diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0000-mt76-sync-to-master-lastest-commit.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0000-mt76-sync-to-master-lastest-commit.patch
deleted file mode 100644
index dc307c3..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0000-mt76-sync-to-master-lastest-commit.patch
+++ /dev/null
@@ -1,3283 +0,0 @@
-From fd9a307422024d5c6e953634129cc2b61425e93f Mon Sep 17 00:00:00 2001
-From: Ryder Lee <ryder.lee@mediatek.com>
-Date: Mon, 14 Nov 2022 10:17:47 +0800
-Subject: [PATCH] mt76: sync to master lastest commit
-
-wifi: mt76: mt7915: fix uninitialized irq_mask
-wifi: mt76: mt7921: introduce remain_on_channel support
-wifi: mt76: connac: rework macros for unified command
-wifi: mt76: connac: update struct sta_rec_phy
-wifi: mt76: connac: rework fields for larger bandwidth support in sta_rec_bf
-wifi: mt76: connac: add more unified command IDs
-wifi: mt76: connac: introduce unified event table
-wifi: mt76: connac: add more bss info command tags
-wifi: mt76: connac: add more starec command tags
-wifi: mt76: connac: introduce helper for mt7996 chipset
-wifi: mt76: mt7921: fix wrong power after multiple SAR set
-wifi: mt76: mt7915: add missing MODULE_PARM_DESC
-wifi: mt76: mt7915: add support to configure spatial reuse parameter set
-wifi: mt76: introduce rxwi and rx token utility routines
-wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf
-wifi: mt76: add WED RX support to mt76_dma_rx_fill
-wifi: mt76: add WED RX support to dma queue alloc
-wifi: mt76: add info parameter to rx_skb signature
-wifi: mt76: connac: introduce mt76_connac_mcu_sta_wed_update utility routine
-wifi: mt76: mt7915: enable WED RX support
-wifi: mt76: mt7915: enable WED RX stats
-wifi: mt76: mt7915: add basedband Txpower info into debugfs
-wifi: mt76: mt7915: enable .sta_set_txpwr support
-wifi: mt76: mt7915: fix band_idx usage
----
- dma.c             | 244 +++++++++++++++++++++++++-------
- dma.h             |   8 ++
- mac80211.c        |  10 +-
- mt76.h            |  26 +++-
- mt7603/dma.c      |   2 +-
- mt7603/mt7603.h   |   2 +-
- mt7615/mac.c      |   2 +-
- mt7615/mt7615.h   |   2 +-
- mt76_connac.h     |   5 +
- mt76_connac_mcu.c |  25 +++-
- mt76_connac_mcu.h |  70 ++++++++-
- mt76x02.h         |   2 +-
- mt76x02_txrx.c    |   2 +-
- mt7915/coredump.c |   1 +
- mt7915/debugfs.c  |  29 ++--
- mt7915/dma.c      |  26 +++-
- mt7915/init.c     |   3 +
- mt7915/mac.c      |  60 ++++++--
- mt7915/main.c     |  84 ++++++++---
- mt7915/mcu.c      | 354 ++++++++++++++++++++++++++++++++++++++++------
- mt7915/mcu.h      |  30 ++++
- mt7915/mmio.c     | 320 +++++++++++++++++++++++++++++------------
- mt7915/mt7915.h   |  13 +-
- mt7915/regs.h     |  11 ++
- mt7915/testmode.c |  18 +--
- mt7921/init.c     |  64 +++++++++
- mt7921/mac.c      |   2 +-
- mt7921/main.c     | 118 ++++++++++++++++
- mt7921/mcu.c      |  24 ++++
- mt7921/mt7921.h   |  52 ++++++-
- mt7921/pci.c      |  33 ++++-
- mt7921/sdio.c     |  23 ++-
- mt7921/usb.c      |  12 +-
- sdio.c            |   2 +-
- tx.c              |  30 ++++
- usb.c             |   2 +-
- 36 files changed, 1438 insertions(+), 273 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 4b181305..ae22b959 100644
---- a/dma.c
-+++ b/dma.c
-@@ -59,6 +59,19 @@ mt76_alloc_txwi(struct mt76_dev *dev)
- 	return t;
- }
- 
-+static struct mt76_txwi_cache *
-+mt76_alloc_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *t;
-+
-+	t = kzalloc(L1_CACHE_ALIGN(sizeof(*t)), GFP_ATOMIC);
-+	if (!t)
-+		return NULL;
-+
-+	t->ptr = NULL;
-+	return t;
-+}
-+
- static struct mt76_txwi_cache *
- __mt76_get_txwi(struct mt76_dev *dev)
- {
-@@ -75,6 +88,22 @@ __mt76_get_txwi(struct mt76_dev *dev)
- 	return t;
- }
- 
-+static struct mt76_txwi_cache *
-+__mt76_get_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *t = NULL;
-+
-+	spin_lock(&dev->wed_lock);
-+	if (!list_empty(&dev->rxwi_cache)) {
-+		t = list_first_entry(&dev->rxwi_cache, struct mt76_txwi_cache,
-+				     list);
-+		list_del(&t->list);
-+	}
-+	spin_unlock(&dev->wed_lock);
-+
-+	return t;
-+}
-+
- static struct mt76_txwi_cache *
- mt76_get_txwi(struct mt76_dev *dev)
- {
-@@ -86,6 +115,18 @@ mt76_get_txwi(struct mt76_dev *dev)
- 	return mt76_alloc_txwi(dev);
- }
- 
-+struct mt76_txwi_cache *
-+mt76_get_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *t = __mt76_get_rxwi(dev);
-+
-+	if (t)
-+		return t;
-+
-+	return mt76_alloc_rxwi(dev);
-+}
-+EXPORT_SYMBOL_GPL(mt76_get_rxwi);
-+
- void
- mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
- {
-@@ -98,6 +139,18 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
- }
- EXPORT_SYMBOL_GPL(mt76_put_txwi);
- 
-+void
-+mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
-+{
-+	if (!t)
-+		return;
-+
-+	spin_lock(&dev->wed_lock);
-+	list_add(&t->list, &dev->rxwi_cache);
-+	spin_unlock(&dev->wed_lock);
-+}
-+EXPORT_SYMBOL_GPL(mt76_put_rxwi);
-+
- static void
- mt76_free_pending_txwi(struct mt76_dev *dev)
- {
-@@ -112,6 +165,20 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
- 	local_bh_enable();
- }
- 
-+static void
-+mt76_free_pending_rxwi(struct mt76_dev *dev)
-+{
-+	struct mt76_txwi_cache *t;
-+
-+	local_bh_disable();
-+	while ((t = __mt76_get_rxwi(dev)) != NULL) {
-+		if (t->ptr)
-+			skb_free_frag(t->ptr);
-+		kfree(t);
-+	}
-+	local_bh_enable();
-+}
-+
- static void
- mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
- {
-@@ -148,11 +215,6 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 	u32 ctrl;
- 	int i, idx = -1;
- 
--	if (txwi) {
--		q->entry[q->head].txwi = DMA_DUMMY_DATA;
--		q->entry[q->head].skip_buf0 = true;
--	}
--
- 	for (i = 0; i < nbufs; i += 2, buf += 2) {
- 		u32 buf0 = buf[0].addr, buf1 = 0;
- 
-@@ -162,28 +224,48 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 		desc = &q->desc[idx];
- 		entry = &q->entry[idx];
- 
--		if (buf[0].skip_unmap)
--			entry->skip_buf0 = true;
--		entry->skip_buf1 = i == nbufs - 1;
--
--		entry->dma_addr[0] = buf[0].addr;
--		entry->dma_len[0] = buf[0].len;
--
--		ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
--		if (i < nbufs - 1) {
--			entry->dma_addr[1] = buf[1].addr;
--			entry->dma_len[1] = buf[1].len;
--			buf1 = buf[1].addr;
--			ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
--			if (buf[1].skip_unmap)
--				entry->skip_buf1 = true;
-+		if ((q->flags & MT_QFLAG_WED) &&
-+		    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
-+			struct mt76_txwi_cache *t = txwi;
-+			int rx_token;
-+
-+			if (!t)
-+				return -ENOMEM;
-+
-+			rx_token = mt76_rx_token_consume(dev, (void *)skb, t,
-+							 buf[0].addr);
-+			buf1 |= FIELD_PREP(MT_DMA_CTL_TOKEN, rx_token);
-+			ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len) |
-+			       MT_DMA_CTL_TO_HOST;
-+		} else {
-+			if (txwi) {
-+				q->entry[q->head].txwi = DMA_DUMMY_DATA;
-+				q->entry[q->head].skip_buf0 = true;
-+			}
-+
-+			if (buf[0].skip_unmap)
-+				entry->skip_buf0 = true;
-+			entry->skip_buf1 = i == nbufs - 1;
-+
-+			entry->dma_addr[0] = buf[0].addr;
-+			entry->dma_len[0] = buf[0].len;
-+
-+			ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
-+			if (i < nbufs - 1) {
-+				entry->dma_addr[1] = buf[1].addr;
-+				entry->dma_len[1] = buf[1].len;
-+				buf1 = buf[1].addr;
-+				ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
-+				if (buf[1].skip_unmap)
-+					entry->skip_buf1 = true;
-+			}
-+
-+			if (i == nbufs - 1)
-+				ctrl |= MT_DMA_CTL_LAST_SEC0;
-+			else if (i == nbufs - 2)
-+				ctrl |= MT_DMA_CTL_LAST_SEC1;
- 		}
- 
--		if (i == nbufs - 1)
--			ctrl |= MT_DMA_CTL_LAST_SEC0;
--		else if (i == nbufs - 2)
--			ctrl |= MT_DMA_CTL_LAST_SEC1;
--
- 		WRITE_ONCE(desc->buf0, cpu_to_le32(buf0));
- 		WRITE_ONCE(desc->buf1, cpu_to_le32(buf1));
- 		WRITE_ONCE(desc->info, cpu_to_le32(info));
-@@ -272,33 +354,60 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
- 
- static void *
- mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
--		 int *len, u32 *info, bool *more)
-+		 int *len, u32 *info, bool *more, bool *drop)
- {
- 	struct mt76_queue_entry *e = &q->entry[idx];
- 	struct mt76_desc *desc = &q->desc[idx];
--	dma_addr_t buf_addr;
--	void *buf = e->buf;
--	int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
-+	void *buf;
- 
--	buf_addr = e->dma_addr[0];
- 	if (len) {
--		u32 ctl = le32_to_cpu(READ_ONCE(desc->ctrl));
--		*len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctl);
--		*more = !(ctl & MT_DMA_CTL_LAST_SEC0);
-+		u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-+		*len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctrl);
-+		*more = !(ctrl & MT_DMA_CTL_LAST_SEC0);
- 	}
- 
- 	if (info)
- 		*info = le32_to_cpu(desc->info);
- 
--	dma_unmap_single(dev->dma_dev, buf_addr, buf_len, DMA_FROM_DEVICE);
--	e->buf = NULL;
-+	if ((q->flags & MT_QFLAG_WED) &&
-+	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
-+		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
-+				      le32_to_cpu(desc->buf1));
-+		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
-+
-+		if (!t)
-+			return NULL;
-+
-+		dma_unmap_single(dev->dma_dev, t->dma_addr,
-+				 SKB_WITH_OVERHEAD(q->buf_size),
-+				 DMA_FROM_DEVICE);
-+
-+		buf = t->ptr;
-+		t->dma_addr = 0;
-+		t->ptr = NULL;
-+
-+		mt76_put_rxwi(dev, t);
-+
-+		if (drop) {
-+			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-+
-+			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
-+					   MT_DMA_CTL_DROP));
-+		}
-+	} else {
-+		buf = e->buf;
-+		e->buf = NULL;
-+		dma_unmap_single(dev->dma_dev, e->dma_addr[0],
-+				 SKB_WITH_OVERHEAD(q->buf_size),
-+				 DMA_FROM_DEVICE);
-+	}
- 
- 	return buf;
- }
- 
- static void *
- mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
--		 int *len, u32 *info, bool *more)
-+		 int *len, u32 *info, bool *more, bool *drop)
- {
- 	int idx = q->tail;
- 
-@@ -314,7 +423,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
- 	q->tail = (q->tail + 1) % q->ndesc;
- 	q->queued--;
- 
--	return mt76_dma_get_buf(dev, q, idx, len, info, more);
-+	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
- }
- 
- static int
-@@ -441,14 +550,26 @@ free_skb:
- 	return ret;
- }
- 
-+static struct page_frag_cache *
-+mt76_dma_rx_get_frag_cache(struct mt76_dev *dev, struct mt76_queue *q)
-+{
-+	struct page_frag_cache *rx_page = &q->rx_page;
-+
-+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+	if ((q->flags & MT_QFLAG_WED) &&
-+	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX)
-+		rx_page = &dev->mmio.wed.rx_buf_ring.rx_page;
-+#endif
-+	return rx_page;
-+}
-+
- static int
- mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- {
--	dma_addr_t addr;
--	void *buf;
--	int frames = 0;
-+	struct page_frag_cache *rx_page = mt76_dma_rx_get_frag_cache(dev, q);
- 	int len = SKB_WITH_OVERHEAD(q->buf_size);
--	int offset = q->buf_offset;
-+	int frames = 0, offset = q->buf_offset;
-+	dma_addr_t addr;
- 
- 	if (!q->ndesc)
- 		return 0;
-@@ -456,9 +577,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	spin_lock_bh(&q->lock);
- 
- 	while (q->queued < q->ndesc - 1) {
-+		struct mt76_txwi_cache *t = NULL;
- 		struct mt76_queue_buf qbuf;
-+		void *buf = NULL;
- 
--		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+		if ((q->flags & MT_QFLAG_WED) &&
-+		    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
-+			t = mt76_get_rxwi(dev);
-+			if (!t)
-+				break;
-+		}
-+
-+		buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
- 		if (!buf)
- 			break;
- 
-@@ -471,7 +601,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		qbuf.addr = addr + offset;
- 		qbuf.len = len - offset;
- 		qbuf.skip_unmap = false;
--		mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL);
-+		mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, t);
- 		frames++;
- 	}
- 
-@@ -517,6 +647,11 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 		if (!ret)
- 			q->wed_regs = wed->txfree_ring.reg_base;
- 		break;
-+	case MT76_WED_Q_RX:
-+		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
-+		if (!ret)
-+			q->wed_regs = wed->rx_ring[ring].reg_base;
-+		break;
- 	default:
- 		ret = -EINVAL;
- 	}
-@@ -574,7 +709,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
- 
- 	spin_lock_bh(&q->lock);
- 	do {
--		buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more);
-+		buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL);
- 		if (!buf)
- 			break;
- 
-@@ -615,7 +750,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
- 
- static void
- mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
--		  int len, bool more)
-+		  int len, bool more, u32 info)
- {
- 	struct sk_buff *skb = q->rx_head;
- 	struct skb_shared_info *shinfo = skb_shinfo(skb);
-@@ -635,7 +770,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
- 
- 	q->rx_head = NULL;
- 	if (nr_frags < ARRAY_SIZE(shinfo->frags))
--		dev->drv->rx_skb(dev, q - dev->q_rx, skb);
-+		dev->drv->rx_skb(dev, q - dev->q_rx, skb, &info);
- 	else
- 		dev_kfree_skb(skb);
- }
-@@ -656,6 +791,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 	}
- 
- 	while (done < budget) {
-+		bool drop = false;
- 		u32 info;
- 
- 		if (check_ddone) {
-@@ -666,10 +802,14 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 				break;
- 		}
- 
--		data = mt76_dma_dequeue(dev, q, false, &len, &info, &more);
-+		data = mt76_dma_dequeue(dev, q, false, &len, &info, &more,
-+					&drop);
- 		if (!data)
- 			break;
- 
-+		if (drop)
-+			goto free_frag;
-+
- 		if (q->rx_head)
- 			data_len = q->buf_size;
- 		else
-@@ -682,7 +822,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 		}
- 
- 		if (q->rx_head) {
--			mt76_add_fragment(dev, q, data, len, more);
-+			mt76_add_fragment(dev, q, data, len, more, info);
- 			continue;
- 		}
- 
-@@ -706,7 +846,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 			continue;
- 		}
- 
--		dev->drv->rx_skb(dev, q - dev->q_rx, skb);
-+		dev->drv->rx_skb(dev, q - dev->q_rx, skb, &info);
- 		continue;
- 
- free_frag:
-@@ -803,11 +943,15 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
- 		mt76_dma_tx_cleanup(dev, dev->q_mcu[i], true);
- 
- 	mt76_for_each_q_rx(dev, i) {
-+		struct mt76_queue *q = &dev->q_rx[i];
-+
- 		netif_napi_del(&dev->napi[i]);
--		mt76_dma_rx_cleanup(dev, &dev->q_rx[i]);
-+		if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags))
-+			mt76_dma_rx_cleanup(dev, q);
- 	}
- 
- 	mt76_free_pending_txwi(dev);
-+	mt76_free_pending_rxwi(dev);
- 
- 	if (mtk_wed_device_active(&dev->mmio.wed))
- 		mtk_wed_device_detach(&dev->mmio.wed);
-diff --git a/dma.h b/dma.h
-index fdf786f9..53c6ce25 100644
---- a/dma.h
-+++ b/dma.h
-@@ -15,6 +15,14 @@
- #define MT_DMA_CTL_SD_LEN0		GENMASK(29, 16)
- #define MT_DMA_CTL_LAST_SEC0		BIT(30)
- #define MT_DMA_CTL_DMA_DONE		BIT(31)
-+#define MT_DMA_CTL_TO_HOST		BIT(8)
-+#define MT_DMA_CTL_TO_HOST_A		BIT(12)
-+#define MT_DMA_CTL_DROP			BIT(14)
-+#define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
-+
-+#define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
-+#define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
-+#define MT_DMA_INFO_PPE_VLD		BIT(31)
- 
- #define MT_DMA_HDR_LEN			4
- #define MT_RX_INFO_LEN			4
-diff --git a/mac80211.c b/mac80211.c
-index 30c1bc56..acac04ef 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -572,6 +572,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
- 	spin_lock_init(&dev->lock);
- 	spin_lock_init(&dev->cc_lock);
- 	spin_lock_init(&dev->status_lock);
-+	spin_lock_init(&dev->wed_lock);
- 	mutex_init(&dev->mutex);
- 	init_waitqueue_head(&dev->tx_wait);
- 
-@@ -594,9 +595,13 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
- 	spin_lock_init(&dev->token_lock);
- 	idr_init(&dev->token);
- 
-+	spin_lock_init(&dev->rx_token_lock);
-+	idr_init(&dev->rx_token);
-+
- 	INIT_LIST_HEAD(&dev->wcid_list);
- 
- 	INIT_LIST_HEAD(&dev->txwi_cache);
-+	INIT_LIST_HEAD(&dev->rxwi_cache);
- 	dev->token_size = dev->drv->token_size;
- 
- 	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
-@@ -1292,7 +1297,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
- 
- 	while ((skb = __skb_dequeue(&dev->rx_skb[q])) != NULL) {
- 		mt76_check_sta(dev, skb);
--		mt76_rx_aggr_reorder(skb, &frames);
-+		if (mtk_wed_device_active(&dev->mmio.wed))
-+			__skb_queue_tail(&frames, skb);
-+		else
-+			mt76_rx_aggr_reorder(skb, &frames);
- 	}
- 
- 	mt76_rx_complete(dev, &frames, napi);
-diff --git a/mt76.h b/mt76.h
-index a2bccf6b..33f87e51 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -35,6 +35,7 @@
- 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
- 				 FIELD_PREP(MT_QFLAG_WED_RING, _n))
- #define MT_WED_Q_TX(_n)		__MT_WED_Q(MT76_WED_Q_TX, _n)
-+#define MT_WED_Q_RX(_n)		__MT_WED_Q(MT76_WED_Q_RX, _n)
- #define MT_WED_Q_TXFREE		__MT_WED_Q(MT76_WED_Q_TXFREE, 0)
- 
- struct mt76_dev;
-@@ -56,6 +57,7 @@ enum mt76_bus_type {
- enum mt76_wed_type {
- 	MT76_WED_Q_TX,
- 	MT76_WED_Q_TXFREE,
-+	MT76_WED_Q_RX,
- };
- 
- struct mt76_bus_ops {
-@@ -271,9 +273,15 @@ struct mt76_sta_stats {
- 	u64 tx_nss[4];		/* 1, 2, 3, 4 */
- 	u64 tx_mcs[16];		/* mcs idx */
- 	u64 tx_bytes;
-+	/* WED TX */
- 	u32 tx_packets;
- 	u32 tx_retries;
- 	u32 tx_failed;
-+	/* WED RX */
-+	u64 rx_bytes;
-+	u32 rx_packets;
-+	u32 rx_errors;
-+	u32 rx_drops;
- };
- 
- enum mt76_wcid_flags {
-@@ -339,7 +347,10 @@ struct mt76_txwi_cache {
- 	struct list_head list;
- 	dma_addr_t dma_addr;
- 
--	struct sk_buff *skb;
-+	union {
-+		struct sk_buff *skb;
-+		void *ptr;
-+	};
- };
- 
- struct mt76_rx_tid {
-@@ -439,7 +450,7 @@ struct mt76_driver_ops {
- 	bool (*rx_check)(struct mt76_dev *dev, void *data, int len);
- 
- 	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
--		       struct sk_buff *skb);
-+		       struct sk_buff *skb, u32 *info);
- 
- 	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
- 
-@@ -728,6 +739,7 @@ struct mt76_dev {
- 
- 	struct ieee80211_hw *hw;
- 
-+	spinlock_t wed_lock;
- 	spinlock_t lock;
- 	spinlock_t cc_lock;
- 
-@@ -754,6 +766,7 @@ struct mt76_dev {
- 	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
- 
- 	struct list_head txwi_cache;
-+	struct list_head rxwi_cache;
- 	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
- 	struct mt76_queue q_rx[__MT_RXQ_MAX];
- 	const struct mt76_queue_ops *queue_ops;
-@@ -768,6 +781,10 @@ struct mt76_dev {
- 	u16 token_count;
- 	u16 token_size;
- 
-+	spinlock_t rx_token_lock;
-+	struct idr rx_token;
-+	u16 rx_token_size;
-+
- 	wait_queue_head_t tx_wait;
- 	/* spinclock used to protect wcid pktid linked list */
- 	spinlock_t status_lock;
-@@ -1247,6 +1264,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
- }
- 
- void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
-+void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
-+struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
- void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
- 		      struct napi_struct *napi);
- void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1391,6 +1410,9 @@ struct mt76_txwi_cache *
- mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
- int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
- void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
-+struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
-+int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
-+			  struct mt76_txwi_cache *r, dma_addr_t phys);
- 
- static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
- {
-diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9d..06a9e6ec 100644
---- a/mt7603/dma.c
-+++ b/mt7603/dma.c
-@@ -69,7 +69,7 @@ free:
- }
- 
- void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 *info)
- {
- 	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d90..7c3be596 100644
---- a/mt7603/mt7603.h
-+++ b/mt7603/mt7603.h
-@@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- void mt7603_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e);
- 
- void mt7603_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 *info);
- void mt7603_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
- void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
-diff --git a/mt7615/mac.c b/mt7615/mac.c
-index 305bf182..a9560247 100644
---- a/mt7615/mac.c
-+++ b/mt7615/mac.c
-@@ -1666,7 +1666,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
- EXPORT_SYMBOL_GPL(mt7615_rx_check);
- 
- void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 *info)
- {
- 	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 1080d202..43739ecf 100644
---- a/mt7615/mt7615.h
-+++ b/mt7615/mt7615.h
-@@ -514,7 +514,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
- void mt7615_tx_token_put(struct mt7615_dev *dev);
- bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 *info);
- void mt7615_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 		       struct ieee80211_sta *sta);
-diff --git a/mt76_connac.h b/mt76_connac.h
-index 0915eb57..8ba883b0 100644
---- a/mt76_connac.h
-+++ b/mt76_connac.h
-@@ -187,6 +187,11 @@ static inline bool is_mt7986(struct mt76_dev *dev)
- 	return mt76_chip(dev) == 0x7986;
- }
- 
-+static inline bool is_mt7996(struct mt76_dev *dev)
-+{
-+	return mt76_chip(dev) == 0x7990;
-+}
-+
- static inline bool is_mt7622(struct mt76_dev *dev)
- {
- 	if (!IS_ENABLED(CONFIG_MT7622_WMAC))
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index dfec416e..c65267b4 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -65,7 +65,8 @@ int mt76_connac_mcu_init_download(struct mt76_dev *dev, u32 addr, u32 len,
- 	int cmd;
- 
- 	if ((!is_connac_v1(dev) && addr == MCU_PATCH_ADDRESS) ||
--	    (is_mt7921(dev) && addr == 0x900000))
-+	    (is_mt7921(dev) && addr == 0x900000) ||
-+	    (is_mt7996(dev) && addr == 0x900000))
- 		cmd = MCU_CMD(PATCH_START_REQ);
- 	else
- 		cmd = MCU_CMD(TARGET_ADDRESS_LEN_REQ);
-@@ -1183,6 +1184,16 @@ void mt76_connac_mcu_sta_ba_tlv(struct sk_buff *skb,
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba_tlv);
- 
-+int mt76_connac_mcu_sta_wed_update(struct mt76_dev *dev, struct sk_buff *skb)
-+{
-+	if (!mtk_wed_device_active(&dev->mmio.wed))
-+		return 0;
-+
-+	return mtk_wed_device_update_msg(&dev->mmio.wed, WED_WO_STA_REC,
-+					 skb->data, skb->len);
-+}
-+EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_wed_update);
-+
- int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 			   struct ieee80211_ampdu_params *params,
- 			   int cmd, bool enable, bool tx)
-@@ -1208,6 +1219,10 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 	mt76_connac_mcu_wtbl_ba_tlv(dev, skb, params, enable, tx, sta_wtbl,
- 				    wtbl_hdr);
- 
-+	ret = mt76_connac_mcu_sta_wed_update(dev, skb);
-+	if (ret)
-+		return ret;
-+
- 	ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
- 	if (ret)
- 		return ret;
-@@ -1218,6 +1233,10 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- 
- 	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
- 
-+	ret = mt76_connac_mcu_sta_wed_update(dev, skb);
-+	if (ret)
-+		return ret;
-+
- 	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
-@@ -2658,6 +2677,10 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
- 	if (ret)
- 		return ret;
- 
-+	ret = mt76_connac_mcu_sta_wed_update(dev, skb);
-+	if (ret)
-+		return ret;
-+
- 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 87c65d25..72d235a1 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -63,7 +63,7 @@ struct mt76_connac2_mcu_txd {
- } __packed __aligned(4);
- 
- /**
-- * struct mt76_connac2_mcu_uni_txd - mcu command descriptor for firmware v3
-+ * struct mt76_connac2_mcu_uni_txd - mcu command descriptor for connac2 and connac3
-  * @txd: hardware descriptor
-  * @len: total length not including txd
-  * @cid: command identifier
-@@ -393,7 +393,8 @@ struct sta_rec_phy {
- 	u8 ampdu;
- 	u8 rts_policy;
- 	u8 rcpi;
--	u8 rsv[2];
-+	u8 max_ampdu_len; /* connac3 */
-+	u8 rsv[1];
- } __packed;
- 
- struct sta_rec_he_6g_capa {
-@@ -454,8 +455,8 @@ struct sta_rec_bf {
- 	u8 ibf_dbw;
- 	u8 ibf_ncol;
- 	u8 ibf_nrow;
--	u8 nrow_bw160;
--	u8 ncol_bw160;
-+	u8 nrow_gt_bw80;
-+	u8 ncol_gt_bw80;
- 	u8 ru_start_idx;
- 	u8 ru_end_idx;
- 
-@@ -781,6 +782,8 @@ enum {
- 	STA_REC_BFEE,
- 	STA_REC_PHY = 0x15,
- 	STA_REC_HE_6G = 0x17,
-+	STA_REC_HDRT = 0x28,
-+	STA_REC_HDR_TRANS = 0x2B,
- 	STA_REC_MAX_NUM
- };
- 
-@@ -986,6 +989,17 @@ enum {
- 	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
- };
- 
-+/* unified event table */
-+enum {
-+	MCU_UNI_EVENT_RESULT = 0x01,
-+	MCU_UNI_EVENT_FW_LOG_2_HOST = 0x04,
-+	MCU_UNI_EVENT_IE_COUNTDOWN = 0x09,
-+	MCU_UNI_EVENT_RDD_REPORT = 0x11,
-+};
-+
-+#define MCU_UNI_CMD_EVENT			BIT(1)
-+#define MCU_UNI_CMD_UNSOLICITED_EVENT		BIT(2)
-+
- enum {
- 	MCU_Q_QUERY,
- 	MCU_Q_SET,
-@@ -1068,10 +1082,11 @@ enum {
- 
- #define MCU_CMD_ACK				BIT(0)
- #define MCU_CMD_UNI				BIT(1)
--#define MCU_CMD_QUERY				BIT(2)
-+#define MCU_CMD_SET				BIT(2)
- 
- #define MCU_CMD_UNI_EXT_ACK			(MCU_CMD_ACK | MCU_CMD_UNI | \
--						 MCU_CMD_QUERY)
-+						 MCU_CMD_SET)
-+#define MCU_CMD_UNI_QUERY_ACK			(MCU_CMD_ACK | MCU_CMD_UNI)
- 
- #define __MCU_CMD_FIELD_ID			GENMASK(7, 0)
- #define __MCU_CMD_FIELD_EXT_ID			GENMASK(15, 8)
-@@ -1079,6 +1094,7 @@ enum {
- #define __MCU_CMD_FIELD_UNI			BIT(17)
- #define __MCU_CMD_FIELD_CE			BIT(18)
- #define __MCU_CMD_FIELD_WA			BIT(19)
-+#define __MCU_CMD_FIELD_WM			BIT(20)
- 
- #define MCU_CMD(_t)				FIELD_PREP(__MCU_CMD_FIELD_ID,		\
- 							   MCU_CMD_##_t)
-@@ -1100,6 +1116,16 @@ enum {
- 						 FIELD_PREP(__MCU_CMD_FIELD_EXT_ID, \
- 							    MCU_WA_PARAM_CMD_##_t))
- 
-+#define MCU_WM_UNI_CMD(_t)			(MCU_UNI_CMD(_t) |		\
-+						 __MCU_CMD_FIELD_WM)
-+#define MCU_WM_UNI_CMD_QUERY(_t)		(MCU_UNI_CMD(_t) |		\
-+						 __MCU_CMD_FIELD_QUERY |	\
-+						 __MCU_CMD_FIELD_WM)
-+#define MCU_WA_UNI_CMD(_t)			(MCU_UNI_CMD(_t) |		\
-+						 __MCU_CMD_FIELD_WA)
-+#define MCU_WMWA_UNI_CMD(_t)			(MCU_WM_UNI_CMD(_t) |		\
-+						 __MCU_CMD_FIELD_WA)
-+
- enum {
- 	MCU_EXT_CMD_EFUSE_ACCESS = 0x01,
- 	MCU_EXT_CMD_RF_REG_ACCESS = 0x02,
-@@ -1153,11 +1179,33 @@ enum {
- 	MCU_UNI_CMD_DEV_INFO_UPDATE = 0x01,
- 	MCU_UNI_CMD_BSS_INFO_UPDATE = 0x02,
- 	MCU_UNI_CMD_STA_REC_UPDATE = 0x03,
-+	MCU_UNI_CMD_EDCA_UPDATE = 0x04,
- 	MCU_UNI_CMD_SUSPEND = 0x05,
- 	MCU_UNI_CMD_OFFLOAD = 0x06,
- 	MCU_UNI_CMD_HIF_CTRL = 0x07,
-+	MCU_UNI_CMD_BAND_CONFIG = 0x08,
-+	MCU_UNI_CMD_REPT_MUAR = 0x09,
-+	MCU_UNI_CMD_WSYS_CONFIG = 0x0b,
-+	MCU_UNI_CMD_REG_ACCESS = 0x0d,
-+	MCU_UNI_CMD_POWER_CREL = 0x0f,
-+	MCU_UNI_CMD_RX_HDR_TRANS = 0x12,
-+	MCU_UNI_CMD_SER = 0x13,
-+	MCU_UNI_CMD_TWT = 0x14,
-+	MCU_UNI_CMD_RDD_CTRL = 0x19,
-+	MCU_UNI_CMD_GET_MIB_INFO = 0x22,
- 	MCU_UNI_CMD_SNIFFER = 0x24,
-+	MCU_UNI_CMD_SR = 0x25,
- 	MCU_UNI_CMD_ROC = 0x27,
-+	MCU_UNI_CMD_TXPOWER = 0x2b,
-+	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
-+	MCU_UNI_CMD_RA = 0x2f,
-+	MCU_UNI_CMD_MURU = 0x31,
-+	MCU_UNI_CMD_BF = 0x33,
-+	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
-+	MCU_UNI_CMD_THERMAL = 0x35,
-+	MCU_UNI_CMD_VOW = 0x37,
-+	MCU_UNI_CMD_RRO = 0x57,
-+	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
- };
- 
- enum {
-@@ -1207,14 +1255,23 @@ enum {
- 
- enum {
- 	UNI_BSS_INFO_BASIC = 0,
-+	UNI_BSS_INFO_RA = 1,
- 	UNI_BSS_INFO_RLM = 2,
- 	UNI_BSS_INFO_BSS_COLOR = 4,
- 	UNI_BSS_INFO_HE_BASIC = 5,
- 	UNI_BSS_INFO_BCN_CONTENT = 7,
-+	UNI_BSS_INFO_BCN_CSA = 8,
-+	UNI_BSS_INFO_BCN_BCC = 9,
-+	UNI_BSS_INFO_BCN_MBSSID = 10,
-+	UNI_BSS_INFO_RATE = 11,
- 	UNI_BSS_INFO_QBSS = 15,
-+	UNI_BSS_INFO_SEC = 16,
-+	UNI_BSS_INFO_TXCMD = 18,
- 	UNI_BSS_INFO_UAPSD = 19,
- 	UNI_BSS_INFO_PS = 21,
- 	UNI_BSS_INFO_BCNFT = 22,
-+	UNI_BSS_INFO_OFFLOAD = 25,
-+	UNI_BSS_INFO_MLD = 26,
- };
- 
- enum {
-@@ -1823,6 +1880,7 @@ int mt76_connac_mcu_set_pm(struct mt76_dev *dev, int band, int enter);
- int mt76_connac_mcu_restart(struct mt76_dev *dev);
- int mt76_connac_mcu_rdd_cmd(struct mt76_dev *dev, int cmd, u8 index,
- 			    u8 rx_sel, u8 val);
-+int mt76_connac_mcu_sta_wed_update(struct mt76_dev *dev, struct sk_buff *skb);
- int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
- 			  const char *fw_wa);
- int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name);
-diff --git a/mt76x02.h b/mt76x02.h
-index 849c2644..3f2a9b7f 100644
---- a/mt76x02.h
-+++ b/mt76x02.h
-@@ -187,7 +187,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
- void mt76x02_remove_hdr_pad(struct sk_buff *skb, int len);
- bool mt76x02_tx_status_data(struct mt76_dev *mdev, u8 *update);
- void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb);
-+			  struct sk_buff *skb, u32 *info);
- void mt76x02_rx_poll_complete(struct mt76_dev *mdev, enum mt76_rxq_id q);
- irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
- void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
-diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 3a313075..d8bc4ae1 100644
---- a/mt76x02_txrx.c
-+++ b/mt76x02_txrx.c
-@@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
- EXPORT_SYMBOL_GPL(mt76x02_tx);
- 
- void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb)
-+			  struct sk_buff *skb, u32 *info)
- {
- 	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
- 	void *rxwi = skb->data;
-diff --git a/mt7915/coredump.c b/mt7915/coredump.c
-index bb4b7040..d097a56d 100644
---- a/mt7915/coredump.c
-+++ b/mt7915/coredump.c
-@@ -9,6 +9,7 @@
- 
- static bool coredump_memdump;
- module_param(coredump_memdump, bool, 0644);
-+MODULE_PARM_DESC(coredump_memdump, "Optional ability to dump firmware memory");
- 
- static const struct mt7915_mem_region mt7915_mem_regions[] = {
- 	{
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 766e6208..30f8f18b 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -51,7 +51,7 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
- {
- 	struct mt7915_phy *phy = file->private_data;
- 	struct mt7915_dev *dev = phy->dev;
--	bool ext_phy = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	char buf[16];
- 	int ret = 0;
- 	u16 val;
-@@ -83,7 +83,7 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
- 	 * 8: trigger firmware crash.
- 	 */
- 	case SER_QUERY:
--		ret = mt7915_mcu_set_ser(dev, 0, 0, ext_phy);
-+		ret = mt7915_mcu_set_ser(dev, 0, 0, band);
- 		break;
- 	case SER_SET_RECOVER_L1:
- 	case SER_SET_RECOVER_L2:
-@@ -91,17 +91,17 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
- 	case SER_SET_RECOVER_L3_TX_ABORT:
- 	case SER_SET_RECOVER_L3_TX_DISABLE:
- 	case SER_SET_RECOVER_L3_BF:
--		ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), ext_phy);
-+		ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), band);
- 		if (ret)
- 			return ret;
- 
--		ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, ext_phy);
-+		ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, band);
- 		break;
- 
- 	/* enable full chip reset */
- 	case SER_SET_RECOVER_FULL:
- 		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, MT_MCU_CMD_WDT_MASK);
--		ret = mt7915_mcu_set_ser(dev, 1, 3, ext_phy);
-+		ret = mt7915_mcu_set_ser(dev, 1, 3, band);
- 		if (ret)
- 			return ret;
- 
-@@ -967,11 +967,18 @@ mt7915_rate_txpower_show(struct seq_file *file, void *data)
- 		"RU484/SU40", "RU996/SU80", "RU2x996/SU160"
- 	};
- 	struct mt7915_phy *phy = file->private;
-+	struct mt7915_dev *dev = phy->dev;
- 	s8 txpower[MT7915_SKU_RATE_NUM], *buf;
--	int i;
-+	u32 reg;
-+	int i, ret;
-+
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower));
-+	if (ret)
-+		return ret;
-+
-+	/* Txpower propagation path: TMAC -> TXV -> BBP */
-+	seq_printf(file, "\nPhy %d\n", phy != &dev->phy);
- 
--	seq_printf(file, "\nBand %d\n", phy != &phy->dev->phy);
--	mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower));
- 	for (i = 0, buf = txpower; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
- 		u8 mcs_num = mt7915_sku_group_len[i];
- 
-@@ -982,6 +989,12 @@ mt7915_rate_txpower_show(struct seq_file *file, void *data)
- 		buf += mt7915_sku_group_len[i];
- 	}
- 
-+	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_TPC_CTRL_STAT(phy->band_idx) :
-+	      MT_WF_PHY_TPC_CTRL_STAT_MT7916(phy->band_idx);
-+
-+	seq_printf(file, "\nBaseband transmit power %ld\n",
-+		   mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER));
-+
- 	return 0;
- }
- 
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 9a57ad8f..27b67800 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -361,11 +361,18 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
- 
- 	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
- 		u32 wed_irq_mask = irq_mask;
-+		int ret;
- 
- 		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
- 		if (!is_mt7986(&dev->mt76))
- 			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
--		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
-+		else
-+			mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
-+
-+		ret = mt7915_mcu_wed_enable_rx_stats(dev);
-+		if (ret)
-+			return ret;
-+
- 		mtk_wed_device_start(&dev->mt76.mmio.wed, wed_irq_mask);
- 	}
- 
-@@ -401,6 +408,9 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1,
- 					   wed_control_rx1));
-+			if (is_mt7915(mdev))
-+				mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
-+					 MT_WFDMA0_EXT0_RXWB_KEEP);
- 		}
- 	} else {
- 		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
-@@ -473,6 +483,13 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 
- 	/* rx data queue for band0 */
- 	if (!dev->phy.band_idx) {
-+		if (mtk_wed_device_active(&mdev->mmio.wed) &&
-+		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
-+			dev->mt76.q_rx[MT_RXQ_MAIN].flags =
-+				MT_WED_Q_RX(MT7915_RXQ_BAND0);
-+			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
-+		}
-+
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
- 				       MT_RXQ_ID(MT_RXQ_MAIN),
- 				       MT7915_RX_RING_SIZE,
-@@ -503,6 +520,13 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 	}
- 
- 	if (dev->dbdc_support || dev->phy.band_idx) {
-+		if (mtk_wed_device_active(&mdev->mmio.wed) &&
-+		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
-+			dev->mt76.q_rx[MT_RXQ_BAND1].flags =
-+				MT_WED_Q_RX(MT7915_RXQ_BAND1);
-+			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
-+		}
-+
- 		/* rx data queue for band1 */
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
- 				       MT_RXQ_ID(MT_RXQ_BAND1),
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 0a5f7d85..9e69ab82 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -355,6 +355,9 @@ mt7915_init_wiphy(struct ieee80211_hw *hw)
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_DISCOVERY);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
- 
-+	if (!is_mt7915(&dev->mt76))
-+		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STA_TX_PWR);
-+
- 	if (!mdev->dev->of_node ||
- 	    !of_property_read_bool(mdev->dev->of_node,
- 				   "mediatek,disable-radar-background"))
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 99123e77..97a19bdb 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -165,9 +165,9 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
- 		sta = container_of((void *)msta, struct ieee80211_sta,
- 				   drv_priv);
- 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
--			u8 q = mt76_connac_lmac_mapping(i);
--			u32 tx_cur = tx_time[q];
--			u32 rx_cur = rx_time[q];
-+			u8 queue = mt76_connac_lmac_mapping(i);
-+			u32 tx_cur = tx_time[queue];
-+			u32 rx_cur = rx_time[queue];
- 			u8 tid = ac_to_tid[i];
- 
- 			if (!tx_cur && !rx_cur)
-@@ -245,8 +245,38 @@ void mt7915_mac_enable_rtscts(struct mt7915_dev *dev,
- 		mt76_clear(dev, addr, BIT(5));
- }
- 
-+static void
-+mt7915_wed_check_ppe(struct mt7915_dev *dev, struct mt76_queue *q,
-+		     struct mt7915_sta *msta, struct sk_buff *skb,
-+		     u32 info)
-+{
-+	struct ieee80211_vif *vif;
-+	struct wireless_dev *wdev;
-+	u32 hash, reason;
-+
-+	if (!msta || !msta->vif)
-+		return;
-+
-+	if (!(q->flags & MT_QFLAG_WED) ||
-+	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) != MT76_WED_Q_RX)
-+		return;
-+
-+	if (!(info & MT_DMA_INFO_PPE_VLD))
-+		return;
-+
-+	vif = container_of((void *)msta->vif, struct ieee80211_vif,
-+			   drv_priv);
-+	wdev = ieee80211_vif_to_wdev(vif);
-+	skb->dev = wdev->netdev;
-+
-+	reason = FIELD_GET(MT_DMA_PPE_CPU_REASON, info);
-+	hash = FIELD_GET(MT_DMA_PPE_ENTRY, info);
-+	mtk_wed_device_ppe_check(&dev->mt76.mmio.wed, skb, reason, hash);
-+}
-+
- static int
--mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
-+mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
-+		   enum mt76_rxq_id q, u32 *info)
- {
- 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
- 	struct mt76_phy *mphy = &dev->mt76.phy;
-@@ -513,6 +543,8 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
- 		}
- 	} else {
- 		status->flag |= RX_FLAG_8023;
-+		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
-+				     *info);
- 	}
- 
- 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
-@@ -1096,7 +1128,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
- }
- 
- void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 *info)
- {
- 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-@@ -1130,7 +1162,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
- 		dev_kfree_skb(skb);
- 		break;
- 	case PKT_TYPE_NORMAL:
--		if (!mt7915_mac_fill_rx(dev, skb)) {
-+		if (!mt7915_mac_fill_rx(dev, skb, q, info)) {
- 			mt76_rx(&dev->mt76, q, skb);
- 			return;
- 		}
-@@ -1228,18 +1260,18 @@ void mt7915_mac_set_timing(struct mt7915_phy *phy)
- 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
- }
- 
--void mt7915_mac_enable_nf(struct mt7915_dev *dev, bool ext_phy)
-+void mt7915_mac_enable_nf(struct mt7915_dev *dev, bool band)
- {
- 	u32 reg;
- 
--	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RXTD12(ext_phy) :
--		MT_WF_PHY_RXTD12_MT7916(ext_phy);
-+	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RXTD12(band) :
-+				      MT_WF_PHY_RXTD12_MT7916(band);
- 	mt76_set(dev, reg,
- 		 MT_WF_PHY_RXTD12_IRPI_SW_CLR_ONLY |
- 		 MT_WF_PHY_RXTD12_IRPI_SW_CLR);
- 
--	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RX_CTRL1(ext_phy) :
--		MT_WF_PHY_RX_CTRL1_MT7916(ext_phy);
-+	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_RX_CTRL1(band) :
-+				      MT_WF_PHY_RX_CTRL1_MT7916(band);
- 	mt76_set(dev, reg, FIELD_PREP(MT_WF_PHY_RX_CTRL1_IPI_EN, 0x5));
- }
- 
-@@ -1354,7 +1386,6 @@ mt7915_mac_restart(struct mt7915_dev *dev)
- 	struct mt76_phy *ext_phy;
- 	struct mt76_dev *mdev = &dev->mt76;
- 	int i, ret;
--	u32 irq_mask;
- 
- 	ext_phy = dev->mt76.phys[MT_BAND1];
- 	phy2 = ext_phy ? ext_phy->priv : NULL;
-@@ -1412,7 +1443,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
- 	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
- 
- 	if (dev->hif2) {
--		mt76_wr(dev, MT_INT1_MASK_CSR, irq_mask);
-+		mt76_wr(dev, MT_INT1_MASK_CSR, dev->mt76.mmio.irqmask);
- 		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
- 	}
- 	if (dev_is_pci(mdev->dev)) {
-@@ -1949,7 +1980,6 @@ void mt7915_mac_update_stats(struct mt7915_phy *phy)
- static void mt7915_mac_severe_check(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
--	bool ext_phy = phy != &dev->phy;
- 	u32 trb;
- 
- 	if (!phy->omac_mask)
-@@ -1967,7 +1997,7 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
- 	     FIELD_GET(MT_TRB_RXPSR0_RX_WTBL_PTR, phy->trb_ts)) &&
- 	    trb == phy->trb_ts)
- 		mt7915_mcu_set_ser(dev, SER_RECOVER, SER_SET_RECOVER_L3_RX_ABORT,
--				   ext_phy);
-+				   phy->band_idx);
- 
- 	phy->trb_ts = trb;
- }
-diff --git a/mt7915/main.c b/mt7915/main.c
-index fe5ec166..2505fa7e 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -30,31 +30,31 @@ int mt7915_run(struct ieee80211_hw *hw)
- 	running = mt7915_dev_running(dev);
- 
- 	if (!running) {
--		ret = mt76_connac_mcu_set_pm(&dev->mt76, 0, 0);
-+		ret = mt76_connac_mcu_set_pm(&dev->mt76, dev->phy.band_idx, 0);
- 		if (ret)
- 			goto out;
- 
--		ret = mt7915_mcu_set_mac(dev, 0, true, true);
-+		ret = mt7915_mcu_set_mac(dev, dev->phy.band_idx, true, true);
- 		if (ret)
- 			goto out;
- 
--		mt7915_mac_enable_nf(dev, 0);
-+		mt7915_mac_enable_nf(dev, dev->phy.band_idx);
- 	}
- 
--	if (phy != &dev->phy || phy->band_idx) {
--		ret = mt76_connac_mcu_set_pm(&dev->mt76, 1, 0);
-+	if (phy != &dev->phy) {
-+		ret = mt76_connac_mcu_set_pm(&dev->mt76, phy->band_idx, 0);
- 		if (ret)
- 			goto out;
- 
--		ret = mt7915_mcu_set_mac(dev, 1, true, true);
-+		ret = mt7915_mcu_set_mac(dev, phy->band_idx, true, true);
- 		if (ret)
- 			goto out;
- 
--		mt7915_mac_enable_nf(dev, 1);
-+		mt7915_mac_enable_nf(dev, phy->band_idx);
- 	}
- 
- 	ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, 0x92b,
--					     phy != &dev->phy);
-+					     phy->band_idx);
- 	if (ret)
- 		goto out;
- 
-@@ -107,13 +107,13 @@ static void mt7915_stop(struct ieee80211_hw *hw)
- 	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
- 
- 	if (phy != &dev->phy) {
--		mt76_connac_mcu_set_pm(&dev->mt76, 1, 1);
--		mt7915_mcu_set_mac(dev, 1, false, false);
-+		mt76_connac_mcu_set_pm(&dev->mt76, phy->band_idx, 1);
-+		mt7915_mcu_set_mac(dev, phy->band_idx, false, false);
- 	}
- 
- 	if (!mt7915_dev_running(dev)) {
--		mt76_connac_mcu_set_pm(&dev->mt76, 0, 1);
--		mt7915_mcu_set_mac(dev, 0, false, false);
-+		mt76_connac_mcu_set_pm(&dev->mt76, dev->phy.band_idx, 1);
-+		mt7915_mcu_set_mac(dev, dev->phy.band_idx, false, false);
- 	}
- 
- 	mutex_unlock(&dev->mt76.mutex);
-@@ -440,7 +440,6 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
- {
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
- 	int ret;
- 
- 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-@@ -468,6 +467,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
- 
- 	if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
- 		bool enabled = !!(hw->conf.flags & IEEE80211_CONF_MONITOR);
-+		bool band = phy->band_idx;
- 
- 		if (!enabled)
- 			phy->rxfilter |= MT_WF_RFCR_DROP_OTHER_UC;
-@@ -505,7 +505,7 @@ static void mt7915_configure_filter(struct ieee80211_hw *hw,
- {
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	u32 ctl_flags = MT_WF_RFCR1_DROP_ACK |
- 			MT_WF_RFCR1_DROP_BF_POLL |
- 			MT_WF_RFCR1_DROP_BA |
-@@ -600,10 +600,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
- 		mt7915_mcu_add_sta(dev, vif, NULL, join);
- 	}
- 
--	if (changed & BSS_CHANGED_ASSOC) {
-+	if (changed & BSS_CHANGED_ASSOC)
- 		mt7915_mcu_add_bss_info(phy, vif, info->assoc);
--		mt7915_mcu_add_obss_spr(dev, vif, info->he_obss_pd.enable);
--	}
- 
- 	if (changed & BSS_CHANGED_ERP_CTS_PROT)
- 		mt7915_mac_enable_rtscts(dev, vif, info->use_cts_prot);
-@@ -627,7 +625,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
- 		mt7915_mcu_set_tx(dev, vif);
- 
- 	if (changed & BSS_CHANGED_HE_OBSS_PD)
--		mt7915_mcu_add_obss_spr(dev, vif, info->he_obss_pd.enable);
-+		mt7915_mcu_add_obss_spr(phy, vif, &info->he_obss_pd);
- 
- 	if (changed & BSS_CHANGED_HE_BSS_COLOR)
- 		mt7915_update_bss_color(hw, vif, &info->he_bss_color);
-@@ -744,7 +742,7 @@ static int mt7915_set_rts_threshold(struct ieee80211_hw *hw, u32 val)
- 	int ret;
- 
- 	mutex_lock(&dev->mt76.mutex);
--	ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, val, phy != &dev->phy);
-+	ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, val, phy->band_idx);
- 	mutex_unlock(&dev->mt76.mutex);
- 
- 	return ret;
-@@ -847,7 +845,7 @@ u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif)
- {
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -892,7 +890,7 @@ mt7915_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -923,7 +921,7 @@ mt7915_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
--	bool band = phy != &dev->phy;
-+	bool band = phy->band_idx;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -1036,6 +1034,14 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
- 
- 		sinfo->tx_retries = msta->wcid.stats.tx_retries;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
-+
-+		if (mtk_wed_get_rx_capa(&phy->dev->mt76.mmio.wed)) {
-+			sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
-+			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
-+
-+			sinfo->rx_packets = msta->wcid.stats.rx_packets;
-+			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
-+		}
- 	}
- 
- 	sinfo->ack_signal = (s8)msta->ack_signal;
-@@ -1127,6 +1133,39 @@ static void mt7915_sta_set_decap_offload(struct ieee80211_hw *hw,
- 	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
- }
- 
-+static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
-+				struct ieee80211_vif *vif,
-+				struct ieee80211_sta *sta)
-+{
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-+	s16 txpower = sta->txpwr.power;
-+	int ret;
-+
-+	if (sta->txpwr.type == NL80211_TX_POWER_AUTOMATIC)
-+		txpower = 0;
-+
-+	mutex_lock(&dev->mt76.mutex);
-+
-+	/* NOTE: temporarily use 0 as minimum limit, which is a
-+	 * global setting and will be applied to all stations.
-+	 */
-+	ret = mt7915_mcu_set_txpower_frame_min(phy, 0);
-+	if (ret)
-+		goto out;
-+
-+	/* This only applies to data frames while pushing traffic,
-+	 * whereas the management frames or other packets that are
-+	 * using fixed rate can be configured via TxD.
-+	 */
-+	ret = mt7915_mcu_set_txpower_frame(phy, vif, sta, txpower);
-+
-+out:
-+	mutex_unlock(&dev->mt76.mutex);
-+
-+	return ret;
-+}
-+
- static const char mt7915_gstrings_stats[][ETH_GSTRING_LEN] = {
- 	"tx_ampdu_cnt",
- 	"tx_stop_q_empty_cnt",
-@@ -1492,6 +1531,7 @@ const struct ieee80211_ops mt7915_ops = {
- 	.set_bitrate_mask = mt7915_set_bitrate_mask,
- 	.set_coverage_class = mt7915_set_coverage_class,
- 	.sta_statistics = mt7915_sta_statistics,
-+	.sta_set_txpwr = mt7915_sta_set_txpwr,
- 	.sta_set_4addr = mt7915_sta_set_4addr,
- 	.sta_set_decap_offload = mt7915_sta_set_decap_offload,
- 	.add_twt_setup = mt7915_mac_add_twt_setup,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 09e3dd8e..36c21596 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -32,6 +32,10 @@
- #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
- #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
- 
-+static bool sr_scene_detect = true;
-+module_param(sr_scene_detect, bool, 0644);
-+MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
-+
- static u8
- mt7915_mcu_get_sta_nss(u16 mcs_map)
- {
-@@ -595,7 +599,7 @@ mt7915_mcu_muar_config(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 		.mode = !!mask || enable,
- 		.entry_count = 1,
- 		.write = 1,
--		.band = phy != &dev->phy,
-+		.band = phy->band_idx,
- 		.index = idx * 2 + bssid,
- 	};
- 
-@@ -1131,7 +1135,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_160);
- 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
- 
--		bf->ncol_bw160 = nss_mcs;
-+		bf->ncol_gt_bw80 = nss_mcs;
- 	}
- 
- 	if (pe->phy_cap_info[0] &
-@@ -1139,10 +1143,10 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 		mcs_map = le16_to_cpu(pc->he_mcs_nss_supp.rx_mcs_80p80);
- 		nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
- 
--		if (bf->ncol_bw160)
--			bf->ncol_bw160 = min_t(u8, bf->ncol_bw160, nss_mcs);
-+		if (bf->ncol_gt_bw80)
-+			bf->ncol_gt_bw80 = min_t(u8, bf->ncol_gt_bw80, nss_mcs);
- 		else
--			bf->ncol_bw160 = nss_mcs;
-+			bf->ncol_gt_bw80 = nss_mcs;
- 	}
- 
- 	snd_dim = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK,
-@@ -1150,7 +1154,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 	sts = HE_PHY(CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK,
- 		     pe->phy_cap_info[4]);
- 
--	bf->nrow_bw160 = min_t(int, snd_dim, sts);
-+	bf->nrow_gt_bw80 = min_t(int, snd_dim, sts);
- }
- 
- static void
-@@ -1677,10 +1681,32 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 		return ret;
- 	}
- out:
-+	ret = mt76_connac_mcu_sta_wed_update(&dev->mt76, skb);
-+	if (ret)
-+		return ret;
-+
- 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
- }
- 
-+int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev)
-+{
-+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
-+	struct {
-+		__le32 args[2];
-+	} req = {
-+		.args[0] = cpu_to_le32(1),
-+		.args[1] = cpu_to_le32(6),
-+	};
-+
-+	return mtk_wed_device_update_msg(wed, MTK_WED_WO_CMD_RXCNT_CTRL,
-+					 &req, sizeof(req));
-+#else
-+	return 0;
-+#endif
-+}
-+
- int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
- 			    struct ieee80211_vif *vif, bool enable)
- {
-@@ -1689,7 +1715,7 @@ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
- 	struct {
- 		struct req_hdr {
- 			u8 omac_idx;
--			u8 dbdc_idx;
-+			u8 band_idx;
- 			__le16 tlv_num;
- 			u8 is_tlv_append;
- 			u8 rsv[3];
-@@ -1698,13 +1724,13 @@ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
- 			__le16 tag;
- 			__le16 len;
- 			u8 active;
--			u8 dbdc_idx;
-+			u8 band_idx;
- 			u8 omac_addr[ETH_ALEN];
- 		} __packed tlv;
- 	} data = {
- 		.hdr = {
- 			.omac_idx = mvif->mt76.omac_idx,
--			.dbdc_idx = mvif->mt76.band_idx,
-+			.band_idx = mvif->mt76.band_idx,
- 			.tlv_num = cpu_to_le16(1),
- 			.is_tlv_append = 1,
- 		},
-@@ -1712,7 +1738,7 @@ int mt7915_mcu_add_dev_info(struct mt7915_phy *phy,
- 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
- 			.len = cpu_to_le16(sizeof(struct req_tlv)),
- 			.active = enable,
--			.dbdc_idx = mvif->mt76.band_idx,
-+			.band_idx = mvif->mt76.band_idx,
- 		},
- 	};
- 
-@@ -2559,7 +2585,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
- 		req.monitor_central_chan =
- 			ieee80211_frequency_to_channel(chandef->center_freq1);
- 		req.monitor_bw = mt76_connac_chan_bw(chandef);
--		req.band_idx = phy != &dev->phy;
-+		req.band_idx = phy->band_idx;
- 		req.scan_mode = 1;
- 		break;
- 	}
-@@ -2567,7 +2593,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
- 		req.monitor_chan = chandef->chan->hw_value;
- 		req.monitor_central_chan =
- 			ieee80211_frequency_to_channel(chandef->center_freq1);
--		req.band_idx = phy != &dev->phy;
-+		req.band_idx = phy->band_idx;
- 		req.scan_mode = 2;
- 		break;
- 	case CH_SWITCH_BACKGROUND_SCAN_STOP:
-@@ -2971,7 +2997,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch)
- 	}
- 
- 	for (i = 0; i < 5; i++) {
--		req[i].band = cpu_to_le32(phy != &dev->phy);
-+		req[i].band = cpu_to_le32(phy->band_idx);
- 		req[i].offs = cpu_to_le32(offs[i + start]);
- 
- 		if (!is_mt7915(&dev->mt76) && i == 3)
-@@ -3016,11 +3042,11 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
- 	struct {
- 		u8 ctrl_id;
- 		u8 action;
--		u8 dbdc_idx;
-+		u8 band_idx;
- 		u8 rsv[5];
- 	} req = {
- 		.ctrl_id = THERMAL_SENSOR_TEMP_QUERY,
--		.dbdc_idx = phy != &dev->phy,
-+		.band_idx = phy->band_idx,
- 	};
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_CTRL), &req,
-@@ -3079,6 +3105,88 @@ out:
- 				 &req, sizeof(req), false);
- }
- 
-+int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 format_id;
-+		u8 rsv;
-+		u8 band_idx;
-+		s8 txpower_min;
-+	} __packed req = {
-+		.format_id = TX_POWER_LIMIT_FRAME_MIN,
-+		.band_idx = phy->band_idx,
-+		.txpower_min = txpower * 2, /* 0.5db */
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76,
-+				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
-+				 sizeof(req), true);
-+}
-+
-+int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
-+				 struct ieee80211_vif *vif,
-+				 struct ieee80211_sta *sta, s8 txpower)
-+{
-+	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_phy *mphy = phy->mt76;
-+	struct {
-+		u8 format_id;
-+		u8 rsv[3];
-+		u8 band_idx;
-+		s8 txpower_max;
-+		__le16 wcid;
-+		s8 txpower_offs[48];
-+	} __packed req = {
-+		.format_id = TX_POWER_LIMIT_FRAME,
-+		.band_idx = phy->band_idx,
-+		.txpower_max = DIV_ROUND_UP(mphy->txpower_cur, 2),
-+		.wcid = cpu_to_le16(msta->wcid.idx),
-+	};
-+	int ret, n_chains = hweight8(mphy->antenna_mask);
-+	s8 txpower_sku[MT7915_SKU_RATE_NUM];
-+
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
-+	if (ret)
-+		return ret;
-+
-+	txpower = txpower * 2 - mt76_tx_power_nss_delta(n_chains);
-+	if (txpower > mphy->txpower_cur || txpower < 0)
-+		return -EINVAL;
-+
-+	if (txpower) {
-+		u32 offs, len, i;
-+
-+		if (sta->ht_cap.ht_supported) {
-+			const u8 *sku_len = mt7915_sku_group_len;
-+
-+			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
-+			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
-+
-+			if (sta->vht_cap.vht_supported) {
-+				offs += len;
-+				len = sku_len[SKU_VHT_BW20] * 4;
-+
-+				if (sta->he_cap.has_he) {
-+					offs += len + sku_len[SKU_HE_RU26] * 3;
-+					len = sku_len[SKU_HE_RU242] * 4;
-+				}
-+			}
-+		} else {
-+			return -EINVAL;
-+		}
-+
-+		for (i = 0; i < len; i++, offs++)
-+			req.txpower_offs[i] =
-+				DIV_ROUND_UP(txpower - txpower_sku[offs], 2);
-+	}
-+
-+	return mt76_mcu_send_msg(&dev->mt76,
-+				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
-+				 sizeof(req), true);
-+}
-+
- int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
-@@ -3087,11 +3195,11 @@ int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
- 	struct mt7915_sku_val {
- 		u8 format_id;
- 		u8 limit_type;
--		u8 dbdc_idx;
-+		u8 band_idx;
- 		s8 val[MT7915_SKU_RATE_NUM];
- 	} __packed req = {
--		.format_id = 4,
--		.dbdc_idx = phy != &dev->phy,
-+		.format_id = TX_POWER_LIMIT_TABLE,
-+		.band_idx = phy->band_idx,
- 	};
- 	struct mt76_power_limits limits_array;
- 	s8 *la = (s8 *)&limits_array;
-@@ -3137,14 +3245,14 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
- 	struct {
- 		u8 format_id;
- 		u8 category;
--		u8 band;
-+		u8 band_idx;
- 		u8 _rsv;
- 	} __packed req = {
--		.format_id = 7,
-+		.format_id = TX_POWER_LIMIT_INFO,
- 		.category = RATE_POWER_INFO,
--		.band = phy != &dev->phy,
-+		.band_idx = phy->band_idx,
- 	};
--	s8 res[MT7915_SKU_RATE_NUM][2];
-+	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
- 	struct sk_buff *skb;
- 	int ret, i;
- 
-@@ -3154,9 +3262,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
- 	if (ret)
- 		return ret;
- 
--	memcpy(res, skb->data + 4, sizeof(res));
-+	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
- 	for (i = 0; i < len; i++)
--		txpower[i] = res[i][req.band];
-+		txpower[i] = txpower_sku[i][req.band_idx];
- 
- 	dev_kfree_skb(skb);
- 
-@@ -3191,11 +3299,11 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
- 	struct mt7915_sku {
- 		u8 format_id;
- 		u8 sku_enable;
--		u8 dbdc_idx;
-+		u8 band_idx;
- 		u8 rsv;
- 	} __packed req = {
--		.format_id = 0,
--		.dbdc_idx = phy != &dev->phy,
-+		.format_id = TX_POWER_LIMIT_ENABLE,
-+		.band_idx = phy->band_idx,
- 		.sku_enable = enable,
- 	};
- 
-@@ -3270,31 +3378,193 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
- 				 sizeof(req), true);
- }
- 
--int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
--			    bool enable)
-+static int
-+mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_mcu_sr_ctrl req = {
-+		.action = action,
-+		.argnum = 1,
-+		.band_idx = phy->band_idx,
-+		.val = cpu_to_le32(val),
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
-+				 sizeof(req), true);
-+}
-+
-+static int
-+mt7915_mcu_set_obss_spr_pd(struct mt7915_phy *phy,
-+			   struct ieee80211_he_obss_pd *he_obss_pd)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		struct mt7915_mcu_sr_ctrl ctrl;
-+		struct {
-+			u8 pd_th_non_srg;
-+			u8 pd_th_srg;
-+			u8 period_offs;
-+			u8 rcpi_src;
-+			__le16 obss_pd_min;
-+			__le16 obss_pd_min_srg;
-+			u8 resp_txpwr_mode;
-+			u8 txpwr_restrict_mode;
-+			u8 txpwr_ref;
-+			u8 rsv[3];
-+		} __packed param;
-+	} __packed req = {
-+		.ctrl = {
-+			.action = SPR_SET_PARAM,
-+			.argnum = 9,
-+			.band_idx = phy->band_idx,
-+		},
-+	};
-+	int ret;
-+	u8 max_th = 82, non_srg_max_th = 62;
-+
-+	/* disable firmware dynamical PD asjustment */
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_DPD, false);
-+	if (ret)
-+		return ret;
-+
-+	if (he_obss_pd->sr_ctrl &
-+	    IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED)
-+		req.param.pd_th_non_srg = max_th;
-+	else if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
-+		req.param.pd_th_non_srg  = max_th - he_obss_pd->non_srg_max_offset;
-+	else
-+		req.param.pd_th_non_srg  = non_srg_max_th;
-+
-+	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
-+		req.param.pd_th_srg = max_th - he_obss_pd->max_offset;
-+
-+	req.param.obss_pd_min = 82;
-+	req.param.obss_pd_min_srg = 82;
-+	req.param.txpwr_restrict_mode = 2;
-+	req.param.txpwr_ref = 21;
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
-+				 sizeof(req), true);
-+}
-+
-+static int
-+mt7915_mcu_set_obss_spr_siga(struct mt7915_phy *phy, struct ieee80211_vif *vif,
-+			     struct ieee80211_he_obss_pd *he_obss_pd)
- {
--#define MT_SPR_ENABLE		1
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mt7915_dev *dev = phy->dev;
-+	u8 omac = mvif->mt76.omac_idx;
- 	struct {
--		u8 action;
--		u8 arg_num;
--		u8 band_idx;
--		u8 status;
--		u8 drop_tx_idx;
--		u8 sta_idx;	/* 256 sta */
--		u8 rsv[2];
--		__le32 val;
-+		struct mt7915_mcu_sr_ctrl ctrl;
-+		struct {
-+			u8 omac;
-+			u8 rsv[3];
-+			u8 flag[20];
-+		} __packed siga;
- 	} __packed req = {
--		.action = MT_SPR_ENABLE,
--		.arg_num = 1,
--		.band_idx = mvif->mt76.band_idx,
--		.val = cpu_to_le32(enable),
-+		.ctrl = {
-+			.action = SPR_SET_SIGA,
-+			.argnum = 1,
-+			.band_idx = phy->band_idx,
-+		},
-+		.siga = {
-+			.omac = omac > HW_BSSID_MAX ? omac - 12 : omac,
-+		},
- 	};
-+	int ret;
-+
-+	if (he_obss_pd->sr_ctrl & IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED)
-+		req.siga.flag[req.siga.omac] = 0xf;
-+	else
-+		return 0;
-+
-+	/* switch to normal AP mode */
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_MODE, 0);
-+	if (ret)
-+		return ret;
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
- 				 sizeof(req), true);
- }
- 
-+static int
-+mt7915_mcu_set_obss_spr_bitmap(struct mt7915_phy *phy,
-+			       struct ieee80211_he_obss_pd *he_obss_pd)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		struct mt7915_mcu_sr_ctrl ctrl;
-+		struct {
-+			__le32 color_l[2];
-+			__le32 color_h[2];
-+			__le32 bssid_l[2];
-+			__le32 bssid_h[2];
-+		} __packed bitmap;
-+	} __packed req = {
-+		.ctrl = {
-+			.action = SPR_SET_SRG_BITMAP,
-+			.argnum = 4,
-+			.band_idx = phy->band_idx,
-+		},
-+	};
-+	u32 bitmap;
-+
-+	memcpy(&bitmap, he_obss_pd->bss_color_bitmap, sizeof(bitmap));
-+	req.bitmap.color_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
-+
-+	memcpy(&bitmap, he_obss_pd->bss_color_bitmap + 4, sizeof(bitmap));
-+	req.bitmap.color_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
-+
-+	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap, sizeof(bitmap));
-+	req.bitmap.bssid_l[req.ctrl.band_idx] = cpu_to_le32(bitmap);
-+
-+	memcpy(&bitmap, he_obss_pd->partial_bssid_bitmap + 4, sizeof(bitmap));
-+	req.bitmap.bssid_h[req.ctrl.band_idx] = cpu_to_le32(bitmap);
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_SPR), &req,
-+				 sizeof(req), true);
-+}
-+
-+int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
-+			    struct ieee80211_he_obss_pd *he_obss_pd)
-+{
-+	int ret;
-+
-+	/* enable firmware scene detection algorithms */
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_SD, sr_scene_detect);
-+	if (ret)
-+		return ret;
-+
-+	/* enable spatial reuse */
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE, he_obss_pd->enable);
-+	if (ret)
-+		return ret;
-+
-+	if (!he_obss_pd->enable)
-+		return 0;
-+
-+	ret = mt7915_mcu_enable_obss_spr(phy, SPR_ENABLE_TX, true);
-+	if (ret)
-+		return ret;
-+
-+	/* firmware dynamically adjusts PD threshold so skip manual control */
-+	if (sr_scene_detect)
-+		return 0;
-+
-+	/* set SRG/non-SRG OBSS PD threshold */
-+	ret = mt7915_mcu_set_obss_spr_pd(phy, he_obss_pd);
-+	if (ret)
-+		return ret;
-+
-+	/* Set SR prohibit */
-+	ret = mt7915_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
-+	if (ret)
-+		return ret;
-+
-+	/* set SRG BSS color/BSSID bitmap */
-+	return mt7915_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
-+}
-+
- int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 			   struct ieee80211_sta *sta, struct rate_info *rate)
- {
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c19b5d66..46c517e5 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -129,6 +129,17 @@ struct mt7915_mcu_background_chain_ctrl {
- 	u8 rsv[2];
- } __packed;
- 
-+struct mt7915_mcu_sr_ctrl {
-+	u8 action;
-+	u8 argnum;
-+	u8 band_idx;
-+	u8 status;
-+	u8 drop_ta_idx;
-+	u8 sta_idx;	/* 256 sta */
-+	u8 rsv[2];
-+	__le32 val;
-+} __packed;
-+
- struct mt7915_mcu_eeprom {
- 	u8 buffer_mode;
- 	u8 format;
-@@ -408,6 +419,25 @@ enum {
- #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
- #define RATE_CFG_HE_LTF			GENMASK(31, 28)
- 
-+enum {
-+	TX_POWER_LIMIT_ENABLE,
-+	TX_POWER_LIMIT_TABLE = 0x4,
-+	TX_POWER_LIMIT_INFO = 0x7,
-+	TX_POWER_LIMIT_FRAME = 0x11,
-+	TX_POWER_LIMIT_FRAME_MIN = 0x12,
-+};
-+
-+enum {
-+	SPR_ENABLE = 0x1,
-+	SPR_ENABLE_SD = 0x3,
-+	SPR_ENABLE_MODE = 0x5,
-+	SPR_ENABLE_DPD = 0x23,
-+	SPR_ENABLE_TX = 0x25,
-+	SPR_SET_SRG_BITMAP = 0x80,
-+	SPR_SET_PARAM = 0xc2,
-+	SPR_SET_SIGA = 0xdc,
-+};
-+
- enum {
- 	THERMAL_PROTECT_PARAMETER_CTRL,
- 	THERMAL_PROTECT_BASIC_INFO,
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 3c840853..3b4ede3b 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -9,107 +9,112 @@
- #include "mt7915.h"
- #include "mac.h"
- #include "../trace.h"
-+#include "../dma.h"
- 
- static bool wed_enable;
- module_param(wed_enable, bool, 0644);
-+MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
- 
- static const u32 mt7915_reg[] = {
--	[INT_SOURCE_CSR]	= 0xd7010,
--	[INT_MASK_CSR]		= 0xd7014,
--	[INT1_SOURCE_CSR]	= 0xd7088,
--	[INT1_MASK_CSR]		= 0xd708c,
--	[INT_MCU_CMD_SOURCE]	= 0xd51f0,
--	[INT_MCU_CMD_EVENT]	= 0x3108,
--	[WFDMA0_ADDR]		= 0xd4000,
--	[WFDMA0_PCIE1_ADDR]	= 0xd8000,
--	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
--	[CBTOP1_PHY_END]	= 0x77ffffff,
--	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
--	[FW_ASSERT_STAT_ADDR]	= 0x219848,
--	[FW_EXCEPT_TYPE_ADDR]	= 0x21987c,
--	[FW_EXCEPT_COUNT_ADDR]	= 0x219848,
--	[FW_CIRQ_COUNT_ADDR]	= 0x216f94,
--	[FW_CIRQ_IDX_ADDR]	= 0x216ef8,
--	[FW_CIRQ_LISR_ADDR]	= 0x2170ac,
--	[FW_TASK_ID_ADDR]	= 0x216f90,
--	[FW_TASK_IDX_ADDR]	= 0x216f9c,
--	[FW_TASK_QID1_ADDR]	= 0x219680,
--	[FW_TASK_QID2_ADDR]	= 0x219760,
--	[FW_TASK_START_ADDR]	= 0x219558,
--	[FW_TASK_END_ADDR]	= 0x219554,
--	[FW_TASK_SIZE_ADDR]	= 0x219560,
--	[FW_LAST_MSG_ID_ADDR]	= 0x216f70,
--	[FW_EINT_INFO_ADDR]	= 0x219818,
--	[FW_SCHED_INFO_ADDR]	= 0x219828,
--	[SWDEF_BASE_ADDR]	= 0x41f200,
--	[TXQ_WED_RING_BASE]	= 0xd7300,
--	[RXQ_WED_RING_BASE]	= 0xd7410,
-+	[INT_SOURCE_CSR]		= 0xd7010,
-+	[INT_MASK_CSR]			= 0xd7014,
-+	[INT1_SOURCE_CSR]		= 0xd7088,
-+	[INT1_MASK_CSR]			= 0xd708c,
-+	[INT_MCU_CMD_SOURCE]		= 0xd51f0,
-+	[INT_MCU_CMD_EVENT]		= 0x3108,
-+	[WFDMA0_ADDR]			= 0xd4000,
-+	[WFDMA0_PCIE1_ADDR]		= 0xd8000,
-+	[WFDMA_EXT_CSR_ADDR]		= 0xd7000,
-+	[CBTOP1_PHY_END]		= 0x77ffffff,
-+	[INFRA_MCU_ADDR_END]		= 0x7c3fffff,
-+	[FW_ASSERT_STAT_ADDR]		= 0x219848,
-+	[FW_EXCEPT_TYPE_ADDR]		= 0x21987c,
-+	[FW_EXCEPT_COUNT_ADDR]		= 0x219848,
-+	[FW_CIRQ_COUNT_ADDR]		= 0x216f94,
-+	[FW_CIRQ_IDX_ADDR]		= 0x216ef8,
-+	[FW_CIRQ_LISR_ADDR]		= 0x2170ac,
-+	[FW_TASK_ID_ADDR]		= 0x216f90,
-+	[FW_TASK_IDX_ADDR]		= 0x216f9c,
-+	[FW_TASK_QID1_ADDR]		= 0x219680,
-+	[FW_TASK_QID2_ADDR]		= 0x219760,
-+	[FW_TASK_START_ADDR]		= 0x219558,
-+	[FW_TASK_END_ADDR]		= 0x219554,
-+	[FW_TASK_SIZE_ADDR]		= 0x219560,
-+	[FW_LAST_MSG_ID_ADDR]		= 0x216f70,
-+	[FW_EINT_INFO_ADDR]		= 0x219818,
-+	[FW_SCHED_INFO_ADDR]		= 0x219828,
-+	[SWDEF_BASE_ADDR]		= 0x41f200,
-+	[TXQ_WED_RING_BASE]		= 0xd7300,
-+	[RXQ_WED_RING_BASE]		= 0xd7410,
-+	[RXQ_WED_DATA_RING_BASE]	= 0xd4500,
- };
- 
- static const u32 mt7916_reg[] = {
--	[INT_SOURCE_CSR]	= 0xd4200,
--	[INT_MASK_CSR]		= 0xd4204,
--	[INT1_SOURCE_CSR]	= 0xd8200,
--	[INT1_MASK_CSR]		= 0xd8204,
--	[INT_MCU_CMD_SOURCE]	= 0xd41f0,
--	[INT_MCU_CMD_EVENT]	= 0x2108,
--	[WFDMA0_ADDR]		= 0xd4000,
--	[WFDMA0_PCIE1_ADDR]	= 0xd8000,
--	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
--	[CBTOP1_PHY_END]	= 0x7fffffff,
--	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
--	[FW_ASSERT_STAT_ADDR]	= 0x02204c14,
--	[FW_EXCEPT_TYPE_ADDR]	= 0x022051a4,
--	[FW_EXCEPT_COUNT_ADDR]	= 0x022050bc,
--	[FW_CIRQ_COUNT_ADDR]	= 0x022001ac,
--	[FW_CIRQ_IDX_ADDR]	= 0x02204f84,
--	[FW_CIRQ_LISR_ADDR]	= 0x022050d0,
--	[FW_TASK_ID_ADDR]	= 0x0220406c,
--	[FW_TASK_IDX_ADDR]	= 0x0220500c,
--	[FW_TASK_QID1_ADDR]	= 0x022028c8,
--	[FW_TASK_QID2_ADDR]	= 0x02202a38,
--	[FW_TASK_START_ADDR]	= 0x0220286c,
--	[FW_TASK_END_ADDR]	= 0x02202870,
--	[FW_TASK_SIZE_ADDR]	= 0x02202878,
--	[FW_LAST_MSG_ID_ADDR]	= 0x02204fe8,
--	[FW_EINT_INFO_ADDR]	= 0x0220525c,
--	[FW_SCHED_INFO_ADDR]	= 0x0220516c,
--	[SWDEF_BASE_ADDR]	= 0x411400,
--	[TXQ_WED_RING_BASE]	= 0xd7300,
--	[RXQ_WED_RING_BASE]	= 0xd7410,
-+	[INT_SOURCE_CSR]		= 0xd4200,
-+	[INT_MASK_CSR]			= 0xd4204,
-+	[INT1_SOURCE_CSR]		= 0xd8200,
-+	[INT1_MASK_CSR]			= 0xd8204,
-+	[INT_MCU_CMD_SOURCE]		= 0xd41f0,
-+	[INT_MCU_CMD_EVENT]		= 0x2108,
-+	[WFDMA0_ADDR]			= 0xd4000,
-+	[WFDMA0_PCIE1_ADDR]		= 0xd8000,
-+	[WFDMA_EXT_CSR_ADDR]		= 0xd7000,
-+	[CBTOP1_PHY_END]		= 0x7fffffff,
-+	[INFRA_MCU_ADDR_END]		= 0x7c085fff,
-+	[FW_ASSERT_STAT_ADDR]		= 0x02204c14,
-+	[FW_EXCEPT_TYPE_ADDR]		= 0x022051a4,
-+	[FW_EXCEPT_COUNT_ADDR]		= 0x022050bc,
-+	[FW_CIRQ_COUNT_ADDR]		= 0x022001ac,
-+	[FW_CIRQ_IDX_ADDR]		= 0x02204f84,
-+	[FW_CIRQ_LISR_ADDR]		= 0x022050d0,
-+	[FW_TASK_ID_ADDR]		= 0x0220406c,
-+	[FW_TASK_IDX_ADDR]		= 0x0220500c,
-+	[FW_TASK_QID1_ADDR]		= 0x022028c8,
-+	[FW_TASK_QID2_ADDR]		= 0x02202a38,
-+	[FW_TASK_START_ADDR]		= 0x0220286c,
-+	[FW_TASK_END_ADDR]		= 0x02202870,
-+	[FW_TASK_SIZE_ADDR]		= 0x02202878,
-+	[FW_LAST_MSG_ID_ADDR]		= 0x02204fe8,
-+	[FW_EINT_INFO_ADDR]		= 0x0220525c,
-+	[FW_SCHED_INFO_ADDR]		= 0x0220516c,
-+	[SWDEF_BASE_ADDR]		= 0x411400,
-+	[TXQ_WED_RING_BASE]		= 0xd7300,
-+	[RXQ_WED_RING_BASE]		= 0xd7410,
-+	[RXQ_WED_DATA_RING_BASE]	= 0xd4540,
- };
- 
- static const u32 mt7986_reg[] = {
--	[INT_SOURCE_CSR]	= 0x24200,
--	[INT_MASK_CSR]		= 0x24204,
--	[INT1_SOURCE_CSR]	= 0x28200,
--	[INT1_MASK_CSR]		= 0x28204,
--	[INT_MCU_CMD_SOURCE]	= 0x241f0,
--	[INT_MCU_CMD_EVENT]	= 0x54000108,
--	[WFDMA0_ADDR]		= 0x24000,
--	[WFDMA0_PCIE1_ADDR]	= 0x28000,
--	[WFDMA_EXT_CSR_ADDR]	= 0x27000,
--	[CBTOP1_PHY_END]	= 0x7fffffff,
--	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
--	[FW_ASSERT_STAT_ADDR]	= 0x02204b54,
--	[FW_EXCEPT_TYPE_ADDR]	= 0x022050dc,
--	[FW_EXCEPT_COUNT_ADDR]	= 0x02204ffc,
--	[FW_CIRQ_COUNT_ADDR]	= 0x022001ac,
--	[FW_CIRQ_IDX_ADDR]	= 0x02204ec4,
--	[FW_CIRQ_LISR_ADDR]	= 0x02205010,
--	[FW_TASK_ID_ADDR]	= 0x02204fac,
--	[FW_TASK_IDX_ADDR]	= 0x02204f4c,
--	[FW_TASK_QID1_ADDR]	= 0x02202814,
--	[FW_TASK_QID2_ADDR]	= 0x02202984,
--	[FW_TASK_START_ADDR]	= 0x022027b8,
--	[FW_TASK_END_ADDR]	= 0x022027bc,
--	[FW_TASK_SIZE_ADDR]	= 0x022027c4,
--	[FW_LAST_MSG_ID_ADDR]	= 0x02204f28,
--	[FW_EINT_INFO_ADDR]	= 0x02205194,
--	[FW_SCHED_INFO_ADDR]	= 0x022051a4,
--	[SWDEF_BASE_ADDR]	= 0x411400,
--	[TXQ_WED_RING_BASE]	= 0x24420,
--	[RXQ_WED_RING_BASE]	= 0x24520,
-+	[INT_SOURCE_CSR]		= 0x24200,
-+	[INT_MASK_CSR]			= 0x24204,
-+	[INT1_SOURCE_CSR]		= 0x28200,
-+	[INT1_MASK_CSR]			= 0x28204,
-+	[INT_MCU_CMD_SOURCE]		= 0x241f0,
-+	[INT_MCU_CMD_EVENT]		= 0x54000108,
-+	[WFDMA0_ADDR]			= 0x24000,
-+	[WFDMA0_PCIE1_ADDR]		= 0x28000,
-+	[WFDMA_EXT_CSR_ADDR]		= 0x27000,
-+	[CBTOP1_PHY_END]		= 0x7fffffff,
-+	[INFRA_MCU_ADDR_END]		= 0x7c085fff,
-+	[FW_ASSERT_STAT_ADDR]		= 0x02204b54,
-+	[FW_EXCEPT_TYPE_ADDR]		= 0x022050dc,
-+	[FW_EXCEPT_COUNT_ADDR]		= 0x02204ffc,
-+	[FW_CIRQ_COUNT_ADDR]		= 0x022001ac,
-+	[FW_CIRQ_IDX_ADDR]		= 0x02204ec4,
-+	[FW_CIRQ_LISR_ADDR]		= 0x02205010,
-+	[FW_TASK_ID_ADDR]		= 0x02204fac,
-+	[FW_TASK_IDX_ADDR]		= 0x02204f4c,
-+	[FW_TASK_QID1_ADDR]		= 0x02202814,
-+	[FW_TASK_QID2_ADDR]		= 0x02202984,
-+	[FW_TASK_START_ADDR]		= 0x022027b8,
-+	[FW_TASK_END_ADDR]		= 0x022027bc,
-+	[FW_TASK_SIZE_ADDR]		= 0x022027c4,
-+	[FW_LAST_MSG_ID_ADDR]		= 0x02204f28,
-+	[FW_EINT_INFO_ADDR]		= 0x02205194,
-+	[FW_SCHED_INFO_ADDR]		= 0x022051a4,
-+	[SWDEF_BASE_ADDR]		= 0x411400,
-+	[TXQ_WED_RING_BASE]		= 0x24420,
-+	[RXQ_WED_RING_BASE]		= 0x24520,
-+	[RXQ_WED_DATA_RING_BASE]	= 0x24540,
- };
- 
- static const u32 mt7915_offs[] = {
-@@ -585,6 +590,105 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
- 		mt76_clear(dev, MT_AGG_ACR4(phy->band_idx),
- 			   MT_AGG_ACR_PPDU_TXS2H);
- }
-+
-+static void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
-+{
-+	struct mt7915_dev *dev;
-+	struct page *page;
-+	int i;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	for (i = 0; i < dev->mt76.rx_token_size; i++) {
-+		struct mt76_txwi_cache *t;
-+
-+		t = mt76_rx_token_release(&dev->mt76, i);
-+		if (!t || !t->ptr)
-+			continue;
-+
-+		dma_unmap_single(dev->mt76.dma_dev, t->dma_addr,
-+				 wed->wlan.rx_size, DMA_FROM_DEVICE);
-+		skb_free_frag(t->ptr);
-+		t->ptr = NULL;
-+
-+		mt76_put_rxwi(&dev->mt76, t);
-+	}
-+
-+	if (!wed->rx_buf_ring.rx_page.va)
-+		return;
-+
-+	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
-+	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
-+	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
-+}
-+
-+static u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
-+{
-+	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
-+	struct mt7915_dev *dev;
-+	u32 length;
-+	int i;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
-+				sizeof(struct skb_shared_info));
-+
-+	for (i = 0; i < size; i++) {
-+		struct mt76_txwi_cache *t = mt76_get_rxwi(&dev->mt76);
-+		dma_addr_t phy_addr;
-+		int token;
-+		void *ptr;
-+
-+		ptr = page_frag_alloc(&wed->rx_buf_ring.rx_page, length,
-+				      GFP_KERNEL);
-+		if (!ptr)
-+			goto unmap;
-+
-+		phy_addr = dma_map_single(dev->mt76.dma_dev, ptr,
-+					  wed->wlan.rx_size,
-+					  DMA_TO_DEVICE);
-+		if (unlikely(dma_mapping_error(dev->mt76.dev, phy_addr))) {
-+			skb_free_frag(ptr);
-+			goto unmap;
-+		}
-+
-+		desc->buf0 = cpu_to_le32(phy_addr);
-+		token = mt76_rx_token_consume(&dev->mt76, ptr, t, phy_addr);
-+		desc->token |= cpu_to_le32(FIELD_PREP(MT_DMA_CTL_TOKEN,
-+						      token));
-+		desc++;
-+	}
-+
-+	return 0;
-+
-+unmap:
-+	mt7915_wed_release_rx_buf(wed);
-+	return -ENOMEM;
-+}
-+
-+static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
-+					    struct mtk_wed_wo_rx_stats *stats)
-+{
-+	int idx = le16_to_cpu(stats->wlan_idx);
-+	struct mt7915_dev *dev;
-+	struct mt76_wcid *wcid;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+
-+	if (idx >= mt7915_wtbl_size(dev))
-+		return;
-+
-+	rcu_read_lock();
-+
-+	wcid = rcu_dereference(dev->mt76.wcid[idx]);
-+	if (wcid) {
-+		wcid->stats.rx_bytes += le32_to_cpu(stats->rx_byte_cnt);
-+		wcid->stats.rx_packets += le32_to_cpu(stats->rx_pkt_cnt);
-+		wcid->stats.rx_errors += le32_to_cpu(stats->rx_err_cnt);
-+		wcid->stats.rx_drops += le32_to_cpu(stats->rx_drop_cnt);
-+	}
-+
-+	rcu_read_unlock();
-+}
- #endif
- 
- int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
-@@ -602,6 +706,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 		wed->wlan.pci_dev = pci_dev;
- 		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
-+		wed->wlan.base = devm_ioremap(dev->mt76.dev,
-+					      pci_resource_start(pci_dev, 0),
-+					      pci_resource_len(pci_dev, 0));
-+		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
- 		wed->wlan.wpdma_int = pci_resource_start(pci_dev, 0) +
- 				      MT_INT_WED_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = pci_resource_start(pci_dev, 0) +
-@@ -612,6 +720,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 				     MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
- 					 MT_RXQ_WED_RING_BASE;
-+		wed->wlan.wpdma_rx_glo = pci_resource_start(pci_dev, 0) +
-+					 MT_WPDMA_GLO_CFG;
-+		wed->wlan.wpdma_rx = pci_resource_start(pci_dev, 0) +
-+				     MT_RXQ_WED_DATA_RING_BASE;
- 	} else {
- 		struct platform_device *plat_dev = pdev_ptr;
- 		struct resource *res;
-@@ -622,19 +734,45 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 		wed->wlan.platform_dev = plat_dev;
- 		wed->wlan.bus_type = MTK_WED_BUS_AXI;
-+		wed->wlan.base = devm_ioremap(dev->mt76.dev, res->start,
-+					      resource_size(res));
-+		wed->wlan.phy_base = res->start;
- 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
- 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
- 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
-+		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
-+		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
- 	}
- 	wed->wlan.nbuf = 4096;
- 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
- 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
--	wed->wlan.txfree_tbit = is_mt7915(&dev->mt76) ? 1 : 2;
-+	wed->wlan.txfree_tbit = is_mt7986(&dev->mt76) ? 2 : 1;
- 	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
-+	wed->wlan.wcid_512 = !is_mt7915(&dev->mt76);
-+
-+	wed->wlan.rx_nbuf = 65536;
-+	wed->wlan.rx_npkt = MT7915_WED_RX_TOKEN_SIZE;
-+	wed->wlan.rx_size = SKB_WITH_OVERHEAD(MT_RX_BUF_SIZE);
-+	if (is_mt7915(&dev->mt76)) {
-+		wed->wlan.rx_tbit[0] = 16;
-+		wed->wlan.rx_tbit[1] = 17;
-+	} else if (is_mt7986(&dev->mt76)) {
-+		wed->wlan.rx_tbit[0] = 22;
-+		wed->wlan.rx_tbit[1] = 23;
-+	} else {
-+		wed->wlan.rx_tbit[0] = 18;
-+		wed->wlan.rx_tbit[1] = 19;
-+	}
-+
- 	wed->wlan.init_buf = mt7915_wed_init_buf;
- 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
- 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
-+	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
-+	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
-+	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
-+
-+	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
- 
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9cb680e7..42f21343 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -68,6 +68,8 @@
- #define MT7915_MIN_TWT_DUR 64
- #define MT7915_MAX_QUEUE		(MT_RXQ_BAND2 + __MT_MCUQ_MAX + 2)
- 
-+#define MT7915_WED_RX_TOKEN_SIZE	12288
-+
- struct mt7915_vif;
- struct mt7915_sta;
- struct mt7915_dfs_pulse;
-@@ -501,8 +503,8 @@ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vi
- 				struct cfg80211_he_bss_color *he_bss_color);
- int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			  int enable, u32 changed);
--int mt7915_mcu_add_obss_spr(struct mt7915_dev *dev, struct ieee80211_vif *vif,
--                            bool enable);
-+int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
-+			    struct ieee80211_he_obss_pd *he_obss_pd);
- int mt7915_mcu_add_rate_ctrl(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 			     struct ieee80211_sta *sta, bool changed);
- int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
-@@ -526,6 +528,10 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
- int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
- int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
- int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
-+int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower);
-+int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
-+				 struct ieee80211_vif *vif,
-+				 struct ieee80211_sta *sta, s8 txpower);
- int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action);
- int mt7915_mcu_set_fcc5_lpn(struct mt7915_dev *dev, int val);
- int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
-@@ -617,7 +623,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 			  struct mt76_tx_info *tx_info);
- void mt7915_tx_token_put(struct mt7915_dev *dev);
- void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 *info);
- bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- void mt7915_stats_work(struct work_struct *work);
-@@ -628,6 +634,7 @@ void mt7915_set_stream_vht_txbf_caps(struct mt7915_phy *phy);
- void mt7915_update_channel(struct mt76_phy *mphy);
- int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enable);
- int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms);
-+int mt7915_mcu_wed_enable_rx_stats(struct mt7915_dev *dev);
- int mt7915_init_debugfs(struct mt7915_phy *phy);
- void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int len);
- bool mt7915_debugfs_rx_log(struct mt7915_dev *dev, const void *data, int len);
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 0c61f125..aca1b2f1 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -43,6 +43,7 @@ enum reg_rev {
- 	SWDEF_BASE_ADDR,
- 	TXQ_WED_RING_BASE,
- 	RXQ_WED_RING_BASE,
-+	RXQ_WED_DATA_RING_BASE,
- 	__MT_REG_MAX,
- };
- 
-@@ -588,9 +589,14 @@ enum offs_rev {
- #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
- 
- #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
-+
-+#define MT_WFDMA0_EXT0_CFG		MT_WFDMA0(0x2b0)
-+#define MT_WFDMA0_EXT0_RXWB_KEEP	BIT(10)
-+
- #define MT_WFDMA0_PRI_DLY_INT_CFG0	MT_WFDMA0(0x2f0)
- #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
- #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
-+#define MT_WPDMA_GLO_CFG		MT_WFDMA0(0x208)
- 
- /* WFDMA1 */
- #define MT_WFDMA1_BASE			0xd5000
-@@ -686,6 +692,7 @@ enum offs_rev {
- 
- #define MT_TXQ_WED_RING_BASE		__REG(TXQ_WED_RING_BASE)
- #define MT_RXQ_WED_RING_BASE		__REG(RXQ_WED_RING_BASE)
-+#define MT_RXQ_WED_DATA_RING_BASE	__REG(RXQ_WED_DATA_RING_BASE)
- 
- #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
- #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
-@@ -1179,6 +1186,10 @@ enum offs_rev {
- #define MT_WF_PHY_RXTD12_IRPI_SW_CLR_ONLY	BIT(18)
- #define MT_WF_PHY_RXTD12_IRPI_SW_CLR		BIT(29)
- 
-+#define MT_WF_PHY_TPC_CTRL_STAT(_phy)		MT_WF_PHY(0xe7a0 + ((_phy) << 16))
-+#define MT_WF_PHY_TPC_CTRL_STAT_MT7916(_phy)	MT_WF_PHY(0xe7a0 + ((_phy) << 20))
-+#define MT_WF_PHY_TPC_POWER			GENMASK(15, 8)
-+
- #define MT_MCU_WM_CIRQ_BASE			0x89010000
- #define MT_MCU_WM_CIRQ(ofs)			(MT_MCU_WM_CIRQ_BASE + (ofs))
- #define MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR	MT_MCU_WM_CIRQ(0x80)
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index a979460f..7ace05e0 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -44,14 +44,14 @@ mt7915_tm_set_tx_power(struct mt7915_phy *phy)
- 	int ret;
- 	struct {
- 		u8 format_id;
--		u8 dbdc_idx;
-+		u8 band_idx;
- 		s8 tx_power;
- 		u8 ant_idx;	/* Only 0 is valid */
- 		u8 center_chan;
- 		u8 rsv[3];
- 	} __packed req = {
- 		.format_id = 0xf,
--		.dbdc_idx = phy != &dev->phy,
-+		.band_idx = phy->band_idx,
- 		.center_chan = ieee80211_frequency_to_channel(freq),
- 	};
- 	u8 *tx_power = NULL;
-@@ -77,7 +77,7 @@ mt7915_tm_set_freq_offset(struct mt7915_phy *phy, bool en, u32 val)
- 	struct mt7915_tm_cmd req = {
- 		.testmode_en = en,
- 		.param_idx = MCU_ATE_SET_FREQ_OFFSET,
--		.param.freq.band = phy != &dev->phy,
-+		.param.freq.band = phy->band_idx,
- 		.param.freq.freq_offset = cpu_to_le32(val),
- 	};
- 
-@@ -111,7 +111,7 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
- 		.param_idx = MCU_ATE_SET_TRX,
- 		.param.trx.type = type,
- 		.param.trx.enable = en,
--		.param.trx.band = phy != &dev->phy,
-+		.param.trx.band = phy->band_idx,
- 	};
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-@@ -126,7 +126,7 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
- 		.testmode_en = 1,
- 		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
- 		.param.clean.wcid = wcid,
--		.param.clean.band = phy != &dev->phy,
-+		.param.clean.band = phy->band_idx,
- 	};
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-@@ -144,7 +144,7 @@ mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
- 		.param.slot.sifs = sifs,
- 		.param.slot.rifs = 2,
- 		.param.slot.eifs = cpu_to_le16(60),
--		.param.slot.band = phy != &dev->phy,
-+		.param.slot.band = phy->band_idx,
- 	};
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-@@ -488,7 +488,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
- 		mt7915_tm_update_channel(phy);
- 
- 		/* read-clear */
--		mt76_rr(dev, MT_MIB_SDR3(phy != &dev->phy));
-+		mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
- 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
- 	}
- }
-@@ -526,7 +526,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
- 	tx_cont->control_ch = chandef->chan->hw_value;
- 	tx_cont->center_ch = freq1;
- 	tx_cont->tx_ant = td->tx_antenna_mask;
--	tx_cont->band = phy != &dev->phy;
-+	tx_cont->band = phy->band_idx;
- 
- 	switch (chandef->width) {
- 	case NL80211_CHAN_WIDTH_40:
-@@ -558,7 +558,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
- 	}
- 
- 	if (!en) {
--		req.op.rf.param.func_data = cpu_to_le32(phy != &dev->phy);
-+		req.op.rf.param.func_data = cpu_to_le32(phy->band_idx);
- 		goto out;
- 	}
- 
-diff --git a/mt7921/init.c b/mt7921/init.c
-index 739d18fc..e42cb6be 100644
---- a/mt7921/init.c
-+++ b/mt7921/init.c
-@@ -2,6 +2,7 @@
- /* Copyright (C) 2020 MediaTek Inc. */
- 
- #include <linux/etherdevice.h>
-+#include <linux/firmware.h>
- #include "mt7921.h"
- #include "mac.h"
- #include "mcu.h"
-@@ -37,6 +38,7 @@ mt7921_regd_notifier(struct wiphy *wiphy,
- 
- 	memcpy(dev->mt76.alpha2, request->alpha2, sizeof(dev->mt76.alpha2));
- 	dev->mt76.region = request->dfs_region;
-+	dev->country_ie_env = request->country_ie_env;
- 
- 	mt7921_mutex_acquire(dev);
- 	mt7921_mcu_set_clc(dev, request->alpha2, request->country_ie_env);
-@@ -65,12 +67,18 @@ mt7921_init_wiphy(struct ieee80211_hw *hw)
- 	hw->sta_data_size = sizeof(struct mt7921_sta);
- 	hw->vif_data_size = sizeof(struct mt7921_vif);
- 
-+	if (dev->fw_features & MT7921_FW_CAP_CNM)
-+		wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
-+	else
-+		wiphy->flags &= ~WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
-+
- 	wiphy->iface_combinations = if_comb;
- 	wiphy->flags &= ~(WIPHY_FLAG_IBSS_RSN | WIPHY_FLAG_4ADDR_AP |
- 			  WIPHY_FLAG_4ADDR_STATION);
- 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
- 				 BIT(NL80211_IFTYPE_AP);
- 	wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
-+	wiphy->max_remain_on_channel_duration = 5000;
- 	wiphy->max_scan_ie_len = MT76_CONNAC_SCAN_IE_LEN;
- 	wiphy->max_scan_ssids = 4;
- 	wiphy->max_sched_scan_plan_interval =
-@@ -129,6 +137,58 @@ mt7921_mac_init_band(struct mt7921_dev *dev, u8 band)
- 	mt76_clear(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN);
- }
- 
-+u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm)
-+{
-+	struct mt7921_fw_features *features = NULL;
-+	const struct mt76_connac2_fw_trailer *hdr;
-+	struct mt7921_realease_info *rel_info;
-+	const struct firmware *fw;
-+	int ret, i, offset = 0;
-+	const u8 *data, *end;
-+
-+	ret = request_firmware(&fw, fw_wm, dev);
-+	if (ret)
-+		return ret;
-+
-+	if (!fw || !fw->data || fw->size < sizeof(*hdr)) {
-+		dev_err(dev, "Invalid firmware\n");
-+		return -EINVAL;
-+	}
-+
-+	data = fw->data;
-+	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
-+
-+	for (i = 0; i < hdr->n_region; i++) {
-+		const struct mt76_connac2_fw_region *region;
-+
-+		region = (const void *)((const u8 *)hdr -
-+					(hdr->n_region - i) * sizeof(*region));
-+		offset += le32_to_cpu(region->len);
-+	}
-+
-+	data += offset + 16;
-+	rel_info = (struct mt7921_realease_info *)data;
-+	data += sizeof(*rel_info);
-+	end = data + le16_to_cpu(rel_info->len);
-+
-+	while (data < end) {
-+		rel_info = (struct mt7921_realease_info *)data;
-+		data += sizeof(*rel_info);
-+
-+		if (rel_info->tag == MT7921_FW_TAG_FEATURE) {
-+			features = (struct mt7921_fw_features *)data;
-+			break;
-+		}
-+
-+		data += le16_to_cpu(rel_info->len) + rel_info->pad_len;
-+	}
-+
-+	release_firmware(fw);
-+
-+	return features ? features->data : 0;
-+}
-+EXPORT_SYMBOL_GPL(mt7921_check_offload_capability);
-+
- int mt7921_mac_init(struct mt7921_dev *dev)
- {
- 	int i;
-@@ -278,6 +338,10 @@ int mt7921_register_device(struct mt7921_dev *dev)
- 	INIT_WORK(&dev->reset_work, mt7921_mac_reset_work);
- 	INIT_WORK(&dev->init_work, mt7921_init_work);
- 
-+	INIT_WORK(&dev->phy.roc_work, mt7921_roc_work);
-+	timer_setup(&dev->phy.roc_timer, mt7921_roc_timer, 0);
-+	init_waitqueue_head(&dev->phy.roc_wait);
-+
- 	dev->pm.idle_timeout = MT7921_PM_TIMEOUT;
- 	dev->pm.stats.last_wake_event = jiffies;
- 	dev->pm.stats.last_doze_event = jiffies;
-diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 7b15193c..639614b0 100644
---- a/mt7921/mac.c
-+++ b/mt7921/mac.c
-@@ -692,7 +692,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
- EXPORT_SYMBOL_GPL(mt7921_rx_check);
- 
- void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb)
-+			 struct sk_buff *skb, u32 *info)
- {
- 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-diff --git a/mt7921/main.c b/mt7921/main.c
-index 00085b12..1b7219e3 100644
---- a/mt7921/main.c
-+++ b/mt7921/main.c
-@@ -385,6 +385,116 @@ static void mt7921_remove_interface(struct ieee80211_hw *hw,
- 	mt76_packet_id_flush(&dev->mt76, &msta->wcid);
- }
- 
-+static void mt7921_roc_iter(void *priv, u8 *mac,
-+			    struct ieee80211_vif *vif)
-+{
-+	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
-+	struct mt7921_phy *phy = priv;
-+
-+	mt7921_mcu_abort_roc(phy, mvif, phy->roc_token_id);
-+}
-+
-+void mt7921_roc_work(struct work_struct *work)
-+{
-+	struct mt7921_phy *phy;
-+
-+	phy = (struct mt7921_phy *)container_of(work, struct mt7921_phy,
-+						roc_work);
-+
-+	if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
-+		return;
-+
-+	mt7921_mutex_acquire(phy->dev);
-+	ieee80211_iterate_active_interfaces(phy->mt76->hw,
-+					    IEEE80211_IFACE_ITER_RESUME_ALL,
-+					    mt7921_roc_iter, phy);
-+	mt7921_mutex_release(phy->dev);
-+	ieee80211_remain_on_channel_expired(phy->mt76->hw);
-+}
-+
-+void mt7921_roc_timer(struct timer_list *timer)
-+{
-+	struct mt7921_phy *phy = from_timer(phy, timer, roc_timer);
-+
-+	ieee80211_queue_work(phy->mt76->hw, &phy->roc_work);
-+}
-+
-+static int mt7921_abort_roc(struct mt7921_phy *phy, struct mt7921_vif *vif)
-+{
-+	int err;
-+
-+	if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state))
-+		return 0;
-+
-+	del_timer_sync(&phy->roc_timer);
-+	cancel_work_sync(&phy->roc_work);
-+	err = mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id);
-+	clear_bit(MT76_STATE_ROC, &phy->mt76->state);
-+
-+	return err;
-+}
-+
-+static int mt7921_set_roc(struct mt7921_phy *phy,
-+			  struct mt7921_vif *vif,
-+			  struct ieee80211_channel *chan,
-+			  int duration,
-+			  enum mt7921_roc_req type)
-+{
-+	int err;
-+
-+	if (test_and_set_bit(MT76_STATE_ROC, &phy->mt76->state))
-+		return -EBUSY;
-+
-+	phy->roc_grant = false;
-+
-+	err = mt7921_mcu_set_roc(phy, vif, chan, duration, type,
-+				 ++phy->roc_token_id);
-+	if (err < 0) {
-+		clear_bit(MT76_STATE_ROC, &phy->mt76->state);
-+		goto out;
-+	}
-+
-+	if (!wait_event_timeout(phy->roc_wait, phy->roc_grant, HZ)) {
-+		mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id);
-+		clear_bit(MT76_STATE_ROC, &phy->mt76->state);
-+		err = -ETIMEDOUT;
-+	}
-+
-+out:
-+	return err;
-+}
-+
-+static int mt7921_remain_on_channel(struct ieee80211_hw *hw,
-+				    struct ieee80211_vif *vif,
-+				    struct ieee80211_channel *chan,
-+				    int duration,
-+				    enum ieee80211_roc_type type)
-+{
-+	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
-+	struct mt7921_phy *phy = mt7921_hw_phy(hw);
-+	int err;
-+
-+	mt7921_mutex_acquire(phy->dev);
-+	err = mt7921_set_roc(phy, mvif, chan, duration, MT7921_ROC_REQ_ROC);
-+	mt7921_mutex_release(phy->dev);
-+
-+	return err;
-+}
-+
-+static int mt7921_cancel_remain_on_channel(struct ieee80211_hw *hw,
-+					   struct ieee80211_vif *vif)
-+{
-+	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
-+	struct mt7921_phy *phy = mt7921_hw_phy(hw);
-+	int err;
-+
-+	mt7921_mutex_acquire(phy->dev);
-+	err = mt7921_abort_roc(phy, mvif);
-+	mt7921_mutex_release(phy->dev);
-+
-+	return err;
-+}
-+
- static int mt7921_set_channel(struct mt7921_phy *phy)
- {
- 	struct mt7921_dev *dev = phy->dev;
-@@ -1503,7 +1613,13 @@ static int mt7921_set_sar_specs(struct ieee80211_hw *hw,
- 	int err;
- 
- 	mt7921_mutex_acquire(dev);
-+	err = mt7921_mcu_set_clc(dev, dev->mt76.alpha2,
-+				 dev->country_ie_env);
-+	if (err < 0)
-+		goto out;
-+
- 	err = mt7921_set_tx_sar_pwr(hw, sar);
-+out:
- 	mt7921_mutex_release(dev);
- 
- 	return err;
-@@ -1621,6 +1737,8 @@ const struct ieee80211_ops mt7921_ops = {
- #endif /* CONFIG_PM */
- 	.flush = mt7921_flush,
- 	.set_sar_specs = mt7921_set_sar_specs,
-+	.remain_on_channel = mt7921_remain_on_channel,
-+	.cancel_remain_on_channel = mt7921_cancel_remain_on_channel,
- };
- EXPORT_SYMBOL_GPL(mt7921_ops);
- 
-diff --git a/mt7921/mcu.c b/mt7921/mcu.c
-index 104da7e1..b7ed744f 100644
---- a/mt7921/mcu.c
-+++ b/mt7921/mcu.c
-@@ -154,6 +154,29 @@ void mt7921_mcu_set_suspend_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
- 
- #endif /* CONFIG_PM */
- 
-+static void
-+mt7921_mcu_uni_roc_event(struct mt7921_dev *dev, struct sk_buff *skb)
-+{
-+	struct mt7921_roc_grant_tlv *grant;
-+	struct mt76_connac2_mcu_rxd *rxd;
-+	int duration;
-+
-+	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
-+	grant = (struct mt7921_roc_grant_tlv *)(rxd->tlv + 4);
-+
-+	/* should never happen */
-+	WARN_ON_ONCE((le16_to_cpu(grant->tag) != UNI_EVENT_ROC_GRANT));
-+
-+	if (grant->reqtype == MT7921_ROC_REQ_ROC)
-+		ieee80211_ready_on_channel(dev->mt76.phy.hw);
-+
-+	dev->phy.roc_grant = true;
-+	wake_up(&dev->phy.roc_wait);
-+	duration = le32_to_cpu(grant->max_interval);
-+	mod_timer(&dev->phy.roc_timer,
-+		  round_jiffies_up(jiffies + msecs_to_jiffies(duration)));
-+}
-+
- static void
- mt7921_mcu_scan_event(struct mt7921_dev *dev, struct sk_buff *skb)
- {
-@@ -295,6 +318,7 @@ mt7921_mcu_uni_rx_unsolicited_event(struct mt7921_dev *dev,
- 
- 	switch (rxd->eid) {
- 	case MCU_UNI_EVENT_ROC:
-+		mt7921_mcu_uni_roc_event(dev, skb);
- 		break;
- 	default:
- 		break;
-diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index d9d78f6b..e915dfce 100644
---- a/mt7921/mt7921.h
-+++ b/mt7921/mt7921.h
-@@ -32,6 +32,9 @@
- #define MT7921_MCU_INIT_RETRY_COUNT	10
- #define MT7921_WFSYS_INIT_RETRY_COUNT	2
- 
-+#define MT7921_FW_TAG_FEATURE		4
-+#define MT7921_FW_CAP_CNM		BIT(7)
-+
- #define MT7921_FIRMWARE_WM		"mediatek/WIFI_RAM_CODE_MT7961_1.bin"
- #define MT7921_ROM_PATCH		"mediatek/WIFI_MT7961_patch_mcu_1_2_hdr.bin"
- 
-@@ -67,6 +70,41 @@ enum mt7921_roc_req {
- 	MT7921_ROC_REQ_NUM
- };
- 
-+enum {
-+	UNI_EVENT_ROC_GRANT = 0,
-+	UNI_EVENT_ROC_TAG_NUM
-+};
-+
-+struct mt7921_realease_info {
-+	__le16 len;
-+	u8 pad_len;
-+	u8 tag;
-+} __packed;
-+
-+struct mt7921_fw_features {
-+	u8 segment;
-+	u8 data;
-+	u8 rsv[14];
-+} __packed;
-+
-+struct mt7921_roc_grant_tlv {
-+	__le16 tag;
-+	__le16 len;
-+	u8 bss_idx;
-+	u8 tokenid;
-+	u8 status;
-+	u8 primarychannel;
-+	u8 rfsco;
-+	u8 rfband;
-+	u8 channelwidth;
-+	u8 centerfreqseg1;
-+	u8 centerfreqseg2;
-+	u8 reqtype;
-+	u8 dbdcband;
-+	u8 rsv[1];
-+	__le32 max_interval;
-+} __packed;
-+
- enum mt7921_sdio_pkt_type {
- 	MT7921_SDIO_TXD,
- 	MT7921_SDIO_DATA,
-@@ -214,6 +252,12 @@ struct mt7921_phy {
- #endif
- 
- 	struct mt7921_clc *clc[MT7921_CLC_MAX_NUM];
-+
-+	struct work_struct roc_work;
-+	struct timer_list roc_timer;
-+	wait_queue_head_t roc_wait;
-+	u8 roc_token_id;
-+	bool roc_grant;
- };
- 
- #define mt7921_init_reset(dev)		((dev)->hif_ops->init_reset(dev))
-@@ -250,6 +294,7 @@ struct mt7921_dev {
- 	struct work_struct init_work;
- 
- 	u8 fw_debug;
-+	u8 fw_features;
- 
- 	struct mt76_connac_pm pm;
- 	struct mt76_connac_coredump coredump;
-@@ -258,6 +303,8 @@ struct mt7921_dev {
- 	struct work_struct ipv6_ns_work;
- 	/* IPv6 addresses for WoWLAN */
- 	struct sk_buff_head ipv6_ns_list;
-+
-+	enum environment_cap country_ie_env;
- };
- 
- enum {
-@@ -422,7 +469,7 @@ void mt7921_tx_worker(struct mt76_worker *w);
- void mt7921_tx_token_put(struct mt7921_dev *dev);
- bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			 struct sk_buff *skb);
-+			 struct sk_buff *skb, u32 *info);
- void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
- void mt7921_stats_work(struct work_struct *work);
- void mt7921_set_stream_he_caps(struct mt7921_phy *phy);
-@@ -439,6 +486,8 @@ int mt7921_mcu_uni_rx_ba(struct mt7921_dev *dev,
- 			 struct ieee80211_ampdu_params *params,
- 			 bool enable);
- void mt7921_scan_work(struct work_struct *work);
-+void mt7921_roc_work(struct work_struct *work);
-+void mt7921_roc_timer(struct timer_list *timer);
- int mt7921_mcu_uni_bss_ps(struct mt7921_dev *dev, struct ieee80211_vif *vif);
- int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev);
- int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev);
-@@ -527,4 +576,5 @@ int mt7921_mcu_set_roc(struct mt7921_phy *phy, struct mt7921_vif *vif,
- 		       enum mt7921_roc_req type, u8 token_id);
- int mt7921_mcu_abort_roc(struct mt7921_phy *phy, struct mt7921_vif *vif,
- 			 u8 token_id);
-+u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm);
- #endif
-diff --git a/mt7921/pci.c b/mt7921/pci.c
-index 4f34cb9e..fbb06f04 100644
---- a/mt7921/pci.c
-+++ b/mt7921/pci.c
-@@ -13,10 +13,14 @@
- #include "../trace.h"
- 
- static const struct pci_device_id mt7921_pci_device_table[] = {
--	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7961) },
--	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7922) },
--	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0608) },
--	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0616) },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7961),
-+		.driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x7922),
-+		.driver_data = (kernel_ulong_t)MT7922_FIRMWARE_WM },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0608),
-+		.driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, 0x0616),
-+		.driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
- 	{ },
- };
- 
-@@ -253,9 +257,11 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
- 		.fw_own = mt7921e_mcu_fw_pmctrl,
- 	};
- 
-+	struct ieee80211_ops *ops;
- 	struct mt76_bus_ops *bus_ops;
- 	struct mt7921_dev *dev;
- 	struct mt76_dev *mdev;
-+	u8 features;
- 	int ret;
- 
- 	ret = pcim_enable_device(pdev);
-@@ -279,8 +285,21 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
- 	if (mt7921_disable_aspm)
- 		mt76_pci_disable_aspm(pdev);
- 
--	mdev = mt76_alloc_device(&pdev->dev, sizeof(*dev), &mt7921_ops,
--				 &drv_ops);
-+	features = mt7921_check_offload_capability(&pdev->dev, (const char *)
-+						   id->driver_data);
-+	ops = devm_kmemdup(&pdev->dev, &mt7921_ops, sizeof(mt7921_ops),
-+			   GFP_KERNEL);
-+	if (!ops) {
-+		ret = -ENOMEM;
-+		goto err_free_pci_vec;
-+	}
-+
-+	if (!(features & MT7921_FW_CAP_CNM)) {
-+		ops->remain_on_channel = NULL;
-+		ops->cancel_remain_on_channel = NULL;
-+	}
-+
-+	mdev = mt76_alloc_device(&pdev->dev, sizeof(*dev), ops, &drv_ops);
- 	if (!mdev) {
- 		ret = -ENOMEM;
- 		goto err_free_pci_vec;
-@@ -289,8 +308,8 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
- 	pci_set_drvdata(pdev, mdev);
- 
- 	dev = container_of(mdev, struct mt7921_dev, mt76);
-+	dev->fw_features = features;
- 	dev->hif_ops = &mt7921_pcie_ops;
--
- 	mt76_mmio_init(&dev->mt76, pcim_iomap_table(pdev)[0]);
- 	tasklet_init(&dev->irq_tasklet, mt7921_irq_tasklet, (unsigned long)dev);
- 
-diff --git a/mt7921/sdio.c b/mt7921/sdio.c
-index 031d99d4..f6b35087 100644
---- a/mt7921/sdio.c
-+++ b/mt7921/sdio.c
-@@ -17,7 +17,8 @@
- #include "mcu.h"
- 
- static const struct sdio_device_id mt7921s_table[] = {
--	{ SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7901) },
-+	{ SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, 0x7901),
-+		.driver_data = (kernel_ulong_t)MT7921_FIRMWARE_WM },
- 	{ }	/* Terminating entry */
- };
- 
-@@ -122,18 +123,32 @@ static int mt7921s_probe(struct sdio_func *func,
- 		.fw_own = mt7921s_mcu_fw_pmctrl,
- 	};
- 
-+	struct ieee80211_ops *ops;
- 	struct mt7921_dev *dev;
- 	struct mt76_dev *mdev;
-+	u8 features;
- 	int ret;
- 
--	mdev = mt76_alloc_device(&func->dev, sizeof(*dev), &mt7921_ops,
--				 &drv_ops);
-+	features = mt7921_check_offload_capability(&func->dev, (const char *)
-+						   id->driver_data);
-+
-+	ops = devm_kmemdup(&func->dev, &mt7921_ops, sizeof(mt7921_ops),
-+			   GFP_KERNEL);
-+	if (!ops)
-+		return -ENOMEM;
-+
-+	if (!(features & MT7921_FW_CAP_CNM)) {
-+		ops->remain_on_channel = NULL;
-+		ops->cancel_remain_on_channel = NULL;
-+	}
-+
-+	mdev = mt76_alloc_device(&func->dev, sizeof(*dev), ops, &drv_ops);
- 	if (!mdev)
- 		return -ENOMEM;
- 
- 	dev = container_of(mdev, struct mt7921_dev, mt76);
-+	dev->fw_features = features;
- 	dev->hif_ops = &mt7921_sdio_ops;
--
- 	sdio_set_drvdata(func, dev);
- 
- 	ret = mt76s_init(mdev, func, &mt7921s_ops);
-diff --git a/mt7921/usb.c b/mt7921/usb.c
-index 89249f0b..8a49d3de 100644
---- a/mt7921/usb.c
-+++ b/mt7921/usb.c
-@@ -13,7 +13,8 @@
- #include "mac.h"
- 
- static const struct usb_device_id mt7921u_device_table[] = {
--	{ USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x7961, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x7961, 0xff, 0xff, 0xff),
-+		.driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM },
- 	{ },
- };
- 
-@@ -204,13 +205,21 @@ static int mt7921u_probe(struct usb_interface *usb_intf,
- 	struct ieee80211_hw *hw;
- 	struct mt7921_dev *dev;
- 	struct mt76_dev *mdev;
-+	u8 features;
- 	int ret;
- 
-+	features = mt7921_check_offload_capability(&usb_intf->dev, (const char *)
-+						   id->driver_info);
- 	ops = devm_kmemdup(&usb_intf->dev, &mt7921_ops, sizeof(mt7921_ops),
- 			   GFP_KERNEL);
- 	if (!ops)
- 		return -ENOMEM;
- 
-+	if (!(features & MT7921_FW_CAP_CNM)) {
-+		ops->remain_on_channel = NULL;
-+		ops->cancel_remain_on_channel = NULL;
-+	}
-+
- 	ops->stop = mt7921u_stop;
- 
- 	mdev = mt76_alloc_device(&usb_intf->dev, sizeof(*dev), ops, &drv_ops);
-@@ -218,6 +227,7 @@ static int mt7921u_probe(struct usb_interface *usb_intf,
- 		return -ENOMEM;
- 
- 	dev = container_of(mdev, struct mt7921_dev, mt76);
-+	dev->fw_features = features;
- 	dev->hif_ops = &hif_ops;
- 
- 	udev = usb_get_dev(udev);
-diff --git a/sdio.c b/sdio.c
-index 0ec308f9..228bc7d4 100644
---- a/sdio.c
-+++ b/sdio.c
-@@ -395,7 +395,7 @@ mt76s_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
- 		if (!e || !e->skb)
- 			break;
- 
--		dev->drv->rx_skb(dev, MT_RXQ_MAIN, e->skb);
-+		dev->drv->rx_skb(dev, MT_RXQ_MAIN, e->skb, NULL);
- 		e->skb = NULL;
- 		nframes++;
- 	}
-diff --git a/tx.c b/tx.c
-index 65e2b7c1..c8d78b0a 100644
---- a/tx.c
-+++ b/tx.c
-@@ -751,6 +751,23 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
- }
- EXPORT_SYMBOL_GPL(mt76_token_consume);
- 
-+int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
-+			  struct mt76_txwi_cache *t, dma_addr_t phys)
-+{
-+	int token;
-+
-+	spin_lock_bh(&dev->rx_token_lock);
-+	token = idr_alloc(&dev->rx_token, t, 0, dev->rx_token_size,
-+			  GFP_ATOMIC);
-+	spin_unlock_bh(&dev->rx_token_lock);
-+
-+	t->ptr = ptr;
-+	t->dma_addr = phys;
-+
-+	return token;
-+}
-+EXPORT_SYMBOL_GPL(mt76_rx_token_consume);
-+
- struct mt76_txwi_cache *
- mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
- {
-@@ -779,3 +796,16 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
- 	return txwi;
- }
- EXPORT_SYMBOL_GPL(mt76_token_release);
-+
-+struct mt76_txwi_cache *
-+mt76_rx_token_release(struct mt76_dev *dev, int token)
-+{
-+	struct mt76_txwi_cache *t;
-+
-+	spin_lock_bh(&dev->rx_token_lock);
-+	t = idr_remove(&dev->rx_token, token);
-+	spin_unlock_bh(&dev->rx_token_lock);
-+
-+	return t;
-+}
-+EXPORT_SYMBOL_GPL(mt76_rx_token_release);
-diff --git a/usb.c b/usb.c
-index 50d07d91..369c27ab 100644
---- a/usb.c
-+++ b/usb.c
-@@ -547,7 +547,7 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb,
- 		len -= data_len;
- 		nsgs++;
- 	}
--	dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb);
-+	dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb, NULL);
- 
- 	return nsgs;
- }
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch
deleted file mode 100644
index 24b1240..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 23 Nov 2021 17:01:45 +0100
-Subject: [PATCH] Revert "of: net: pass the dst buffer to of_get_mac_address()"
-
-This reverts commit 4932c5d80153c336c77dbe8d7af9f8fdd879d01f.
----
-
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -105,9 +105,15 @@ mt76_eeprom_override(struct mt76_phy *ph
- {
- 	struct mt76_dev *dev = phy->dev;
- 
-+#ifdef CONFIG_OF
- 	struct device_node *np = dev->dev->of_node;
-+	const u8 *mac = NULL;
- 
--	of_get_mac_address(np, phy->macaddr);
-+	if (np)
-+		mac = of_get_mac_address(np);
-+	if (!IS_ERR_OR_NULL(mac))
-+		ether_addr_copy(phy->macaddr, mac);
-+#endif
- 
- 	if (!is_valid_ether_addr(phy->macaddr)) {
- 		eth_random_addr(phy->macaddr);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index d1fa706..e194f7d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,7 +1,7 @@
-From 6f3fdaaef8dcd1d95017aaf1755cf001168d0836 Mon Sep 17 00:00:00 2001
+From b9974cb5e246a0b7f999e16c1e6dc48bb65737f2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1001/1010] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    7 +
@@ -22,10 +22,10 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 72d235a1..ff733f9f 100644
+index f1e942b9..9d0d6130 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1135,6 +1135,7 @@ enum {
+@@ -1146,6 +1146,7 @@ enum {
  	MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
  	MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_CMD_TXBF_ACTION = 0x1e,
@@ -33,7 +33,7 @@
  	MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
  	MCU_EXT_CMD_THERMAL_PROT = 0x23,
  	MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
-@@ -1158,6 +1159,12 @@ enum {
+@@ -1169,6 +1170,12 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
@@ -60,7 +60,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 30f8f18b..092d8434 100644
+index 5a46813a..f1f3f2f3 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -137,7 +137,7 @@
  	return mt7915_fw_debug_wm_set(dev, dev->fw.debug_wm);
  }
  
-@@ -1103,6 +1133,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1257,6 +1287,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	if (!ext_phy)
  		dev->debugfs_dir = dir;
  
@@ -149,7 +149,7 @@
  	return 0;
  }
  
-@@ -1143,17 +1178,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
+@@ -1297,17 +1332,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -204,10 +204,10 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 97a19bdb..0b13375e 100644
+index f0d5a360..149527df 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -301,6 +301,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -300,6 +300,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	__le16 fc = 0;
  	int idx;
  
@@ -217,8 +217,8 @@
 +#endif
  	memset(status, 0, sizeof(*status));
  
- 	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->band_idx) {
-@@ -484,6 +488,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+ 	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->mt76->band_idx) {
+@@ -483,6 +487,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	}
  
  	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
@@ -229,7 +229,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		struct ieee80211_vif *vif;
  		int err;
-@@ -821,6 +829,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -820,6 +828,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -243,10 +243,10 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2505fa7e..b6e5f97c 100644
+index 0511d6a5..b44507f4 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -58,7 +58,11 @@ int mt7915_run(struct ieee80211_hw *hw)
+@@ -62,7 +62,11 @@ int mt7915_run(struct ieee80211_hw *hw)
  	if (ret)
  		goto out;
  
@@ -259,7 +259,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 36c21596..5af6de5d 100644
+index 35441dcb..56e5ea55 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -274,7 +274,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3307,6 +3312,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3323,6 +3328,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -283,7 +283,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3744,6 +3751,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3760,6 +3767,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -327,7 +327,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -3772,3 +3816,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3788,3 +3832,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -351,10 +351,10 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 46c517e5..b7e8ba2e 100644
+index 29b5434b..aa89106e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -271,6 +271,10 @@ enum {
+@@ -278,6 +278,10 @@ enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
  	MCU_WA_PARAM_RED = 0x0e,
@@ -366,7 +366,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 42f21343..2f91020c 100644
+index 6351feba..7c129f7f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -377,7 +377,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -368,6 +369,29 @@ struct mt7915_dev {
+@@ -367,6 +368,29 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -407,7 +407,7 @@
  };
  
  enum {
-@@ -645,4 +669,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -644,4 +668,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -4721,7 +4721,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 00000000..145fe785
+index 00000000..143dae26
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4742,7 +4742,7 @@
 +		u8 _rsv;
 +	} __packed req = {
 +		.format_id = 1,
-+		.band = phy->band_idx,
++		.band = phy->mt76->band_idx,
 +		.val = !!drop_level,
 +	};
 +	int ret;
@@ -4891,5 +4891,5 @@
  	return ret;
  }
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
index cc9e5ed..5f2a8e3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,7 +1,7 @@
-From 3913add871ba0d7b4b6a997109ee2acb6d7e5ed3 Mon Sep 17 00:00:00 2001
+From 60ac6480474b349c21c256f4d720baa2c6622b2f Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 1002/1010] mt76: mt7915: csi: implement csi support
+Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -17,10 +17,10 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ff733f9f..3f35c6fb 100644
+index 9d0d6130..26e7cf6f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -987,6 +987,7 @@ enum {
+@@ -998,6 +998,7 @@ enum {
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
@@ -28,7 +28,7 @@
  };
  
  /* unified event table */
-@@ -1180,6 +1181,7 @@ enum {
+@@ -1191,6 +1192,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -53,12 +53,12 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 9e69ab82..34ace7c9 100644
+index 6fd5c63e..79080aee 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -574,6 +574,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -645,6 +645,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
- 	mt7915_init_wiphy(mphy->hw);
+ 	mt7915_init_wiphy(phy);
  
 +#ifdef CONFIG_MTK_VENDOR
 +	INIT_LIST_HEAD(&phy->csi.csi_list);
@@ -69,7 +69,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1079,6 +1085,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1151,6 +1157,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -95,7 +95,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1087,6 +1112,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1159,6 +1184,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -106,7 +106,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1099,6 +1128,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1171,6 +1200,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -117,7 +117,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1141,6 +1174,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1212,6 +1245,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -127,11 +127,11 @@
 +	mt7915_vendor_register(&dev->phy);
 +#endif
 +
- 	/* init led callbacks */
- 	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
- 		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
+ 	ret = mt76_register_device(&dev->mt76, true, mt76_rates,
+ 				   ARRAY_SIZE(mt76_rates));
+ 	if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5af6de5d..e6cd1e2c 100644
+index 56e5ea55..f483d443 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
@@ -145,7 +145,7 @@
  static u8
  mt7915_mcu_get_sta_nss(u16 mcs_map)
  {
-@@ -355,6 +359,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -371,6 +375,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_FW_LOG_2_HOST:
  		mt7915_mcu_rx_log_message(dev, skb);
  		break;
@@ -157,7 +157,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3751,6 +3760,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3767,6 +3776,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -219,7 +219,7 @@
 +	SET_CSI_DATA(ts);
 +
 +	SET_CSI_DATA(band);
-+	if (csi->band && !phy->band_idx)
++	if (csi->band && !phy->mt76->band_idx)
 +		phy = mt7915_ext_phy(dev);
 +#undef SET_CSI_DATA
 +
@@ -267,12 +267,12 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b7e8ba2e..50bf4cb6 100644
+index aa89106e..f3dedd5b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -513,4 +513,80 @@ enum {
- 					 sizeof(struct bss_info_bcn_cont) + \
- 					 sizeof(struct bss_info_inband_discovery))
+@@ -532,4 +532,80 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
+ 	return txpower;
+ }
  
 +#ifdef CONFIG_MTK_VENDOR
 +struct mt7915_mcu_csi {
@@ -352,10 +352,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2f91020c..8b6c95ef 100644
+index 7c129f7f..8bb6d091 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -289,6 +289,20 @@ struct mt7915_phy {
+@@ -288,6 +288,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -376,7 +376,7 @@
  };
  
  struct mt7915_dev {
-@@ -669,6 +683,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -668,6 +682,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -914,5 +914,5 @@
 +
 +#endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
index 1cd5dc0..1e6158a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,7 +1,7 @@
-From 8d44ea8b90c3fa7020f6d7e31c5d30232fef262c Mon Sep 17 00:00:00 2001
+From 088b6c6f35ed5213deae1b4515375632457ec90f Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1003/1010] mt76: mt7915: air monitor support
+Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 3f35c6fb..55c9fcd5 100644
+index 26e7cf6f..841fcdec 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1181,6 +1181,8 @@ enum {
+@@ -1192,6 +1192,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,10 +26,10 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0b13375e..f1c61578 100644
+index 149527df..015f2705 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -549,6 +549,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -548,6 +548,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
  			qos_ctl = *ieee80211_get_qos_ctl(hdr);
  		}
@@ -41,10 +41,10 @@
  		status->flag |= RX_FLAG_8023;
  		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b6e5f97c..11efcadc 100644
+index b44507f4..33db7202 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -686,6 +686,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -691,6 +691,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,7 +55,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8b6c95ef..bb21433a 100644
+index 8bb6d091..33ca8e8c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -244,6 +244,35 @@ struct mt7915_hif {
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -302,6 +331,8 @@ struct mt7915_phy {
+@@ -301,6 +330,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -687,6 +718,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -686,6 +717,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 4b30a6e..378e0a3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,21 +1,21 @@
-From d59ea5f5af1478aa25b8723f9c8064c244175a50 Mon Sep 17 00:00:00 2001
+From f942dbe1374ccf688477a532226dc55caa2ac72d Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
-Subject: [PATCH 1004/1010] mt76: mt7915: add support for muru_onoff via
+Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
  debugfs
 
 ---
  mt7915/init.c        |  1 +
- mt7915/mcu.c         |  9 +++++++--
+ mt7915/mcu.c         | 11 ++++++++---
  mt7915/mcu.h         |  6 ++++++
  mt7915/mtk_debugfs.c | 33 +++++++++++++++++++++++++++++++++
- 4 files changed, 47 insertions(+), 2 deletions(-)
+ 4 files changed, 48 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 34ace7c9..d4105835 100644
+index 79080aee..172bdcf2 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -609,6 +609,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -680,6 +680,7 @@ static void mt7915_init_work(struct work_struct *work)
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
  	mt7915_txbf_init(dev);
@@ -24,19 +24,20 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e6cd1e2c..2ee4afe9 100644
+index f483d443..e0e25a91 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -860,13 +860,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -876,13 +876,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  
  	muru = (struct sta_rec_muru *)tlv;
  
 -	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
-+	muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
- 			       mvif->cap.vht_mu_ebfer ||
+-			       mvif->cap.vht_mu_ebfer ||
 -			       mvif->cap.vht_mu_ebfee;
-+			       mvif->cap.vht_mu_ebfee) &&
-+				   !!(dev->dbg.muru_onoff & MUMIMO_DL);
++	muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
++			        mvif->cap.vht_mu_ebfer ||
++			        mvif->cap.vht_mu_ebfee) &&
++			       !!(dev->dbg.muru_onoff & MUMIMO_DL);
  	if (!is_mt7915(&dev->mt76))
  		muru->cfg.mimo_ul_en = true;
  	muru->cfg.ofdma_dl_en = true;
@@ -45,14 +46,14 @@
 +	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
 +	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
 +
- 	if (sta->vht_cap.vht_supported)
+ 	if (sta->deflink.vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
- 			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
+ 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 50bf4cb6..aa07e426 100644
+index f3dedd5b..b6840b22 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -589,4 +589,10 @@ struct csi_data {
+@@ -608,4 +608,10 @@ struct csi_data {
  };
  #endif
  
@@ -115,5 +116,5 @@
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
index 209d039..1ead9ba 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From b9b4a77af1657e0b71a6f57dc8c8c2d50c37a946 Mon Sep 17 00:00:00 2001
+From 2da7ca62781e48d7775df06318bc975182ec11e6 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1005/1010] mt76: mt7915: certification patches
+Subject: [PATCH 1005/1009] mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -16,10 +16,10 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 55c9fcd5..0d4d466f 100644
+index 841fcdec..18ae3acb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1183,6 +1183,7 @@ enum {
+@@ -1194,6 +1194,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f1c61578..cf119cf4 100644
+index 015f2705..229e68c3 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -2020,6 +2021,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2021,6 +2022,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2042,6 +2058,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -2043,6 +2059,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 11efcadc..75073363 100644
+index 33db7202..3d309bc0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -662,6 +662,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -667,6 +667,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -689,7 +692,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -694,7 +697,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -109,10 +109,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2ee4afe9..fe314bf2 100644
+index e0e25a91..4e36910c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3865,6 +3865,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3881,6 +3881,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -586,10 +586,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aa07e426..6d4580bf 100644
+index b6840b22..d7322fe8 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -408,10 +408,14 @@ enum {
+@@ -415,10 +415,14 @@ enum {
  	RATE_PARAM_FIXED = 3,
  	RATE_PARAM_MMPS_UPDATE = 5,
  	RATE_PARAM_FIXED_HE_LTF = 7,
@@ -605,7 +605,7 @@
  };
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -423,6 +427,9 @@ enum {
+@@ -430,6 +434,9 @@ enum {
  #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
  #define RATE_CFG_HE_LTF			GENMASK(31, 28)
  
@@ -615,7 +615,7 @@
  enum {
  	TX_POWER_LIMIT_ENABLE,
  	TX_POWER_LIMIT_TABLE = 0x4,
-@@ -594,5 +601,203 @@ struct csi_data {
+@@ -613,5 +620,203 @@ struct csi_data {
  #define OFDMA_UL                       BIT(1)
  #define MUMIMO_DL                      BIT(2)
  #define MUMIMO_UL                      BIT(3)
@@ -820,10 +820,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index bb21433a..e6c000a7 100644
+index 33ca8e8c..415fe82a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -715,6 +715,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -714,6 +714,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -1134,5 +1134,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 5f9e051..2c4fbe8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,7 +1,7 @@
-From d29700d24b6b117341d5e3597fdf9e652e836032 Mon Sep 17 00:00:00 2001
+From f481ab038d6087eef48f89e097b0d821d4640d1b Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
-Subject: [PATCH 1006/1010] mt76: mt7915:add support for runtime set in-band
+Subject: [PATCH 1006/1009] mt76: mt7915:add support for runtime set in-band
  discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fe314bf2..cb6195f6 100644
+index 4e36910c..47dee76e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1977,8 +1977,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -1993,8 +1993,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	u8 *buf, interval;
  	int len;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2013,7 +2012,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2029,7 +2028,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
@@ -33,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 402e888..18262bf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,7 +1,7 @@
-From 5aa7362344f0cd6ef9c045e0d9be98f4d679010c Mon Sep 17 00:00:00 2001
+From 18accd0fdefb61e9edd2d425b7ca8a363402f0df Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
-Subject: [PATCH 1007/1010] mt76: mt7915: add mt76 vendor muru onoff command
+Subject: [PATCH 1007/1009] mt76: mt7915: add mt76 vendor muru onoff command
 
 ---
  mt7915/mcu.c    |  7 +++++++
@@ -11,10 +11,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index cb6195f6..696ca11b 100644
+index 47dee76e..ec306f01 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3884,6 +3884,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3900,6 +3900,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,10 +29,10 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 6d4580bf..e7ad0560 100644
+index d7322fe8..eaadd331 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -415,6 +415,7 @@ enum {
+@@ -422,6 +422,7 @@ enum {
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
  	RATE_PARAM_FIXED_OFDMA = 31,
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
index b1c8a6f..6eff0ae 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,17 +1,17 @@
-From 830e283fe7f3f7b4514fae3de01b0c728ea0ecfb Mon Sep 17 00:00:00 2001
+From 8c5a000a492457202b6fe8518f42a2515238b528 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 1008/1010] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 1008/1009] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index cf119cf4..28c6ab35 100644
+index 229e68c3..fc7b7903 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -762,6 +762,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -761,6 +761,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info)
  {
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
@@ -20,7 +20,7 @@
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -792,6 +794,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -791,6 +793,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
@@ -32,5 +32,5 @@
  	if (id < 0)
  		return id;
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
index 078dad5..4af0e5b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,7 +1,7 @@
-From e024583e77c3eedc2e3dcfb52d179a20ebb08e86 Mon Sep 17 00:00:00 2001
+From eba9059676a9a0012aed63fbc800e1f6b2a2a381 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH 1009/1010] mt76: mt7915: add fw_version dump
+Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
 
 ---
  mt76.h               |  4 ++++
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 33f87e51..84d49c2b 100644
+index 1037d23b..beea57d5 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -835,6 +835,10 @@ struct mt76_dev {
+@@ -837,6 +837,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,10 +25,10 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index c65267b4..a48903ca 100644
+index 5a047e63..cf6ec55f 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2927,6 +2927,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2968,6 +2968,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
  
@@ -38,7 +38,7 @@
  	release_firmware(fw);
  
  	if (!fw_wa)
-@@ -2952,6 +2955,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2993,6 +2996,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -48,7 +48,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -3022,6 +3028,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -3063,6 +3069,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
@@ -96,5 +96,5 @@
  }
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
index 50c491b..4b36dae 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,4 +1,4 @@
-From 62514b545ba99ba75fbed0ece763009b583473dc Mon Sep 17 00:00:00 2001
+From 41e8c107e1e3e4ecc5b99d9066702b9b560abf6e Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
 Subject: [PATCH 1111/1128] mt76: mt7915: rework testmode init registers
@@ -17,10 +17,10 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index acac04ef..9a908c9a 100644
+index 7fe7f68a..19d9efb3 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -761,7 +761,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -775,7 +775,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -31,7 +31,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 84d49c2b..0d87f135 100644
+index beea57d5..4822ffb7 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -637,6 +637,8 @@ struct mt76_testmode_ops {
@@ -61,10 +61,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 0d4d466f..172a926a 100644
+index 18ae3acb..18d6c669 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1177,6 +1177,7 @@ enum {
+@@ -1188,6 +1188,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -73,7 +73,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index e7ad0560..6a145aef 100644
+index eaadd331..2e97db7b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -85,7 +85,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 3b4ede3b..19518cb5 100644
+index afa558c9..07de3cbd 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
@@ -105,7 +105,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index aca1b2f1..688f7dee 100644
+index c8e478a5..d6a05f13 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -48,6 +48,7 @@ enum reg_rev {
@@ -153,7 +153,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 7ace05e0..931d1db2 100644
+index 0d76ae31..46939191 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -187,16 +187,16 @@
  static int
  mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
  {
-@@ -335,7 +350,7 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+@@ -336,7 +351,7 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
  {
  	int n_regs = ARRAY_SIZE(reg_backup_list);
  	struct mt7915_dev *dev = phy->dev;
 -	u32 *b = phy->test.reg_backup;
 +	u32 *b = phy->test.reg_backup, val;
+ 	u8 band = phy->mt76->band_idx;
  	int i;
  
- 	REG_BAND_IDX(reg_backup_list[0], AGG_PCR0, 0);
-@@ -347,18 +362,28 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+@@ -349,18 +364,28 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
  	REG_BAND(reg_backup_list[6], AGG_MRCR);
  	REG_BAND(reg_backup_list[7], TMAC_TFCR0);
  	REG_BAND(reg_backup_list[8], TMAC_TCR0);
@@ -219,15 +219,15 @@
 +	REG_BAND(reg_backup_list[17], WF_RFCR1);
 +
 +	if (is_mt7916(&dev->mt76)) {
-+		reg_backup_list[18].band[phy->band_idx] = MT_MDP_TOP_DBG_WDT_CTRL;
-+		reg_backup_list[19].band[phy->band_idx] = MT_MDP_TOP_DBG_CTRL;
++		reg_backup_list[18].band[band] = MT_MDP_TOP_DBG_WDT_CTRL;
++		reg_backup_list[19].band[band] = MT_MDP_TOP_DBG_CTRL;
 +	}
  
  	if (phy->mt76->test.state == MT76_TM_STATE_OFF) {
 -		for (i = 0; i < n_regs; i++)
--			mt76_wr(dev, reg_backup_list[i].band[phy->band_idx], b[i]);
+-			mt76_wr(dev, reg_backup_list[i].band[band], b[i]);
 +		for (i = 0; i < n_regs; i++) {
-+			u8 reg = reg_backup_list[i].band[phy->band_idx];
++			u8 reg = reg_backup_list[i].band[band];
 +
 +			if (reg)
 +				mt76_wr(dev, reg, b[i]);
@@ -235,11 +235,11 @@
  		return;
  	}
  
-@@ -378,8 +403,13 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+@@ -380,8 +405,13 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
  		   MT_AGG_PCR0_BW40_PROT | MT_AGG_PCR0_BW80_PROT);
- 	mt76_set(dev, MT_AGG_PCR0(phy->band_idx, 0), MT_AGG_PCR0_PTA_WIN_DIS);
+ 	mt76_set(dev, MT_AGG_PCR0(band, 0), MT_AGG_PCR0_PTA_WIN_DIS);
  
--	mt76_wr(dev, MT_AGG_PCR0(phy->band_idx, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
+-	mt76_wr(dev, MT_AGG_PCR0(band, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
 -		MT_AGG_PCR1_RTS0_LEN_THRES);
 +	if (is_mt7915(&dev->mt76))
 +		val = MT_AGG_PCR1_RTS0_NUM_THRES | MT_AGG_PCR1_RTS0_LEN_THRES;
@@ -247,19 +247,19 @@
 +		val = MT_AGG_PCR1_RTS0_NUM_THRES_MT7916 |
 +		      MT_AGG_PCR1_RTS0_LEN_THRES_MT7916;
 +
-+	mt76_wr(dev, MT_AGG_PCR0(phy->band_idx, 1), val);
++	mt76_wr(dev, MT_AGG_PCR0(band, 1), val);
  
- 	mt76_clear(dev, MT_AGG_MRCR(phy->band_idx), MT_AGG_MRCR_BAR_CNT_LIMIT |
+ 	mt76_clear(dev, MT_AGG_MRCR(band), MT_AGG_MRCR_BAR_CNT_LIMIT |
  		   MT_AGG_MRCR_LAST_RTS_CTS_RN | MT_AGG_MRCR_RTS_FAIL_LIMIT |
-@@ -392,10 +422,19 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+@@ -394,10 +424,19 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
  
- 	mt76_wr(dev, MT_TMAC_TFCR0(phy->band_idx), 0);
- 	mt76_clear(dev, MT_TMAC_TCR0(phy->band_idx), MT_TMAC_TCR0_TBTT_STOP_CTRL);
-+	mt76_set(dev, MT_TMAC_TCR2(phy->band_idx), MT_TMAC_TCR2_SCH_DET_DIS);
+ 	mt76_wr(dev, MT_TMAC_TFCR0(band), 0);
+ 	mt76_clear(dev, MT_TMAC_TCR0(band), MT_TMAC_TCR0_TBTT_STOP_CTRL);
++	mt76_set(dev, MT_TMAC_TCR2(band), MT_TMAC_TCR2_SCH_DET_DIS);
  
  	/* config rx filter for testmode rx */
- 	mt76_wr(dev, MT_WF_RFCR(phy->band_idx), 0xcf70a);
- 	mt76_wr(dev, MT_WF_RFCR1(phy->band_idx), 0);
+ 	mt76_wr(dev, MT_WF_RFCR(band), 0xcf70a);
+ 	mt76_wr(dev, MT_WF_RFCR1(band), 0);
 +
 +	if (is_mt7916(&dev->mt76)) {
 +		/* enable MDP Tx block mode */
@@ -271,7 +271,7 @@
  }
  
  static void
-@@ -415,6 +454,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -417,6 +456,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
  	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
  
@@ -280,7 +280,7 @@
  	if (!en)
  		mt7915_tm_set_tam_arb(phy, en, 0);
  }
-@@ -477,18 +518,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -479,18 +520,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
  
@@ -298,7 +298,7 @@
 +		u8 _rsv[2];
 +	} __packed req = {
 +		.format_id = CMD_RX_STAT_BAND,
-+		.band = phy != &dev->phy,
++		.band = phy->mt76->band_idx,
 +	};
 +	int ret;
 +
@@ -337,7 +337,7 @@
  		mt7915_tm_update_channel(phy);
  
  		/* read-clear */
--		mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
+-		mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
 +		mt7915_tm_get_rx_stats(phy, true);
 +
 +		/* clear fw count */
@@ -347,7 +347,7 @@
  		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
  	}
  }
-@@ -718,12 +804,8 @@ static int
+@@ -721,12 +807,8 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -360,15 +360,15 @@
  
  	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
  	if (!rx)
-@@ -767,15 +849,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -770,15 +852,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
--	cnt = mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
+-	cnt = mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
 -	fcs_err = is_mt7915(&dev->mt76) ? FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK, cnt) :
 -		FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK_MT7916, cnt);
 -
--	q = phy->band_idx ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
+-	q = phy->mt76->band_idx ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
 -	mphy->test.rx_stats.packets[q] += fcs_err;
 -	mphy->test.rx_stats.fcs_error[q] += fcs_err;
 -
@@ -474,5 +474,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
index 31cddf7..bc80d3f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
@@ -1,4 +1,4 @@
-From b797f4107d893a697b20cfe77ad82a4c8348c397 Mon Sep 17 00:00:00 2001
+From 26061a276c620654542fb96064f6537070e3f278 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
 Subject: [PATCH 1112/1128] mt76: testmode: additional supports
@@ -18,19 +18,19 @@
  mt7915/mmio.c     |    2 +
  mt7915/mt7915.h   |   14 +-
  mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1170 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.c | 1172 ++++++++++++++++++++++++++++++++++++++++++---
  mt7915/testmode.h |  278 +++++++++++
  testmode.c        |  275 +++++++++--
  testmode.h        |   75 +++
  tools/fields.c    |   80 ++++
  tx.c              |    3 +-
- 19 files changed, 1962 insertions(+), 146 deletions(-)
+ 19 files changed, 1963 insertions(+), 147 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index ae22b959..d2891c64 100644
+index fc24b353..dc8d8882 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -535,8 +535,7 @@ free:
+@@ -539,8 +539,7 @@ free:
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index 9a908c9a..f8ca7ba1 100644
+index 19d9efb3..2e0e011d 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,7 +71,7 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 0d87f135..32e2dea0 100644
+index 4822ffb7..58258e19 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -635,6 +635,21 @@ struct mt76_testmode_ops {
@@ -152,7 +152,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1132,6 +1169,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1135,6 +1172,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -212,7 +212,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1142,7 +1232,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1145,7 +1235,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -222,7 +222,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1244,7 +1335,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1247,7 +1338,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -233,7 +233,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index a48903ca..4f17954e 100644
+index cf6ec55f..291a7c12 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
@@ -255,10 +255,10 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 172a926a..e10e92b6 100644
+index 18d6c669..a8ce98c9 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -983,6 +983,7 @@ enum {
+@@ -994,6 +994,7 @@ enum {
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
@@ -266,7 +266,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1184,6 +1185,7 @@ enum {
+@@ -1195,6 +1196,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -275,10 +275,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index d4105835..2f3453b0 100644
+index 172bdcf2..3f0a9d93 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -603,7 +603,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -674,7 +674,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -288,10 +288,10 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 28c6ab35..3b144ad0 100644
+index fc7b7903..0746e4b3 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -629,16 +629,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -628,16 +628,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  {
  #ifdef CONFIG_NL80211_TESTMODE
  	struct mt76_testmode_data *td = &phy->mt76->test;
@@ -333,7 +333,7 @@
  
  	switch (td->tx_rate_mode) {
  	case MT76_TM_TX_MODE_HT:
-@@ -728,13 +750,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -727,13 +749,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  	if (mode >= MT_PHY_TYPE_HE_SU)
  		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
  
@@ -361,12 +361,12 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 75073363..e84d6132 100644
+index 3d309bc0..8527b90a 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -223,7 +223,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -227,7 +227,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mvif->phy = phy;
- 	mvif->mt76.band_idx = phy->band_idx;
+ 	mvif->mt76.band_idx = phy->mt76->band_idx;
  
 -	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
 +	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP && vif->type != NL80211_IFTYPE_MONITOR);
@@ -374,10 +374,10 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 696ca11b..5687e136 100644
+index ec306f01..d4336f69 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -367,6 +367,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -383,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -389,7 +389,7 @@
  	default:
  		break;
  	}
-@@ -398,6 +403,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -414,6 +419,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
  	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
  	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
@@ -397,7 +397,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2781,14 +2787,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2798,14 +2804,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -415,7 +415,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 6a145aef..4bc58c98 100644
+index 2e97db7b..4d86c7f1 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -434,7 +434,7 @@
  };
  
  struct mt7915_mcu_thermal_ctrl {
-@@ -464,6 +469,12 @@ enum {
+@@ -471,6 +476,12 @@ enum {
  
  enum {
  	MT_BF_SOUNDING_ON = 1,
@@ -447,7 +447,7 @@
  	MT_BF_TYPE_UPDATE = 20,
  	MT_BF_MODULE_UPDATE = 25
  };
-@@ -698,10 +709,19 @@ struct mt7915_muru {
+@@ -717,10 +728,19 @@ struct mt7915_muru {
  #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
  
  /* Common Config */
@@ -472,7 +472,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 19518cb5..fef4b126 100644
+index 07de3cbd..26881fdc 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
@@ -492,10 +492,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e6c000a7..cf7fcdfc 100644
+index 415fe82a..6206c7f5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -316,6 +316,9 @@ struct mt7915_phy {
+@@ -315,6 +315,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -505,7 +505,7 @@
  	} test;
  #endif
  
-@@ -415,6 +418,14 @@ struct mt7915_dev {
+@@ -414,6 +417,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -520,7 +520,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -586,7 +597,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -585,7 +596,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -529,7 +529,7 @@
  int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -623,6 +634,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -622,6 +633,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -538,7 +538,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 688f7dee..ae4695ae 100644
+index d6a05f13..e8768488 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -559,7 +559,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 931d1db2..d9d43cb7 100644
+index 46939191..e0ba088f 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -635,7 +635,7 @@
  		.testmode_en = 1,
  		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
 -		.param.clean.wcid = wcid,
- 		.param.clean.band = phy->band_idx,
+ 		.param.clean.band = phy->mt76->band_idx,
  	};
  
 -	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
@@ -654,6 +654,15 @@
  }
  
  static int
+@@ -141,7 +189,7 @@ mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
+ 		.testmode_en = 1,
+ 		.param_idx = MCU_ATE_SET_PHY_COUNT,
+ 		.param.cfg.enable = control,
+-		.param.cfg.band = phy != &dev->phy,
++		.param.cfg.band = phy->mt76->band_idx,
+ 	};
+ 
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
 @@ -182,12 +230,738 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
  	return mt7915_mcu_set_muru_ctrl(dev, MURU_SET_ARB_OP_MODE, op_mode);
  }
@@ -673,7 +682,7 @@
 +		.testmode_en = !(phy->mt76->test.state == MT76_TM_STATE_OFF),
 +		.param_idx = cfg_cmd[td->cfg.type],
 +		.param.cfg.enable = td->cfg.enable,
-+		.param.cfg.band = phy->band_idx,
++		.param.cfg.band = phy->mt76->band_idx,
 +	};
 +
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
@@ -775,12 +784,12 @@
 +	}
 +
 +	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
-+		memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
++		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
 +	if (td->tx_rate_mode >= MT76_TM_TX_MODE_VHT)
-+		memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
++		memcpy(&sta->deflink.vht_cap, &sband->vht_cap, sizeof(sta->deflink.vht_cap));
 +	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_SU)
-+		memcpy(&sta->he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
-+		       sizeof(sta->he_cap));
++		memcpy(&sta->deflink.he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
++		       sizeof(sta->deflink.he_cap));
 +	sta->aid = aid;
 +	sta->wme = 1;
 +
@@ -956,7 +965,7 @@
 +		.category = MT_BF_IBF_PHASE_COMP,
 +		.bw = val[0],
 +		.jp_band = (val[2] == 1) ? 1 : 0,
-+		.dbdc_idx = phy->band_idx,
++		.dbdc_idx = phy->mt76->band_idx,
 +		.read_from_e2p = val[3],
 +		.disable = val[4],
 +	};
@@ -1395,7 +1404,7 @@
  	struct edca *e = &req.edca[0];
  
  	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
-@@ -262,7 +1036,8 @@ done:
+@@ -263,7 +1037,8 @@ done:
  
  	return mt7915_tm_set_wmm_qid(phy,
  				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
@@ -1405,7 +1414,7 @@
  }
  
  static int
-@@ -338,7 +1113,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+@@ -339,7 +1114,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
  	bitrate = cfg80211_calculate_bitrate(&rate);
  	tx_len = bitrate * tx_time / 10 / 8;
  
@@ -1414,7 +1423,7 @@
  	if (ret)
  		return ret;
  
-@@ -456,64 +1231,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -458,64 +1233,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  
  	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
  
@@ -1554,7 +1563,7 @@
 +		u8 _rsv[2];
 +		__le32 tx_count;
 +	} __packed req = {
-+		.band = phy != &dev->phy,
++		.band = phy->mt76->band_idx,
 +		.enable = enable,
 +		.tx_count = enable ? cpu_to_le32(tx_count) : 0,
 +	};
@@ -1673,7 +1682,7 @@
  
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
-@@ -542,10 +1480,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -544,10 +1482,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  		return ret;
  
  	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
@@ -1684,7 +1693,7 @@
  
  	if (!clear) {
  		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
-@@ -560,13 +1494,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -562,13 +1496,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  	return 0;
  }
  
@@ -1699,7 +1708,7 @@
 +		u8 _rsv;
 +		__le16 wlan_idx;
 +	} __packed req = {
-+		.band = phy->band_idx,
++		.band = phy->mt76->band_idx,
 +	};
 +
 +	mt76_tm_for_each_entry(phy->mt76, wcid, ed)
@@ -1722,7 +1731,7 @@
 +	struct mt7915_tm_cmd req = {
 +		.testmode_en = 1,
 +		.param_idx = MCU_ATE_SET_MU_RX_AID,
-+		.param.rx_aid.band = cpu_to_le32(phy->band_idx),
++		.param.rx_aid.band = cpu_to_le32(phy->mt76->band_idx),
 +		.param.rx_aid.aid = cpu_to_le16(aid),
 +	};
 +
@@ -1747,7 +1756,7 @@
  
  		/* read-clear */
  		mt7915_tm_get_rx_stats(phy, true);
-@@ -574,9 +1556,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -576,9 +1558,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  		/* clear fw count */
  		mt7915_tm_set_phy_count(phy, 0);
  		mt7915_tm_set_phy_count(phy, 1);
@@ -1762,9 +1771,9 @@
  }
  
  static int
-@@ -614,34 +1599,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+@@ -617,34 +1602,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  	tx_cont->tx_ant = td->tx_antenna_mask;
- 	tx_cont->band = phy->band_idx;
+ 	tx_cont->band = band;
  
 -	switch (chandef->width) {
 -	case NL80211_CHAN_WIDTH_40:
@@ -1797,8 +1806,8 @@
 +	tx_cont->bw = mt7915_tm_chan_bw(chandef->width);
  
  	if (!en) {
- 		req.op.rf.param.func_data = cpu_to_le32(phy->band_idx);
-@@ -725,6 +1683,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ 		req.op.rf.param.func_data = cpu_to_le32(band);
+@@ -728,6 +1686,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
  	if (changed & BIT(TM_CHANGED_TXPOWER))
  		mt7915_tm_set_tx_power(phy);
@@ -1811,7 +1820,7 @@
  }
  
  static int
-@@ -804,6 +1768,7 @@ static int
+@@ -807,6 +1771,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1819,7 +1828,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -849,11 +1814,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -852,11 +1817,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -2902,10 +2911,10 @@
  };
  
 diff --git a/tx.c b/tx.c
-index c8d78b0a..c7cd842c 100644
+index 1f309d05..6d55566f 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
+@@ -250,8 +250,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -2916,5 +2925,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
index a9882c1..676491e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
@@ -1,4 +1,4 @@
-From 2ae175cba8bc0192c251c380d00448fb08a709a5 Mon Sep 17 00:00:00 2001
+From 0efb01a98e1abbe39c141df4f7ab6aa2bbb55ad8 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
 Subject: [PATCH 1113/1128] mt76: testmode: add pre-cal support
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 1e41b94d..e083964b 100644
+index 0a88048b..cb6ff17a 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,7 +37,7 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 32e2dea0..2beb1056 100644
+index 58258e19..89c85709 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -636,6 +636,7 @@ struct mt76_testmode_ops {
@@ -49,10 +49,10 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e10e92b6..4e489244 100644
+index a8ce98c9..f42946ec 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -979,6 +979,7 @@ enum {
+@@ -990,6 +990,7 @@ enum {
  
  /* ext event table */
  enum {
@@ -114,10 +114,10 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5687e136..d1ff73a9 100644
+index d4336f69..92bae4f7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -371,6 +371,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -387,6 +387,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BF_STATUS_READ:
  		mt7915_tm_txbf_status_read(dev, skb);
  		break;
@@ -127,7 +127,7 @@
  #endif
  	default:
  		break;
-@@ -2882,7 +2885,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2901,7 +2904,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -136,7 +136,7 @@
  		return 0;
  
  	/*
-@@ -2962,11 +2965,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -2981,11 +2984,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index cf7fcdfc..cafd4389 100644
+index 6206c7f5..ed1469d6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -402,6 +402,10 @@ struct mt7915_dev {
+@@ -401,6 +401,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -635,6 +639,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -634,6 +638,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index d9d43cb7..c6a5837e 100644
+index e0ba088f..a9e57e4b 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -203,7 +203,7 @@
  
  enum {
  	TM_CHANGED_TXPOWER,
-@@ -1578,17 +1579,15 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
+@@ -1580,18 +1581,16 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
  static int
  mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  {
@@ -216,6 +216,7 @@
 -	u32 func_idx = en ? TX_CONT_START : TX_CONT_STOP;
 +	u32 func_idx = en ? RF_TEST_TX_CONT_START : RF_TEST_TX_CONT_STOP;
  	u8 rate_idx = td->tx_rate_idx, mode;
+ 	u8 band = phy->mt76->band_idx;
  	u16 rateval;
  	struct mt7915_tm_rf_test req = {
 -		.action = 1,
@@ -223,7 +224,7 @@
  		.icap_len = 120,
  		.op.rf.func_idx = cpu_to_le32(func_idx),
  	};
-@@ -1673,6 +1672,316 @@ out:
+@@ -1676,6 +1675,316 @@ out:
  				 sizeof(req), true);
  }
  
@@ -277,7 +278,7 @@
 +		}
 +		dev_info(dev->mt76.dev, "Group Pre-Cal:\n");
 +		for (i = 0; i < (group_size / sizeof(u32)); i += 4) {
-+			dev_info(dev->mt76.dev, "[0x%08x] 0x%8x 0x%8x 0x%8x 0x%8x\n",
++			dev_info(dev->mt76.dev, "[0x%08lx] 0x%8x 0x%8x 0x%8x 0x%8x\n",
 +				 i * sizeof(u32), pre_cal[i], pre_cal[i + 1],
 +				 pre_cal[i + 2], pre_cal[i + 3]);
 +		}
@@ -404,7 +405,7 @@
 +		}
 +
 +		req.op.rf.param.cal_param.func_data = func_data;
-+		req.op.rf.param.cal_param.band_idx = phy->band_idx;
++		req.op.rf.param.cal_param.band_idx = phy->mt76->band_idx;
 +
 +		memcpy(&chan_backup, chandef->chan, sizeof(struct ieee80211_channel));
 +		memcpy(&chandef_backup, chandef, sizeof(struct cfg80211_chan_def));
@@ -458,7 +459,7 @@
 +		dev_info(dev->mt76.dev, "DPD Pre-Cal:\n");
 +		for (i = 0; i < dpd_size / sizeof(u32); i += 4) {
 +			j = i + (group_size / sizeof(u32));
-+			dev_info(dev->mt76.dev, "[0x%08x] 0x%8x 0x%8x 0x%8x 0x%8x\n",
++			dev_info(dev->mt76.dev, "[0x%08lx] 0x%8x 0x%8x 0x%8x 0x%8x\n",
 +				 j * sizeof(u32), pre_cal[j], pre_cal[j + 1],
 +				 pre_cal[j + 2], pre_cal[j + 3]);
 +		}
@@ -540,7 +541,7 @@
  static void
  mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  {
-@@ -1712,6 +2021,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -1715,6 +2024,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	else if (prev_state == MT76_TM_STATE_OFF ||
  		 state == MT76_TM_STATE_OFF)
  		mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
@@ -551,7 +552,7 @@
  
  	if ((state == MT76_TM_STATE_IDLE &&
  	     prev_state == MT76_TM_STATE_OFF) ||
-@@ -1873,9 +2186,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+@@ -1876,9 +2189,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
  	return ret;
  }
  
@@ -842,5 +843,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
index d37122d..87c53f9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,4 +1,4 @@
-From 872894745f05c7fb7c2928cd6bd8395af47933c1 Mon Sep 17 00:00:00 2001
+From 2a26fd854c3b09d271571505cb22075fef30ae36 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
 Subject: [PATCH 1114/1128] mt76: testmode: add iBF command mode support
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index c6a5837e..9de11e98 100644
+index a9e57e4b..99582d9c 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -88,7 +88,7 @@
  	default:
  		break;
  	};
-@@ -1071,7 +1080,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+@@ -1072,7 +1081,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
  		rate.legacy = sband->bitrates[rate.mcs].bitrate;
  		break;
  	case MT76_TM_TX_MODE_HT:
@@ -96,7 +96,7 @@
  		flags |= RATE_INFO_FLAGS_MCS;
  
  		if (td->tx_rate_sgi)
-@@ -1435,7 +1443,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1437,7 +1445,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  			if (duty_cycle < 100)
  				tx_time = duty_cycle * ipg / (100 - duty_cycle);
  		}
@@ -239,5 +239,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 5b05b06..9d0b040 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,4 +1,4 @@
-From 189f75c624438287c7228eb029f07e7a79cbccff Mon Sep 17 00:00:00 2001
+From 98bf3fe9efb60744e0de0cdbc16b6954d4586d2c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
 Subject: [PATCH 1115/1128] mt76: testmode: add ZWDFS test mode support
@@ -19,7 +19,7 @@
  10 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 2beb1056..8139b4ad 100644
+index 89c85709..2bacc1b4 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -719,6 +719,15 @@ struct mt76_testmode_data {
@@ -39,10 +39,10 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4e489244..c353341e 100644
+index f42946ec..7853e074 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1179,6 +1179,7 @@ enum {
+@@ -1190,6 +1190,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -50,7 +50,7 @@
  	MCU_EXT_CMD_RX_STAT = 0xa4,
  	MCU_EXT_CMD_SET_SPR = 0xa8,
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
-@@ -1189,6 +1190,7 @@ enum {
+@@ -1200,6 +1201,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
@@ -59,18 +59,18 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d1ff73a9..51ec151b 100644
+index 92bae4f7..87d2c0de 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2620,6 +2620,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+@@ -2636,6 +2636,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
  		req.monitor_chan = chandef->chan->hw_value;
  		req.monitor_central_chan =
  			ieee80211_frequency_to_channel(chandef->center_freq1);
 +		req.monitor_bw = mt76_connac_chan_bw(chandef);
- 		req.band_idx = phy->band_idx;
+ 		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4450,3 +4451,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4466,3 +4467,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -91,7 +91,7 @@
 +		u32 idle_power_cmd_type;
 +	} __packed req = {
 +		.ipi_hist_idx = cmd,
-+		.band_idx = phy->band_idx,
++		.band_idx = phy->mt76->band_idx,
 +	};
 +
 +	if (!wait_resp)
@@ -123,7 +123,7 @@
 +	} __packed req = {
 +		.mode = mode,
 +		.pd_setting = 1,
-+		.band_idx = phy->band_idx,
++		.band_idx = phy->mt76->band_idx,
 +	};
 +
 +	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(IPI_HIST_SCAN),
@@ -140,10 +140,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 4bc58c98..300b7834 100644
+index 4d86c7f1..9a485249 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -609,6 +609,52 @@ struct csi_data {
+@@ -628,6 +628,52 @@ struct csi_data {
  };
  #endif
  
@@ -197,10 +197,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index cafd4389..0cbd02e2 100644
+index ed1469d6..26bcb4e5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -304,6 +304,7 @@ struct mt7915_phy {
+@@ -303,6 +303,7 @@ struct mt7915_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -208,7 +208,7 @@
  
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
-@@ -753,6 +754,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -752,6 +753,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -219,10 +219,10 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index ae4695ae..6aa98812 100644
+index e8768488..f4b57099 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -1187,6 +1187,8 @@ enum offs_rev {
+@@ -1194,6 +1194,8 @@ enum offs_rev {
  #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
  #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
  
@@ -232,7 +232,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 9de11e98..6ce2c0e6 100644
+index 99582d9c..2ae6c07f 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -406,14 +406,14 @@
 +		if (self_idle_ratio <= td->ipi_threshold) {
 +			dev_info(dev->mt76.dev,
 +				 "band[%d]: self idle ratio = %d%%, idle ratio = %d%%\n",
-+				 phy->band_idx, self_idle_ratio, ipi_idle_ratio);
++				 phy->mt76->band_idx, self_idle_ratio, ipi_idle_ratio);
 +			return;
 +		}
 +
 +		channel_load = (100 * channel_load) / self_idle_ratio;
 +		dev_info(dev->mt76.dev,
 +			 "band[%d]: chan load = %d%%, self idle ratio = %d%%, idle ratio = %d%%\n",
-+			 phy->band_idx, channel_load, self_idle_ratio, ipi_idle_ratio);
++			 phy->mt76->band_idx, channel_load, self_idle_ratio, ipi_idle_ratio);
 +		antenna_idx++;
 +	}
 +}
@@ -429,7 +429,7 @@
 +	if (!is_mt7915(&dev->mt76)) {
 +		struct mt7915_mcu_rdd_ipi_scan data;
 +
-+		if (phy->band_idx)
++		if (phy->mt76->band_idx)
 +			start_antenna_idx = 4;
 +
 +		/* Use all antenna */
@@ -478,7 +478,7 @@
  static int
  mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
  		      u16 cw_max, u16 txop, u8 tx_cmd)
-@@ -1247,6 +1469,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -1249,6 +1471,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  		phy->mt76->test.tx_mpdu_len = 0;
  		phy->test.bf_en = 0;
  		mt7915_tm_set_entry(phy);
@@ -487,7 +487,7 @@
  	}
  }
  
-@@ -2005,6 +2229,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -2008,6 +2232,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_cfg(phy);
  	if (changed & BIT(TM_CHANGED_TXBF_ACT))
  		mt7915_tm_set_txbf(phy);
@@ -682,5 +682,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 9e4c950..18a49c0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,4 +1,4 @@
-From 5d6beb19bab77695d83719719a179437f7674806 Mon Sep 17 00:00:00 2001
+From 3a0e0ac5413c0705e0cb997c276f75360875b584 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
 Subject: [PATCH 1116/1128] mt76: mt7915: init rssi in WTBL when add station
@@ -8,10 +8,10 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index e84d6132..9180689e 100644
+index 8527b90a..0396031c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -671,6 +671,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy;
  #endif
  	int ret, idx;
@@ -19,7 +19,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -689,6 +690,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -694,6 +695,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 5331089..3a727dc 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,4 +1,4 @@
-From 540e6d1ba99002e4ac0cc0ae93022ee20592e5c4 Mon Sep 17 00:00:00 2001
+From 34332523e19b7689147f83936bac106934f935e0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
 Subject: [PATCH 1117/1128] mt76: mt7915: reduce TWT SP sent to FW for cert
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 51ec151b..8ebe38f0 100644
+index 87d2c0de..11732993 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3773,7 +3773,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3789,7 +3789,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
@@ -24,5 +24,5 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
index bcdd484..113fd2e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,4 +1,4 @@
-From bb596598ed5abff5cdf4ab659d77419573436baf Mon Sep 17 00:00:00 2001
+From b456d43fa8c053eb10dd20f29b61f0cdb25550a1 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
 Subject: [PATCH 1118/1128] mt76: connac: airtime fairness feature off in
@@ -9,10 +9,10 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index f8ca7ba1..7e0f0e0e 100644
+index 2e0e011d..de9ef237 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
+@@ -435,7 +435,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
  			WIPHY_FLAG_AP_UAPSD;
  
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
@@ -21,5 +21,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index 7bc97f8..df9eb33 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,4 +1,4 @@
-From 2118a1b7be90a8ab8894e0094fbe4e14e498c767 Mon Sep 17 00:00:00 2001
+From 6e7838964db8b046363f479ce898b18e09ed30fc Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
 Subject: [PATCH 1119/1128] mt76: mt7915: add mt7986 and mt7916 pre-calibration
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 0bce0ce5..0f5862e3 100644
+index 24efa280..7bdd4d52 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8ebe38f0..97b1cf3b 100644
+index 11732993..ca2e4029 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2884,7 +2884,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2903,7 +2903,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2922,9 +2923,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2941,9 +2942,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2932,34 +2933,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2951,34 +2952,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -2991,24 +3027,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3010,24 +3046,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
index 2012df4..d7cd7f4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,4 +1,4 @@
-From b7a732694ec0bffaa3ff2805cdd6600ba3b598a9 Mon Sep 17 00:00:00 2001
+From f93d67b6ae1b70d4fcf95db93951627362d174c8 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
 Subject: [PATCH 1120/1128] mt76: mt7915: add phy capability vendor command
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0cbd02e2..69f1b6b4 100644
+index 26bcb4e5..66695d5b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
index 940b835..7edac8d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
@@ -1,4 +1,4 @@
-From c33574d98607b2ff23a683fb30a8de2ebbc9c8f2 Mon Sep 17 00:00:00 2001
+From b36a1933047e93c0d3a048c53dfdd5a395a833cd Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
 Subject: [PATCH 1121/1128] mt76: mt7915: add vendor subcmd EDCCA ctrl
@@ -11,15 +11,15 @@
  mt7915/mcu.c      |  72 +++++++++++++++++++++++++
  mt7915/mcu.h      |  21 ++++++++
  mt7915/mt7915.h   |   3 +-
- mt7915/vendor.c   | 134 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.c   | 132 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7915/vendor.h   |  33 ++++++++++++
- 7 files changed, 266 insertions(+), 1 deletion(-)
+ 7 files changed, 264 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c353341e..9339b711 100644
+index 7853e074..88bfd09f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1189,6 +1189,7 @@ enum {
+@@ -1200,6 +1200,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -28,10 +28,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 9180689e..83b97d23 100644
+index 0396031c..94b7a651 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -454,6 +454,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -458,6 +458,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  			mutex_unlock(&dev->mt76.mutex);
  		}
  #endif
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 97b1cf3b..cd6f3292 100644
+index ca2e4029..7507344a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4552,3 +4552,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4568,3 +4568,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -67,7 +67,7 @@
 +		u8 region;
 +		s8 thres_compensation;
 +	} __packed req = {
-+		.band_idx = phy->band_idx,
++		.band_idx = phy->mt76->band_idx,
 +		.cmd_idx = mode,
 +		.record_in_fw = false,
 +		.thres_compensation = compensation,
@@ -101,7 +101,7 @@
 +		u8 region;
 +		s8 thres_compensation;
 +	} __packed req = {
-+		.band_idx = phy->band_idx,
++		.band_idx = phy->mt76->band_idx,
 +		.cmd_idx = mode,
 +		.record_in_fw = false,
 +	};
@@ -122,10 +122,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 300b7834..de265d15 100644
+index 9a485249..33e33d89 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -866,6 +866,27 @@ enum {
+@@ -885,6 +885,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -154,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 69f1b6b4..aaab5f7a 100644
+index 66695d5b..5bffcff5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -754,7 +754,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -753,7 +753,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -168,7 +168,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..cd5c3b83 100644
+index 77d71e48..2484e25f 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -196,7 +196,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1015,6 +1033,110 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1015,6 +1033,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -266,9 +266,7 @@
 +{
 +	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 +	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
 +	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
-+	void *a;
 +	int len = EDCCA_THRES_NUM;
 +	int err;
 +	u8 edcca_mode;
@@ -307,7 +305,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1083,6 +1205,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1083,6 +1203,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_phy_capa_ctrl_dump,
  		.policy = phy_capa_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
@@ -378,5 +376,5 @@
  
  enum mtk_capi_control_changed {
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
index 1357d9a..01962a8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,4 +1,4 @@
-From a811ab8ab270c406e6360910a3dc09255990b3aa Mon Sep 17 00:00:00 2001
+From 117480121b8833507a563ecd319bcf57c270b977 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
 Subject: [PATCH 1122/1128] mt76: mt7915: implement bin file mode
@@ -7,14 +7,14 @@
 ---
  eeprom.c             | 18 +++++++++++++++
  mt76.h               |  1 +
- mt7915/eeprom.c      | 52 ++++++++++++++++++++------------------------
- mt7915/eeprom.h      | 44 +++++++++++++++++++++++++++++++++++++
- mt7915/mt7915.h      | 17 ++++++++++++---
+ mt7915/eeprom.c      | 53 ++++++++++++++++++++------------------------
+ mt7915/eeprom.h      | 44 ++++++++++++++++++++++++++++++++++++
+ mt7915/mt7915.h      | 17 +++++++++++---
  mt7915/mtk_debugfs.c | 41 ++++++++++++++++++++++++++++++++++
- 6 files changed, 141 insertions(+), 32 deletions(-)
+ 6 files changed, 142 insertions(+), 32 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index e083964b..5b9faf7e 100644
+index cb6ff17a..aac70efb 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -43,10 +43,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 8139b4ad..db2075c3 100644
+index 2bacc1b4..d102333b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1027,6 +1027,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1029,6 +1029,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -55,7 +55,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 0f5862e3..4d2d9ca2 100644
+index 7bdd4d52..64a7750b 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -42,33 +42,6 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
@@ -112,15 +112,16 @@
  	} else {
  		u8 free_block_num;
  		u32 block_num, i;
-@@ -121,6 +98,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 		for (i = 0; i < block_num; i++)
- 			mt7915_mcu_get_eeprom(dev,
- 					      i * MT7915_EEPROM_BLOCK_SIZE);
+@@ -126,6 +103,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ 			if (ret < 0)
+ 				return ret;
+ 		}
++
 +		dev->eeprom_mode = EFUSE_MODE;
  	}
  
  	return mt7915_check_eeprom(dev);
-@@ -224,12 +202,28 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -231,12 +210,28 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
  
@@ -213,7 +214,7 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index aaab5f7a..5a206f7a 100644
+index 5bffcff5..239eef58 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -42,15 +42,24 @@
@@ -244,7 +245,7 @@
  #define MT7915_EEPROM_SIZE		3584
  #define MT7916_EEPROM_SIZE		4096
  
-@@ -397,6 +406,8 @@ struct mt7915_dev {
+@@ -396,6 +405,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -254,7 +255,7 @@
  	bool ibf;
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index d96f222a..9a9e0cb6 100644
+index d96f222a..376e5f89 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
@@ -274,10 +275,10 @@
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	struct mt76_dev *mdev = &dev->mt76;
 +#ifdef CONFIG_NL80211_TESTMODE
-+	char *mtd_name = mdev->test_mtd.name;
++	const char *mtd_name = mdev->test_mtd.name;
 +	u32 mtd_offset = mdev->test_mtd.offset;
 +#else
-+	char *mtd_name;
++	const char *mtd_name = NULL;
 +	u32 mtd_offset;
 +#endif
 +
@@ -320,5 +321,5 @@
  }
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
index d34181e..49d45f1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
@@ -1,4 +1,4 @@
-From 010250dee3f031e1de7edc5c867b2057454a61a0 Mon Sep 17 00:00:00 2001
+From 409f3949513cb8bf94d696401be9864d0363b22f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
 Subject: [PATCH 1123/1128] mt76: mt7915: initialize wcid
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3b144ad0..dc4c6eb3 100644
+index 0746e4b3..22dd66e3 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1031,7 +1031,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1030,7 +1030,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
index 74a5e86..75e864d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
@@ -1,16 +1,16 @@
-From 88e63910976d94c67751edc6a430b27d1049bb6a Mon Sep 17 00:00:00 2001
+From c977d69ea6fd5a6db3e889ef6d3baaae19d2aee7 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
 Subject: [PATCH 1124/1128] mt76: mt7915: Add hemu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
- mt7915/vendor.c | 26 ++++++++++++++++++++++++++
+ mt7915/vendor.c | 25 +++++++++++++++++++++++++
  mt7915/vendor.h |  1 +
- 2 files changed, 27 insertions(+)
+ 2 files changed, 26 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index cd5c3b83..5e34b852 100644
+index 2484e25f..f7becce9 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -21,7 +21,7 @@
  };
  
  static const struct nla_policy
-@@ -1004,6 +1005,30 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
+@@ -1004,6 +1005,29 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -34,7 +34,6 @@
 +	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
 +	struct mt7915_phy *phy = mt7915_hw_phy(hw);
 +	struct mt7915_dev *dev = phy->dev;
-+	void *a;
 +	int len = 0;
 +
 +	if (*storage == 1)
@@ -52,7 +51,7 @@
  static int
  mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1192,6 +1217,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1190,6 +1214,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
  			WIPHY_VENDOR_CMD_NEED_RUNNING,
  		.doit = mt7915_vendor_hemu_ctrl,
@@ -73,5 +72,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 88f7b33..5a73958 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,4 +1,4 @@
-From f7ab85c232e5f4048e3f2a2bdc1141915d503ae4 Mon Sep 17 00:00:00 2001
+From f865459f3adbb780091ef0346f93ce65130412d4 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
 Subject: [PATCH 1125/1128] mt76: mt7915: add vendor subcmd three wire (PTA)
@@ -16,10 +16,10 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9339b711..131257c7 100644
+index 88bfd09f..5cff1a45 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1188,7 +1188,7 @@ enum {
+@@ -1199,7 +1199,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -29,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index cd6f3292..4e7bc982 100644
+index 7507344a..5791cb29 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4234,37 +4234,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4250,37 +4250,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,10 +94,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index de265d15..9780f128 100644
+index 33e33d89..08476eb6 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -655,6 +655,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -674,6 +674,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -134,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5a206f7a..626b2634 100644
+index 239eef58..22454b54 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -757,6 +757,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -756,6 +756,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5e34b852..6b86b77a 100644
+index f7becce9..fb760e17 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -170,7 +170,7 @@
  		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
  	}
  
-@@ -1117,6 +1122,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
+@@ -1116,6 +1121,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -178,7 +178,7 @@
  static int
  mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1162,6 +1168,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1159,6 +1165,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -210,7 +210,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1243,6 +1274,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1240,6 +1271,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_edcca_ctrl_dump,
  		.policy = edcca_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
@@ -268,5 +268,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 47606a0..5cf8574 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,19 +1,19 @@
-From c327c081324034c44660ded9a50848da27c81879 Mon Sep 17 00:00:00 2001
+From 191b449eb978f73b95143e8cf3ec1765b73eb609 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
 Subject: [PATCH 1126/1128] mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
- mt7915/vendor.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h | 25 ++++++++++++++++-
- 2 files changed, 95 insertions(+), 1 deletion(-)
+ mt7915/vendor.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 25 ++++++++++++++++++-
+ 2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 6b86b77a..e4915623 100644
+index fb760e17..22af66d5 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
-@@ -86,6 +86,17 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
+@@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
         [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
  };
  
@@ -22,16 +22,10 @@
 +	[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
 +};
 +
-+static struct nla_policy
-+ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
-+	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
-+};
-+
-+
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1192,6 +1203,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
+@@ -1189,6 +1194,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
  	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
  }
  
@@ -86,7 +80,7 @@
  
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
-@@ -1285,6 +1344,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1282,6 +1335,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_3wire_ctrl,
  		.policy = three_wire_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
@@ -147,5 +141,5 @@
 +
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index f2b554d..b7ae10e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,4 +1,4 @@
-From ccbf47f2ebfed7523d92f17bd74352bd88779869 Mon Sep 17 00:00:00 2001
+From 5a4f3c3d504087725ef9f47191b4a8edbf27b70e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
 Subject: [PATCH 1127/1128] mt76: mt7915: add E3 re-bonding for low yield rate
@@ -12,19 +12,19 @@
  3 files changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4d2d9ca2..b3d2bbc5 100644
+index 64a7750b..efa9c173 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -97,7 +97,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 					 MT7915_EEPROM_BLOCK_SIZE);
- 		for (i = 0; i < block_num; i++)
- 			mt7915_mcu_get_eeprom(dev,
--					      i * MT7915_EEPROM_BLOCK_SIZE);
-+					      i * MT7915_EEPROM_BLOCK_SIZE, NULL);
- 		dev->eeprom_mode = EFUSE_MODE;
- 	}
- 
-@@ -198,6 +198,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+@@ -99,7 +99,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ 		/* read eeprom data from efuse */
+ 		block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
+ 		for (i = 0; i < block_num; i++) {
+-			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size);
++			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size, NULL);
+ 			if (ret < 0)
+ 				return ret;
+ 		}
+@@ -206,6 +206,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  	dev->chainshift = hweight8(dev->mphy.chainmask);
  }
  
@@ -54,7 +54,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
-@@ -229,6 +252,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -237,6 +260,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  			return ret;
  	}
  
@@ -64,10 +64,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 4e7bc982..dfb1ee69 100644
+index 5791cb29..785c3c10 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2805,7 +2805,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+@@ -2822,7 +2822,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
  				 &req, sizeof(req), true);
  }
  
@@ -76,7 +76,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2822,8 +2822,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2840,8 +2840,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -95,10 +95,10 @@
  
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 626b2634..701e5c86 100644
+index 22454b54..2d3769c6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -562,6 +562,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -561,6 +561,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
@@ -106,7 +106,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev);
  void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  				struct mt7915_phy *phy);
-@@ -615,7 +616,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -614,7 +615,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
  int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
@@ -116,5 +116,5 @@
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
index 97fe88d..00543cf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,4 +1,4 @@
-From d8e79f875fb1c569d10c1c214021b1629f4118a3 Mon Sep 17 00:00:00 2001
+From 3fb208eb0a314a489cd0f0c74d22cc01e6d99822 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
 Subject: [PATCH 1128/1128] mt76: mt7915: support on off SW ACI through debugfs
@@ -11,10 +11,10 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 131257c7..3b789d75 100644
+index 5cff1a45..98b00747 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1190,6 +1190,7 @@ enum {
+@@ -1201,6 +1201,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_SET_CFG = 0xb7,
  	MCU_EXT_CMD_EDCCA = 0xba,
@@ -23,7 +23,7 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9a9e0cb6..ddde4961 100644
+index 376e5f89..846dc5e3 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2932,6 +2932,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
@@ -62,5 +62,5 @@
  }
  #endif
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
index 0c3111e..84aeced 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From 4e69db534b8abba258baefdd7897907d70234857 Mon Sep 17 00:00:00 2001
+From 30ce8783532bc157e2639b4a91aecb3c050d1bf6 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 3001/3010] mt76: mt7915: wed: add wed tx support
+Subject: [PATCH 3001/3011] mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -24,10 +24,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index dc4c6eb3..d07bf790 100644
+index 22dd66e3..5373777a 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -890,9 +890,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -889,9 +889,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -39,7 +39,7 @@
  }
  
  static void
-@@ -1008,6 +1008,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1007,6 +1007,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -47,7 +47,7 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1063,12 +1064,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1062,12 +1063,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -65,10 +65,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 83b97d23..2d237abf 100644
+index 94b7a651..370bfad7 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1505,14 +1505,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1512,14 +1512,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -86,7 +86,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index fef4b126..7a50aa11 100644
+index 26881fdc..ac574722 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -11,7 +11,7 @@
@@ -107,7 +107,7 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  
  	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-@@ -783,6 +783,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -790,6 +790,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
@@ -116,5 +116,5 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
index ec71b11..a9f6d89 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,7 +1,7 @@
-From b1b86c7f0be6ae9e2ff171f0469c332bf820c849 Mon Sep 17 00:00:00 2001
+From a92a1c7b40b57f5d6594ae8170d7d9e3cd993aef Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
-Subject: [PATCH 3002/3010] mt76: mt7915: wed: add-wed-tx-wds-support-on-mt7986
+Subject: [PATCH 3002/3011] mt76: mt7915: wed: add-wed-tx-wds-support-on-mt7986
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -16,10 +16,10 @@
  8 files changed, 74 insertions(+), 5 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 7e0f0e0e..f0ffbd0c 100644
+index de9ef237..15d300a9 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1371,7 +1371,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -1385,7 +1385,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
  
  	mt76_packet_id_flush(dev, wcid);
  
@@ -32,7 +32,7 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index db2075c3..bb0433b2 100644
+index d102333b..74818a59 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -465,6 +465,7 @@ struct mt76_driver_ops {
@@ -43,7 +43,7 @@
  };
  
  struct mt76_channel_state {
-@@ -842,6 +843,7 @@ struct mt76_dev {
+@@ -849,6 +850,7 @@ struct mt76_dev {
  	spinlock_t status_lock;
  
  	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
@@ -52,10 +52,10 @@
  
  	u64 vif_mask;
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 2f3453b0..8f32b6a8 100644
+index 3f0a9d93..1ed519be 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -722,6 +722,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -793,6 +793,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  			return ret;
  	}
  
@@ -72,10 +72,10 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2d237abf..8813e3c5 100644
+index 370bfad7..0e08bde6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
+@@ -663,6 +663,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -100,7 +100,7 @@
  int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta)
  {
-@@ -670,8 +688,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -675,8 +693,18 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -120,7 +120,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1141,6 +1169,15 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1148,6 +1176,15 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -136,7 +136,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1512,7 +1549,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1519,7 +1556,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -150,10 +150,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index dfb1ee69..03fd8c50 100644
+index 785c3c10..0ad110ff 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2305,6 +2305,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2321,6 +2321,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  {
  	int ret;
@@ -161,7 +161,7 @@
  
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
-@@ -2334,8 +2335,15 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2350,8 +2351,15 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -180,10 +180,10 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9780f128..5fcac90f 100644
+index 08476eb6..cf1d7d7a 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -281,6 +281,7 @@ enum {
+@@ -288,6 +288,7 @@ enum {
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
  #endif
@@ -192,10 +192,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 7a50aa11..f348a779 100644
+index ac574722..ffe23406 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -991,6 +991,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -998,6 +998,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  		.sta_add = mt7915_mac_sta_add,
  		.sta_remove = mt7915_mac_sta_remove,
  		.update_survey = mt7915_update_channel,
@@ -204,7 +204,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 701e5c86..6bc33f21 100644
+index 2d3769c6..51453058 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -217,7 +217,7 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -725,6 +728,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -724,6 +727,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
@@ -226,5 +226,5 @@
  void mt7915_stats_work(struct work_struct *work);
  int mt76_dfs_start_rdd(struct mt7915_dev *dev, bool force);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
index c11071b..86404b0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,7 +1,7 @@
-From 632b007beff9a0800d2a37d173dee028701ecd02 Mon Sep 17 00:00:00 2001
+From bd9310d73f9c7396d06e60fc10ff554a8e02817f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 12:05:06 +0800
-Subject: [PATCH 3003/3010] mt76: connac: wed: add wed rx copy skb
+Subject: [PATCH 3003/3011] mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 18 insertions(+), 5 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index d2891c64..40885754 100644
+index dc8d8882..53c7528f 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -382,9 +382,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -386,9 +386,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
  
@@ -27,7 +27,7 @@
  
  		mt76_put_rxwi(dev, t);
  
-@@ -578,6 +581,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -568,6 +571,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	while (q->queued < q->ndesc - 1) {
  		struct mt76_txwi_cache *t = NULL;
  		struct mt76_queue_buf qbuf;
@@ -35,7 +35,7 @@
  		void *buf = NULL;
  
  		if ((q->flags & MT_QFLAG_WED) &&
-@@ -585,11 +589,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -575,11 +579,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  			t = mt76_get_rxwi(dev);
  			if (!t)
  				break;
@@ -46,18 +46,18 @@
 +			}
  		}
  
--		buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
+-		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
 -		if (!buf)
 -			break;
 +		if (!skip_alloc) {
-+			buf = page_frag_alloc(rx_page, q->buf_size, GFP_ATOMIC);
++			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
 +			if (!buf)
 +				break;
 +		}
  
  		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
  		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
-@@ -954,5 +965,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -949,5 +960,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  	if (mtk_wed_device_active(&dev->mmio.wed))
  		mtk_wed_device_detach(&dev->mmio.wed);
@@ -66,5 +66,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
index e3e0550..86dff09 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -1,7 +1,7 @@
-From 1bae1f4f3400ed51d57c315c3c003f352ab5f495 Mon Sep 17 00:00:00 2001
+From 705e520c10a4f08bf5b24b56b5ddb015e27c7b99 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3010] mt76: mt7915: wed: add fill receive path to report
+Subject: [PATCH 3004/3011] mt76: mt7915: wed: add fill receive path to report
  wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8813e3c5..52aab3d1 100644
+index 0e08bde6..d8571642 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1560,6 +1560,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1567,6 +1567,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -38,7 +38,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1612,5 +1630,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1619,5 +1637,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
@@ -46,5 +46,5 @@
  #endif
  };
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
index 73feb26..4b36261 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -1,21 +1,21 @@
-From 37113fa0b112098fc65ace049e984438629a6c4f Mon Sep 17 00:00:00 2001
+From 47cfa806f1e2945d1d63f3642207cbdb205e9a12 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:07:46 +0800
-Subject: [PATCH 3005/3010] mt76: mt7915: wed: add ser support when wed on
+Subject: [PATCH 3005/3011] mt76: mt7915: wed: add ser support when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  dma.c           | 29 ++++++++++++++++++++---------
  dma.h           |  1 +
  mt76.h          |  1 +
- mt7915/dma.c    | 36 +++++++++++++++++++++++++++++++-----
+ mt7915/dma.c    | 37 ++++++++++++++++++++++++++++++++-----
  mt7915/mac.c    | 18 ++++++++++++++++++
  mt7915/mmio.c   |  3 +++
  mt7915/mt7915.h |  1 +
- 7 files changed, 75 insertions(+), 14 deletions(-)
+ 7 files changed, 76 insertions(+), 14 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 40885754..87ce79cb 100644
+index 53c7528f..35beec72 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -35,7 +35,7 @@
  
  static void
  mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
-@@ -623,14 +624,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -618,14 +619,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	return frames;
  }
  
@@ -57,7 +57,7 @@
  	if (!mtk_wed_device_active(wed))
  		q->flags &= ~MT_QFLAG_WED;
  
-@@ -642,7 +647,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -637,7 +642,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	switch (type) {
  	case MT76_WED_Q_TX:
@@ -66,7 +66,7 @@
  		if (!ret)
  			q->wed_regs = wed->tx_ring[ring].reg_base;
  		break;
-@@ -658,7 +663,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -653,7 +658,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  			q->wed_regs = wed->txfree_ring.reg_base;
  		break;
  	case MT76_WED_Q_RX:
@@ -75,7 +75,7 @@
  		if (!ret)
  			q->wed_regs = wed->rx_ring[ring].reg_base;
  		break;
-@@ -671,6 +676,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -666,6 +671,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  	return 0;
  #endif
  }
@@ -83,7 +83,7 @@
  
  static int
  mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
-@@ -697,7 +703,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -692,7 +698,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -92,7 +92,7 @@
  	if (ret)
  		return ret;
  
-@@ -748,8 +754,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -743,8 +749,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  		q->desc[i].ctrl = cpu_to_le32(MT_DMA_CTL_DMA_DONE);
  
  	mt76_dma_rx_cleanup(dev, q);
@@ -120,10 +120,10 @@
  
  #endif
 diff --git a/mt76.h b/mt76.h
-index bb0433b2..cca8986f 100644
+index 74818a59..b7fa1724 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1380,6 +1380,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1383,6 +1383,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,10 +132,18 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 27b67800..03563919 100644
+index e3fa0649..1ae6c339 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -562,6 +562,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -4,6 +4,7 @@
+ #include "mt7915.h"
+ #include "../dma.h"
+ #include "mac.h"
++#include <linux/rtnetlink.h>
+ 
+ static int
+ mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc, int ring_base)
+@@ -562,6 +563,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  {
  	struct mt76_phy *mphy_ext = dev->mt76.phys[MT_BAND1];
@@ -143,7 +151,7 @@
  	int i;
  
  	/* clean up hw queues */
-@@ -581,28 +582,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
+@@ -581,28 +583,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  	if (force)
  		mt7915_wfsys_reset(dev);
  
@@ -203,10 +211,10 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d07bf790..f72e2bc2 100644
+index 5373777a..d5df73db 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -895,6 +895,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -894,6 +894,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  	return MT_TXD_TXP_BUF_SIZE;
  }
  
@@ -215,7 +223,7 @@
 +	struct mt7915_dev *dev;
 +	u8 band_idx;
 +	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	band_idx = dev->phy.band_idx;
++	band_idx = dev->phy.mt76->band_idx;
 +
 +	mt7915_mcu_set_ser(dev, SER_RECOVER, 1, band_idx);
 +
@@ -239,10 +247,10 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index f348a779..f5dfee37 100644
+index ffe23406..6fb3419d 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -617,6 +617,8 @@ static void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -617,6 +617,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  		mt76_put_rxwi(&dev->mt76, t);
  	}
  
@@ -251,19 +259,19 @@
  	if (!wed->rx_buf_ring.rx_page.va)
  		return;
  
-@@ -775,6 +777,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
- 	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
+@@ -782,6 +784,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 	wed->wlan.init_rx_buf = mt7915_mmio_wed_init_rx_buf;
+ 	wed->wlan.release_rx_buf = mt7915_mmio_wed_release_rx_buf;
  	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
 +	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
  
  	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6bc33f21..ec61941e 100644
+index 51453058..c39be358 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -562,6 +562,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -561,6 +561,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -272,5 +280,5 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
index bebd7ea..254e6f0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -1,7 +1,7 @@
-From f6b59719aef1daa47df3ea5da4fb30c09505f9fe Mon Sep 17 00:00:00 2001
+From 10e8cbecc7872f0ad0d18ef37713362da3f9600d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3006/3010] mt76: mt7915: wed: enable red per-band token drop
+Subject: [PATCH 3006/3011] mt76: mt7915: wed: enable red per-band token drop
  for HW Path
 
 Limit the number of token used by each band. If a band uses too many token,
@@ -16,10 +16,10 @@
  3 files changed, 46 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 03fd8c50..e6826c60 100644
+index 0ad110ff..fcb15fb5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2343,8 +2343,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2359,8 +2359,13 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
  					  MCU_WA_PARAM_WED_VERSION,
  					  wed->rev_id, 0);
@@ -33,7 +33,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2354,12 +2359,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2370,12 +2375,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -47,7 +47,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4429,6 +4429,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4445,6 +4445,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -83,7 +83,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4439,17 +4468,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4455,17 +4484,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -110,10 +110,10 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 5fcac90f..f9fb4137 100644
+index cf1d7d7a..49728514 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -282,6 +282,7 @@ enum {
+@@ -289,6 +289,7 @@ enum {
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
  #endif
  	MCU_WA_PARAM_WED_VERSION = 0x32,
@@ -122,10 +122,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ec61941e..3930c441 100644
+index c39be358..2c0aee1e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -774,13 +774,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -773,13 +773,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
@@ -142,5 +142,5 @@
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
index c8ae556..29f1072 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
@@ -1,7 +1,7 @@
-From 0574a0f51cbecfee460a73a6f1764357a9f20baa Mon Sep 17 00:00:00 2001
+From 1f69487aed883d7ea07b50a10f87b30db329043c Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH 3007/3010] mt76: mt7915: wed: update mt7916 trinfo when hw
+Subject: [PATCH 3007/3011] mt76: mt7915: wed: update mt7916 trinfo when hw
  path enable
 
 ---
@@ -57,7 +57,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index ddde4961..61996085 100644
+index 846dc5e3..3365f3f3 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -856,12 +856,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
@@ -87,5 +87,5 @@
  	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
  	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
index 3d6380a..9d9765b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -1,7 +1,7 @@
-From c02c4712a0513109f0983a421a9742da1c761a21 Mon Sep 17 00:00:00 2001
+From 7f80dae506d79a41a7357ec14bd6dabdeeb9cd4f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 3008/3010] mt76: mt7915: wed: find rx token by physical
+Subject: [PATCH 3008/3011] mt76: mt7915: wed: find rx token by physical
  address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -13,10 +13,10 @@
  1 file changed, 20 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index 87ce79cb..ddc804a5 100644
+index 35beec72..327ed3bc 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -372,10 +372,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -376,10 +376,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  	if ((q->flags & MT_QFLAG_WED) &&
  	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
@@ -48,5 +48,5 @@
  			return NULL;
  
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
index 0b3581d..8720477 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -1,31 +1,35 @@
-From 504f797dfcca7ff11c1ab1698a92c0ef545bae89 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
+From c37cd3ad8c8ed0ddcf18858263edeee80c9e40b6 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 25 Nov 2022 14:37:58 +0800
-Subject: [PATCH 3009/3010] mt76: mt7915: wed: drop scatter and gather frame
+Subject: [PATCH 3009/3011] mt76: mt7915: wed: drop scatter and gather frame
 
 The scatter and gather frame may be incorrect because WED and WO may
 send frames to host driver interleaved.
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c  | 5 +++++
+ dma.c  | 9 +++++++++
  dma.h  | 1 +
  mt76.h | 1 +
- 3 files changed, 7 insertions(+)
+ 3 files changed, 11 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index ddc804a5..fec9d090 100644
+index 327ed3bc..0914266a 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -416,6 +416,11 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -420,6 +420,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
  					   MT_DMA_CTL_DROP));
 +
-+			if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
-+				q->flags &= ~MT_QFLAG_WED_FRAG;
-+			else
-+				q->flags |= MT_QFLAG_WED_FRAG;
++			if (*more || (q->flags & MT_QFLAG_WED_FRAG)) {
++				*drop = true;
++
++				if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
++					q->flags &= ~MT_QFLAG_WED_FRAG;
++				else
++					q->flags |= MT_QFLAG_WED_FRAG;
++			}
  		}
  	} else {
  		buf = e->buf;
@@ -42,7 +46,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index cca8986f..43594102 100644
+index b7fa1724..7a5b0b61 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -30,6 +30,7 @@
@@ -54,5 +58,5 @@
  #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
  				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index ced7af9..796cd51 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 053443a80970f7a586fb76a7a889c7ca091dcc32 Mon Sep 17 00:00:00 2001
+From 78409553ecdb43e9b22bb951f3d993d42f120e7c Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3010/3010] mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 3010/3011] mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
@@ -16,10 +16,10 @@
  mode change 100644 => 100755 mt7915/init.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 3b789d75..eb17a015 100644
+index 98b00747..239643b9 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1148,6 +1148,7 @@ enum {
+@@ -1159,6 +1159,7 @@ enum {
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
  	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
@@ -27,7 +27,7 @@
  	MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
  	MCU_EXT_CMD_ATE_CTRL = 0x3d,
  	MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
-@@ -1157,6 +1158,7 @@ enum {
+@@ -1168,6 +1169,7 @@ enum {
  	MCU_EXT_CMD_MUAR_UPDATE = 0x48,
  	MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
  	MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 092d8434..79a29ee8 100644
+index f1f3f2f3..f3b039ff 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -457,22 +457,22 @@
  static int
  mt7915_radar_trigger(void *data, u64 val)
  {
-@@ -1120,6 +1524,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1274,6 +1678,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 +	debugfs_create_file("vow", 0600, dir, phy, &mt7915_vow_ops);
  
- 	if (!dev->dbdc_support || phy->band_idx) {
+ 	if (!dev->dbdc_support || phy->mt76->band_idx) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7915/init.c b/mt7915/init.c
 old mode 100644
 new mode 100755
-index 8f32b6a8..f62a9dae
+index 1ed519be..c347509b
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -476,10 +476,46 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
- 	mt76_rmw(dev, MT_WTBLOFF_TOP_RSCR(band), mask, set);
+@@ -550,10 +550,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+ 	}
  }
  
 +void mt7915_vow_init(struct mt7915_dev *dev)
@@ -518,21 +518,21 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -504,6 +540,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
- 		i = dev->mt76.led_pin ? MT_LED_GPIO_MUX3 : MT_LED_GPIO_MUX2;
- 		mt76_rmw_field(dev, i, MT_LED_GPIO_SEL_MASK, 4);
- 	}
+@@ -575,6 +611,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+ 		mt7915_mac_init_band(dev, i);
+ 
+ 	mt7915_init_led_mux(dev);
 +
-+	if (mt7915_is_atf_defult_on(wiphy, dev))
++	if (mt7915_is_atf_default_on(wiphy, dev))
 +		mt7915_vow_init(dev);
  }
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 52aab3d1..ece28aa0 100644
+index d8571642..dcf1583d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -195,6 +195,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -199,6 +199,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
@@ -540,18 +540,18 @@
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
-@@ -264,6 +265,10 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -268,6 +269,10 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
-+	if (mt7915_is_atf_defult_on(wiphy, dev)) {
++	if (mt7915_is_atf_default_on(wiphy, dev)) {
 +		mt7915_mcu_set_vow_band(dev, mvif);
 +	}
 +
  out:
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -683,6 +688,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -688,6 +693,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -559,11 +559,11 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy;
  #endif
-@@ -737,6 +743,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -742,6 +748,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		mt7915_mcu_set_mimo(phy, 0);
  	}
  #endif
-+	if (mt7915_is_atf_defult_on(wiphy, dev)) {
++	if (mt7915_is_atf_default_on(wiphy, dev)) {
 +		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO] = 2;
 +		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI] = 2;
 +		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE] = 1;
@@ -577,10 +577,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e6826c60..4d3def95 100644
+index fcb15fb5..ff207f70 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3428,6 +3428,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3444,6 +3444,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -753,7 +753,7 @@
  {
  	struct {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3930c441..890e329e 100644
+index 2c0aee1e..afd99498 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -132,6 +132,58 @@ struct mt7915_twt_flow {
@@ -823,7 +823,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -468,6 +521,8 @@ struct mt7915_dev {
+@@ -467,6 +520,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -832,12 +832,12 @@
  };
  
  enum {
-@@ -500,6 +555,15 @@ enum mt7915_rdd_cmd {
+@@ -499,6 +554,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
 +static inline bool
-+mt7915_is_atf_defult_on(struct wiphy *wiphy, struct mt7915_dev *dev)
++mt7915_is_atf_default_on(struct wiphy *wiphy, struct mt7915_dev *dev)
 +{
 +	return ((!wiphy_ext_feature_isset(wiphy,
 +                NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) ||
@@ -848,7 +848,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -627,6 +691,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -626,6 +690,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -860,7 +860,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 61996085..f74b91fa 100644
+index 3365f3f3..a8ffefd4 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1301,7 +1301,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
@@ -1011,5 +1011,5 @@
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 -- 
-2.36.1
+2.25.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
new file mode 100644
index 0000000..c7f7081
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
@@ -0,0 +1,74 @@
+From 0431d98e1a656f59c4fab110897e7e9bc092cc5a Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 2 Dec 2022 17:17:06 +0800
+Subject: [PATCH 3011/3011] mt76: mt7915: wed: add mt7916 2 pcie support when
+ wed on
+
+It should use bit 23 in interrupt mask for wfdma band1 data
+for 2 pcie mt7916, and use bit 19 for  band1 data for 1 pcie.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ mt7915/dma.c  |  8 ++++++--
+ mt7915/mcu.c  |  2 +-
+ mt7915/mmio.c | 10 +++++-----
+ 3 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/mt7915/dma.c b/mt7915/dma.c
+index 1ae6c339..36260085 100644
+--- a/mt7915/dma.c
++++ b/mt7915/dma.c
+@@ -88,8 +88,12 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
+ 				   MT7916_RXQ_BAND0);
+ 			RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MT7916,
+ 				   MT7916_RXQ_MCU_WA);
+-			RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_WED_RX_DONE_BAND1_MT7916,
+-				   MT7916_RXQ_BAND1);
++			if (dev->hif2)
++				RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1_MT7916,
++					   MT7916_RXQ_BAND1);
++			else
++				RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_WED_RX_DONE_BAND1_MT7916,
++					   MT7916_RXQ_BAND1);
+ 			RXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MAIN_MT7916,
+ 				   MT7916_RXQ_MCU_WA_MAIN);
+ 			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index ff207f70..737a714f 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2352,7 +2352,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+ 		return ret;
+ 
+ 	if (mtk_wed_device_active(wed)) {
+-		if (is_mt7915(&dev->mt76))
++		if (is_mt7915(&dev->mt76) || !mtk_wed_get_rx_capa(wed))
+ 			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY),
+ 					  0, 0, 0);
+ 		else
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 6fb3419d..e30a8d4c 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -964,13 +964,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
+ 	struct mt7915_dev *dev = dev_instance;
+ 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ 
+-	if (mtk_wed_device_active(wed)) {
++	if (mtk_wed_device_active(wed))
+ 		mtk_wed_device_irq_set_mask(wed, 0);
+-	} else {
++	else
+ 		mt76_wr(dev, MT_INT_MASK_CSR, 0);
+-		if (dev->hif2)
+-			mt76_wr(dev, MT_INT1_MASK_CSR, 0);
+-	}
++
++	if (dev->hif2)
++		mt76_wr(dev, MT_INT1_MASK_CSR, 0);
+ 
+ 	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
+ 		return IRQ_NONE;
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
new file mode 100644
index 0000000..dc83560
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
@@ -0,0 +1,33 @@
+From dbc09e842e33cecb9e6237ed0664c9fc1f12a412 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 13 Dec 2022 10:51:46 +0800
+Subject: [PATCH 4000/4002] mt76: revert get_of_mac_addr
+
+---
+ eeprom.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index aac70efb..bb9265cc 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -126,9 +126,15 @@ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+ 	struct mt76_dev *dev = phy->dev;
++#ifdef CONFIG_OF
+ 	struct device_node *np = dev->dev->of_node;
++	const u8 *mac = NULL;
+ 
+-	of_get_mac_address(np, phy->macaddr);
++	if (np)
++		mac = of_get_mac_address(np);
++	if (!IS_ERR_OR_NULL(mac))
++		ether_addr_copy(phy->macaddr, mac);
++#endif
+ 
+ 	if (!is_valid_ether_addr(phy->macaddr)) {
+ 		eth_random_addr(phy->macaddr);
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
new file mode 100644
index 0000000..cc3a10d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
@@ -0,0 +1,63 @@
+From 51c0737433ea318d6897585366de4af124c0bb4a Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 13 Dec 2022 10:38:13 +0800
+Subject: [PATCH 4001/4002] mt76: include header files for module param
+
+---
+ mcu.c             | 1 +
+ mt7615/mcu.c      | 1 +
+ mt76_connac_mcu.c | 1 +
+ mt7915/mcu.c      | 1 +
+ 4 files changed, 4 insertions(+)
+
+diff --git a/mcu.c b/mcu.c
+index a8cafa39..fa4b0544 100644
+--- a/mcu.c
++++ b/mcu.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include "mt76.h"
++#include <linux/moduleparam.h>
+ 
+ struct sk_buff *
+ __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
+diff --git a/mt7615/mcu.c b/mt7615/mcu.c
+index 83f30305..e917d025 100644
+--- a/mt7615/mcu.c
++++ b/mt7615/mcu.c
+@@ -10,6 +10,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ static bool prefer_offload_fw = true;
+ module_param(prefer_offload_fw, bool, 0644);
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 291a7c12..56493774 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -4,6 +4,7 @@
+ #include <linux/firmware.h>
+ #include "mt76_connac2_mac.h"
+ #include "mt76_connac_mcu.h"
++#include <linux/module.h>
+ 
+ int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
+ {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 737a714f..e08a96d9 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -6,6 +6,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ #define fw_name(_dev, name, ...)	({			\
+ 	char *_fw;						\
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index 6866209..6985ba6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -1,7 +1,5 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
-    file://0000-mt76-sync-to-master-lastest-commit.patch \
-    file://100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
     file://1003-mt76-mt7915-air-monitor-support.patch \
@@ -39,4 +37,8 @@
     file://3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch \
     file://3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch \
     file://3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch \
+    file://3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
+    file://4000-mt76-revert-get_of_mac_addr.patch \
+    file://4001-mt76-include-header-files-for-module-param.patch \
+    file://4002-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-some-structs-of-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-some-structs-of-wireless-stack.patch
rename to recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
index cce072c..0a0ede2 100644
--- a/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-some-structs-of-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,29 +1,12 @@
-From f9c04f3a99e251532db5680d6dc2d2d44f5e831b Mon Sep 17 00:00:00 2001
+From a4a4b918aa6c2895840226fc4816c265c6461131 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 13 Dec 2022 10:53:12 +0800
-Subject: [PATCH 4002/4002] mt76: revert some structs of wireless stack
+Date: Mon, 12 Dec 2022 18:17:12 +0800
+Subject: [PATCH 4002/4002] mt76: revert for backports-5.15 wireless stack
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- debugfs.c         |   2 +
- dma.c             |   2 +-
- mac80211.c        |   4 +-
- mt7615/main.c     |   6 +-
- mt7615/mcu.c      |   8 +--
- mt76_connac_mcu.c | 108 +++++++++++++++---------------
- mt76x02_mac.c     |   6 +-
- mt7915/debugfs.c  |   4 +-
- mt7915/dma.c      |   4 +-
- mt7915/init.c     |   3 +-
- mt7915/mac.c      |   2 +-
- mt7915/main.c     |  10 +--
- mt7915/mcu.c      | 166 +++++++++++++++++++++++-----------------------
- mt7915/testmode.c |   8 +--
- tx.c              |  11 +--
- 15 files changed, 168 insertions(+), 176 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
-index 79064a4d..4a8e1864 100644
+index 79064a4..4a8e186 100644
 --- a/debugfs.c
 +++ b/debugfs.c
 @@ -33,8 +33,10 @@ mt76_napi_threaded_set(void *data, u64 val)
@@ -38,7 +21,7 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 0914266a..21e88a2d 100644
+index 0914266..21e88a2 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -939,7 +939,7 @@ mt76_dma_init(struct mt76_dev *dev,
@@ -50,8 +33,29 @@
  		mt76_dma_rx_fill(dev, &dev->q_rx[i]);
  		napi_enable(&dev->napi[i]);
  	}
+diff --git a/eeprom.c b/eeprom.c
+index aac70ef..bb9265c 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -126,9 +126,15 @@ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+ 	struct mt76_dev *dev = phy->dev;
++#ifdef CONFIG_OF
+ 	struct device_node *np = dev->dev->of_node;
++	const u8 *mac = NULL;
+ 
+-	of_get_mac_address(np, phy->macaddr);
++	if (np)
++		mac = of_get_mac_address(np);
++	if (!IS_ERR_OR_NULL(mac))
++		ether_addr_copy(phy->macaddr, mac);
++#endif
+ 
+ 	if (!is_valid_ether_addr(phy->macaddr)) {
+ 		eth_random_addr(phy->macaddr);
 diff --git a/mac80211.c b/mac80211.c
-index 15d300a9..be4a1408 100644
+index 15d300a..be4a140 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1511,7 +1511,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
@@ -73,7 +77,7 @@
  
  	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
 diff --git a/mt7615/main.c b/mt7615/main.c
-index ab4c1b44..8fb5b256 100644
+index ab4c1b4..8fb5b25 100644
 --- a/mt7615/main.c
 +++ b/mt7615/main.c
 @@ -474,7 +474,7 @@ static int mt7615_config(struct ieee80211_hw *hw, u32 changed)
@@ -104,10 +108,10 @@
  	mt7615_mutex_release(dev);
  }
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index e917d025..b2e1f388 100644
+index 83f3030..81579a1 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
-@@ -353,7 +353,7 @@ out:
+@@ -352,7 +352,7 @@ out:
  static void
  mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -116,7 +120,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -699,7 +699,7 @@ mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
+@@ -698,7 +698,7 @@ mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
  	if (!enable)
  		goto out;
  
@@ -125,7 +129,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -1074,7 +1074,7 @@ mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
+@@ -1073,7 +1073,7 @@ mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
  	if (!enable)
  		goto out;
  
@@ -134,7 +138,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -2526,7 +2526,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
+@@ -2525,7 +2525,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
  		u8 pad;
  	} req = {
  		.bss_idx = mvif->mt76.idx,
@@ -144,10 +148,10 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 56493774..99851dc0 100644
+index 291a7c1..d5254f9 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -197,7 +197,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
+@@ -196,7 +196,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
  			      */
  	} req = {
  		.bss_idx = mvif->idx,
@@ -156,7 +160,7 @@
  	};
  
  	if (vif->type != NL80211_IFTYPE_STATION)
-@@ -409,7 +409,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+@@ -408,7 +408,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
  		else
  			conn_type = CONNECTION_INFRA_AP;
  		basic->conn_type = cpu_to_le32(conn_type);
@@ -165,7 +169,7 @@
  		break;
  	case NL80211_IFTYPE_ADHOC:
  		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
-@@ -553,7 +553,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -552,7 +552,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  
  	if (sta) {
  		if (vif->type == NL80211_IFTYPE_STATION)
@@ -174,7 +178,7 @@
  		else
  			generic->partial_aid = cpu_to_le16(sta->aid);
  		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
-@@ -602,14 +602,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -601,14 +601,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  	    vif->type != NL80211_IFTYPE_STATION)
  		return;
  
@@ -191,7 +195,7 @@
  			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
  
  	wcid->amsdu = true;
-@@ -620,7 +620,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -619,7 +619,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  static void
  mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
@@ -200,7 +204,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he *he;
  	struct tlv *tlv;
-@@ -708,7 +708,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -707,7 +707,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -209,7 +213,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -753,7 +753,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -752,7 +752,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  static void
  mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
@@ -218,7 +222,7 @@
  	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
  	struct sta_rec_he_v2 *he;
  	struct tlv *tlv;
-@@ -764,7 +764,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -763,7 +763,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  	memcpy(he->he_phy_cap, elem->phy_cap_info, sizeof(he->he_phy_cap));
  	memcpy(he->he_mac_cap, elem->mac_cap_info, sizeof(he->he_mac_cap));
  
@@ -227,7 +231,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -780,7 +780,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -779,7 +779,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
  		break;
  	}
  
@@ -236,7 +240,7 @@
  }
  
  static u8
-@@ -793,9 +793,9 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+@@ -792,9 +792,9 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
  	u8 mode = 0;
  
  	if (sta) {
@@ -249,7 +253,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -844,25 +844,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -843,25 +843,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	u16 supp_rates;
  
  	/* starec ht */
@@ -281,7 +285,7 @@
  	}
  
  	/* starec uapsd */
-@@ -871,11 +871,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -870,11 +870,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	if (!is_mt7921(dev))
  		return;
  
@@ -295,7 +299,7 @@
  		mt76_connac_mcu_sta_he_tlv(skb, sta);
  		mt76_connac_mcu_sta_he_tlv_v2(skb, sta);
  		if (band == NL80211_BAND_6GHZ &&
-@@ -885,7 +885,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -884,7 +884,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
  						      sizeof(*he_6g_capa));
  			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
@@ -304,7 +308,7 @@
  		}
  	}
  
-@@ -895,14 +895,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -894,14 +894,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
  	phy->rcpi = rcpi;
  	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
@@ -322,7 +326,7 @@
  	if (band == NL80211_BAND_2GHZ)
  		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
  			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
-@@ -911,18 +911,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -910,18 +910,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  
  	ra_info->legacy = cpu_to_le16(supp_rates);
  
@@ -346,7 +350,7 @@
  			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
  	}
  }
-@@ -938,7 +938,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
+@@ -937,7 +937,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
  					     wtbl_tlv, sta_wtbl);
  	smps = (struct wtbl_smps *)tlv;
@@ -355,7 +359,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
  
-@@ -950,27 +950,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -949,27 +949,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u32 flags = 0;
  
@@ -391,7 +395,7 @@
  		struct wtbl_vht *vht;
  		u8 af;
  
-@@ -979,18 +979,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -978,18 +978,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sta_wtbl);
  		vht = (struct wtbl_vht *)tlv;
  		vht->ldpc = vht_ldpc &&
@@ -413,7 +417,7 @@
  		/* sgi */
  		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
  			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
-@@ -1000,15 +1000,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -999,15 +999,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sizeof(*raw), wtbl_tlv,
  						     sta_wtbl);
  
@@ -434,7 +438,7 @@
  				flags |= MT_WTBL_W5_SHORT_GI_160;
  		}
  		raw = (struct wtbl_raw *)tlv;
-@@ -1294,9 +1294,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1293,9 +1293,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  		return 0x38;
  
  	if (sta) {
@@ -447,7 +451,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -1616,7 +1616,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1615,7 +1615,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	for (i = 0; i < sreq->n_ssids; i++) {
  		if (!sreq->ssids[i].ssid_len)
  			continue;
@@ -455,7 +459,7 @@
  		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
  		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
  		       sreq->ssids[i].ssid_len);
-@@ -1749,7 +1748,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
+@@ -1748,7 +1747,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
  		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
  		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
  	}
@@ -463,7 +467,7 @@
  	req->match_num = sreq->n_match_sets;
  	for (i = 0; i < req->match_num; i++) {
  		match = &sreq->match_sets[i];
-@@ -2236,10 +2234,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2235,10 +2233,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  				      struct mt76_vif *vif,
  				      struct ieee80211_bss_conf *info)
  {
@@ -475,7 +479,7 @@
  			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
  	struct {
  		struct {
-@@ -2267,7 +2263,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2266,7 +2262,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  
  	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
  	for (i = 0; i < len; i++)
@@ -485,7 +489,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
  }
 diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-index d3f74473..87ea3db1 100644
+index d3f7447..87ea3db 100644
 --- a/mt76x02_mac.c
 +++ b/mt76x02_mac.c
 @@ -404,7 +404,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
@@ -510,7 +514,7 @@
  		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
  			ba_size = 0;
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f3b039ff..47c9dfdd 100644
+index f3b039f..47c9dfd 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1840,8 +1840,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
@@ -525,10 +529,10 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 36260085..e3d4ebc4 100644
+index 50b7ed5..1dde068 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -555,8 +555,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -554,8 +554,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  	if (ret < 0)
  		return ret;
  
@@ -540,7 +544,7 @@
  
  	mt7915_dma_enable(dev);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index c347509b..e643c0e4 100755
+index c347509..e643c0e 100755
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -1148,8 +1148,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
@@ -554,7 +558,7 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d5df73db..3bbe757c 100644
+index d5df73d..3bbe757 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -913,7 +913,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
@@ -567,7 +571,7 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index dcf1583d..5d678df8 100644
+index dcf1583..5d678df 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -503,7 +503,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -611,10 +615,10 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e08a96d9..3860051f 100644
+index 737a714..5bd1881 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -64,7 +64,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+@@ -63,7 +63,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
  	struct mt7915_dev *dev = msta->vif->phy->dev;
  	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
  	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
@@ -623,7 +627,7 @@
  
  	for (nss = 0; nss < max_nss; nss++) {
  		int mcs;
-@@ -104,7 +104,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+@@ -103,7 +103,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
  
  		/* only support 2ss on 160MHz for mt7915 */
  		if (is_mt7915(&dev->mt76) && nss > 1 &&
@@ -632,7 +636,7 @@
  			break;
  	}
  
-@@ -117,8 +117,8 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -116,8 +116,8 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  {
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_dev *dev = msta->vif->phy->dev;
@@ -643,7 +647,7 @@
  	u16 mcs;
  
  	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
-@@ -140,7 +140,7 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -139,7 +139,7 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  
  		/* only support 2ss on 160MHz for mt7915 */
  		if (is_mt7915(&dev->mt76) && nss > 1 &&
@@ -652,7 +656,7 @@
  			break;
  	}
  }
-@@ -149,10 +149,10 @@ static void
+@@ -148,10 +148,10 @@ static void
  mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
  			  const u8 *mask)
  {
@@ -665,7 +669,7 @@
  }
  
  static int
-@@ -230,7 +230,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+@@ -229,7 +229,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
  static void
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -674,7 +678,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -331,7 +331,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -330,7 +330,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
  static void
  mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -683,7 +687,7 @@
  		return;
  
  	ieee80211_color_change_finish(vif);
-@@ -731,13 +731,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -730,13 +730,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  		      struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -699,7 +703,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -823,8 +823,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -822,8 +822,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -710,7 +714,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -874,7 +874,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -873,7 +873,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -719,7 +723,7 @@
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -898,11 +898,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -897,11 +897,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
  
@@ -734,7 +738,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -936,13 +936,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -935,13 +935,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_ht *ht;
  	struct tlv *tlv;
  
@@ -750,7 +754,7 @@
  }
  
  static void
-@@ -951,15 +951,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -950,15 +950,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
  
@@ -770,7 +774,7 @@
  }
  
  static void
-@@ -974,7 +974,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -973,7 +973,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -779,7 +783,7 @@
  	    return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -983,7 +983,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -982,7 +982,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	amsdu->amsdu_en = true;
  	msta->wcid.amsdu = true;
  
@@ -788,7 +792,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		if (!is_mt7915(&dev->mt76)) {
  			amsdu->max_mpdu_size =
-@@ -1046,8 +1046,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1045,8 +1045,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	if (!bfee && tx_ant < 2)
  		return false;
  
@@ -799,7 +803,7 @@
  
  		if (bfee)
  			return mvif->cap.he_su_ebfee &&
-@@ -1057,8 +1057,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1056,8 +1056,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -810,7 +814,7 @@
  
  		if (bfee)
  			return mvif->cap.vht_su_ebfee &&
-@@ -1084,7 +1084,7 @@ static void
+@@ -1083,7 +1083,7 @@ static void
  mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		       struct sta_rec_bf *bf)
  {
@@ -819,7 +823,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1109,7 +1109,7 @@ static void
+@@ -1108,7 +1108,7 @@ static void
  mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  			struct sta_rec_bf *bf, bool explicit)
  {
@@ -828,7 +832,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1130,14 +1130,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
+@@ -1129,14 +1129,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -845,7 +849,7 @@
  			bf->ibf_nrow = 1;
  	}
  }
-@@ -1146,7 +1146,7 @@ static void
+@@ -1145,7 +1145,7 @@ static void
  mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
  {
@@ -854,7 +858,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1171,7 +1171,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1170,7 +1170,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -863,7 +867,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1219,7 +1219,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1218,7 +1218,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -872,7 +876,7 @@
  		return;
  
  	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1233,21 +1233,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1232,21 +1232,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -900,7 +904,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1257,7 +1257,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1256,7 +1256,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -909,7 +913,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1282,7 +1282,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1281,7 +1281,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -918,7 +922,7 @@
  		return;
  
  	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1291,13 +1291,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1290,13 +1290,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
  	bfee = (struct sta_rec_bfee *)tlv;
  
@@ -936,7 +940,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1353,7 +1353,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -1352,7 +1352,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -945,7 +949,7 @@
  		break;
  	case RATE_PARAM_SPE_UPDATE:
  		ra->spe_idx = *(u8 *)data;
-@@ -1428,7 +1428,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1427,7 +1427,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  	do {									\
  		u8 i, gi = mask->control[band]._gi;				\
  		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
@@ -954,7 +958,7 @@
  			phy.sgi |= gi << (i << (_he));				\
  			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
  		}								\
-@@ -1442,11 +1442,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1441,11 +1441,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		}								\
  	} while (0)
  
@@ -969,7 +973,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -1480,7 +1480,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1479,7 +1479,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		 * actual txrate hardware sends out.
  		 */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
@@ -978,7 +982,7 @@
  			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1513,7 +1513,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1512,7 +1512,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra *ra;
  	struct tlv *tlv;
@@ -987,7 +991,7 @@
  	u32 cap = sta->wme ? STA_CAP_WMM : 0;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1523,9 +1523,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1522,9 +1522,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	ra->auto_rate = true;
  	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
  	ra->channel = chandef->chan->hw_value;
@@ -1000,7 +1004,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -1545,22 +1545,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1544,22 +1544,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		}
  	}
  
@@ -1031,7 +1035,7 @@
  			cap |= STA_CAP_LDPC;
  
  		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1568,37 +1568,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1567,37 +1567,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
  	}
  
@@ -1079,7 +1083,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  
-@@ -1807,7 +1807,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -1806,7 +1806,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1088,7 +1092,7 @@
  	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
  					   &bcn->sub_ntlv, &bcn->len);
  	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -1892,9 +1892,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1891,9 +1891,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1100,7 +1104,7 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -2078,7 +2078,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2077,7 +2077,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (!en)
  		goto out;
  
@@ -1109,7 +1113,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -3279,17 +3279,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3278,17 +3278,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1130,29 +1134,8 @@
  					offs += len + sku_len[SKU_HE_RU26] * 3;
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 2ae6c07f..75be1ed9 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -360,12 +360,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
- 	}
- 
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
--		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
-+		memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_VHT)
--		memcpy(&sta->deflink.vht_cap, &sband->vht_cap, sizeof(sta->deflink.vht_cap));
-+		memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_SU)
--		memcpy(&sta->deflink.he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
--		       sizeof(sta->deflink.he_cap));
-+		memcpy(&sta->he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
-+		       sizeof(sta->he_cap));
- 	sta->aid = aid;
- 	sta->wme = 1;
- 
 diff --git a/tx.c b/tx.c
-index 6d55566f..91c8dd8d 100644
+index 6d55566..91c8dd8 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
@@ -1180,5 +1163,5 @@
  
  		hw = mt76_tx_status_get_hw(dev, skb);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 1644c44..6985ba6 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -40,5 +40,5 @@
     file://3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
     file://4000-mt76-revert-get_of_mac_addr.patch \
     file://4001-mt76-include-header-files-for-module-param.patch \
-    file://4002-mt76-revert-some-structs-of-wireless-stack.patch \
+    file://4002-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "