123/1128] mt76: mt7915: initialize wcid
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3b144ad0..dc4c6eb3 100644
+index 0746e4b3..22dd66e3 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1031,7 +1031,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1030,7 +1030,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
index 74a5e86..75e864d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
@@ -1,16 +1,16 @@
-From 88e63910976d94c67751edc6a430b27d1049bb6a Mon Sep 17 00:00:00 2001
+From c977d69ea6fd5a6db3e889ef6d3baaae19d2aee7 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
 Subject: [PATCH 1124/1128] mt76: mt7915: Add hemu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
- mt7915/vendor.c | 26 ++++++++++++++++++++++++++
+ mt7915/vendor.c | 25 +++++++++++++++++++++++++
  mt7915/vendor.h |  1 +
- 2 files changed, 27 insertions(+)
+ 2 files changed, 26 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index cd5c3b83..5e34b852 100644
+index 2484e25f..f7becce9 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -21,7 +21,7 @@
  };
  
  static const struct nla_policy
-@@ -1004,6 +1005,30 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
+@@ -1004,6 +1005,29 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -34,7 +34,6 @@
 +	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 +	struct mt7915_phy *phy = mt7915_hw_phy(hw);
 +	struct mt7915_dev *dev = phy->dev;
-+	void *a;
 +	int len = 0;
 +
 +	if (*storage == 1)
@@ -52,7 +51,7 @@
  static int
  mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1192,6 +1217,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1190,6 +1214,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
  			WIPHY_VENDOR_CMD_NEED_RUNNING,
  		.doit = mt7915_vendor_hemu_ctrl,
@@ -73,5 +72,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 88f7b33..5a73958 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,4 +1,4 @@
-From f7ab85c232e5f4048e3f2a2bdc1141915d503ae4 Mon Sep 17 00:00:00 2001
+From f865459f3adbb780091ef0346f93ce65130412d4 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
 Subject: [PATCH 1125/1128] mt76: mt7915: add vendor subcmd three wire (PTA)
@@ -16,10 +16,10 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9339b711..131257c7 100644
+index 88bfd09f..5cff1a45 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1188,7 +1188,7 @@ enum {
+@@ -1199,7 +1199,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -29,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index cd6f3292..4e7bc982 100644
+index 7507344a..5791cb29 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4234,37 +4234,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4250,37 +4250,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,10 +94,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index de265d15..9780f128 100644
+index 33e33d89..08476eb6 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -655,6 +655,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -674,6 +674,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -134,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5a206f7a..626b2634 100644
+index 239eef58..22454b54 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -757,6 +757,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -756,6 +756,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5e34b852..6b86b77a 100644
+index f7becce9..fb760e17 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -170,7 +170,7 @@
  		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
  	}
  
-@@ -1117,6 +1122,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
+@@ -1116,6 +1121,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -178,7 +178,7 @@
  static int
  mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1162,6 +1168,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1159,6 +1165,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -210,7 +210,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1243,6 +1274,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1240,6 +1271,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_edcca_ctrl_dump,
  		.policy = edcca_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
@@ -268,5 +268,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 47606a0..5cf8574 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,19 +1,19 @@
-From c327c081324034c44660ded9a50848da27c81879 Mon Sep 17 00:00:00 2001
+From 191b449eb978f73b95143e8cf3ec1765b73eb609 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
 Subject: [PATCH 1126/1128] mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
- mt7915/vendor.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h | 25 ++++++++++++++++-
- 2 files changed, 95 insertions(+), 1 deletion(-)
+ mt7915/vendor.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 25 ++++++++++++++++++-
+ 2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 6b86b77a..e4915623 100644
+index fb760e17..22af66d5 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -86,6 +86,17 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
+@@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
         [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
  };
  
@@ -22,16 +22,10 @@
 +	[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
 +};
 +
-+static struct nla_policy
-+ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
-+	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
-+};
-+
-+
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1192,6 +1203,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
+@@ -1189,6 +1194,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
  	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
  }
  
@@ -86,7 +80,7 @@
  
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
-@@ -1285,6 +1344,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1282,6 +1335,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_3wire_ctrl,
  		.policy = three_wire_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
@@ -147,5 +141,5 @@
 +
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index f2b554d..b7ae10e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,4 +1,4 @@
-From ccbf47f2ebfed7523d92f17bd74352bd88779869 Mon Sep 17 00:00:00 2001
+From 5a4f3c3d504087725ef9f47191b4a8edbf27b70e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
 Subject: [PATCH 1127/1128] mt76: mt7915: add E3 re-bonding for low yield rate
@@ -12,19 +12,19 @@
  3 files changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4d2d9ca2..b3d2bbc5 100644
+index 64a7750b..efa9c173 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -97,7 +97,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 					 MT7915_EEPROM_BLOCK_SIZE);
- 		for (i = 0; i < block_num; i++)
- 			mt7915_mcu_get_eeprom(dev,
--					      i * MT7915_EEPROM_BLOCK_SIZE);
-+					      i * MT7915_EEPROM_BLOCK_SIZE, NULL);
- 		dev->eeprom_mode = EFUSE_MODE;
- 	}
- 
-@@ -198,6 +198,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+@@ -99,7 +99,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ 		/* read eeprom data from efuse */
+ 		block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
+ 		for (i = 0; i < block_num; i++) {
+-			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size);
++			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size, NULL);
+ 			if (ret < 0)
+ 				return ret;
+ 		}
+@@ -206,6 +206,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  	dev->chainshift = hweight8(dev->mphy.chainmask);
  }
  
@@ -54,7 +54,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
-@@ -229,6 +252,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -237,6 +260,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  			return ret;
  	}
  
@@ -64,10 +64,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 4e7bc982..dfb1ee69 100644
+index 5791cb29..785c3c10 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2805,7 +2805,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+@@ -2822,7 +2822,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
  				 &req, sizeof(req), true);
  }
  
@@ -76,7 +76,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2822,8 +2822,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2840,8 +2840,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -95,10 +95,10 @@
  
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 626b2634..701e5c86 100644
+index 22454b54..2d3769c6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -562,6 +562,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -561,6 +561,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
@@ -106,7 +106,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev);
  void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  				struct mt7915_phy *phy);
-@@ -615,7 +616,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -614,7 +615,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
  int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
@@ -116,5 +116,5 @@
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
index 97fe88d..00543cf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,4 +1,4 @@
-From d8e79f875fb1c569d10c1c214021b1629f4118a3 Mon Sep 17 00:00:00 2001
+From 3fb208eb0a314a489cd0f0c74d22cc01e6d99822 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
 Subject: [PATCH 1128/1128] mt76: mt7915: support on off SW ACI through debugfs
@@ -11,10 +11,10 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 131257c7..3b789d75 100644
+index 5cff1a45..98b00747 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1190,6 +1190,7 @@ enum {
+@@ -1201,6 +1201,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_SET_CFG = 0xb7,
  	MCU_EXT_CMD_EDCCA = 0xba,
@@ -23,7 +23,7 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9a9e0cb6..ddde4961 100644
+index 376e5f89..846dc5e3 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2932,6 +2932,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
@@ -62,5 +62,5 @@
  }
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
index 0c3111e..84aeced 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From 4e69db534b8abba258baefdd7897907d70234857 Mon Sep 17 00:00:00 2001
+From 30ce8783532bc157e2639b4a91aecb3c050d1bf6 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 3001/3010] mt76: mt7915: wed: add wed tx support
+Subject: [PATCH 3001/3011] mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -24,10 +24,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index dc4c6eb3..d07bf790 100644
+index 22dd66e3..5373777a 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -890,9 +890,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -889,9 +889,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -39,7 +39,7 @@
  }
  
  static void
-@@ -1008,6 +1008,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1007,6 +1007,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -47,7 +47,7 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1063,12 +1064,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1062,12 +1063,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -65,10 +65,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 83b97d23..2d237abf 100644
+index 94b7a651..370bfad7 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1505,14 +1505,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1512,14 +1512,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -86,7 +86,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index fef4b126..7a50aa11 100644
+index 26881fdc..ac574722 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -11,7 +11,7 @@
@@ -107,7 +107,7 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  
  	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-@@ -783,6 +783,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -790,6 +790,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
@@ -116,5 +116,5 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
index ec71b11..a9f6d89 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,7 +1,7 @@
-From b1b86c7f0be6ae9e2ff171f0469c332bf820c849 Mon Sep 17 00:00:00 2001
+From a92a1c7b40b57f5d6594ae8170d7d9e3cd993aef Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
-Subject: [PATCH 3002/3010] mt76: mt7915: wed: add-wed-tx-wds-support-on-mt7986
+Subject: [PATCH 3002/3011] mt76: mt7915: wed: add-wed-tx-wds-support-on-mt7986
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -16,10 +16,10 @@
  8 files changed, 74 insertions(+), 5 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 7e0f0e0e..f0ffbd0c 100644
+index de9ef237..15d300a9 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1371,7 +1371,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -1385,7 +1385,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
  
  	mt76_packet_id_flush(dev, wcid);
  
@@ -32,7 +32,7 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index db2075c3..bb0433b2 100644
+index d102333b..74818a59 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -465,6 +465,7 @@ struct mt76_driver_ops {
@@ -43,7 +43,7 @@
  };
  
  struct mt76_channel_state {
-@@ -842,6 +843,7 @@ struct mt76_dev {
+@@ -849,6 +850,7 @@ struct mt76_dev {
  	spinlock_t status_lock;
  
  	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
@@ -52,10 +52,10 @@
  
  	u64 vif_mask;
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 2f3453b0..8f32b6a8 100644
+index 3f0a9d93..1ed519be 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -722,6 +722,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -793,6 +793,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  			return ret;
  	}
  
@@ -72,10 +72,10 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2d237abf..8813e3c5 100644
+index 370bfad7..0e08bde6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
+@@ -663,6 +663,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -100,7 +100,7 @@
  int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta)
  {
-@@ -670,8 +688,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -675,8 +693,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -120,7 +120,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1141,6 +1169,15 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1148,6 +1176,15 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -136,7 +136,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1512,7 +1549,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1519,7 +1556,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -150,10 +150,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index dfb1ee69..03fd8c50 100644
+index 785c3c10..0ad110ff 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2305,6 +2305,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2321,6 +2321,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  {
  	int ret;
@@ -161,7 +161,7 @@
  
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
-@@ -2334,8 +2335,15 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2350,8 +2351,15 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -180,10 +180,10 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9780f128..5fcac90f 100644
+index 08476eb6..cf1d7d7a 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -281,6 +281,7 @@ enum {
+@@ -288,6 +288,7 @@ enum {
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
  #endif
@@ -192,10 +192,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 7a50aa11..f348a779 100644
+index ac574722..ffe23406 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -991,6 +991,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -998,6 +998,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  		.sta_add = mt7915_mac_sta_add,
  		.sta_remove = mt7915_mac_sta_remove,
  		.update_survey = mt7915_update_channel,
@@ -204,7 +204,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 701e5c86..6bc33f21 100644
+index 2d3769c6..51453058 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -217,7 +217,7 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -725,6 +728,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -724,6 +727,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
@@ -226,5 +226,5 @@
  void mt7915_stats_work(struct work_struct *work);
  int mt76_dfs_start_rdd(struct mt7915_dev *dev, bool force);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
index c11071b..86404b0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,7 +1,7 @@
-From 632b007beff9a0800d2a37d173dee028701ecd02 Mon Sep 17 00:00:00 2001
+From bd9310d73f9c7396d06e60fc10ff554a8e02817f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 12:05:06 +0800
-Subject: [PATCH 3003/3010] mt76: connac: wed: add wed rx copy skb
+Subject: [PATCH 3003/3011] mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 18 insertions(+), 5 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index d2891c64..40885754 100644
+index dc8d8882..53c7528f 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -382,9 +382,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -386,9 +386,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
  
@@ -27,7 +27,7 @@
  
  		mt76_put_rxwi(dev, t);
  
-@@ -578,6 +581,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -568,6 +571,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	while (q->queued < q->ndesc - 1) {
  		struct mt76_txwi_cache *t = NULL;
  		struct mt76_queue_buf qbuf;
@@ -35,7 +35,7 @@
  		void *buf = NULL;
  
  		if ((q->flags & MT_QFLAG_WED) &&
-@@ -585,11 +589,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -575,11 +579,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  			t = mt76_get_rxwi(dev);
  			if (!t)
  				break;
@@ -46,18 +46,18 @@
 +			}
  		}
  
--		buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
+-		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
 -		if (!buf)
 -			break;
 +		if (!skip_alloc) {
-+			buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
++			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
 +			if (!buf)
 +				break;
 +		}
  
  		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
  		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
-@@ -954,5 +965,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -949,5 +960,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  	if (mtk_wed_device_active(&dev->mmio.wed))
  		mtk_wed_device_detach(&dev->mmio.wed);
@@ -66,5 +66,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
index e3e0550..86dff09 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -1,7 +1,7 @@
-From 1bae1f4f3400ed51d57c315c3c003f352ab5f495 Mon Sep 17 00:00:00 2001
+From 705e520c10a4f08bf5b24b56b5ddb015e27c7b99 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3010] mt76: mt7915: wed: add fill receive path to report
+Subject: [PATCH 3004/3011] mt76: mt7915: wed: add fill receive path to report
  wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8813e3c5..52aab3d1 100644
+index 0e08bde6..d8571642 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1560,6 +1560,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1567,6 +1567,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -38,7 +38,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1612,5 +1630,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1619,5 +1637,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
@@ -46,5 +46,5 @@
  #endif
  };
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
index 73feb26..4b36261 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -1,21 +1,21 @@
-From 37113fa0b112098fc65ace049e984438629a6c4f Mon Sep 17 00:00:00 2001
+From 47cfa806f1e2945d1d63f3642207cbdb205e9a12 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:07:46 +0800
-Subject: [PATCH 3005/3010] mt76: mt7915: wed: add ser support when wed on
+Subject: [PATCH 3005/3011] mt76: mt7915: wed: add ser support when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  dma.c           | 29 ++++++++++++++++++++---------
  dma.h           |  1 +
  mt76.h          |  1 +
- mt7915/dma.c    | 36 +++++++++++++++++++++++++++++++-----
+ mt7915/dma.c    | 37 ++++++++++++++++++++++++++++++++-----
  mt7915/mac.c    | 18 ++++++++++++++++++
  mt7915/mmio.c   |  3 +++
  mt7915/mt7915.h |  1 +
- 7 files changed, 75 insertions(+), 14 deletions(-)
+ 7 files changed, 76 insertions(+), 14 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 40885754..87ce79cb 100644
+index 53c7528f..35beec72 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -35,7 +35,7 @@
  
  static void
  mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
-@@ -623,14 +624,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -618,14 +619,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	return frames;
  }
  
@@ -57,7 +57,7 @@
  	if (!mtk_wed_device_active(wed))
  		q->flags &= ~MT_QFLAG_WED;
  
-@@ -642,7 +647,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -637,7 +642,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	switch (type) {
  	case MT76_WED_Q_TX:
@@ -66,7 +66,7 @@
  		if (!ret)
  			q->wed_regs = wed->tx_ring[ring].reg_base;
  		break;
-@@ -658,7 +663,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -653,7 +658,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  			q->wed_regs = wed->txfree_ring.reg_base;
  		break;
  	case MT76_WED_Q_RX:
@@ -75,7 +75,7 @@
  		if (!ret)
  			q->wed_regs = wed->rx_ring[ring].reg_base;
  		break;
-@@ -671,6 +676,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -666,6 +671,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  	return 0;
  #endif
  }
@@ -83,7 +83,7 @@
  
  static int
  mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
-@@ -697,7 +703,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -692,7 +698,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -92,7 +92,7 @@
  	if (ret)
  		return ret;
  
-@@ -748,8 +754,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -743,8 +749,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  		q->desc[i].ctrl = cpu_to_le32(MT_DMA_CTL_DMA_DONE);
  
  	mt76_dma_rx_cleanup(dev, q);
@@ -120,10 +120,10 @@
  
  #endif
 diff --git a/mt76.h b/mt76.h
-index bb0433b2..cca8986f 100644
+index 74818a59..b7fa1724 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1380,6 +1380,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1383,6 +1383,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,10 +132,18 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 27b67800..03563919 100644
+index e3fa0649..1ae6c339 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -562,6 +562,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -4,6 +4,7 @@
+ #include "mt7915.h"
+ #include "../dma.h"
+ #include "mac.h"
++#include <linux/rtnetlink.h>
+ 
+ static int
+ mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc, int ring_base)
+@@ -562,6 +563,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  {
  	struct mt76_phy *mphy_ext = dev->mt76.phys[MT_BAND1];
@@ -143,7 +151,7 @@
  	int i;
  
  	/* clean up hw queues */
-@@ -581,28 +582,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
+@@ -581,28 +583,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  	if (force)
  		mt7915_wfsys_reset(dev);
  
@@ -203,10 +211,10 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d07bf790..f72e2bc2 100644
+index 5373777a..d5df73db 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -895,6 +895,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -894,6 +894,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  	return MT_TXD_TXP_BUF_SIZE;
  }
  
@@ -215,7 +223,7 @@
 +	struct mt7915_dev *dev;
 +	u8 band_idx;
 +	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	band_idx = dev->phy.band_idx;
++	band_idx = dev->phy.mt76->band_idx;
 +
 +	mt7915_mcu_set_ser(dev, SER_RECOVER, 1, band_idx);
 +
@@ -239,10 +247,10 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index f348a779..f5dfee37 100644
+index ffe23406..6fb3419d 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -617,6 +617,8 @@ static void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -617,6 +617,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  		mt76_put_rxwi(&dev->mt76, t);
  	}
  
@@ -251,19 +259,19 @@
  	if (!wed->rx_buf_ring.rx_page.va)
  		return;
  
-@@ -775,6 +777,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
- 	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
+@@ -782,6 +784,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 	wed->wlan.init_rx_buf = mt7915_mmio_wed_init_rx_buf;
+ 	wed->wlan.release_rx_buf = mt7915_mmio_wed_release_rx_buf;
  	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
 +	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
  
  	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6bc33f21..ec61941e 100644
+index 51453058..c39be358 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -562,6 +562,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -561,6 +561,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -272,5 +280,5 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
index bebd7ea..254e6f0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -1,7 +1,7 @@
-From f6b59719aef1daa47df3ea5da4fb30c09505f9fe Mon Sep 17 00:00:00 2001
+From 10e8cbecc7872f0ad0d18ef37713362da3f9600d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3006/3010] mt76: mt7915: wed: enable red per-band token drop
+Subject: [PATCH 3006/3011] mt76: mt7915: wed: enable red per-band token drop
  for HW Path
 
 Limit the number of token used by each band. If a band uses too many token,
@@ -16,10 +16,10 @@
  3 files changed, 46 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 03fd8c50..e6826c60 100644
+index 0ad110ff..fcb15fb5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2343,8 +2343,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2359,8 +2359,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
  					  MCU_WA_PARAM_WED_VERSION,
  					  wed->rev_id, 0);
@@ -33,7 +33,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2354,12 +2359,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2370,12 +2375,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -47,7 +47,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4429,6 +4429,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4445,6 +4445,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -83,7 +83,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4439,17 +4468,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4455,17 +4484,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -110,10 +110,10 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 5fcac90f..f9fb4137 100644
+index cf1d7d7a..49728514 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -282,6 +282,7 @@ enum {
+@@ -289,6 +289,7 @@ enum {
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
  #endif
  	MCU_WA_PARAM_WED_VERSION = 0x32,
@@ -122,10 +122,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ec61941e..3930c441 100644
+index c39be358..2c0aee1e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -774,13 +774,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -773,13 +773,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
@@ -142,5 +142,5 @@
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
index c8ae556..29f1072 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
@@ -1,7 +1,7 @@
-From 0574a0f51cbecfee460a73a6f1764357a9f20baa Mon Sep 17 00:00:00 2001
+From 1f69487aed883d7ea07b50a10f87b30db329043c Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH 3007/3010] mt76: mt7915: wed: update mt7916 trinfo when hw
+Subject: [PATCH 3007/3011] mt76: mt7915: wed: update mt7916 trinfo when hw
  path enable
 
 ---
@@ -57,7 +57,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index ddde4961..61996085 100644
+index 846dc5e3..3365f3f3 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -856,12 +856,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
@@ -87,5 +87,5 @@
  	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
  	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
index 3d6380a..9d9765b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -1,7 +1,7 @@
-From c02c4712a0513109f0983a421a9742da1c761a21 Mon Sep 17 00:00:00 2001
+From 7f80dae506d79a41a7357ec14bd6dabdeeb9cd4f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 3008/3010] mt76: mt7915: wed: find rx token by physical
+Subject: [PATCH 3008/3011] mt76: mt7915: wed: find rx token by physical
  address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -13,10 +13,10 @@
  1 file changed, 20 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index 87ce79cb..ddc804a5 100644
+index 35beec72..327ed3bc 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -372,10 +372,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -376,10 +376,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  	if ((q->flags & MT_QFLAG_WED) &&
  	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
@@ -48,5 +48,5 @@
  			return NULL;
  
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
index 0b3581d..8720477 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -1,31 +1,35 @@
-From 504f797dfcca7ff11c1ab1698a92c0ef545bae89 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
+From c37cd3ad8c8ed0ddcf18858263edeee80c9e40b6 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 25 Nov 2022 14:37:58 +0800
-Subject: [PATCH 3009/3010] mt76: mt7915: wed: drop scatter and gather frame
+Subject: [PATCH 3009/3011] mt76: mt7915: wed: drop scatter and gather frame
 
 The scatter and gather frame may be incorrect because WED and WO may
 send frames to host driver interleaved.
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c  | 5 +++++
+ dma.c  | 9 +++++++++
  dma.h  | 1 +
  mt76.h | 1 +
- 3 files changed, 7 insertions(+)
+ 3 files changed, 11 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index ddc804a5..fec9d090 100644
+index 327ed3bc..0914266a 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -416,6 +416,11 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -420,6 +420,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
  					   MT_DMA_CTL_DROP));
 +
-+			if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
-+				q->flags &= ~MT_QFLAG_WED_FRAG;
-+			else
-+				q->flags |= MT_QFLAG_WED_FRAG;
++			if (*more || (q->flags & MT_QFLAG_WED_FRAG)) {
++				*drop = true;
++
++				if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
++					q->flags &= ~MT_QFLAG_WED_FRAG;
++				else
++					q->flags |= MT_QFLAG_WED_FRAG;
++			}
  		}
  	} else {
  		buf = e->buf;
@@ -42,7 +46,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index cca8986f..43594102 100644
+index b7fa1724..7a5b0b61 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -30,6 +30,7 @@
@@ -54,5 +58,5 @@
  #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
  				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index ced7af9..796cd51 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 053443a80970f7a586fb76a7a889c7ca091dcc32 Mon Sep 17 00:00:00 2001
+From 78409553ecdb43e9b22bb951f3d993d42f120e7c Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3010/3010] mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 3010/3011] mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
@@ -16,10 +16,10 @@
  mode change 100644 => 100755 mt7915/init.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 3b789d75..eb17a015 100644
+index 98b00747..239643b9 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1148,6 +1148,7 @@ enum {
+@@ -1159,6 +1159,7 @@ enum {
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
  	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
@@ -27,7 +27,7 @@
  	MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
  	MCU_EXT_CMD_ATE_CTRL = 0x3d,
  	MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
-@@ -1157,6 +1158,7 @@ enum {
+@@ -1168,6 +1169,7 @@ enum {
  	MCU_EXT_CMD_MUAR_UPDATE = 0x48,
  	MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
  	MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 092d8434..79a29ee8 100644
+index f1f3f2f3..f3b039ff 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -457,22 +457,22 @@
  static int
  mt7915_radar_trigger(void *data, u64 val)
  {
-@@ -1120,6 +1524,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1274,6 +1678,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 +	debugfs_create_file("vow", 0600, dir, phy, &mt7915_vow_ops);
  
- 	if (!dev->dbdc_support || phy->band_idx) {
+ 	if (!dev->dbdc_support || phy->mt76->band_idx) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7915/init.c b/mt7915/init.c
 old mode 100644
 new mode 100755
-index 8f32b6a8..f62a9dae
+index 1ed519be..c347509b
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -476,10 +476,46 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
- 	mt76_rmw(dev, MT_WTBLOFF_TOP_RSCR(band), mask, set);
+@@ -550,10 +550,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+ 	}
  }
  
 +void mt7915_vow_init(struct mt7915_dev *dev)
@@ -518,21 +518,21 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -504,6 +540,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
- 		i = dev->mt76.led_pin ? MT_LED_GPIO_MUX3 : MT_LED_GPIO_MUX2;
- 		mt76_rmw_field(dev, i, MT_LED_GPIO_SEL_MASK, 4);
- 	}
+@@ -575,6 +611,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+ 		mt7915_mac_init_band(dev, i);
+ 
+ 	mt7915_init_led_mux(dev);
 +
-+	if (mt7915_is_atf_defult_on(wiphy, dev))
++	if (mt7915_is_atf_default_on(wiphy, dev))
 +		mt7915_vow_init(dev);
  }
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 52aab3d1..ece28aa0 100644
+index d8571642..dcf1583d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -195,6 +195,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -199,6 +199,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
@@ -540,18 +540,18 @@
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
-@@ -264,6 +265,10 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -268,6 +269,10 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
-+	if (mt7915_is_atf_defult_on(wiphy, dev)) {
++	if (mt7915_is_atf_default_on(wiphy, dev)) {
 +		mt7915_mcu_set_vow_band(dev, mvif);
 +	}
 +
  out:
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -683,6 +688,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -688,6 +693,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -559,11 +559,11 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy;
  #endif
-@@ -737,6 +743,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -742,6 +748,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		mt7915_mcu_set_mimo(phy, 0);
  	}
  #endif
-+	if (mt7915_is_atf_defult_on(wiphy, dev)) {
++	if (mt7915_is_atf_default_on(wiphy, dev)) {
 +		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO] = 2;
 +		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI] = 2;
 +		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE] = 1;
@@ -577,10 +577,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e6826c60..4d3def95 100644
+index fcb15fb5..ff207f70 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3428,6 +3428,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3444,6 +3444,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -753,7 +753,7 @@
  {
  	struct {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3930c441..890e329e 100644
+index 2c0aee1e..afd99498 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -132,6 +132,58 @@ struct mt7915_twt_flow {
@@ -823,7 +823,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -468,6 +521,8 @@ struct mt7915_dev {
+@@ -467,6 +520,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -832,12 +832,12 @@
  };
  
  enum {
-@@ -500,6 +555,15 @@ enum mt7915_rdd_cmd {
+@@ -499,6 +554,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
 +static inline bool
-+mt7915_is_atf_defult_on(struct wiphy *wiphy, struct mt7915_dev *dev)
++mt7915_is_atf_default_on(struct wiphy *wiphy, struct mt7915_dev *dev)
 +{
 +	return ((!wiphy_ext_feature_isset(wiphy,
 +                NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) ||
@@ -848,7 +848,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -627,6 +691,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -626,6 +690,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -860,7 +860,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 61996085..f74b91fa 100644
+index 3365f3f3..a8ffefd4 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1301,7 +1301,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
@@ -1011,5 +1011,5 @@
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
new file mode 100644
index 0000000..c7f7081
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
@@ -0,0 +1,74 @@
+From 0431d98e1a656f59c4fab110897e7e9bc092cc5a Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 2 Dec 2022 17:17:06 +0800
+Subject: [PATCH 3011/3011] mt76: mt7915: wed: add mt7916 2 pcie support when
+ wed on
+
+It should use bit 23 in interrupt mask for wfdma band1 data
+for 2 pcie mt7916, and use bit 19 for  band1 data for 1 pcie.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ mt7915/dma.c  |  8 ++++++--
+ mt7915/mcu.c  |  2 +-
+ mt7915/mmio.c | 10 +++++-----
+ 3 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/mt7915/dma.c b/mt7915/dma.c
+index 1ae6c339..36260085 100644
+--- a/mt7915/dma.c
++++ b/mt7915/dma.c
+@@ -88,8 +88,12 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
+ 				   MT7916_RXQ_BAND0);
+ 			RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MT7916,
+ 				   MT7916_RXQ_MCU_WA);
+-			RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_WED_RX_DONE_BAND1_MT7916,
+-				   MT7916_RXQ_BAND1);
++			if (dev->hif2)
++				RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1_MT7916,
++					   MT7916_RXQ_BAND1);
++			else
++				RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_WED_RX_DONE_BAND1_MT7916,
++					   MT7916_RXQ_BAND1);
+ 			RXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MAIN_MT7916,
+ 				   MT7916_RXQ_MCU_WA_MAIN);
+ 			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index ff207f70..737a714f 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2352,7 +2352,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+ 		return ret;
+ 
+ 	if (mtk_wed_device_active(wed)) {
+-		if (is_mt7915(&dev->mt76))
++		if (is_mt7915(&dev->mt76) || !mtk_wed_get_rx_capa(wed))
+ 			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY),
+ 					  0, 0, 0);
+ 		else
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 6fb3419d..e30a8d4c 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -964,13 +964,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
+ 	struct mt7915_dev *dev = dev_instance;
+ 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ 
+-	if (mtk_wed_device_active(wed)) {
++	if (mtk_wed_device_active(wed))
+ 		mtk_wed_device_irq_set_mask(wed, 0);
+-	} else {
++	else
+ 		mt76_wr(dev, MT_INT_MASK_CSR, 0);
+-		if (dev->hif2)
+-			mt76_wr(dev, MT_INT1_MASK_CSR, 0);
+-	}
++
++	if (dev->hif2)
++		mt76_wr(dev, MT_INT1_MASK_CSR, 0);
+ 
+ 	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
+ 		return IRQ_NONE;
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
new file mode 100644
index 0000000..dc83560
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
@@ -0,0 +1,33 @@
+From dbc09e842e33cecb9e6237ed0664c9fc1f12a412 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 13 Dec 2022 10:51:46 +0800
+Subject: [PATCH 4000/4002] mt76: revert get_of_mac_addr
+
+---
+ eeprom.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index aac70efb..bb9265cc 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -126,9 +126,15 @@ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+ 	struct mt76_dev *dev = phy->dev;
++#ifdef CONFIG_OF
+ 	struct device_node *np = dev->dev->of_node;
++	const u8 *mac = NULL;
+ 
+-	of_get_mac_address(np, phy->macaddr);
++	if (np)
++		mac = of_get_mac_address(np);
++	if (!IS_ERR_OR_NULL(mac))
++		ether_addr_copy(phy->macaddr, mac);
++#endif
+ 
+ 	if (!is_valid_ether_addr(phy->macaddr)) {
+ 		eth_random_addr(phy->macaddr);
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
new file mode 100644
index 0000000..cc3a10d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
@@ -0,0 +1,63 @@
+From 51c0737433ea318d6897585366de4af124c0bb4a Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 13 Dec 2022 10:38:13 +0800
+Subject: [PATCH 4001/4002] mt76: include header files for module param
+
+---
+ mcu.c             | 1 +
+ mt7615/mcu.c      | 1 +
+ mt76_connac_mcu.c | 1 +
+ mt7915/mcu.c      | 1 +
+ 4 files changed, 4 insertions(+)
+
+diff --git a/mcu.c b/mcu.c
+index a8cafa39..fa4b0544 100644
+--- a/mcu.c
++++ b/mcu.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include "mt76.h"
++#include <linux/moduleparam.h>
+ 
+ struct sk_buff *
+ __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
+diff --git a/mt7615/mcu.c b/mt7615/mcu.c
+index 83f30305..e917d025 100644
+--- a/mt7615/mcu.c
++++ b/mt7615/mcu.c
+@@ -10,6 +10,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ static bool prefer_offload_fw = true;
+ module_param(prefer_offload_fw, bool, 0644);
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 291a7c12..56493774 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -4,6 +4,7 @@
+ #include <linux/firmware.h>
+ #include "mt76_connac2_mac.h"
+ #include "mt76_connac_mcu.h"
++#include <linux/module.h>
+ 
+ int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
+ {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 737a714f..e08a96d9 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -6,6 +6,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ #define fw_name(_dev, name, ...)	({			\
+ 	char *_fw;						\
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index 6866209..6985ba6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -1,7 +1,5 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
-    file://0000-mt76-sync-to-master-lastest-commit.patch \
-    file://100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
     file://1003-mt76-mt7915-air-monitor-support.patch \
@@ -39,4 +37,8 @@
     file://3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch \
     file://3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch \
     file://3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch \
+    file://3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
+    file://4000-mt76-revert-get_of_mac_addr.patch \
+    file://4001-mt76-include-header-files-for-module-param.patch \
+    file://4002-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-some-structs-of-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-some-structs-of-wireless-stack.patch
rename to recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
index cce072c..0a0ede2 100644
--- a/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-some-structs-of-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,29 +1,12 @@
-From f9c04f3a99e251532db5680d6dc2d2d44f5e831b Mon Sep 17 00:00:00 2001
+From a4a4b918aa6c2895840226fc4816c265c6461131 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 13 Dec 2022 10:53:12 +0800
-Subject: [PATCH 4002/4002] mt76: revert some structs of wireless stack
+Date: Mon, 12 Dec 2022 18:17:12 +0800
+Subject: [PATCH 4002/4002] mt76: revert for backports-5.15 wireless stack
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- debugfs.c         |   2 +
- dma.c             |   2 +-
- mac80211.c        |   4 +-
- mt7615/main.c     |   6 +-
- mt7615/mcu.c      |   8 +--
- mt76_connac_mcu.c | 108 +++++++++++++++---------------
- mt76x02_mac.c     |   6 +-
- mt7915/debugfs.c  |   4 +-
- mt7915/dma.c      |   4 +-
- mt7915/init.c     |   3 +-
- mt7915/mac.c      |   2 +-
- mt7915/main.c     |  10 +--
- mt7915/mcu.c      | 166 +++++++++++++++++++++++-----------------------
- mt7915/testmode.c |   8 +--
- tx.c              |  11 +--
- 15 files changed, 168 insertions(+), 176 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
-index 79064a4d..4a8e1864 100644
+index 79064a4..4a8e186 100644
 --- a/debugfs.c
 +++ b/debugfs.c
 @@ -33,8 +33,10 @@ mt76_napi_threaded_set(void *data, u64 val)
@@ -38,7 +21,7 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 0914266a..21e88a2d 100644
+index 0914266..21e88a2 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -939,7 +939,7 @@ mt76_dma_init(struct mt76_dev *dev,
@@ -50,8 +33,29 @@
  		mt76_dma_rx_fill(dev, &dev->q_rx[i]);
  		napi_enable(&dev->napi[i]);
  	}
+diff --git a/eeprom.c b/eeprom.c
+index aac70ef..bb9265c 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -126,9 +126,15 @@ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+ 	struct mt76_dev *dev = phy->dev;
++#ifdef CONFIG_OF
+ 	struct device_node *np = dev->dev->of_node;
++	const u8 *mac = NULL;
+ 
+-	of_get_mac_address(np, phy->macaddr);
++	if (np)
++		mac = of_get_mac_address(np);
++	if (!IS_ERR_OR_NULL(mac))
++		ether_addr_copy(phy->macaddr, mac);
++#endif
+ 
+ 	if (!is_valid_ether_addr(phy->macaddr)) {
+ 		eth_random_addr(phy->macaddr);
 diff --git a/mac80211.c b/mac80211.c
-index 15d300a9..be4a1408 100644
+index 15d300a..be4a140 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1511,7 +1511,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
@@ -73,7 +77,7 @@
  
  	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
 diff --git a/mt7615/main.c b/mt7615/main.c
-index ab4c1b44..8fb5b256 100644
+index ab4c1b4..8fb5b25 100644
 --- a/mt7615/main.c
 +++ b/mt7615/main.c
 @@ -474,7 +474,7 @@ static int mt7615_config(struct ieee80211_hw *hw, u32 changed)
@@ -104,10 +108,10 @@
  	mt7615_mutex_release(dev);
  }
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index e917d025..b2e1f388 100644
+index 83f3030..81579a1 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
-@@ -353,7 +353,7 @@ out:
+@@ -352,7 +352,7 @@ out:
  static void
  mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -116,7 +120,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -699,7 +699,7 @@ mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
+@@ -698,7 +698,7 @@ mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
  	if (!enable)
  		goto out;
  
@@ -125,7 +129,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -1074,7 +1074,7 @@ mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
+@@ -1073,7 +1073,7 @@ mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
  	if (!enable)
  		goto out;
  
@@ -134,7 +138,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -2526,7 +2526,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
+@@ -2525,7 +2525,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
  		u8 pad;
  	} req = {
  		.bss_idx = mvif->mt76.idx,
@@ -144,10 +148,10 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 56493774..99851dc0 100644
+index 291a7c1..d5254f9 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -197,7 +197,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
+@@ -196,7 +196,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
  			      */
  	} req = {
  		.bss_idx = mvif->idx,
@@ -156,7 +160,7 @@
  	};
  
  	if (vif->type != NL80211_IFTYPE_STATION)
-@@ -409,7 +409,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+@@ -408,7 +408,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
  		else
  			conn_type = CONNECTION_INFRA_AP;
  		basic->conn_type = cpu_to_le32(conn_type);
@@ -165,7 +169,7 @@
  		break;
  	case NL80211_IFTYPE_ADHOC:
  		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
-@@ -553,7 +553,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -552,7 +552,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  
  	if (sta) {
  		if (vif->type == NL80211_IFTYPE_STATION)
@@ -174,7 +178,7 @@
  		else
  			generic->partial_aid = cpu_to_le16(sta->aid);
  		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
-@@ -602,14 +602,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -601,14 +601,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  	    vif->type != NL80211_IFTYPE_STATION)
  		return;
  
@@ -191,7 +195,7 @@
  			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
  
  	wcid->amsdu = true;
-@@ -620,7 +620,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -619,7 +619,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  static void
  mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
@@ -200,7 +204,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he *he;
  	struct tlv *tlv;
-@@ -708,7 +708,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -707,7 +707,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -209,7 +213,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -753,7 +753,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -752,7 +752,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  static void
  mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
@@ -218,7 +222,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he_v2 *he;
  	struct tlv *tlv;
-@@ -764,7 +764,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -763,7 +763,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  	memcpy(he->he_phy_cap, elem->phy_cap_info, sizeof(he->he_phy_cap));
  	memcpy(he->he_mac_cap, elem->mac_cap_info, sizeof(he->he_mac_cap));
  
@@ -227,7 +231,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -780,7 +780,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -779,7 +779,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  		break;
  	}
  
@@ -236,7 +240,7 @@
  }
  
  static u8
-@@ -793,9 +793,9 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+@@ -792,9 +792,9 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
  	u8 mode = 0;
  
  	if (sta) {
@@ -249,7 +253,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -844,25 +844,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -843,25 +843,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	u16 supp_rates;
  
  	/* starec ht */
@@ -281,7 +285,7 @@
  	}
  
  	/* starec uapsd */
-@@ -871,11 +871,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -870,11 +870,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	if (!is_mt7921(dev))
  		return;
  
@@ -295,7 +299,7 @@
  		mt76_connac_mcu_sta_he_tlv(skb, sta);
  		mt76_connac_mcu_sta_he_tlv_v2(skb, sta);
  		if (band == NL80211_BAND_6GHZ &&
-@@ -885,7 +885,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -884,7 +884,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
  						      sizeof(*he_6g_capa));
  			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
@@ -304,7 +308,7 @@
  		}
  	}
  
-@@ -895,14 +895,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -894,14 +894,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
  	phy->rcpi = rcpi;
  	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
@@ -322,7 +326,7 @@
  	if (band == NL80211_BAND_2GHZ)
  		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
  			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
-@@ -911,18 +911,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -910,18 +910,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  
  	ra_info->legacy = cpu_to_le16(supp_rates);
  
@@ -346,7 +350,7 @@
  			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
  	}
  }
-@@ -938,7 +938,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
+@@ -937,7 +937,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
  					     wtbl_tlv, sta_wtbl);
  	smps = (struct wtbl_smps *)tlv;
@@ -355,7 +359,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
  
-@@ -950,27 +950,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -949,27 +949,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u32 flags = 0;
  
@@ -391,7 +395,7 @@
  		struct wtbl_vht *vht;
  		u8 af;
  
-@@ -979,18 +979,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -978,18 +978,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sta_wtbl);
  		vht = (struct wtbl_vht *)tlv;
  		vht->ldpc = vht_ldpc &&
@@ -413,7 +417,7 @@
  		/* sgi */
  		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
  			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
-@@ -1000,15 +1000,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -999,15 +999,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sizeof(*raw), wtbl_tlv,
  						     sta_wtbl);
  
@@ -434,7 +438,7 @@
  				flags |= MT_WTBL_W5_SHORT_GI_160;
  		}
  		raw = (struct wtbl_raw *)tlv;
-@@ -1294,9 +1294,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1293,9 +1293,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  		return 0x38;
  
  	if (sta) {
@@ -447,7 +451,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -1616,7 +1616,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1615,7 +1615,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	for (i = 0; i < sreq->n_ssids; i++) {
  		if (!sreq->ssids[i].ssid_len)
  			continue;
@@ -455,7 +459,7 @@
  		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
  		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
  		       sreq->ssids[i].ssid_len);
-@@ -1749,7 +1748,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
+@@ -1748,7 +1747,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
  		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
  		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
  	}
@@ -463,7 +467,7 @@
  	req->match_num = sreq->n_match_sets;
  	for (i = 0; i < req->match_num; i++) {
  		match = &sreq->match_sets[i];
-@@ -2236,10 +2234,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2235,10 +2233,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  				      struct mt76_vif *vif,
  				      struct ieee80211_bss_conf *info)
  {
@@ -475,7 +479,7 @@
  			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
  	struct {
  		struct {
-@@ -2267,7 +2263,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2266,7 +2262,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  
  	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
  	for (i = 0; i < len; i++)
@@ -485,7 +489,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
  }
 diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-index d3f74473..87ea3db1 100644
+index d3f7447..87ea3db 100644
 --- a/mt76x02_mac.c
 +++ b/mt76x02_mac.c
 @@ -404,7 +404,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
@@ -510,7 +514,7 @@
  		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
  			ba_size = 0;
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f3b039ff..47c9dfdd 100644
+index f3b039f..47c9dfd 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1840,8 +1840,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
@@ -525,10 +529,10 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 36260085..e3d4ebc4 100644
+index 50b7ed5..1dde068 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -555,8 +555,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -554,8 +554,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  	if (ret < 0)
  		return ret;
  
@@ -540,7 +544,7 @@
  
  	mt7915_dma_enable(dev);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index c347509b..e643c0e4 100755
+index c347509..e643c0e 100755
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -1148,8 +1148,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
@@ -554,7 +558,7 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d5df73db..3bbe757c 100644
+index d5df73d..3bbe757 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -913,7 +913,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
@@ -567,7 +571,7 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index dcf1583d..5d678df8 100644
+index dcf1583..5d678df 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -503,7 +503,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -611,10 +615,10 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e08a96d9..3860051f 100644
+index 737a714..5bd1881 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -64,7 +64,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+@@ -63,7 +63,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
  	struct mt7915_dev *dev = msta->vif->phy->dev;
  	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
  	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
@@ -623,7 +627,7 @@
  
  	for (nss = 0; nss < max_nss; nss++) {
  		int mcs;
-@@ -104,7 +104,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+@@ -103,7 +103,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
  
  		/* only support 2ss on 160MHz for mt7915 */
  		if (is_mt7915(&dev->mt76) && nss > 1 &&
@@ -632,7 +636,7 @@
  			break;
  	}
  
-@@ -117,8 +117,8 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -116,8 +116,8 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  {
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_dev *dev = msta->vif->phy->dev;
@@ -643,7 +647,7 @@
  	u16 mcs;
  
  	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
-@@ -140,7 +140,7 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -139,7 +139,7 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  
  		/* only support 2ss on 160MHz for mt7915 */
  		if (is_mt7915(&dev->mt76) && nss > 1 &&
@@ -652,7 +656,7 @@
  			break;
  	}
  }
-@@ -149,10 +149,10 @@ static void
+@@ -148,10 +148,10 @@ static void
  mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
  			  const u8 *mask)
  {
@@ -665,7 +669,7 @@
  }
  
  static int
-@@ -230,7 +230,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+@@ -229,7 +229,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
  static void
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -674,7 +678,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -331,7 +331,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -330,7 +330,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
  static void
  mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -683,7 +687,7 @@
  		return;
  
  	ieee80211_color_change_finish(vif);
-@@ -731,13 +731,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -730,13 +730,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  		      struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -699,7 +703,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -823,8 +823,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -822,8 +822,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -710,7 +714,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -874,7 +874,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -873,7 +873,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -719,7 +723,7 @@
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -898,11 +898,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -897,11 +897,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
  
@@ -734,7 +738,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -936,13 +936,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -935,13 +935,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_ht *ht;
  	struct tlv *tlv;
  
@@ -750,7 +754,7 @@
  }
  
  static void
-@@ -951,15 +951,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -950,15 +950,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
  
@@ -770,7 +774,7 @@
  }
  
  static void
-@@ -974,7 +974,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -973,7 +973,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -779,7 +783,7 @@
  	    return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -983,7 +983,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -982,7 +982,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	amsdu->amsdu_en = true;
  	msta->wcid.amsdu = true;
  
@@ -788,7 +792,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		if (!is_mt7915(&dev->mt76)) {
  			amsdu->max_mpdu_size =
-@@ -1046,8 +1046,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1045,8 +1045,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	if (!bfee && tx_ant < 2)
  		return false;
  
@@ -799,7 +803,7 @@
  
  		if (bfee)
  			return mvif->cap.he_su_ebfee &&
-@@ -1057,8 +1057,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1056,8 +1056,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -810,7 +814,7 @@
  
  		if (bfee)
  			return mvif->cap.vht_su_ebfee &&
-@@ -1084,7 +1084,7 @@ static void
+@@ -1083,7 +1083,7 @@ static void
  mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		       struct sta_rec_bf *bf)
  {
@@ -819,7 +823,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1109,7 +1109,7 @@ static void
+@@ -1108,7 +1108,7 @@ static void
  mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  			struct sta_rec_bf *bf, bool explicit)
  {
@@ -828,7 +832,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1130,14 +1130,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
+@@ -1129,14 +1129,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -845,7 +849,7 @@
  			bf->ibf_nrow = 1;
  	}
  }
-@@ -1146,7 +1146,7 @@ static void
+@@ -1145,7 +1145,7 @@ static void
  mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
  {
@@ -854,7 +858,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1171,7 +1171,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1170,7 +1170,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -863,7 +867,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1219,7 +1219,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1218,7 +1218,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -872,7 +876,7 @@
  		return;
  
  	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1233,21 +1233,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1232,21 +1232,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -900,7 +904,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1257,7 +1257,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1256,7 +1256,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -909,7 +913,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1282,7 +1282,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1281,7 +1281,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -918,7 +922,7 @@
  		return;
  
  	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1291,13 +1291,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1290,13 +1290,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
  	bfee = (struct sta_rec_bfee *)tlv;
  
@@ -936,7 +940,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1353,7 +1353,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -1352,7 +1352,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -945,7 +949,7 @@
  		break;
  	case RATE_PARAM_SPE_UPDATE:
  		ra->spe_idx = *(u8 *)data;
-@@ -1428,7 +1428,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1427,7 +1427,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  	do {									\
  		u8 i, gi = mask->control[band]._gi;				\
  		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
@@ -954,7 +958,7 @@
  			phy.sgi |= gi << (i << (_he));				\
  			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
  		}								\
-@@ -1442,11 +1442,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1441,11 +1441,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		}								\
  	} while (0)
  
@@ -969,7 +973,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -1480,7 +1480,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1479,7 +1479,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		 * actual txrate hardware sends out.
  		 */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
@@ -978,7 +982,7 @@
  			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1513,7 +1513,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1512,7 +1512,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra *ra;
  	struct tlv *tlv;
@@ -987,7 +991,7 @@
  	u32 cap = sta->wme ? STA_CAP_WMM : 0;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1523,9 +1523,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1522,9 +1522,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	ra->auto_rate = true;
  	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
  	ra->channel = chandef->chan->hw_value;
@@ -1000,7 +1004,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -1545,22 +1545,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1544,22 +1544,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		}
  	}
  
@@ -1031,7 +1035,7 @@
  			cap |= STA_CAP_LDPC;
  
  		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1568,37 +1568,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1567,37 +1567,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
  	}
  
@@ -1079,7 +1083,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  
-@@ -1807,7 +1807,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -1806,7 +1806,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1088,7 +1092,7 @@
  	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
  					   &bcn->sub_ntlv, &bcn->len);
  	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -1892,9 +1892,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1891,9 +1891,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1100,7 +1104,7 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -2078,7 +2078,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2077,7 +2077,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (!en)
  		goto out;
  
@@ -1109,7 +1113,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -3279,17 +3279,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3278,17 +3278,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1130,29 +1134,8 @@
  					offs += len + sku_len[SKU_HE_RU26] * 3;
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 2ae6c07f..75be1ed9 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -360,12 +360,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
- 	}
- 
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
--		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
-+		memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_VHT)
--		memcpy(&sta->deflink.vht_cap, &sband->vht_cap, sizeof(sta->deflink.vht_cap));
-+		memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_SU)
--		memcpy(&sta->deflink.he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
--		       sizeof(sta->deflink.he_cap));
-+		memcpy(&sta->he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
-+		       sizeof(sta->he_cap));
- 	sta->aid = aid;
- 	sta->wme = 1;
- 
 diff --git a/tx.c b/tx.c
-index 6d55566f..91c8dd8d 100644
+index 6d55566..91c8dd8 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
@@ -1180,5 +1163,5 @@
  
  		hw = mt76_tx_status_get_hw(dev, skb);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 1644c44..6985ba6 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -40,5 +40,5 @@
     file://3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
     file://4000-mt76-revert-get_of_mac_addr.patch \
     file://4001-mt76-include-header-files-for-module-param.patch \
-    file://4002-mt76-revert-some-structs-of-wireless-stack.patch \
+    file://4002-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "