diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/99902-mac80211-mtk-register-.ndo_setup_tc-in-wifi-net-.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/99902-mac80211-mtk-register-.ndo_setup_tc-in-wifi-net-.patch
new file mode 100755
index 0000000..4e69f7d
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/99902-mac80211-mtk-register-.ndo_setup_tc-in-wifi-net-.patch
@@ -0,0 +1,47 @@
+From 9249b7fe460dca2eb73c3389689bfa1a9808a79b Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 23 Dec 2022 18:12:41 +0800
+Subject: [PATCH 2/2] mac80211: mtk: register .ndo_setup_tc in wifi net
+ device
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ net/mac80211/iface.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 35f1233..73b00f5 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -932,6 +932,8 @@ static int ieee80211_netdev_fill_receive_path(struct net_device_path_ctx *ctx,
+ 	return ret;
+ }
+ 
++extern int mtk_eth_setup_tc(struct net_device *dev, enum tc_setup_type type,
++		     void *type_data);
+ 
+ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ #if LINUX_VERSION_IS_LESS(4,10,0)
+@@ -952,6 +954,9 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+ #endif
+ 	.ndo_fill_forward_path = ieee80211_netdev_fill_forward_path,
+ 	.ndo_fill_receive_path = ieee80211_netdev_fill_receive_path,
++#ifdef CONFIG_NET_MEDIATEK_SOC_WED
++	.ndo_setup_tc		= mtk_eth_setup_tc,
++#endif
+ };
+ 
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+@@ -1504,6 +1509,9 @@ static void ieee80211_if_setup(struct net_device *dev)
+ 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 	dev->netdev_ops = &ieee80211_dataif_ops;
+ 	netdev_set_priv_destructor(dev, ieee80211_if_free);
++#if IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED)
++	dev->features |= NETIF_F_HW_TC;
++#endif
+ }
+ 
+ static void ieee80211_if_setup_no_queue(struct net_device *dev)
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
index 5bdb454..dae6492 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/subsys.inc
@@ -65,4 +65,5 @@
     file://913-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
     file://99900-mac80211-mtk-mask-kernel-version-limitation-and-fil.patch \
     file://99901-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-i.patch \
+    file://99902-mac80211-mtk-register-.ndo_setup_tc-in-wifi-net-.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/2999-rdkb-mt76-mt7996-tmp-build-fix.patch b/recipes-wifi/linux-mt76/files/2999-rdkb-mt76-mt7996-tmp-build-fix.patch
deleted file mode 100644
index 9fc3f6c..0000000
--- a/recipes-wifi/linux-mt76/files/2999-rdkb-mt76-mt7996-tmp-build-fix.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff -urN a/debugfs.c b/debugfs.c
---- a/debugfs.c	2022-12-15 16:44:17.882701775 +0800
-+++ b/debugfs.c	2022-12-15 16:44:34.686406545 +0800
-@@ -32,10 +32,10 @@
- 
- 	if (!mt76_is_mmio(dev))
- 		return -EOPNOTSUPP;
--
-+#if 0
- 	if (dev->napi_dev.threaded != val)
- 		return dev_set_threaded(&dev->napi_dev, val);
--
-+#endif
- 	return 0;
- }
- 
-diff -urN a/mt7996/mcu.c b/mt7996/mcu.c
---- a/mt7996/mcu.c	2022-12-15 16:42:14.368885449 +0800
-+++ b/mt7996/mcu.c	2022-12-15 16:43:30.047544516 +0800
-@@ -9,6 +9,7 @@
- #include "mcu.h"
- #include "mac.h"
- #include "eeprom.h"
-+#include <linux/moduleparam.h>
- 
- struct mt7996_patch_hdr {
- 	char build_date[16];
diff --git a/recipes-wifi/linux-mt76/files/5000-mt76-add-internal-wed_tiny-header-file.patch b/recipes-wifi/linux-mt76/files/5000-mt76-add-internal-wed_tiny-header-file.patch
index f2fa3fc..f5fa448 100644
--- a/recipes-wifi/linux-mt76/files/5000-mt76-add-internal-wed_tiny-header-file.patch
+++ b/recipes-wifi/linux-mt76/files/5000-mt76-add-internal-wed_tiny-header-file.patch
@@ -144,18 +144,3 @@
 +#define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
 +
 +#endif
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index e30a8d4c..57c56918 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -11,7 +11,11 @@
- #include "../trace.h"
- #include "../dma.h"
- 
-+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
- static bool wed_enable = true;
-+#else
-+static bool wed_enable;
-+#endif	
- module_param(wed_enable, bool, 0644);
- MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
\ No newline at end of file
diff --git a/recipes-wifi/linux-mt76/files/5001-mt76-mt7915-disable-wed.patch b/recipes-wifi/linux-mt76/files/5001-mt76-mt7915-disable-wed.patch
new file mode 100644
index 0000000..f12e909
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/5001-mt76-mt7915-disable-wed.patch
@@ -0,0 +1,24 @@
+From 1430e7a7a3d5ae7693d6fa8e795524ee4c78c0ef Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 7 Nov 2022 23:05:51 +0800
+Subject: [PATCH] mt76: add internal wed_tiny header file
+
+To prevent build fail of WED related parts.
+
+Change-Id: I907cae30e0775337a0c670010b450be15b510e18
+---
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index e30a8d4c..57c56918 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -11,7 +11,11 @@
+ #include "../trace.h"
+ #include "../dma.h"
+ 
++#ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ static bool wed_enable = true;
++#else
++static bool wed_enable;
++#endif	
+ module_param(wed_enable, bool, 0644);
+ MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
deleted file mode 100644
index 9ac96f3..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 3126ebf7886276a5a1da781a539da0fa3603f673 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Fri, 2 Dec 2022 10:16:49 +0800
-Subject: [PATCH 1/6] wifi: mt76: mt7915: call
- mt7915_mcu_set_thermal_throttling() only after init_work
-
-Enable thermal management by default shall not be executed during mcu
-init. This causes thermal configuration being reset to the firmware
-default settings.
-
-Fixes: 0063b86c9120 ("mt76: mt7915e: Enable thermal management by default")
-Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7915/init.c | 3 +--
- mt7915/main.c | 6 ++++++
- 2 files changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 6fd5c63..a03d0b3 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -201,8 +201,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
- 	phy->throttle_temp[0] = 110;
- 	phy->throttle_temp[1] = 120;
- 
--	return mt7915_mcu_set_thermal_throttling(phy,
--						 MT7915_THERMAL_THROTTLE_MAX);
-+	return 0;
- }
- 
- static void mt7915_led_set_config(struct led_classdev *led_cdev,
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 0511d6a..98af032 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -57,6 +57,12 @@ int mt7915_run(struct ieee80211_hw *hw)
- 		mt7915_mac_enable_nf(dev, phy->mt76->band_idx);
- 	}
- 
-+	ret = mt7915_mcu_set_thermal_throttling(phy,
-+						MT7915_THERMAL_THROTTLE_MAX);
-+
-+	if (ret)
-+		goto out;
-+
- 	ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, 0x92b,
- 					     phy->mt76->band_idx);
- 	if (ret)
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-fix-chainmask-calculation-in-mt7996.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-fix-chainmask-calculation-in-mt7996.patch
new file mode 100644
index 0000000..dfc04e5
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-fix-chainmask-calculation-in-mt7996.patch
@@ -0,0 +1,34 @@
+From 36dcb418d47fb74f7a5a6fb276ff2fee63f4533a Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 30 Nov 2022 23:18:03 +0800
+Subject: [PATCH 1/7] wifi: mt76: mt7996: fix chainmask calculation in
+ mt7996_set_antenna()
+
+Fix per-band chainmask when restoring from the dev chainmask.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Change-Id: Idf607cfdfb342fd283d2911231262f0f74994360
+---
+ mt7996/main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/main.c b/mt7996/main.c
+index 4421cd5..c423b05 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -880,7 +880,10 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+ 	phy->mt76->antenna_mask = tx_ant;
+ 
+ 	/* restore to the origin chainmask which might have auxiliary path */
+-	if (hweight8(tx_ant) == max_nss)
++	if (hweight8(tx_ant) == max_nss && band_idx < MT_BAND2)
++		phy->mt76->chainmask = ((dev->chainmask >> shift) &
++					(BIT(dev->chainshift[band_idx + 1] - shift) - 1)) << shift;
++	else if (hweight8(tx_ant) == max_nss)
+ 		phy->mt76->chainmask = (dev->chainmask >> shift) << shift;
+ 	else
+ 		phy->mt76->chainmask = tx_ant << shift;
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
deleted file mode 100644
index 5878df6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
+++ /dev/null
@@ -1,151 +0,0 @@
-From 40d952371aa09e9c979a0fa198825bee104acbe0 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 5 Dec 2022 14:09:18 +0800
-Subject: [PATCH 2/6] wifi: mt76: mt7915: rework
- mt7915_mcu_set_thermal_throttling
-
-This patch includes 2 changes:
-1. Firmware expects to disable thermal protect first before
-reconfiguring.
-2. Separate setting thermal_protect and setting thermal_tx_duty into
-different functions. These two firmware commands do not need to send
-together.
-
-Fixes: 34b877d972be ("mt76: mt7915: add thermal cooling device support")
-Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7915/init.c   |  3 ---
- mt7915/main.c   |  5 +++++
- mt7915/mcu.c    | 54 ++++++++++++++++++++++++++++---------------------
- mt7915/mt7915.h |  1 +
- 4 files changed, 37 insertions(+), 26 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index a03d0b3..df3a35d 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -134,9 +134,6 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,
- 	if (state > MT7915_CDEV_THROTTLE_MAX)
- 		return -EINVAL;
- 
--	if (phy->throttle_temp[0] > phy->throttle_temp[1])
--		return 0;
--
- 	if (state == phy->cdev_state)
- 		return 0;
- 
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 98af032..7589af4 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -60,6 +60,11 @@ int mt7915_run(struct ieee80211_hw *hw)
- 	ret = mt7915_mcu_set_thermal_throttling(phy,
- 						MT7915_THERMAL_THROTTLE_MAX);
- 
-+	if (ret)
-+		goto out;
-+
-+	ret = mt7915_mcu_set_thermal_protect(phy);
-+
- 	if (ret)
- 		goto out;
- 
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 35441dc..7c14a18 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3077,6 +3077,29 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
- }
- 
- int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_mcu_thermal_ctrl req = {
-+		.band_idx = phy->mt76->band_idx,
-+		.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG,
-+	};
-+	int level, ret;
-+
-+	/* set duty cycle and level */
-+	for (level = 0; level < 4; level++) {
-+		req.duty.duty_level = level;
-+		req.duty.duty_cycle = state;
-+		state /= 2;
-+
-+		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
-+					&req, sizeof(req), false);
-+		if (ret)
-+			return ret;
-+	}
-+	return 0;
-+}
-+
-+int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
- 	struct {
-@@ -3089,29 +3112,18 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
- 	} __packed req = {
- 		.ctrl = {
- 			.band_idx = phy->mt76->band_idx,
-+			.type.protect_type = 1,
-+			.type.trigger_type = 1,
- 		},
- 	};
--	int level;
--
--	if (!state) {
--		req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
--		goto out;
--	}
--
--	/* set duty cycle and level */
--	for (level = 0; level < 4; level++) {
--		int ret;
-+	int ret;
- 
--		req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG;
--		req.ctrl.duty.duty_level = level;
--		req.ctrl.duty.duty_cycle = state;
--		state /= 2;
-+	req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE;
-+	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
-+				&req, sizeof(req.ctrl), false);
- 
--		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
--					&req, sizeof(req.ctrl), false);
--		if (ret)
--			return ret;
--	}
-+	if (ret)
-+		return ret;
- 
- 	/* set high-temperature trigger threshold */
- 	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
-@@ -3120,10 +3132,6 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state)
- 	req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]);
- 	req.sustain_time = cpu_to_le16(10);
- 
--out:
--	req.ctrl.type.protect_type = 1;
--	req.ctrl.type.trigger_type = 1;
--
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT),
- 				 &req, sizeof(req), false);
- }
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6351feb..855779f 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -543,6 +543,7 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy);
- int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
- int mt7915_mcu_get_temperature(struct mt7915_phy *phy);
- int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state);
-+int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
- int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 			   struct ieee80211_sta *sta, struct rate_info *rate);
- int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch
new file mode 100644
index 0000000..927bbe6
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch
@@ -0,0 +1,85 @@
+From 6098317d391c07b301bede6002c03ea0eed72103 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 1 Dec 2022 14:23:35 +0800
+Subject: [PATCH 2/7] wifi: mt76: mt7996: update register for CFEND_RATE
+
+In newer chipsets, CFEND_RATE setting has been moved to different hw
+module.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Change-Id: I41dd443010ede910d934f38f4d86aaa3e7f31032
+---
+ mt7996/mac.c  |  2 +-
+ mt7996/mmio.c |  1 +
+ mt7996/regs.h | 15 ++++++++-------
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 0b3e287..ce4242f 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1690,7 +1690,7 @@ void mt7996_mac_set_timing(struct mt7996_phy *phy)
+ 	else
+ 		val = MT7996_CFEND_RATE_11B;
+ 
+-	mt76_rmw_field(dev, MT_AGG_ACR0(band_idx), MT_AGG_ACR_CFEND_RATE, val);
++	mt76_rmw_field(dev, MT_RATE_HRCR0(band_idx), MT_RATE_HRCR0_CFEND_RATE, val);
+ 	mt76_clear(dev, MT_ARB_SCR(band_idx),
+ 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
+ }
+diff --git a/mt7996/mmio.c b/mt7996/mmio.c
+index 60781d0..d8a2c1a 100644
+--- a/mt7996/mmio.c
++++ b/mt7996/mmio.c
+@@ -21,6 +21,7 @@ static const struct __base mt7996_reg_base[] = {
+ 	[WF_ETBF_BASE]		= { { 0x820ea000, 0x820fa000, 0x830ea000 } },
+ 	[WF_LPON_BASE]		= { { 0x820eb000, 0x820fb000, 0x830eb000 } },
+ 	[WF_MIB_BASE]		= { { 0x820ed000, 0x820fd000, 0x830ed000 } },
++	[WF_RATE_BASE]		= { { 0x820ee000, 0x820fe000, 0x830ee000 } },
+ };
+ 
+ static const struct __map mt7996_reg_map[] = {
+diff --git a/mt7996/regs.h b/mt7996/regs.h
+index 42980b9..7a28cae 100644
+--- a/mt7996/regs.h
++++ b/mt7996/regs.h
+@@ -33,6 +33,7 @@ enum base_rev {
+ 	WF_ETBF_BASE,
+ 	WF_LPON_BASE,
+ 	WF_MIB_BASE,
++	WF_RATE_BASE,
+ 	__MT_REG_BASE_MAX,
+ };
+ 
+@@ -235,13 +236,6 @@ enum base_rev {
+ 						 FIELD_PREP(MT_WTBL_LMAC_ID, _id) | \
+ 						 FIELD_PREP(MT_WTBL_LMAC_DW, _dw))
+ 
+-/* AGG: band 0(0x820e2000), band 1(0x820f2000), band 2(0x830e2000) */
+-#define MT_WF_AGG_BASE(_band)			__BASE(WF_AGG_BASE, (_band))
+-#define MT_WF_AGG(_band, ofs)			(MT_WF_AGG_BASE(_band) + (ofs))
+-
+-#define MT_AGG_ACR0(_band)			MT_WF_AGG(_band, 0x054)
+-#define MT_AGG_ACR_CFEND_RATE			GENMASK(13, 0)
+-
+ /* ARB: band 0(0x820e3000), band 1(0x820f3000), band 2(0x830e3000) */
+ #define MT_WF_ARB_BASE(_band)			__BASE(WF_ARB_BASE, (_band))
+ #define MT_WF_ARB(_band, ofs)			(MT_WF_ARB_BASE(_band) + (ofs))
+@@ -300,6 +294,13 @@ enum base_rev {
+ #define MT_WF_RMAC_RSVD0(_band)			MT_WF_RMAC(_band, 0x03e0)
+ #define MT_WF_RMAC_RSVD0_EIFS_CLR		BIT(21)
+ 
++/* RATE: band 0(0x820ee000), band 1(0x820fe000), band 2(0x830ee000) */
++#define MT_WF_RATE_BASE(_band)			__BASE(WF_RATE_BASE, (_band))
++#define MT_WF_RATE(_band, ofs)			(MT_WF_RATE_BASE(_band) + (ofs))
++
++#define MT_RATE_HRCR0(_band)			MT_WF_RATE(_band, 0x050)
++#define MT_RATE_HRCR0_CFEND_RATE		GENMASK(14, 0)
++
+ /* WFDMA0 */
+ #define MT_WFDMA0_BASE				0xd4000
+ #define MT_WFDMA0(ofs)				(MT_WFDMA0_BASE + (ofs))
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
deleted file mode 100644
index 49239f7..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 797d4335d5399b79cdd99668760658f780f951cf Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 12 Dec 2022 11:30:37 +0800
-Subject: [PATCH 3/6] wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
-
-Call mt7915_mcu_set_thermal_protect() through
-mt7915_thermal_temp_store() to update firmware trigger/restore temp
-directly.
-
-Fixes: 02ee68b95d81 ("mt76: mt7915: add control knobs for thermal throttling")
-Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7915/init.c   | 18 ++++++++++++++++--
- mt7915/mt7915.h |  3 +++
- 2 files changed, 19 insertions(+), 2 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index df3a35d..98655e4 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -83,9 +83,23 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev,
- 
- 	mutex_lock(&phy->dev->mt76.mutex);
- 	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 60, 130);
-+
-+	if ((i - 1 == MT7915_CRIT_TEMP_IDX &&
-+	     val > phy->throttle_temp[MT7915_MAX_TEMP_IDX]) ||
-+	    (i - 1 == MT7915_MAX_TEMP_IDX &&
-+	     val < phy->throttle_temp[MT7915_CRIT_TEMP_IDX])) {
-+		dev_err(phy->dev->mt76.dev,
-+			"temp1_max shall be greater than temp1_crit.");
-+		return -EINVAL;
-+	}
-+
- 	phy->throttle_temp[i - 1] = val;
- 	mutex_unlock(&phy->dev->mt76.mutex);
- 
-+	ret = mt7915_mcu_set_thermal_protect(phy);
-+	if (ret)
-+		return ret;
-+
- 	return count;
- }
- 
-@@ -195,8 +209,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
- 		return PTR_ERR(hwmon);
- 
- 	/* initialize critical/maximum high temperature */
--	phy->throttle_temp[0] = 110;
--	phy->throttle_temp[1] = 120;
-+	phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = 110;
-+	phy->throttle_temp[MT7915_MAX_TEMP_IDX] = 120;
- 
- 	return 0;
- }
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 855779f..e58650b 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -70,6 +70,9 @@
- 
- #define MT7915_WED_RX_TOKEN_SIZE	12288
- 
-+#define MT7915_CRIT_TEMP_IDX		0
-+#define MT7915_MAX_TEMP_IDX		1
-+
- struct mt7915_vif;
- struct mt7915_sta;
- struct mt7915_dfs_pulse;
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-do-not-hardcode-vht-beamform-cap.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-do-not-hardcode-vht-beamform-cap.patch
new file mode 100644
index 0000000..4d9142b
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-do-not-hardcode-vht-beamform-cap.patch
@@ -0,0 +1,29 @@
+From bc54af3f8657ee2633a1c976247fb8d2f07ad568 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 9 Dec 2022 16:38:03 +0800
+Subject: [PATCH 3/7] wifi: mt76: mt7996: do not hardcode vht beamform cap
+
+Use the sts variable when setting vht beamform sts cap.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Change-Id: Idbc52c144220ee855251d4a316e475510cfdadad
+---
+ mt7996/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 64e8dfd..7a9692a 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -465,7 +465,7 @@ void mt7996_set_stream_vht_txbf_caps(struct mt7996_phy *phy)
+ 
+ 	*cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+ 		IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE |
+-		(3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
++		FIELD_PREP(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK, sts - 1);
+ 
+ 	*cap &= ~(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK |
+ 		  IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-connac-fix-POWER_CTRL-command-name-typo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-connac-fix-POWER_CTRL-command-name-typo.patch
new file mode 100644
index 0000000..55c75e5
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-connac-fix-POWER_CTRL-command-name-typo.patch
@@ -0,0 +1,44 @@
+From 5842d6dc7b6644545dac3444a522910a87df7e2b Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 9 Dec 2022 16:22:16 +0800
+Subject: [PATCH 4/7] wifi: mt76: connac: fix POWER_CTRL command name typo
+
+Fix typo MCU_UNI_CMD_POWER_CREL to MCU_UNI_CMD_POWER_CTRL.
+
+Fixes: 779d34de055e ("wifi: mt76: connac: add more unified command IDs")
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Change-Id: I89f9e930be97acb91b456c6361b8fb818fe6cbda
+---
+ mt76_connac_mcu.h | 2 +-
+ mt7996/mcu.c      | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index f1e942b..82fdf6d 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1198,7 +1198,7 @@ enum {
+ 	MCU_UNI_CMD_REPT_MUAR = 0x09,
+ 	MCU_UNI_CMD_WSYS_CONFIG = 0x0b,
+ 	MCU_UNI_CMD_REG_ACCESS = 0x0d,
+-	MCU_UNI_CMD_POWER_CREL = 0x0f,
++	MCU_UNI_CMD_POWER_CTRL = 0x0f,
+ 	MCU_UNI_CMD_RX_HDR_TRANS = 0x12,
+ 	MCU_UNI_CMD_SER = 0x13,
+ 	MCU_UNI_CMD_TWT = 0x14,
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index a88fc76..d781c6e 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2399,7 +2399,7 @@ mt7996_mcu_restart(struct mt76_dev *dev)
+ 		.power_mode = 1,
+ 	};
+ 
+-	return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CREL), &req,
++	return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CTRL), &req,
+ 				 sizeof(req), false);
+ }
+ 
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
deleted file mode 100644
index 04b211e..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From a0db278ac3f340b894e98e8672a36d428ed92dee Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 12 Dec 2022 13:18:49 +0800
-Subject: [PATCH 4/6] wifi: mt76: mt7915: add error message in
- mt7915_thermal_set_cur_throttle_state()
-
-Add dev_err so that it is easier to see invalid setting while looking at
-dmesg.
-
-Co-developed-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7915/init.c   | 12 +++++++-----
- mt7915/mt7915.h |  2 ++
- 2 files changed, 9 insertions(+), 5 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 98655e4..b23a2fb 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -145,8 +145,11 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,
- 	u8 throttling = MT7915_THERMAL_THROTTLE_MAX - state;
- 	int ret;
- 
--	if (state > MT7915_CDEV_THROTTLE_MAX)
-+	if (state > MT7915_CDEV_THROTTLE_MAX) {
-+		dev_err(phy->dev->mt76.dev,
-+			"please specify a valid throttling state\n");
- 		return -EINVAL;
-+	}
- 
- 	if (state == phy->cdev_state)
- 		return 0;
-@@ -175,7 +178,7 @@ static void mt7915_unregister_thermal(struct mt7915_phy *phy)
- 	struct wiphy *wiphy = phy->mt76->hw->wiphy;
- 
- 	if (!phy->cdev)
--	    return;
-+		return;
- 
- 	sysfs_remove_link(&wiphy->dev.kobj, "cooling_device");
- 	thermal_cooling_device_unregister(phy->cdev);
-@@ -209,8 +212,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
- 		return PTR_ERR(hwmon);
- 
- 	/* initialize critical/maximum high temperature */
--	phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = 110;
--	phy->throttle_temp[MT7915_MAX_TEMP_IDX] = 120;
-+	phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = MT7915_CRIT_TEMP;
-+	phy->throttle_temp[MT7915_MAX_TEMP_IDX] = MT7915_MAX_TEMP;
- 
- 	return 0;
- }
-@@ -1185,7 +1188,6 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
- 		mt7986_wmac_disable(dev);
- }
- 
--
- int mt7915_register_device(struct mt7915_dev *dev)
- {
- 	struct mt7915_phy *phy2;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e58650b..942d70c 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -72,6 +72,8 @@
- 
- #define MT7915_CRIT_TEMP_IDX		0
- #define MT7915_MAX_TEMP_IDX		1
-+#define MT7915_CRIT_TEMP		110
-+#define MT7915_MAX_TEMP			120
- 
- struct mt7915_vif;
- struct mt7915_sta;
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch
deleted file mode 100644
index 13bcbdc..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 88bb62ee65721e2591f989e2bda3e1ab08efdf2b Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Thu, 15 Dec 2022 17:15:49 +0800
-Subject: [PATCH 5/6] wifi: mt76: mt7915: set sku initial value to zero
-
-Set sku initial value to prevent mcu get an invalid value before mcu starts
-to run.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/soc.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/mt7915/soc.c b/mt7915/soc.c
-index 686c9bb..2ac0a0f 100644
---- a/mt7915/soc.c
-+++ b/mt7915/soc.c
-@@ -883,6 +883,8 @@ static int mt7986_wmac_wm_enable(struct mt7915_dev *dev, bool enable)
- {
- 	u32 cur;
- 
-+	mt76_wr(dev, MT_CONNINFRA_SKU_DEC_ADDR, 0);
-+
- 	mt76_rmw_field(dev, MT7986_TOP_WM_RESET,
- 		       MT7986_TOP_WM_RESET_MASK, enable);
- 	if (!enable)
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch
deleted file mode 100644
index 7bbd01d..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 6d47538ac0b3e34f8cda287e9666fc15842f1d0b Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 8 Dec 2022 15:54:19 +0800
-Subject: [PATCH 6/6] wifi: mt76: mt7915: add chip id condition in
- mt7915_check_eeprom()
-
-When flash mode is enabled, and the eeprom data in the flash is not for
-the current chipset, it'll still be checked valid, and the default
-eeprom bin won't be loaded.
-(e.g., mt7915 NIC inserted with mt7916 eeprom data in the flash.)
-
-Fix this kind of case by adding chip id into consideration in
-mt7915_check_eeprom().
-
-Reported-by: Cheng-Ji Li <cheng-ji.li@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt7915/eeprom.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 24efa28..a796289 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -33,11 +33,14 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
- 	u8 *eeprom = dev->mt76.eeprom.data;
- 	u16 val = get_unaligned_le16(eeprom);
- 
-+#define CHECK_EEPROM_ERR(match)	(match ? 0 : -EINVAL)
- 	switch (val) {
- 	case 0x7915:
-+		return CHECK_EEPROM_ERR(is_mt7915(&dev->mt76));
- 	case 0x7916:
-+		return CHECK_EEPROM_ERR(is_mt7916(&dev->mt76));
- 	case 0x7986:
--		return 0;
-+		return CHECK_EEPROM_ERR(is_mt7986(&dev->mt76));
- 	default:
- 		return -EINVAL;
- 	}
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
deleted file mode 100644
index 9655ad6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ /dev/null
@@ -1,4896 +0,0 @@
-From 39b998e2093d62bb814c5f05ff648561421820b2 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
-
----
- mt76_connac_mcu.h     |    7 +
- mt7915/Makefile       |    2 +-
- mt7915/debugfs.c      |   73 +-
- mt7915/mac.c          |   14 +
- mt7915/main.c         |    4 +
- mt7915/mcu.c          |   63 +
- mt7915/mcu.h          |    4 +
- mt7915/mt7915.h       |   44 +
- mt7915/mt7915_debug.h | 1350 +++++++++++++++++++
- mt7915/mtk_debugfs.c  | 2926 +++++++++++++++++++++++++++++++++++++++++
- mt7915/mtk_mcu.c      |   51 +
- tools/fwlog.c         |   44 +-
- 12 files changed, 4569 insertions(+), 13 deletions(-)
- create mode 100644 mt7915/mt7915_debug.h
- create mode 100644 mt7915/mtk_debugfs.c
- create mode 100644 mt7915/mtk_mcu.c
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f1e942b..9d0d613 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1146,6 +1146,7 @@ enum {
- 	MCU_EXT_CMD_SET_TX_POWER_CTRL = 0x11,
- 	MCU_EXT_CMD_FW_LOG_2_HOST = 0x13,
- 	MCU_EXT_CMD_TXBF_ACTION = 0x1e,
-+	MCU_EXT_CMD_MEC_CTRL = 0x1f,
- 	MCU_EXT_CMD_EFUSE_BUFFER_MODE = 0x21,
- 	MCU_EXT_CMD_THERMAL_PROT = 0x23,
- 	MCU_EXT_CMD_STA_REC_UPDATE = 0x25,
-@@ -1169,6 +1170,12 @@ enum {
- 	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
- 	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
- 	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
-+#ifdef MTK_DEBUG
-+	MCU_EXT_CMD_RED_ENABLE = 0x68,
-+	MCU_EXT_CMD_RED_SHOW_STA = 0x69,
-+	MCU_EXT_CMD_RED_TARGET_DELAY = 0x6A,
-+	MCU_EXT_CMD_RED_TX_RPT = 0x6B,
-+#endif
- 	MCU_EXT_CMD_TXDPD_CAL = 0x60,
- 	MCU_EXT_CMD_CAL_CACHE = 0x67,
- 	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
-diff --git a/mt7915/Makefile b/mt7915/Makefile
-index 797ae49..a42866e 100644
---- a/mt7915/Makefile
-+++ b/mt7915/Makefile
-@@ -3,7 +3,7 @@
- obj-$(CONFIG_MT7915E) += mt7915e.o
- 
- mt7915e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
--	     debugfs.o mmio.o
-+	     debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o
- 
- mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
- mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 5a46813..f1f3f2f 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -8,6 +8,9 @@
- #include "mac.h"
- 
- #define FW_BIN_LOG_MAGIC	0x44e98caf
-+#ifdef MTK_DEBUG
-+#define FW_BIN_LOG_MAGIC_V2	0x44d9c99a
-+#endif
- 
- /** global debugfs **/
- 
-@@ -504,6 +507,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
- 	int ret;
- 
- 	dev->fw.debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
-+#ifdef MTK_DEBUG
-+	dev->fw.debug_wm = val;
-+#endif
- 
- 	if (dev->fw.debug_bin)
- 		val = 16;
-@@ -528,6 +534,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
- 		if (ret)
- 			goto out;
- 	}
-+#ifdef MTK_DEBUG
-+	mt7915_mcu_fw_dbg_ctrl(dev, 68, !!val);
-+#endif
- 
- 	/* WM CPU info record control */
- 	mt76_clear(dev, MT_CPU_UTIL_CTRL, BIT(0));
-@@ -535,6 +544,12 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
- 	mt76_wr(dev, MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR, BIT(5));
- 	mt76_wr(dev, MT_MCU_WM_CIRQ_IRQ_SOFT_ADDR, BIT(5));
- 
-+#ifdef MTK_DEBUG
-+	if (dev->fw.debug_bin & BIT(3))
-+		/* use bit 7 to indicate v2 magic number */
-+		dev->fw.debug_wm |= BIT(7);
-+#endif
-+
- out:
- 	if (ret)
- 		dev->fw.debug_wm = 0;
-@@ -547,7 +562,11 @@ mt7915_fw_debug_wm_get(void *data, u64 *val)
- {
- 	struct mt7915_dev *dev = data;
- 
--	*val = dev->fw.debug_wm;
-+#ifdef MTK_DEBUG
-+	*val = dev->fw.debug_wm & ~BIT(7);
-+#else
-+	val = dev->fw.debug_wm;
-+#endif
- 
- 	return 0;
- }
-@@ -632,6 +651,17 @@ mt7915_fw_debug_bin_set(void *data, u64 val)
- 
- 	relay_reset(dev->relay_fwlog);
- 
-+#ifdef MTK_DEBUG
-+	dev->dbg.dump_mcu_pkt = val & BIT(4) ? true : false;
-+	dev->dbg.dump_txd = val & BIT(5) ? true : false;
-+	dev->dbg.dump_tx_pkt = val & BIT(6) ? true : false;
-+	dev->dbg.dump_rx_pkt = val & BIT(7) ? true : false;
-+	dev->dbg.dump_rx_raw = val & BIT(8) ? true : false;
-+	if (!(val & GENMASK(3, 0)))
-+		return 0;
-+#endif
-+
-+
- 	return mt7915_fw_debug_wm_set(dev, dev->fw.debug_wm);
- }
- 
-@@ -1257,6 +1287,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
- 	if (!ext_phy)
- 		dev->debugfs_dir = dir;
- 
-+#ifdef MTK_DEBUG
-+	debugfs_create_u16("wlan_idx", 0600, dir, &dev->wlan_idx);
-+	mt7915_mtk_init_debugfs(phy, dir);
-+#endif
-+
- 	return 0;
- }
- 
-@@ -1297,17 +1332,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
- 		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
- 	};
- 
-+#ifdef MTK_DEBUG
-+	struct {
-+		__le32 magic;
-+		u8 version;
-+		u8 _rsv;
-+		__le16 serial_id;
-+		__le32 timestamp;
-+		__le16 msg_type;
-+		__le16 len;
-+	} hdr2 = {
-+		.version = 0x1,
-+		.magic = cpu_to_le32(FW_BIN_LOG_MAGIC_V2),
-+		.msg_type = PKT_TYPE_RX_FW_MONITOR,
-+	};
-+#endif
-+
- 	if (!dev->relay_fwlog)
- 		return;
- 
-+#ifdef MTK_DEBUG
-+	/* old magic num */
-+	if (!(dev->fw.debug_wm & BIT(7))) {
-+		hdr.timestamp = mt76_rr(dev, MT_LPON_FRCR(0));
-+		hdr.len = *(__le16 *)data;
-+		mt7915_debugfs_write_fwlog(dev, &hdr, sizeof(hdr), data, len);
-+	} else {
-+		hdr2.serial_id = dev->dbg.fwlog_seq++;
-+		hdr2.timestamp = mt76_rr(dev, MT_LPON_FRCR(0));
-+		hdr2.len = *(__le16 *)data;
-+		mt7915_debugfs_write_fwlog(dev, &hdr2, sizeof(hdr2), data, len);
-+	}
-+#else
- 	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
- 	hdr.len = *(__le16 *)data;
- 	mt7915_debugfs_write_fwlog(dev, &hdr, sizeof(hdr), data, len);
-+#endif
- }
- 
- bool mt7915_debugfs_rx_log(struct mt7915_dev *dev, const void *data, int len)
- {
-+#ifdef MTK_DEBUG
-+	if (get_unaligned_le32(data) != FW_BIN_LOG_MAGIC &&
-+	    get_unaligned_le32(data) != FW_BIN_LOG_MAGIC_V2 &&
-+	    get_unaligned_le32(data) != PKT_BIN_DEBUG_MAGIC)
-+#else
- 	if (get_unaligned_le32(data) != FW_BIN_LOG_MAGIC)
-+#endif
- 		return false;
- 
- 	if (dev->relay_fwlog)
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f0d5a36..149527d 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -300,6 +300,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
- 	__le16 fc = 0;
- 	int idx;
- 
-+#ifdef MTK_DEBUG
-+	if (dev->dbg.dump_rx_raw)
-+		mt7915_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_RX_RAW, 0);
-+#endif
- 	memset(status, 0, sizeof(*status));
- 
- 	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->mt76->band_idx) {
-@@ -483,6 +487,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
- 	}
- 
- 	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
-+#ifdef MTK_DEBUG
-+	if (dev->dbg.dump_rx_pkt)
-+		mt7915_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_RX, hdr_gap);
-+#endif
- 	if (hdr_trans && ieee80211_has_morefrags(fc)) {
- 		struct ieee80211_vif *vif;
- 		int err;
-@@ -820,6 +828,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	tx_info->buf[1].skip_unmap = true;
- 	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
- 
-+#ifdef MTK_DEBUG
-+	if (dev->dbg.dump_txd)
-+		mt7915_packet_log_to_host(dev, txwi, MT_TXD_SIZE, PKT_BIN_DEBUG_TXD, 0);
-+	if (dev->dbg.dump_tx_pkt)
-+		mt7915_packet_log_to_host(dev, t->skb->data, t->skb->len, PKT_BIN_DEBUG_TX, 0);
-+#endif
- 	return 0;
- }
- 
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 7589af4..f6edab6 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
- 	if (ret)
- 		goto out;
- 
-+#ifdef MTK_DEBUG
-+	ret = mt7915_mcu_set_sku_en(phy, !dev->dbg.sku_disable);
-+#else
- 	ret = mt7915_mcu_set_sku_en(phy, true);
-+#endif
- 	if (ret)
- 		goto out;
- 
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7c14a18..644e6a8 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
- 	else
- 		qid = MT_MCUQ_WM;
- 
-+#ifdef MTK_DEBUG
-+	if (dev->dbg.dump_mcu_pkt)
-+		mt7915_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_MCU, 0);
-+#endif
-+
- 	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
- }
- 
-@@ -3331,6 +3336,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
- 		.sku_enable = enable,
- 	};
- 
-+	pr_info("%s: enable = %d\n", __func__, enable);
-+
- 	return mt76_mcu_send_msg(&dev->mt76,
- 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
- 				 sizeof(req), true);
-@@ -3768,6 +3775,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
- 				 &req, sizeof(req), true);
- }
- 
-+#ifdef MTK_DEBUG
-+int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
-+{
-+	struct {
-+		__le32 args[3];
-+	} req = {
-+		.args = {
-+			cpu_to_le32(a1),
-+			cpu_to_le32(a2),
-+			cpu_to_le32(a3),
-+		},
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
-+}
-+
-+int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
-+{
-+#define RED_DISABLE		0
-+#define RED_BY_HOST_ENABLE	1
-+#define RED_BY_WA_ENABLE	2
-+	int ret;
-+	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
-+	__le32 req = cpu_to_le32(red_type);
-+
-+	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
-+				 sizeof(req), false);
-+	if (ret < 0)
-+		return ret;
-+
-+	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
-+			  MCU_WA_PARAM_RED, enabled, 0, true);
-+
-+	return 0;
-+}
-+#endif
-+
- int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
- {
- 	struct {
-@@ -3796,3 +3840,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
- 
- 	return 0;
- }
-+
-+#ifdef MTK_DEBUG
-+int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
-+{
-+	struct {
-+		u16 action;
-+		u8 _rsv1[2];
-+		u16 wcid;
-+		u8 enable;
-+		u8 _rsv2[5];
-+	} __packed req = {
-+		.action = cpu_to_le16(1),
-+		.wcid = cpu_to_le16(wcid),
-+		.enable = enable,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
-+}
-+#endif
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 29b5434..aa89106 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -278,6 +278,10 @@ enum {
- 	MCU_WA_PARAM_PDMA_RX = 0x04,
- 	MCU_WA_PARAM_CPU_UTIL = 0x0b,
- 	MCU_WA_PARAM_RED = 0x0e,
-+#ifdef MTK_DEBUG
-+	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
-+	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
-+#endif
- };
- 
- enum mcu_mmps_mode {
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 942d70c..afe2ec7 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -9,6 +9,7 @@
- #include "../mt76_connac.h"
- #include "regs.h"
- 
-+#define MTK_DEBUG 1
- #define MT7915_MAX_INTERFACES		19
- #define MT7915_WTBL_SIZE		288
- #define MT7916_WTBL_SIZE		544
-@@ -372,6 +373,29 @@ struct mt7915_dev {
- 	struct reset_control *rstc;
- 	void __iomem *dcm;
- 	void __iomem *sku;
-+
-+#ifdef MTK_DEBUG
-+	u16 wlan_idx;
-+	struct {
-+		u32 fixed_rate;
-+		u32 l1debugfs_reg;
-+		u32 l2debugfs_reg;
-+		u32 mac_reg;
-+		u32 fw_dbg_module;
-+		u8 fw_dbg_lv;
-+		u32 bcn_total_cnt[2];
-+		u16 fwlog_seq;
-+		bool dump_mcu_pkt;
-+		bool dump_txd;
-+		bool dump_tx_pkt;
-+		bool dump_rx_pkt;
-+		bool dump_rx_raw;
-+		u32 token_idx;
-+		u8 sku_disable;
-+		u8 muru_onoff;
-+	} dbg;
-+	const struct mt7915_dbg_reg_desc *dbg_reg;
-+#endif
- };
- 
- enum {
-@@ -650,4 +674,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 			 bool pci, int *irq);
- 
-+#ifdef MTK_DEBUG
-+int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
-+int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
-+int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
-+void mt7915_dump_tmac_info(u8 *tmac_info);
-+int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
-+void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
-+int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
-+
-+#define PKT_BIN_DEBUG_MAGIC	0xc8763123
-+enum {
-+	PKT_BIN_DEBUG_MCU,
-+	PKT_BIN_DEBUG_TXD,
-+	PKT_BIN_DEBUG_TX,
-+	PKT_BIN_DEBUG_RX,
-+	PKT_BIN_DEBUG_RX_RAW,
-+};
-+
-+#endif
-+
- #endif
-diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-new file mode 100644
-index 0000000..ecdc02a
---- /dev/null
-+++ b/mt7915/mt7915_debug.h
-@@ -0,0 +1,1350 @@
-+#ifndef __MT7915_DEBUG_H
-+#define __MT7915_DEBUG_H
-+
-+#ifdef MTK_DEBUG
-+
-+#define DBG_INVALID_BASE		0xffffffff
-+#define DBG_INVALID_OFFSET		0x0
-+
-+struct __dbg_map {
-+	u32 phys;
-+	u32 maps;
-+	u32 size;
-+};
-+
-+struct __dbg_reg {
-+	u32 base;
-+	u32 offs;
-+};
-+
-+struct __dbg_mask {
-+	u32 end;
-+	u32 start;
-+};
-+
-+enum dbg_base_rev {
-+	MT_DBG_WFDMA0_BASE,
-+	MT_DBG_WFDMA1_BASE,
-+	MT_DBG_WFDMA0_PCIE1_BASE,
-+	MT_DBG_WFDMA1_PCIE1_BASE,
-+	MT_DBG_WFDMA_EXT_CSR_BASE,
-+	MT_DBG_SWDEF_BASE,
-+	__MT_DBG_BASE_REV_MAX,
-+};
-+
-+enum dbg_reg_rev {
-+	DBG_INT_SOURCE_CSR,
-+	DBG_INT_MASK_CSR,
-+	DBG_INT1_SOURCE_CSR,
-+	DBG_INT1_MASK_CSR,
-+	DBG_TX_RING_BASE,
-+	DBG_RX_EVENT_RING_BASE,
-+	DBG_RX_STS_RING_BASE,
-+	DBG_RX_DATA_RING_BASE,
-+	DBG_DMA_ICSC_FR0,
-+	DBG_DMA_ICSC_FR1,
-+	DBG_TMAC_ICSCR0,
-+	DBG_RMAC_RXICSRPT,
-+	DBG_MIB_M0SDR0,
-+	DBG_MIB_M0SDR3,
-+	DBG_MIB_M0SDR4,
-+	DBG_MIB_M0SDR5,
-+	DBG_MIB_M0SDR7,
-+	DBG_MIB_M0SDR8,
-+	DBG_MIB_M0SDR9,
-+	DBG_MIB_M0SDR10,
-+	DBG_MIB_M0SDR11,
-+	DBG_MIB_M0SDR12,
-+	DBG_MIB_M0SDR14,
-+	DBG_MIB_M0SDR15,
-+	DBG_MIB_M0SDR16,
-+	DBG_MIB_M0SDR17,
-+	DBG_MIB_M0SDR18,
-+	DBG_MIB_M0SDR19,
-+	DBG_MIB_M0SDR20,
-+	DBG_MIB_M0SDR21,
-+	DBG_MIB_M0SDR22,
-+	DBG_MIB_M0SDR23,
-+	DBG_MIB_M0DR0,
-+	DBG_MIB_M0DR1,
-+	DBG_MIB_MUBF,
-+	DBG_MIB_M0DR6,
-+	DBG_MIB_M0DR7,
-+	DBG_MIB_M0DR8,
-+	DBG_MIB_M0DR9,
-+	DBG_MIB_M0DR10,
-+	DBG_MIB_M0DR11,
-+	DBG_MIB_M0DR12,
-+	DBG_WTBLON_WDUCR,
-+	DBG_UWTBL_WDUCR,
-+	DBG_PLE_DRR_TABLE_CTRL,
-+	DBG_PLE_DRR_TABLE_RDATA,
-+	DBG_PLE_PBUF_CTRL,
-+	DBG_PLE_QUEUE_EMPTY,
-+	DBG_PLE_FREEPG_CNT,
-+	DBG_PLE_FREEPG_HEAD_TAIL,
-+	DBG_PLE_PG_HIF_GROUP,
-+	DBG_PLE_HIF_PG_INFO,
-+	DBG_PLE_PG_HIF_TXCMD_GROUP,
-+	DBG_PLE_HIF_TXCMD_PG_INFO,
-+	DBG_PLE_PG_CPU_GROUP,
-+	DBG_PLE_CPU_PG_INFO,
-+	DBG_PLE_FL_QUE_CTRL,
-+	DBG_PLE_NATIVE_TXCMD_Q_EMPTY,
-+	DBG_PLE_TXCMD_Q_EMPTY,
-+	DBG_PLE_AC_QEMPTY,
-+	DBG_PLE_AC_OFFSET,
-+	DBG_PLE_STATION_PAUSE,
-+	DBG_PLE_DIS_STA_MAP,
-+	DBG_PSE_PBUF_CTRL,
-+	DBG_PSE_FREEPG_CNT,
-+	DBG_PSE_FREEPG_HEAD_TAIL,
-+	DBG_PSE_HIF0_PG_INFO,
-+	DBG_PSE_PG_HIF1_GROUP,
-+	DBG_PSE_HIF1_PG_INFO,
-+	DBG_PSE_PG_CPU_GROUP,
-+	DBG_PSE_CPU_PG_INFO,
-+	DBG_PSE_PG_PLE_GROUP,
-+	DBG_PSE_PLE_PG_INFO,
-+	DBG_PSE_PG_LMAC0_GROUP,
-+	DBG_PSE_LMAC0_PG_INFO,
-+	DBG_PSE_PG_LMAC1_GROUP,
-+	DBG_PSE_LMAC1_PG_INFO,
-+	DBG_PSE_PG_LMAC2_GROUP,
-+	DBG_PSE_LMAC2_PG_INFO,
-+	DBG_PSE_PG_LMAC3_GROUP,
-+	DBG_PSE_LMAC3_PG_INFO,
-+	DBG_PSE_PG_MDP_GROUP,
-+	DBG_PSE_MDP_PG_INFO,
-+	DBG_PSE_PG_PLE1_GROUP,
-+	DBG_PSE_PLE1_PG_INFO,
-+	DBG_AGG_AALCR0,
-+	DBG_AGG_AALCR1,
-+	DBG_AGG_AALCR2,
-+	DBG_AGG_AALCR3,
-+	DBG_AGG_AALCR4,
-+	DBG_AGG_B0BRR0,
-+	DBG_AGG_B1BRR0,
-+	DBG_AGG_B2BRR0,
-+	DBG_AGG_B3BRR0,
-+	DBG_AGG_AWSCR0,
-+	DBG_AGG_PCR0,
-+	DBG_AGG_TTCR0,
-+	DBG_MIB_M0ARNG0,
-+	DBG_MIB_M0DR2,
-+	DBG_MIB_M0DR13,
-+	__MT_DBG_REG_REV_MAX,
-+};
-+
-+enum dbg_mask_rev {
-+	DBG_MIB_M0SDR10_RX_MDRDY_COUNT,
-+	DBG_MIB_M0SDR14_AMPDU,
-+	DBG_MIB_M0SDR15_AMPDU_ACKED,
-+	DBG_MIB_RX_FCS_ERROR_COUNT,
-+	__MT_DBG_MASK_REV_MAX,
-+};
-+
-+enum dbg_bit_rev {
-+	__MT_DBG_BIT_REV_MAX,
-+};
-+
-+static const u32 mt7915_dbg_base[] = {
-+	[MT_DBG_WFDMA0_BASE]		= 0xd4000,
-+	[MT_DBG_WFDMA1_BASE]		= 0xd5000,
-+	[MT_DBG_WFDMA0_PCIE1_BASE]	= 0xd8000,
-+	[MT_DBG_WFDMA1_PCIE1_BASE]	= 0xd9000,
-+	[MT_DBG_WFDMA_EXT_CSR_BASE]	= 0xd7000,
-+	[MT_DBG_SWDEF_BASE]		= 0x41f200,
-+};
-+
-+static const u32 mt7916_dbg_base[] = {
-+	[MT_DBG_WFDMA0_BASE]		= 0xd4000,
-+	[MT_DBG_WFDMA1_BASE]		= 0xd5000,
-+	[MT_DBG_WFDMA0_PCIE1_BASE]	= 0xd8000,
-+	[MT_DBG_WFDMA1_PCIE1_BASE]	= 0xd9000,
-+	[MT_DBG_WFDMA_EXT_CSR_BASE]	= 0xd7000,
-+	[MT_DBG_SWDEF_BASE]		= 0x411400,
-+};
-+
-+static const u32 mt7986_dbg_base[] = {
-+	[MT_DBG_WFDMA0_BASE]		= 0x24000,
-+	[MT_DBG_WFDMA1_BASE]		= 0x25000,
-+	[MT_DBG_WFDMA0_PCIE1_BASE]	= 0x28000,
-+	[MT_DBG_WFDMA1_PCIE1_BASE]	= 0x29000,
-+	[MT_DBG_WFDMA_EXT_CSR_BASE]	= 0x27000,
-+	[MT_DBG_SWDEF_BASE]		= 0x411400,
-+};
-+
-+/* mt7915 regs with different base and offset */
-+static const struct __dbg_reg mt7915_dbg_reg[] = {
-+	[DBG_INT_SOURCE_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x10 },
-+	[DBG_INT_MASK_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x14 },
-+	[DBG_INT1_SOURCE_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x88 },
-+	[DBG_INT1_MASK_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x8c },
-+	[DBG_TX_RING_BASE]		= { MT_DBG_WFDMA1_BASE, 0x400 },
-+	[DBG_RX_EVENT_RING_BASE]	= { MT_DBG_WFDMA1_BASE, 0x500 },
-+	[DBG_RX_STS_RING_BASE]		= { MT_DBG_WFDMA1_BASE, 0x510 },
-+	[DBG_RX_DATA_RING_BASE]		= { MT_DBG_WFDMA0_BASE, 0x500 },
-+	[DBG_DMA_ICSC_FR0]		= { DBG_INVALID_BASE, 0x0f0 },
-+	[DBG_DMA_ICSC_FR1]		= { DBG_INVALID_BASE, 0x0f4 },
-+	[DBG_TMAC_ICSCR0]		= { DBG_INVALID_BASE, 0x200 },
-+	[DBG_RMAC_RXICSRPT]		= { DBG_INVALID_BASE, 0x618},
-+	[DBG_MIB_M0SDR0]		= { DBG_INVALID_BASE, 0x010},
-+	[DBG_MIB_M0SDR3]		= { DBG_INVALID_BASE, 0x014},
-+	[DBG_MIB_M0SDR4]		= { DBG_INVALID_BASE, 0x018},
-+	[DBG_MIB_M0SDR5]		= { DBG_INVALID_BASE, 0x01c},
-+	[DBG_MIB_M0SDR7]		= { DBG_INVALID_BASE, 0x024},
-+	[DBG_MIB_M0SDR8]		= { DBG_INVALID_BASE, 0x028},
-+	[DBG_MIB_M0SDR9]		= { DBG_INVALID_BASE, 0x02C},
-+	[DBG_MIB_M0SDR10]		= { DBG_INVALID_BASE, 0x030},
-+	[DBG_MIB_M0SDR11]		= { DBG_INVALID_BASE, 0x034},
-+	[DBG_MIB_M0SDR12]		= { DBG_INVALID_BASE, 0x038},
-+	[DBG_MIB_M0SDR14]		= { DBG_INVALID_BASE, 0x040},
-+	[DBG_MIB_M0SDR15]		= { DBG_INVALID_BASE, 0x044},
-+	[DBG_MIB_M0SDR16]		= { DBG_INVALID_BASE, 0x048},
-+	[DBG_MIB_M0SDR17]		= { DBG_INVALID_BASE, 0x04c},
-+	[DBG_MIB_M0SDR18]		= { DBG_INVALID_BASE, 0x050},
-+	[DBG_MIB_M0SDR19]		= { DBG_INVALID_BASE, 0x054},
-+	[DBG_MIB_M0SDR20]		= { DBG_INVALID_BASE, 0x058},
-+	[DBG_MIB_M0SDR21]		= { DBG_INVALID_BASE, 0x05c},
-+	[DBG_MIB_M0SDR22]		= { DBG_INVALID_BASE, 0x060},
-+	[DBG_MIB_M0SDR23]		= { DBG_INVALID_BASE, 0x064},
-+	[DBG_MIB_M0DR0]			= { DBG_INVALID_BASE, 0x0a0},
-+	[DBG_MIB_M0DR1]			= { DBG_INVALID_BASE, 0x0a4},
-+	[DBG_MIB_MUBF]			= { DBG_INVALID_BASE, 0x090},
-+	[DBG_MIB_M0DR6]			= { DBG_INVALID_BASE, 0x0b8},
-+	[DBG_MIB_M0DR7]			= { DBG_INVALID_BASE, 0x0bc},
-+	[DBG_MIB_M0DR8]			= { DBG_INVALID_BASE, 0x0c0},
-+	[DBG_MIB_M0DR9]			= { DBG_INVALID_BASE, 0x0c4},
-+	[DBG_MIB_M0DR10]		= { DBG_INVALID_BASE, 0x0c8},
-+	[DBG_MIB_M0DR11]		= { DBG_INVALID_BASE, 0x0cc},
-+	[DBG_MIB_M0DR12]		= { DBG_INVALID_BASE, 0x160},
-+	[DBG_WTBLON_WDUCR]		= { DBG_INVALID_BASE, 0x0},
-+	[DBG_UWTBL_WDUCR]		= { DBG_INVALID_BASE, 0x0},
-+	[DBG_PLE_DRR_TABLE_CTRL]	= { DBG_INVALID_BASE, 0x388},
-+	[DBG_PLE_DRR_TABLE_RDATA]	= { DBG_INVALID_BASE, 0x350},
-+	[DBG_PLE_PBUF_CTRL]		= { DBG_INVALID_BASE, 0x014},
-+	[DBG_PLE_QUEUE_EMPTY]		= { DBG_INVALID_BASE, 0x0b0},
-+	[DBG_PLE_FREEPG_CNT]		= { DBG_INVALID_BASE, 0x100},
-+	[DBG_PLE_FREEPG_HEAD_TAIL]	= { DBG_INVALID_BASE, 0x104},
-+	[DBG_PLE_PG_HIF_GROUP]		= { DBG_INVALID_BASE, 0x110},
-+	[DBG_PLE_HIF_PG_INFO]		= { DBG_INVALID_BASE, 0x114},
-+	[DBG_PLE_PG_HIF_TXCMD_GROUP]	= { DBG_INVALID_BASE, 0x120},
-+	[DBG_PLE_HIF_TXCMD_PG_INFO]	= { DBG_INVALID_BASE, 0x124},
-+	[DBG_PLE_PG_CPU_GROUP]		= { DBG_INVALID_BASE, 0x150},
-+	[DBG_PLE_CPU_PG_INFO]		= { DBG_INVALID_BASE, 0x154},
-+	[DBG_PLE_FL_QUE_CTRL]		= { DBG_INVALID_BASE, 0x1b0},
-+	[DBG_PLE_NATIVE_TXCMD_Q_EMPTY]	= { DBG_INVALID_BASE, 0x22c},
-+	[DBG_PLE_TXCMD_Q_EMPTY]		= { DBG_INVALID_BASE, 0x230},
-+	[DBG_PLE_AC_QEMPTY]		= { DBG_INVALID_BASE, 0x500},
-+	[DBG_PLE_AC_OFFSET]		= { DBG_INVALID_BASE, 0x040},
-+	[DBG_PLE_STATION_PAUSE]		= { DBG_INVALID_BASE, 0x400},
-+	[DBG_PLE_DIS_STA_MAP]		= { DBG_INVALID_BASE, 0x440},
-+	[DBG_PSE_PBUF_CTRL]		= { DBG_INVALID_BASE, 0x014},
-+	[DBG_PSE_FREEPG_CNT]		= { DBG_INVALID_BASE, 0x100},
-+	[DBG_PSE_FREEPG_HEAD_TAIL]	= { DBG_INVALID_BASE, 0x104},
-+	[DBG_PSE_HIF0_PG_INFO]		= { DBG_INVALID_BASE, 0x114},
-+	[DBG_PSE_PG_HIF1_GROUP]		= { DBG_INVALID_BASE, 0x118},
-+	[DBG_PSE_HIF1_PG_INFO]		= { DBG_INVALID_BASE, 0x11c},
-+	[DBG_PSE_PG_CPU_GROUP]		= { DBG_INVALID_BASE, 0x150},
-+	[DBG_PSE_CPU_PG_INFO]		= { DBG_INVALID_BASE, 0x154},
-+	[DBG_PSE_PG_PLE_GROUP]		= { DBG_INVALID_BASE, 0x160},
-+	[DBG_PSE_PLE_PG_INFO]		= { DBG_INVALID_BASE, 0x164},
-+	[DBG_PSE_PG_LMAC0_GROUP]	= { DBG_INVALID_BASE, 0x170},
-+	[DBG_PSE_LMAC0_PG_INFO]		= { DBG_INVALID_BASE, 0x174},
-+	[DBG_PSE_PG_LMAC1_GROUP]	= { DBG_INVALID_BASE, 0x178},
-+	[DBG_PSE_LMAC1_PG_INFO]		= { DBG_INVALID_BASE, 0x17c},
-+	[DBG_PSE_PG_LMAC2_GROUP]	= { DBG_INVALID_BASE, 0x180},
-+	[DBG_PSE_LMAC2_PG_INFO]		= { DBG_INVALID_BASE, 0x184},
-+	[DBG_PSE_PG_LMAC3_GROUP]	= { DBG_INVALID_BASE, 0x188},
-+	[DBG_PSE_LMAC3_PG_INFO]		= { DBG_INVALID_BASE, 0x18c},
-+	[DBG_PSE_PG_MDP_GROUP]		= { DBG_INVALID_BASE, 0x198},
-+	[DBG_PSE_MDP_PG_INFO]		= { DBG_INVALID_BASE, 0x19c},
-+	[DBG_PSE_PG_PLE1_GROUP]		= { DBG_INVALID_BASE, 0x168},
-+	[DBG_PSE_PLE1_PG_INFO]		= { DBG_INVALID_BASE, 0x16c},
-+	[DBG_AGG_AALCR0]		= { DBG_INVALID_BASE, 0x048},
-+	[DBG_AGG_AALCR1]		= { DBG_INVALID_BASE, 0x04c},
-+	[DBG_AGG_AALCR2]		= { DBG_INVALID_BASE, 0x050},
-+	[DBG_AGG_AALCR3]		= { DBG_INVALID_BASE, 0x054},
-+	[DBG_AGG_AALCR4]		= { DBG_INVALID_BASE, 0x058},
-+	[DBG_AGG_B0BRR0]		= { DBG_INVALID_BASE, 0x100},
-+	[DBG_AGG_B1BRR0]		= { DBG_INVALID_BASE, 0x104},
-+	[DBG_AGG_B2BRR0]		= { DBG_INVALID_BASE, 0x108},
-+	[DBG_AGG_B3BRR0]		= { DBG_INVALID_BASE, 0x10c},
-+	[DBG_AGG_AWSCR0]		= { DBG_INVALID_BASE, 0x030},
-+	[DBG_AGG_PCR0]			= { DBG_INVALID_BASE, 0x040},
-+	[DBG_AGG_TTCR0]			= { DBG_INVALID_BASE, 0x04c},
-+	[DBG_MIB_M0ARNG0]		= { DBG_INVALID_BASE, 0x4b8},
-+	[DBG_MIB_M0DR2]			= { DBG_INVALID_BASE, 0x0a8},
-+	[DBG_MIB_M0DR13]		= { DBG_INVALID_BASE, 0x164},
-+};
-+
-+/* mt7986/mt7916 regs with different base and offset */
-+static const struct __dbg_reg mt7916_dbg_reg[] = {
-+	[DBG_INT_SOURCE_CSR]		= { MT_DBG_WFDMA0_BASE, 0x200 },
-+	[DBG_INT_MASK_CSR]		= { MT_DBG_WFDMA0_BASE, 0x204 },
-+	[DBG_INT1_SOURCE_CSR]		= { MT_DBG_WFDMA0_PCIE1_BASE, 0x200 },
-+	[DBG_INT1_MASK_CSR]		= { MT_DBG_WFDMA0_PCIE1_BASE, 0x204 },
-+	[DBG_TX_RING_BASE]		= { MT_DBG_WFDMA0_BASE, 0x400 },
-+	[DBG_RX_EVENT_RING_BASE]	= { MT_DBG_WFDMA0_BASE, 0x500 },
-+	[DBG_RX_STS_RING_BASE]		= { MT_DBG_WFDMA0_BASE, 0x520 },
-+	[DBG_RX_DATA_RING_BASE]		= { MT_DBG_WFDMA0_BASE, 0x540 },
-+	[DBG_DMA_ICSC_FR0]		= { DBG_INVALID_BASE, 0x05c },
-+	[DBG_DMA_ICSC_FR1]		= { DBG_INVALID_BASE, 0x060 },
-+	[DBG_TMAC_ICSCR0]		= { DBG_INVALID_BASE, 0x120 },
-+	[DBG_RMAC_RXICSRPT]		= { DBG_INVALID_BASE, 0xd0 },
-+	[DBG_MIB_M0SDR0]		= { DBG_INVALID_BASE, 0x7d8},
-+	[DBG_MIB_M0SDR3]		= { DBG_INVALID_BASE, 0x698},
-+	[DBG_MIB_M0SDR4]		= { DBG_INVALID_BASE, 0x788},
-+	[DBG_MIB_M0SDR5]		= { DBG_INVALID_BASE, 0x780},
-+	[DBG_MIB_M0SDR7]		= { DBG_INVALID_BASE, 0x5a8},
-+	[DBG_MIB_M0SDR8]		= { DBG_INVALID_BASE, 0x78c},
-+	[DBG_MIB_M0SDR9]		= { DBG_INVALID_BASE, 0x024},
-+	[DBG_MIB_M0SDR10]		= { DBG_INVALID_BASE, 0x76c},
-+	[DBG_MIB_M0SDR11]		= { DBG_INVALID_BASE, 0x790},
-+	[DBG_MIB_M0SDR12]		= { DBG_INVALID_BASE, 0x558},
-+	[DBG_MIB_M0SDR14]		= { DBG_INVALID_BASE, 0x564},
-+	[DBG_MIB_M0SDR15]		= { DBG_INVALID_BASE, 0x564},
-+	[DBG_MIB_M0SDR16]		= { DBG_INVALID_BASE, 0x7fc},
-+	[DBG_MIB_M0SDR17]		= { DBG_INVALID_BASE, 0x800},
-+	[DBG_MIB_M0SDR18]		= { DBG_INVALID_BASE, 0x030},
-+	[DBG_MIB_M0SDR19]		= { DBG_INVALID_BASE, 0x5ac},
-+	[DBG_MIB_M0SDR20]		= { DBG_INVALID_BASE, 0x5b0},
-+	[DBG_MIB_M0SDR21]		= { DBG_INVALID_BASE, 0x5b4},
-+	[DBG_MIB_M0SDR22]		= { DBG_INVALID_BASE, 0x770},
-+	[DBG_MIB_M0SDR23]		= { DBG_INVALID_BASE, 0x774},
-+	[DBG_MIB_M0DR0]			= { DBG_INVALID_BASE, 0x594},
-+	[DBG_MIB_M0DR1]			= { DBG_INVALID_BASE, 0x598},
-+	[DBG_MIB_MUBF]			= { DBG_INVALID_BASE, 0x7ac},
-+	[DBG_MIB_M0DR6]			= { DBG_INVALID_BASE, 0x658},
-+	[DBG_MIB_M0DR7]			= { DBG_INVALID_BASE, 0x65c},
-+	[DBG_MIB_M0DR8]			= { DBG_INVALID_BASE, 0x56c},
-+	[DBG_MIB_M0DR9]			= { DBG_INVALID_BASE, 0x570},
-+	[DBG_MIB_M0DR10]		= { DBG_INVALID_BASE, 0x578},
-+	[DBG_MIB_M0DR11]		= { DBG_INVALID_BASE, 0x574},
-+	[DBG_MIB_M0DR12]		= { DBG_INVALID_BASE, 0x654},
-+	[DBG_WTBLON_WDUCR]		= { DBG_INVALID_BASE, 0x200},
-+	[DBG_UWTBL_WDUCR]		= { DBG_INVALID_BASE, 0x094},
-+	[DBG_PLE_DRR_TABLE_CTRL]	= { DBG_INVALID_BASE, 0x490},
-+	[DBG_PLE_DRR_TABLE_RDATA]	= { DBG_INVALID_BASE, 0x470},
-+	[DBG_PLE_PBUF_CTRL]		= { DBG_INVALID_BASE, 0x004},
-+	[DBG_PLE_QUEUE_EMPTY]		= { DBG_INVALID_BASE, 0x360},
-+	[DBG_PLE_FREEPG_CNT]		= { DBG_INVALID_BASE, 0x380},
-+	[DBG_PLE_FREEPG_HEAD_TAIL]	= { DBG_INVALID_BASE, 0x384},
-+	[DBG_PLE_PG_HIF_GROUP]		= { DBG_INVALID_BASE, 0x00c},
-+	[DBG_PLE_HIF_PG_INFO]		= { DBG_INVALID_BASE, 0x388},
-+	[DBG_PLE_PG_HIF_TXCMD_GROUP]	= { DBG_INVALID_BASE, 0x014},
-+	[DBG_PLE_HIF_TXCMD_PG_INFO]	= { DBG_INVALID_BASE, 0x390},
-+	[DBG_PLE_PG_CPU_GROUP]		= { DBG_INVALID_BASE, 0x018},
-+	[DBG_PLE_CPU_PG_INFO]		= { DBG_INVALID_BASE, 0x394},
-+	[DBG_PLE_FL_QUE_CTRL]		= { DBG_INVALID_BASE, 0x3e0},
-+	[DBG_PLE_NATIVE_TXCMD_Q_EMPTY]	= { DBG_INVALID_BASE, 0x370},
-+	[DBG_PLE_TXCMD_Q_EMPTY]		= { DBG_INVALID_BASE, 0x36c},
-+	[DBG_PLE_AC_QEMPTY]		= { DBG_INVALID_BASE, 0x600},
-+	[DBG_PLE_AC_OFFSET]		= { DBG_INVALID_BASE, 0x080},
-+	[DBG_PLE_STATION_PAUSE]		= { DBG_INVALID_BASE, 0x100},
-+	[DBG_PLE_DIS_STA_MAP] 		= { DBG_INVALID_BASE, 0x180},
-+	[DBG_PSE_PBUF_CTRL]		= { DBG_INVALID_BASE, 0x004},
-+	[DBG_PSE_FREEPG_CNT]		= { DBG_INVALID_BASE, 0x380},
-+	[DBG_PSE_FREEPG_HEAD_TAIL]	= { DBG_INVALID_BASE, 0x384},
-+	[DBG_PSE_HIF0_PG_INFO]		= { DBG_INVALID_BASE, 0x150},
-+	[DBG_PSE_PG_HIF1_GROUP]		= { DBG_INVALID_BASE, 0x154},
-+	[DBG_PSE_HIF1_PG_INFO]		= { DBG_INVALID_BASE, 0x160},
-+	[DBG_PSE_PG_CPU_GROUP]		= { DBG_INVALID_BASE, 0x118},
-+	[DBG_PSE_CPU_PG_INFO]		= { DBG_INVALID_BASE, 0x158},
-+	[DBG_PSE_PG_PLE_GROUP]		= { DBG_INVALID_BASE, 0x11c},
-+	[DBG_PSE_PLE_PG_INFO]		= { DBG_INVALID_BASE, 0x15c},
-+	[DBG_PSE_PG_LMAC0_GROUP]	= { DBG_INVALID_BASE, 0x124},
-+	[DBG_PSE_LMAC0_PG_INFO]		= { DBG_INVALID_BASE, 0x164},
-+	[DBG_PSE_PG_LMAC1_GROUP]	= { DBG_INVALID_BASE, 0x128},
-+	[DBG_PSE_LMAC1_PG_INFO]		= { DBG_INVALID_BASE, 0x168},
-+	[DBG_PSE_PG_LMAC2_GROUP]	= { DBG_INVALID_BASE, 0x12c},
-+	[DBG_PSE_LMAC2_PG_INFO]		= { DBG_INVALID_BASE, 0x16c},
-+	[DBG_PSE_PG_LMAC3_GROUP]	= { DBG_INVALID_BASE, 0x130},
-+	[DBG_PSE_LMAC3_PG_INFO]		= { DBG_INVALID_BASE, 0x17c},
-+	[DBG_PSE_PG_MDP_GROUP]		= { DBG_INVALID_BASE, 0x134},
-+	[DBG_PSE_MDP_PG_INFO]		= { DBG_INVALID_BASE, 0x174},
-+	[DBG_PSE_PG_PLE1_GROUP]		= { DBG_INVALID_BASE, 0x120},
-+	[DBG_PSE_PLE1_PG_INFO]		= { DBG_INVALID_BASE, 0x160},
-+	[DBG_AGG_AALCR0]		= { DBG_INVALID_BASE, 0x028},
-+	[DBG_AGG_AALCR1]		= { DBG_INVALID_BASE, 0x144},
-+	[DBG_AGG_AALCR2]		= { DBG_INVALID_BASE, 0x14c},
-+	[DBG_AGG_AALCR3]		= { DBG_INVALID_BASE, 0x154},
-+	[DBG_AGG_AALCR4]		= { DBG_INVALID_BASE, 0x02c},
-+	[DBG_AGG_B0BRR0]		= { DBG_INVALID_BASE, 0x08c},
-+	[DBG_AGG_B1BRR0]		= { DBG_INVALID_BASE, 0x148},
-+	[DBG_AGG_B2BRR0]		= { DBG_INVALID_BASE, 0x150},
-+	[DBG_AGG_B3BRR0]		= { DBG_INVALID_BASE, 0x158},
-+	[DBG_AGG_AWSCR0]		= { DBG_INVALID_BASE, 0x05c},
-+	[DBG_AGG_PCR0]			= { DBG_INVALID_BASE,	0x06c},
-+	[DBG_AGG_TTCR0]			= { DBG_INVALID_BASE, 0x07c},
-+	[DBG_MIB_M0ARNG0]		= { DBG_INVALID_BASE, 0x0b0},
-+	[DBG_MIB_M0DR2]			= { DBG_INVALID_BASE, 0x7dc},
-+	[DBG_MIB_M0DR13]		= { DBG_INVALID_BASE, 0x7ec},
-+};
-+
-+static const struct __dbg_mask mt7915_dbg_mask[] = {
-+	[DBG_MIB_M0SDR10_RX_MDRDY_COUNT]= {25, 0},
-+	[DBG_MIB_M0SDR14_AMPDU]		= {23, 0},
-+	[DBG_MIB_M0SDR15_AMPDU_ACKED]	= {23, 0},
-+	[DBG_MIB_RX_FCS_ERROR_COUNT]	= {15, 0},
-+};
-+
-+static const struct __dbg_mask mt7916_dbg_mask[] = {
-+	[DBG_MIB_M0SDR10_RX_MDRDY_COUNT]= {31, 0},
-+	[DBG_MIB_M0SDR14_AMPDU]		= {31, 0},
-+	[DBG_MIB_M0SDR15_AMPDU_ACKED]	= {31, 0},
-+	[DBG_MIB_RX_FCS_ERROR_COUNT]	= {31, 16},
-+};
-+
-+/* used to differentiate between generations */
-+struct mt7915_dbg_reg_desc {
-+	const u32 id;
-+	const u32 *base_rev;
-+	const struct __dbg_reg *reg_rev;
-+	const struct __dbg_mask *mask_rev;
-+};
-+
-+static const struct mt7915_dbg_reg_desc dbg_reg_s[] = {
-+	{ 0x7915,
-+	  mt7915_dbg_base,
-+	  mt7915_dbg_reg,
-+	  mt7915_dbg_mask
-+	},
-+	{ 0x7906,
-+	  mt7916_dbg_base,
-+	  mt7916_dbg_reg,
-+	  mt7916_dbg_mask
-+	},
-+	{ 0x7986,
-+	  mt7986_dbg_base,
-+	  mt7916_dbg_reg,
-+	  mt7916_dbg_mask
-+	},
-+};
-+
-+struct bin_debug_hdr {
-+	__le32 magic_num;
-+	__le16 serial_id;
-+	__le16 msg_type;
-+	__le16 len;
-+	__le16 des_len;	/* descriptor len for rxd */
-+} __packed;
-+
-+#define __DBG_REG_MAP(_dev, id, ofs)	((_dev)->dbg_reg->base_rev[(id)] + (ofs))
-+#define __DBG_REG_BASE(_dev, id)	((_dev)->dbg_reg->reg_rev[(id)].base)
-+#define __DBG_REG_OFFS(_dev, id)	((_dev)->dbg_reg->reg_rev[(id)].offs)
-+
-+#define __DBG_MASK(_dev, id)		GENMASK((_dev)->dbg_reg->mask_rev[(id)].end,	\
-+						(_dev)->dbg_reg->mask_rev[(id)].start)
-+#define __DBG_REG(_dev, id)		__DBG_REG_MAP((_dev), __DBG_REG_BASE((_dev), (id)),	\
-+						__DBG_REG_OFFS((_dev), (id)))
-+
-+#define __DBG_FIELD_GET(id, _reg)	(((_reg) & __DBG_MASK(dev, (id))) >>	\
-+						dev->dbg_reg->mask_rev[(id)].start)
-+#define __DBG_FIELD_PREP(id, _reg)	(((_reg) << dev->dbg_reg->mask_rev[(id)].start) &	\
-+						__DBG_MASK(dev, (id)))
-+
-+
-+#define MT_DBG_TX_RING_BASE			__DBG_REG(dev, DBG_TX_RING_BASE)
-+#define MT_DBG_RX_EVENT_RING_BASE		__DBG_REG(dev, DBG_RX_EVENT_RING_BASE)
-+#define MT_DBG_RX_STS_RING_BASE			__DBG_REG(dev, DBG_RX_STS_RING_BASE)
-+#define MT_DBG_RX_DATA_RING_BASE		__DBG_REG(dev, DBG_RX_DATA_RING_BASE)
-+
-+#define MT_DBG_TX_RING_CTRL(n)			(MT_DBG_TX_RING_BASE + (0x10 * (n)))
-+#define MT_DBG_RX_DATA_RING_CTRL(n)		(MT_DBG_RX_DATA_RING_BASE + (0x10 * (n)))
-+#define MT_DBG_RX_EVENT_RING_CTRL(n)		(MT_DBG_RX_EVENT_RING_BASE + (0x10 * (n)))
-+
-+/* WFDMA COMMON */
-+#define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
-+#define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
-+#define MT_DBG_INT1_SOURCE_CSR			__DBG_REG(dev, DBG_INT1_SOURCE_CSR)
-+#define MT_DBG_INT1_MASK_CSR			__DBG_REG(dev, DBG_INT1_MASK_CSR)
-+
-+/* WFDMA0 */
-+#define MT_DBG_WFDMA0(_ofs)			__DBG_REG_MAP(dev, MT_DBG_WFDMA0_BASE, (_ofs))
-+
-+#define MT_DBG_WFDMA0_INT_SOURCE_CSR		MT_DBG_WFDMA0(0x200)
-+#define MT_DBG_WFDMA0_INT_MASK_CSR		MT_DBG_WFDMA0(0x204)
-+
-+#define MT_DBG_WFDMA0_GLO_CFG			MT_DBG_WFDMA0(0x208)
-+#define MT_DBG_WFDMA0_GLO_CFG_TX_DMA_EN		BIT(0)
-+#define MT_DBG_WFDMA0_GLO_CFG_RX_DMA_EN		BIT(2)
-+#define MT_DBG_WFDMA0_GLO_CFG_TX_BUSY_MASK	BIT(1)
-+#define MT_DBG_WFDMA0_GLO_CFG_RX_BUSY_MASK	BIT(3)
-+
-+
-+/* WFDMA1 */
-+#define MT_DBG_WFDMA1(_ofs)			__DBG_REG_MAP(dev, MT_DBG_WFDMA1_BASE, (_ofs))
-+#define MT_DBG_WFDMA1_INT_SOURCE_CSR		MT_DBG_WFDMA1(0x200)
-+#define MT_DBG_WFDMA1_INT_MASK_CSR		MT_DBG_WFDMA1(0x204)
-+
-+#define MT_DBG_WFDMA1_GLO_CFG			MT_DBG_WFDMA1(0x208)
-+
-+#define MT_DBG_WFDMA1_GLO_CFG_TX_DMA_EN		BIT(0)
-+#define MT_DBG_WFDMA1_GLO_CFG_RX_DMA_EN		BIT(2)
-+#define MT_DBG_WFDMA1_GLO_CFG_TX_BUSY_MASK	BIT(1)
-+#define MT_DBG_WFDMA1_GLO_CFG_RX_BUSY_MASK	BIT(3)
-+
-+/* WFDMA0 PCIE1 */
-+#define MT_DBG_WFDMA0_PCIE1(_ofs)		__DBG_REG_MAP(dev, MT_DBG_WFDMA0_PCIE1_BASE, (_ofs))
-+
-+#define MT_DBG_WFDMA0_PCIE1_INT_SOURCE_CSR	MT_DBG_WFDMA0_PCIE1(0x200)
-+#define MT_DBG_WFDMA0_PCIE1_INT_MASK_CSR	MT_DBG_WFDMA0_PCIE1(0x204)
-+#define MT_DBG_WFDMA0_PCIE1_GLO_CFG		MT_DBG_WFDMA0_PCIE1(0x208)
-+#define MT_DBG_WFDMA0_PCIE1_RX1_CTRL0		MT_DBG_WFDMA1_PCIE1(0x510)
-+
-+#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_DMA_EN		BIT(0)
-+#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_BUSY_MASK	BIT(1)
-+#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_DMA_EN		BIT(2)
-+#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_BUSY_MASK	BIT(3)
-+
-+/* WFDMA1 PCIE1 */
-+#define MT_DBG_WFDMA1_PCIE1(_ofs)		__DBG_REG_MAP(dev, MT_DBG_WFDMA1_PCIE1_BASE, (_ofs))
-+#define MT_DBG_WFDMA1_PCIE1_INT_SOURCE_CSR	MT_DBG_WFDMA1_PCIE1(0x200)
-+#define MT_DBG_WFDMA1_PCIE1_INT_MASK_CSR	MT_DBG_WFDMA1_PCIE1(0x204)
-+#define MT_DBG_WFDMA1_PCIE1_GLO_CFG		MT_DBG_WFDMA1_PCIE1(0x208)
-+#define MT_DBG_WFDMA1_PCIE1_TX19_CTRL0		MT_DBG_WFDMA1_PCIE1(0x330)
-+#define MT_DBG_WFDMA1_PCIE1_RX2_CTRL0		MT_DBG_WFDMA1_PCIE1(0x520)
-+
-+#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_TX_DMA_EN		BIT(0)
-+#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_TX_BUSY_MASK	BIT(1)
-+#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_RX_DMA_EN		BIT(2)
-+#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_RX_BUSY_MASK	BIT(3)
-+
-+#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_EN_MASK	BIT(2)
-+#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_EN_MASK	BIT(0)
-+#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_BUSY_MASK	BIT(3)
-+#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_BUSY_MASK	BIT(1)
-+
-+
-+/* WF DMA TOP: band 0(0x820E7000),band 1(0x820F7000) */
-+#define MT_DBG_WF_DMA_BASE(_band)		((_band) ? 0x820F7000 : 0x820E7000)
-+#define MT_DBG_WF_DMA(_band, ofs)		(MT_WF_DMA_BASE(_band) + (ofs))
-+
-+#define MT_DBG_DMA_DCR0(_band)			MT_DBG_WF_DMA((_band), 0x000)
-+#define MT_DBG_DMA_DCR0_MAX_RX_LEN		GENMASK(15, 3)
-+#define MT_DBG_DMA_DCR0_RXD_G5_EN		BIT(23)
-+
-+#define MT_DBG_DMA_ICSC_FR0(_band)		MT_DBG_WF_DMA((_band), __DBG_REG_OFFS(dev, DBG_DMA_ICSC_FR0))
-+#define MT_DBG_DMA_ICSC_FR0_RXBF_EN		BIT(25)
-+#define MT_DBG_DMA_ICSC_FR0_EN			BIT(24)
-+#define MT_DBG_DMA_ICSC_FR0_TOUT_MASK		GENMASK(23, 16)
-+#define MT_DBG_DMA_ICSC_FR0_PID_MASK		GENMASK(9, 8)
-+#define MT_DBG_DMA_ICSC_FR0_QID_MASK		GENMASK(6, 0)
-+
-+#define MT_DBG_DMA_ICSC_FR1(_band)		MT_DBG_WF_DMA((_band), __DBG_REG_OFFS(dev, DBG_DMA_ICSC_FR1))
-+#define MT_DBG_DMA_ICSC_FR1_AGG_SIZE_MASK	GENMASK(26, 16)
-+#define MT_DBG_DMA_ICSC_FR1_MAX_FRAME_SIZE_MASK	GENMASK(10, 0)
-+
-+/* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
-+#define MT_DBG_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
-+#define MT_DBG_WF_TMAC(_band, ofs)		(MT_DBG_WF_TMAC_BASE(_band) + (ofs))
-+
-+#define MT_DBG_TMAC_ICSCR0(_band)		MT_DBG_WF_TMAC((_band), __DBG_REG_OFFS(dev, DBG_TMAC_ICSCR0))
-+#define MT_DBG_TMAC_ICSCR0_ICSRPT_EN        	BIT(0)
-+
-+/* RMAC: band 0(0x820E5000), band 1(0x820f5000) */
-+#define MT_DBG_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820E5000)
-+#define MT_DBG_WF_RMAC(_band, ofs)		(MT_DBG_WF_RMAC_BASE(_band) + (ofs))
-+
-+#define MT_DBG_RMAC_RXICSRPT(_band)		MT_DBG_WF_RMAC((_band), __DBG_REG_OFFS(dev, DBG_RMAC_RXICSRPT))
-+#define MT_DBG_RMAC_RXICSRPT_ICSRPT_EN		BIT(0)
-+
-+/* MIB: band 0(0x820ed000), band 1(0x820fd000) */
-+#define MT_DBG_MIB_BASE(_band)			((_band) ? 0x820fd000 : 0x820ed000)
-+#define MT_DBG_MIB(_band, ofs)			(MT_DBG_MIB_BASE(_band) + (ofs))
-+
-+
-+#define MT_DBG_MIB_M0SCR0(_band)		MT_DBG_MIB((_band), 0x00)
-+#define MT_DBG_MIB_M0PBSCR(_band)		MT_DBG_MIB((_band), 0x04)
-+
-+#define MT_DBG_MIB_M0SDR0(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR0))
-+#define MT_DBG_MIB_M0SDR3(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR3))
-+#define MT_DBG_MIB_RX_FCS_ERROR_COUNT_MASK	__DBG_MASK(dev, DBG_MIB_RX_FCS_ERROR_COUNT)
-+#define MT_DBG_MIB_M0SDR4(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR4))
-+#define MT_DBG_MIB_M0SDR5(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR5))
-+#define MT_DBG_MIB_M0SDR6(_band)		MT_DBG_MIB((_band), 0x20)
-+#define MT_DBG_MIB_M0SDR7(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR7))
-+#define MT_DBG_MIB_M0SDR8(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR8))
-+#define MT_DBG_MIB_M0SDR9(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR9))
-+#define MT_DBG_MIB_M0SDR10(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR10))
-+#define MT_DBG_MIB_M0SDR10_RX_MDRDY_COUNT_MASK	__DBG_MASK(dev, DBG_MIB_M0SDR10_RX_MDRDY_COUNT)
-+#define MT_DBG_MIB_M0SDR11(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR11))
-+
-+#define MT_DBG_MIB_M0SDR12(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR12))
-+
-+#define MT_DBG_MIB_M0SDR14(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR14))
-+#define MT_DBG_MIB_M0SDR14_AMPDU_MASK		__DBG_MASK(dev, DBG_MIB_M0SDR14_AMPDU)
-+#define MT_DBG_MIB_M0SDR15(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR15))
-+#define MT_DBG_MIB_M0SDR15_AMPDU_ACKED_MASK	__DBG_MASK(dev, DBG_MIB_M0SDR15_AMPDU_ACKED)
-+#define MT_DBG_MIB_M0SDR16(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR16))
-+#define MT_DBG_MIB_M0SDR17(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR17))
-+#define MT_DBG_MIB_M0SDR18(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR18))
-+#define MT_DBG_MIB_M0SDR19(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR19))
-+#define MT_DBG_MIB_M0SDR20(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR20))
-+#define MT_DBG_MIB_M0SDR21(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR21))
-+#define MT_DBG_MIB_M0SDR22(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR22))
-+#define MT_DBG_MIB_M0SDR23(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR23))
-+#define MT_DBG_MIB_M0DR0(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR0))
-+#define MT_DBG_MIB_M0DR1(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR1))
-+
-+#define MT_DBG_MIB_MUBF(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_MUBF))
-+#define MT_DBG_MIB_M0DR6(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR6))
-+#define MT_DBG_MIB_M0DR7(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR7))
-+#define MT_DBG_MIB_M0DR8(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR8))
-+#define MT_DBG_MIB_M0DR9(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR9))
-+#define MT_DBG_MIB_M0DR10(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR10))
-+#define MT_DBG_MIB_M0DR11(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR11))
-+ #define MT_DBG_MIB_M0DR12(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR12))
-+
-+/* WTBLON TOP: 0x820D4000/pcie(0x34000) rbus(0x434000) */
-+#define MT_DBG_WTBLON_TOP_BASE			0x820D4000
-+#define MT_DBG_WTBLON_TOP(ofs)			(MT_WTBLON_TOP_BASE + (ofs))
-+#define MT_DBG_WTBLON_TOP_WDUCR			MT_DBG_WTBLON_TOP(__DBG_REG_OFFS(dev, DBG_WTBLON_WDUCR))
-+#define MT_DBG_WTBLON_TOP_WDUCR_GROUP		GENMASK(2, 0)
-+
-+#define WF_WTBLON_TOP_B0BTCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1000) // 5000
-+#define WF_WTBLON_TOP_B0BTBCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1010) // 5010
-+#define WF_WTBLON_TOP_B0BRCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1020) // 5020
-+#define WF_WTBLON_TOP_B0BRBCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1030) // 5030
-+#define WF_WTBLON_TOP_B0BTDCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1040) // 5040
-+#define WF_WTBLON_TOP_B0BRDCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1050) // 5050
-+#define WF_WTBLON_TOP_B0MBTCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1100) // 5100
-+#define WF_WTBLON_TOP_B0MBTBCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1140) // 5140
-+#define WF_WTBLON_TOP_B0MBRCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1180) // 5180
-+#define WF_WTBLON_TOP_B0MBRBCRn_ADDR 		(MT_DBG_WTBLON_TOP_BASE + 0x11C0) // 51C0
-+
-+#define WF_WTBLON_TOP_B1BTCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1800) // 5800
-+
-+/* WTBLON TOP: 0x820C4000/pcie(0xa8000) rbus(0x4a8000) */
-+#define MT_DBG_UWTBL_TOP_BASE			0x820C4000
-+#define MT_DBG_UWTBL_TOP(ofs)			(MT_DBG_UWTBL_TOP_BASE + (ofs))
-+
-+#define MT_DBG_UWTBL_TOP_WDUCR			MT_DBG_UWTBL_TOP(__DBG_REG_OFFS(dev, DBG_UWTBL_WDUCR))
-+
-+#define MT_UWTBL_TOP_WDUCR_TARGET		BIT(31)
-+#define MT_UWTBL_TOP_WDUCR_GROUP		GENMASK(3, 0)
-+
-+
-+/* WTBL : 0x820D8000/pcie(0x38000) rbus(0x438000) */
-+#define MT_DBG_WTBL_BASE			0x820D8000
-+
-+/* PLE related CRs. */
-+#define MT_DBG_PLE_BASE				0x820C0000
-+#define MT_DBG_PLE(ofs)				(MT_DBG_PLE_BASE + (ofs))
-+
-+#define MT_DBG_PLE_DRR_TAB_CTRL			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_DRR_TABLE_CTRL))
-+#define MT_DBG_PLE_DRR_TAB_RD_OFS		__DBG_REG_OFFS(dev, DBG_PLE_DRR_TABLE_RDATA)
-+
-+#define MT_DBG_PLE_DRR_TABLE_RDATA0		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x0)
-+#define MT_DBG_PLE_DRR_TABLE_RDATA1		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x4)
-+#define MT_DBG_PLE_DRR_TABLE_RDATA2		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x8)
-+#define MT_DBG_PLE_DRR_TABLE_RDATA3		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0xc)
-+#define MT_DBG_PLE_DRR_TABLE_RDATA4		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x10)
-+#define MT_DBG_PLE_DRR_TABLE_RDATA5		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x14)
-+#define MT_DBG_PLE_DRR_TABLE_RDATA6		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x18)
-+#define MT_DBG_PLE_DRR_TABLE_RDATA7		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS+ 0x1c)
-+
-+#define MT_DBG_PLE_PBUF_CTRL_ADDR		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PBUF_CTRL))
-+#define MT_DBG_PLE_QUEUE_EMPTY			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_QUEUE_EMPTY))
-+#define MT_DBG_PLE_FREEPG_CNT			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_FREEPG_CNT))
-+#define MT_DBG_PLE_FREEPG_HEAD_TAIL		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_FREEPG_HEAD_TAIL))
-+#define MT_DBG_PLE_PG_HIF_GROUP			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PG_HIF_GROUP))
-+#define MT_DBG_PLE_HIF_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_HIF_PG_INFO))
-+#define MT_DBG_PLE_PG_HIF_TXCMD_GROUP		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PG_HIF_TXCMD_GROUP))
-+#define MT_DBG_PLE_HIF_TXCMD_PG_INFO		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_HIF_TXCMD_PG_INFO))
-+#define MT_DBG_PLE_PG_CPU_GROUP			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PG_CPU_GROUP))
-+#define MT_DBG_PLE_CPU_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_CPU_PG_INFO))
-+#define PLE_FL_QUE_CTRL_OFFSET			__DBG_REG_OFFS(dev, DBG_PLE_FL_QUE_CTRL)
-+#define MT_DBG_PLE_FL_QUE_CTRL0			MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0x0)
-+#define MT_DBG_PLE_FL_QUE_CTRL1			MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0x4)
-+#define MT_DBG_PLE_FL_QUE_CTRL2			MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0x8)
-+#define MT_DBG_PLE_FL_QUE_CTRL3			MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0xc)
-+#define MT_DBG_PLE_NATIVE_TXCMD_Q_EMPTY		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_NATIVE_TXCMD_Q_EMPTY))
-+#define MT_DBG_PLE_TXCMD_Q_EMPTY		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_TXCMD_Q_EMPTY))
-+
-+#define MT_DBG_PLE_PBUF_CTRL_PAGE_SIZE_MASK		BIT(31)
-+#define MT_DBG_PLE_PBUF_CTRL_OFFSET_MASK 		GENMASK(25, 17)
-+#define MT_DBG_PLE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK	GENMASK(11, 0)
-+
-+#define MT_DBG_PLE_FREEPG_CNT_FREEPG_CNT_MASK		GENMASK(11, 0)
-+#define MT_DBG_PLE_FREEPG_CNT_FFA_CNT_MASK		GENMASK(27, 16)
-+#define MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK	GENMASK(27, 16)
-+#define MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK	GENMASK(11, 0)
-+#define MT_DBG_PLE_PG_HIF_GROUP_HIF_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_PLE_PG_HIF_GROUP_HIF_MIN_QUOTA_MASK	GENMASK(11, 0)
-+
-+#define MT_DBG_PLE_HIF_PG_INFO_HIF_SRC_CNT_MASK		GENMASK(27, 16)
-+#define MT_DBG_PLE_HIF_PG_INFO_HIF_RSV_CNT_MASK		GENMASK(11, 0)
-+
-+#define MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MIN_QUOTA_MASK	GENMASK(11, 0)
-+
-+#define MT_DBG_PLE_HIF_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK	GENMASK(27, 16)
-+#define MT_DBG_PLE_HIF_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK	GENMASK(11, 0)
-+
-+#define MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK GENMASK(27, 16)
-+#define MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK	GENMASK(11, 0)
-+
-+#define MT_DBG_PLE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_PLE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK 	GENMASK(11, 0)
-+
-+#define MT_DBG_PLE_CPU_PG_INFO_CPU_SRC_CNT_MASK		GENMASK(27, 16)
-+#define MT_DBG_PLE_CPU_PG_INFO_CPU_RSV_CNT_MASK 	GENMASK(11, 0)
-+
-+#define MT_DBG_PLE_Q_EMPTY_ALL_AC_EMPTY_MASK		BIT(24)
-+#define MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK		BIT(31)
-+#define MT_DBG_PLE_FL_QUE_CTRL0_Q_BUF_QID_MASK 		GENMASK(30, 24)
-+
-+#define MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT		24
-+#define MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT             	10
-+
-+#define MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK		GENMASK(27, 16)
-+#define MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK		GENMASK(11, 0)
-+#define MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK		GENMASK(11, 0)
-+
-+#define MT_DBG_PLE_STATION_PAUSE(n)		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_STATION_PAUSE) + ((n) << 2))
-+#define MT_DBG_PLE_DIS_STA_MAP(n)		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_DIS_STA_MAP) + ((n) << 2))
-+#define MT_DBG_PLE_AC_QEMPTY(ac, n)		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_AC_QEMPTY) +	\
-+							   __DBG_REG_OFFS(dev, DBG_PLE_AC_OFFSET) * (ac) + ((n) << 2))
-+
-+#define MT_DBG_PLE_AMSDU_PACK_MSDU_CNT(n)	MT_DBG_PLE(0x10e0 + ((n) << 2))
-+
-+/* pseinfo related CRs. */
-+#define MT_DBG_PSE_BASE				0x820C8000
-+#define MT_DBG_PSE(ofs)				(MT_DBG_PSE_BASE + (ofs))
-+
-+#define MT_DBG_PSE_PBUF_CTRL			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PBUF_CTRL))
-+#define MT_DBG_PSE_QUEUE_EMPTY			MT_DBG_PSE(0x0b0)
-+#define MT_DBG_PSE_FREEPG_CNT			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_FREEPG_CNT))
-+#define MT_DBG_PSE_FREEPG_HEAD_TAIL		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_FREEPG_HEAD_TAIL))
-+#define MT_DBG_PSE_PG_HIF0_GROUP		MT_DBG_PSE(0x110)
-+#define MT_DBG_PSE_HIF0_PG_INFO			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_HIF0_PG_INFO))
-+#define MT_DBG_PSE_PG_HIF1_GROUP		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_HIF1_GROUP))
-+#define MT_DBG_PSE_HIF1_PG_INFO			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_HIF1_PG_INFO))
-+#define MT_DBG_PSE_PG_CPU_GROUP			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_CPU_GROUP))
-+#define MT_DBG_PSE_CPU_PG_INFO			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_CPU_PG_INFO))
-+#define MT_DBG_PSE_PG_LMAC0_GROUP		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC0_GROUP))
-+#define MT_DBG_PSE_LMAC0_PG_INFO		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC0_PG_INFO))
-+#define MT_DBG_PSE_PG_LMAC1_GROUP		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC1_GROUP))
-+#define MT_DBG_PSE_LMAC1_PG_INFO		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC1_PG_INFO))
-+#define MT_DBG_PSE_PG_LMAC2_GROUP		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC2_GROUP))
-+#define MT_DBG_PSE_LMAC2_PG_INFO		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC2_PG_INFO))
-+#define MT_DBG_PSE_PG_PLE_GROUP			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_PLE_GROUP))
-+#define MT_DBG_PSE_PLE_PG_INFO			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PLE_PG_INFO))
-+#define MT_DBG_PSE_PG_LMAC3_GROUP		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC3_GROUP))
-+#define MT_DBG_PSE_LMAC3_PG_INFO		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC3_PG_INFO))
-+#define MT_DBG_PSE_PG_MDP_GROUP			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_MDP_GROUP))
-+#define MT_DBG_PSE_MDP_PG_INFO			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_MDP_PG_INFO))
-+#define MT_DBG_PSE_PG_PLE1_GROUP		MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PG_PLE1_GROUP))
-+#define MT_DBG_PSE_PLE1_PG_INFO			MT_DBG_PSE(__DBG_REG_OFFS(dev, DBG_PSE_PLE1_PG_INFO))
-+
-+#define MT_DBG_PSE_PBUF_CTRL_PAGE_SIZE_CFG_MASK		BIT(31)
-+#define MT_DBG_PSE_PBUF_CTRL_PBUF_OFFSET_MASK		GENMASK(25, 17)
-+#define MT_DBG_PSE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_QUEUE_EMPTY_RLS_Q_EMTPY_MASK		BIT(31)
-+#define MT_DBG_PSE_QUEUE_EMPTY_MDP_RXIOC_QUEUE_EMPTY_MASK	BIT(23)
-+#define MT_DBG_PSE_QUEUE_EMPTY_MDP_TXIOC_QUEUE_EMPTY_MASK 	BIT(22)
-+#define MT_DBG_PSE_QUEUE_EMPTY_SFD_PARK_QUEUE_EMPTY_MASK 	BIT(21)
-+#define MT_DBG_PSE_QUEUE_EMPTY_SEC_RX_QUEUE_EMPTY_SHFT   	BIT(20)
-+#define MT_DBG_PSE_QUEUE_EMPTY_SEC_TX_QUEUE_EMPTY_MASK 	BIT(19)
-+#define MT_DBG_PSE_QUEUE_EMPTY_MDP_RX_QUEUE_EMPTY_MASK	BIT(18)
-+#define MT_DBG_PSE_QUEUE_EMPTY_MDP_TX_QUEUE_EMPTY_MASK  BIT(17)
-+#define MT_DBG_PSE_QUEUE_EMPTY_LMAC_TX_QUEUE_EMPTY_MASK BIT(16)
-+#define MT_DBG_PSE_QUEUE_EMPTY_HIF_5_EMPTY_MASK		BIT(13)
-+#define MT_DBG_PSE_QUEUE_EMPTY_HIF_4_EMPTY_MASK	   	BIT(12)
-+#define MT_DBG_PSE_QUEUE_EMPTY_HIF_3_EMPTY_MASK		BIT(11)
-+#define MT_DBG_PSE_QUEUE_EMPTY_HIF_2_EMPTY_MASK	   	BIT(10)
-+#define MT_DBG_PSE_QUEUE_EMPTY_HIF_1_EMPTY_MASK		BIT(9)
-+#define MT_DBG_PSE_QUEUE_EMPTY_HIF_0_EMPTY_MASK	   	BIT(8)
-+#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q3_EMPTY_MASK	BIT(3)
-+#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q2_EMPTY_MASK	BIT(2)
-+#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q1_EMPTY_MASK	BIT(1)
-+#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q0_EMPTY_MASK	BIT(0)
-+#define MT_DBG_PSE_FREEPG_CNT_FFA_CNT_MASK		GENMASK(27, 16)
-+#define MT_DBG_PSE_FREEPG_CNT_FREEPG_CNT_MASK	   	GENMASK(11, 0)
-+#define MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK	GENMASK(27, 16)
-+#define MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MAX_QUOTA_MASK 	GENMASK(27, 16)
-+#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MIN_QUOTA_MASK 	GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MIN_QUOTA_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_HIF0_PG_INFO_HIF0_SRC_CNT_MASK 	GENMASK(27, 16)
-+#define MT_DBG_PSE_HIF0_PG_INFO_HIF0_RSV_CNT_MASK 	GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MAX_QUOTA_MASK 	GENMASK(27, 16)
-+#define MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MIN_QUOTA_MASK 	GENMASK(11, 0)
-+#define MT_DBG_PSE_HIF1_PG_INFO_HIF1_SRC_CNT_MASK   	GENMASK(27, 16)
-+#define MT_DBG_PSE_HIF1_PG_INFO_HIF1_RSV_CNT_MASK 	GENMASK(11, 0)
-+#define MT_DBG_PSE_CPU_PG_INFO_CPU_SRC_CNT_MASK    	GENMASK(27, 16)
-+#define MT_DBG_PSE_CPU_PG_INFO_CPU_RSV_CNT_MASK		GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_PLE_GROUP_PLE_MAX_QUOTA_MASK    	GENMASK(27, 16)
-+#define MT_DBG_PSE_PG_PLE_GROUP_PLE_MIN_QUOTA_MASK 	GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_PSE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_PLE_PG_INFO_PLE_SRC_CNT_MASK    	GENMASK(27, 16)
-+#define MT_DBG_PSE_PLE_PG_INFO_PLE_RSV_CNT_MASK		GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MIN_QUOTA_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_SRC_CNT_MASK   	GENMASK(27, 16)
-+#define MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_RSV_CNT_MASK   	GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_LMAC1_GROUP_LMAC1_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_TOP_PG_LMAC1_GROUP_LMAC1_MIN_QUOTA_MASK 	GENMASK(11, 0)
-+#define MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_SRC_CNT_MASK	GENMASK(27, 16)
-+#define MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_RSV_CNT_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MIN_QUOTA_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_SRC_CNT_MASK	GENMASK(27, 16)
-+#define MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_RSV_CNT_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_LMAC3_GROUP_LMAC3_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_TOP_PG_LMAC3_GROUP_LMAC3_MIN_QUOTA_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_SRC_CNT_MASK	GENMASK(27, 16)
-+#define MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_RSV_CNT_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_LMAC3_GROUP_LMAC3_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_TOP_PG_LMAC3_GROUP_LMAC3_MIN_QUOTA_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_PG_MDP_GROUP_MDP_MAX_QUOTA_MASK	GENMASK(27, 16)
-+#define MT_DBG_PSE_PG_MDP_GROUP_MDP_MIN_QUOTA_MASK	GENMASK(11, 0)
-+#define MT_DBG_PSE_MDP_PG_INFO_MDP_SRC_CNT_MASK		GENMASK(27, 16)
-+#define MT_DBG_PSE_MDP_PG_INFO_MDP_RSV_CNT_MASK		GENMASK(11, 0)
-+
-+#define MT_DBG_PSE_FL_QUE_CTRL_0_ADDR			MT_DBG_PLE(0x1b0)
-+#define MT_DBG_PSE_FL_QUE_CTRL_0_EXECUTE_MASK	   	BIT(31)
-+#define MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_QID_SHFT         24
-+#define MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_PID_SHFT         10
-+#define MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_WLANID_MASK    	GENMASK(9, 0)
-+
-+#define MT_DBG_PSE_FL_QUE_CTRL_2_ADDR			MT_DBG_PLE(0x1b8)
-+#define MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_TAIL_FID_MASK    GENMASK(27, 16)
-+#define MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_HEAD_FID_MASK    GENMASK(11, 0)
-+
-+#define MT_DBG_PSE_FL_QUE_CTRL_3_ADDR			MT_DBG_PLE(0x1bc)
-+#define MT_DBG_PSE_FL_QUE_CTRL_3_QUEUE_PKT_NUM_MASK    	GENMASK(11, 0)
-+
-+
-+/* AGG */
-+#define MT_DBG_AGG_BASE(_band)			((_band) ? 0x820f2000 : 0x820e2000)
-+#define MT_DBG_AGG(_band, ofs)			(MT_DBG_AGG_BASE(_band) + (ofs))
-+
-+#define MT_DBG_AGG_AALCR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR0))
-+#define MT_DBG_AGG_AALCR1(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR1))
-+#define MT_DBG_AGG_AALCR2(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR2))
-+#define MT_DBG_AGG_AALCR3(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR3))
-+#define MT_DBG_AGG_AALCR4(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR4))
-+#define MT_DBG_AGG_B0BRR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B0BRR0))
-+#define MT_DBG_AGG_B1BRR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B1BRR0))
-+#define MT_DBG_AGG_B2BRR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B2BRR0))
-+#define MT_DBG_AGG_B3BRR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B3BRR0))
-+#define MT_DBG_AGG_AWSCR(_band, n)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AWSCR0) + ((n) << 2))
-+#define MT_DBG_AGG_PCR(_band, n)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_PCR0) + ((n) << 2))
-+#define MT_DBG_AGG_TTCR(_band, n)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_TTCR0) + ((n) << 2))
-+#define MT_DBG_MIB_M0ARNG(_band, n)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0ARNG0) + ((n) << 2))
-+#define MT_DBG_MIB_M0DR2(_band, n)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR2) + ((n) << 2))
-+#define MT_DBG_MIB_M0DR13(_band, n)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR13) + ((n) << 2))
-+
-+#define MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK   	GENMASK(31, 24)
-+#define MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK  	GENMASK(23, 16)
-+#define MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK  	GENMASK(15, 8)
-+#define MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK  	GENMASK(7, 0)
-+#define MT_DBG_AGG_AALCR4_ALTX0_AGG_LIMIT_MASK  GENMASK(7, 0)
-+
-+#define MT_DBG_AGG_AWSCR0_WINSIZE3_MASK	   	GENMASK(31, 24)
-+#define MT_DBG_AGG_AWSCR0_WINSIZE2_MASK   	GENMASK(23, 16)
-+#define MT_DBG_AGG_AWSCR0_WINSIZE1_MASK  	GENMASK(15, 8)
-+#define MT_DBG_AGG_AWSCR0_WINSIZE0_MASK  	GENMASK(7, 0)
-+
-+#define MT_DBG_AGG_AWSCR1_WINSIZE7_MASK	   	GENMASK(31, 24)
-+#define MT_DBG_AGG_AWSCR1_WINSIZE6_MASK   	GENMASK(23, 16)
-+#define MT_DBG_AGG_AWSCR1_WINSIZE5_MASK  	GENMASK(15, 8)
-+#define MT_DBG_AGG_AWSCR1_WINSIZE4_MASK  	GENMASK(7, 0)
-+
-+#define MT_DBG_AGG_AWSCR2_WINSIZEB_MASK	   	GENMASK(31, 24)
-+#define MT_DBG_AGG_AWSCR2_WINSIZEA_MASK   	GENMASK(23, 16)
-+#define MT_DBG_AGG_AWSCR2_WINSIZE9_MASK  	GENMASK(15, 8)
-+#define MT_DBG_AGG_AWSCR2_WINSIZE8_MASK  	GENMASK(7, 0)
-+
-+#define MT_DBG_AGG_AWSCR3_WINSIZEE_MASK  	GENMASK(23, 16)
-+#define MT_DBG_AGG_AWSCR3_WINSIZED_MASK  	GENMASK(15, 8)
-+#define MT_DBG_AGG_AWSCR3_WINSIZEC_MASK  	GENMASK(7, 0)
-+
-+#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL3_MASK	GENMASK(31, 24)
-+#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL2_MASK   GENMASK(23, 16)
-+#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL1_MASK  	GENMASK(15, 8)
-+#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL0_MASK  	GENMASK(7, 0)
-+
-+#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL7_MASK	GENMASK(31, 24)
-+#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL6_MASK	GENMASK(23, 16)
-+#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL5_MASK  	GENMASK(15, 8)
-+#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL4_MASK  	GENMASK(7, 0)
-+
-+#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL11_MASK	GENMASK(31, 24)
-+#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL10_MASK	GENMASK(23, 16)
-+#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL9_MASK  	GENMASK(15, 8)
-+#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL8_MASK  	GENMASK(7, 0)
-+
-+#define MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL14_MASK	GENMASK(23, 16)
-+#define MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL13_MASK  GENMASK(15, 8)
-+#define MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL12_MASK	GENMASK(7, 0)
-+
-+#define MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK	GENMASK(31, 16)
-+#define MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK	GENMASK(15, 0)
-+#define MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK  	GENMASK(31, 16)
-+#define MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK  	GENMASK(15, 0)
-+#define MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK  	GENMASK(31, 16)
-+#define MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK  	GENMASK(15, 0)
-+#define MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK  	GENMASK(31, 16)
-+#define MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK  	GENMASK(15, 0)
-+#define MT_DBG_MIB_M0DR13_TRX_AGG_RANGE9_CNT_MASK  	GENMASK(31, 16)
-+#define MT_DBG_MIB_M0DR13_TRX_AGG_RANGE8_CNT_MASK  	GENMASK(15, 0)
-+#define MT_DBG_MIB_M0DR14_TRX_AGG_RANGE11_CNT_MASK  	GENMASK(31, 16)
-+#define MT_DBG_MIB_M0DR14_TRX_AGG_RANGE10_CNT_MASK  	GENMASK(15, 0)
-+#define MT_DBG_MIB_M0DR15_TRX_AGG_RANGE13_CNT_MASK  	GENMASK(31, 16)
-+#define MT_DBG_MIB_M0DR15_TRX_AGG_RANGE12_CNT_MASK  	GENMASK(15, 0)
-+#define MT_DBG_MIB_M0DR16_TRX_AGG_RANGE15_CNT_MASK  	GENMASK(31, 16)
-+#define MT_DBG_MIB_M0DR16_TRX_AGG_RANGE14_CNT_MASK  	GENMASK(15, 0)
-+
-+/* mt7915 host DMA*/
-+#define MT_DBG_INT_DMA1_R0_DONE			BIT(0)
-+#define MT_DBG_INT_DMA1_R1_DONE			BIT(1)
-+#define MT_DBG_INT_DMA1_R2_DONE			BIT(2)
-+
-+#define MT_DBG_INT_DMA1_T16_DONE		BIT(26)
-+#define MT_DBG_INT_DMA1_T17_DONE		BIT(27)
-+#define MT_DBG_INT_DMA1_T18_DONE		BIT(30)
-+#define MT_DBG_INT_DMA1_T19_DONE		BIT(31)
-+#define MT_DBG_INT_DMA1_T20_DONE		BIT(15)
-+
-+#define MT_DBG_EXT_WRAP_INT_DMA0_R0_DONE	BIT(16)
-+#define MT_DBG_EXT_WRAP_INT_DMA0_R1_DONE	BIT(17)
-+
-+/* mt7986 host DMA */
-+#define MT_DBG_INT_DMA0_R0_DONE			BIT(0)
-+#define MT_DBG_INT_DMA0_R1_DONE			BIT(1)
-+#define MT_DBG_INT_DMA0_R2_DONE			BIT(2)
-+#define MT_DBG_INT_DMA0_R3_DONE			BIT(3)
-+#define MT_DBG_INT_DMA0_R4_DONE			BIT(22)
-+#define MT_DBG_INT_DMA0_R5_DONE			BIT(23)
-+
-+#define MT_DBG_INT_DMA0_T16_DONE		BIT(26)
-+#define MT_DBG_INT_DMA0_T17_DONE		BIT(27)
-+#define MT_DBG_INT_DMA0_T18_DONE		BIT(30)
-+#define MT_DBG_INT_DMA0_T19_DONE		BIT(31)
-+#define MT_DBG_INT_DMA0_T20_DONE		BIT(25)
-+
-+/* MCU DMA */
-+#define WF_WFDMA_MCU_DMA0_BASE					0x54000000
-+#define WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR			(WF_WFDMA_MCU_DMA0_BASE + 0x200) // 0200
-+#define WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR			(WF_WFDMA_MCU_DMA0_BASE + 0X204) // 0204
-+#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR			(WF_WFDMA_MCU_DMA0_BASE + 0x208) // 0208
-+#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK	0x00000008	// RX_DMA_BUSY[3]
-+#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT	3
-+#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK		0x00000004	// RX_DMA_EN[2]
-+#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT		2
-+#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK	0x00000002	// TX_DMA_BUSY[1]
-+#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT	1
-+#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK		0x00000001	// TX_DMA_EN[0]
-+#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT	0
-+
-+#define WF_WFDMA_MCU_DMA1_BASE					0x55000000
-+#define WF_WFDMA_MCU_DMA1_HOST_INT_STA_ADDR			(WF_WFDMA_MCU_DMA1_BASE + 0x200) // 0200
-+#define WF_WFDMA_MCU_DMA1_HOST_INT_ENA_ADDR			(WF_WFDMA_MCU_DMA1_BASE + 0X204) // 0204
-+#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_ADDR			(WF_WFDMA_MCU_DMA1_BASE + 0x208) // 0208
-+#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK	0x00000008	// RX_DMA_BUSY[3]
-+#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT	3
-+#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_MASK		0x00000004	// RX_DMA_EN[2]
-+#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT		2
-+#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK	0x00000002	// TX_DMA_BUSY[1]
-+#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT	1
-+#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_MASK		0x00000001	// TX_DMA_EN[0]
-+#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT		0
-+#define WF_WFDMA_MCU_DMA1_WPDMA_TX_RING0_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x300) // 0300
-+#define WF_WFDMA_MCU_DMA1_WPDMA_TX_RING1_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x310) // 0310
-+#define WF_WFDMA_MCU_DMA1_WPDMA_TX_RING2_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x320) // 0320
-+#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING0_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x500) // 0500
-+#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING1_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x510) // 0510
-+#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING2_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x520) // 0520
-+#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING3_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x530) // 0530
-+#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING4_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x540) // 0540
-+
-+#define WF_WFDMA_MCU_DMA1_PCIE1_BASE				0x59000000
-+#define WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_STA_ADDR		(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x200) // 0200
-+#define WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_ENA_ADDR		(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0X204) // 0204
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_ADDR		(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x208) // 0208
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK	0x00000008	// RX_DMA_BUSY[3]
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT	3
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK	0x00000004	// RX_DMA_EN[2]
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT	2
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK	0x00000002	// TX_DMA_BUSY[1]
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT	1
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK	0x00000001	// TX_DMA_EN[0]
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT	0
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_TX_RING2_CTRL0_ADDR	(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x320) // 0320
-+#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR	(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x530) // 0530
-+
-+#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x300) // 0300
-+#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x310) // 0310
-+#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x320) // 0320
-+/* mt7986 add */
-+#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x330) // 0330
-+#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x340) // 0340
-+#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x350) // 0350
-+#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x360) // 0360
-+
-+
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x500) // 0500
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x510) // 0510
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x520) // 0520
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x530) // 0530
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x540) // 0540
-+
-+/* mt7986 add */
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x550) // 0550
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x560) // 0560
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x570) // 0570
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x580) // 0580
-+#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x590) // 0590
-+
-+/* MEM DMA */
-+#define WF_WFDMA_MEM_DMA_BASE					0x58000000
-+#define WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR			(WF_WFDMA_MEM_DMA_BASE + 0x200) // 0200
-+#define WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR			(WF_WFDMA_MEM_DMA_BASE + 0X204) // 0204
-+#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR			(WF_WFDMA_MEM_DMA_BASE + 0x208) // 0208
-+#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK		0x00000008	// RX_DMA_BUSY[3]
-+#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT		3
-+#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK		0x00000004	// RX_DMA_EN[2]
-+#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT		2
-+#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK		0x00000002	// TX_DMA_BUSY[1]
-+#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT		1
-+#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK		0x00000001	// TX_DMA_EN[0]
-+#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT		0
-+#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR		(WF_WFDMA_MEM_DMA_BASE + 0x300) // 0300
-+#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR		(WF_WFDMA_MEM_DMA_BASE + 0x310) // 0310
-+#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR		(WF_WFDMA_MEM_DMA_BASE + 0x500) // 0500
-+#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR		(WF_WFDMA_MEM_DMA_BASE + 0x510) // 0510
-+
-+enum resource_attr {
-+	HIF_TX_DATA,
-+	HIF_TX_CMD,
-+	HIF_TX_CMD_WM, /* direct path to WMCPU, only exist for WFDMA arch with 2 CPU */
-+	HIF_TX_FWDL,
-+	HIF_RX_DATA,
-+	HIF_RX_EVENT,
-+	RING_ATTR_NUM
-+};
-+
-+struct hif_pci_tx_ring_desc {
-+	u32 hw_int_mask;
-+	u16 ring_size;
-+	enum resource_attr ring_attr;
-+	u8 band_idx;
-+	char *const ring_info;
-+};
-+
-+struct hif_pci_rx_ring_desc {
-+	u32 hw_desc_base;
-+	u32 hw_int_mask;
-+	u16 ring_size;
-+	enum resource_attr ring_attr;
-+	u16 max_rx_process_cnt;
-+	u16 max_sw_read_idx_inc;
-+	char *const ring_info;
-+};
-+
-+const struct hif_pci_tx_ring_desc mt7915_tx_ring_layout[] = {
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA1_T16_DONE,
-+	 .ring_size = 128,
-+	 .ring_attr = HIF_TX_FWDL,
-+	 .ring_info = "FWDL"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA1_T17_DONE,
-+	 .ring_size = 256,
-+	 .ring_attr = HIF_TX_CMD_WM,
-+	 .ring_info = "cmd to WM"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA1_T18_DONE,
-+	 .ring_size = 2048,
-+	 .ring_attr = HIF_TX_DATA,
-+	 .ring_info = "band0 TXD"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA1_T19_DONE,
-+	 .ring_size = 2048,
-+	 .ring_attr = HIF_TX_DATA,
-+	 .ring_info = "band1 TXD"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA1_T20_DONE,
-+	 .ring_size = 256,
-+	 .ring_attr = HIF_TX_CMD,
-+	 .ring_info = "cmd to WA"
-+	}
-+};
-+
-+const struct hif_pci_rx_ring_desc mt7915_rx_ring_layout[] = {
-+	{
-+	 .hw_int_mask = MT_DBG_EXT_WRAP_INT_DMA0_R0_DONE,
-+	 .ring_size = 1536,
-+	 .ring_attr = HIF_RX_DATA,
-+	 .ring_info = "band0 RX data"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_EXT_WRAP_INT_DMA0_R1_DONE,
-+	 .ring_size = 1536,
-+	 .ring_attr = HIF_RX_DATA,
-+	 .ring_info = "band1 RX data"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA1_R0_DONE,
-+	 .ring_size = 512,
-+	 .ring_attr = HIF_RX_EVENT,
-+	 .ring_info = "event from WM"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA1_R1_DONE,
-+	 .ring_size = 1024,
-+	 .ring_attr = HIF_RX_EVENT,
-+	 .ring_info = "event from WA band0"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA1_R2_DONE,
-+	 .ring_size = 512,
-+	 .ring_attr = HIF_RX_EVENT,
-+	 .ring_info = "event from WA band1"
-+	}
-+};
-+
-+const struct hif_pci_tx_ring_desc mt7986_tx_ring_layout[] = {
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_T16_DONE,
-+	 .ring_size = 128,
-+	 .ring_attr = HIF_TX_FWDL,
-+	 .ring_info = "FWDL"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_T17_DONE,
-+	 .ring_size = 256,
-+	 .ring_attr = HIF_TX_CMD_WM,
-+	 .ring_info = "cmd to WM"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_T18_DONE,
-+	 .ring_size = 2048,
-+	 .ring_attr = HIF_TX_DATA,
-+	 .ring_info = "band0 TXD"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_T19_DONE,
-+	 .ring_size = 2048,
-+	 .ring_attr = HIF_TX_DATA,
-+	 .ring_info = "band1 TXD"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_T20_DONE,
-+	 .ring_size = 256,
-+	 .ring_attr = HIF_TX_CMD,
-+	 .ring_info = "cmd to WA"
-+	}
-+};
-+
-+const struct hif_pci_rx_ring_desc mt7986_rx_ring_layout[] = {
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_R4_DONE,
-+	 .ring_size = 1536,
-+	 .ring_attr = HIF_RX_DATA,
-+	 .ring_info = "band0 RX data"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_R5_DONE,
-+	 .ring_size = 1536,
-+	 .ring_attr = HIF_RX_DATA,
-+	 .ring_info = "band1 RX data"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_R0_DONE,
-+	 .ring_size = 512,
-+	 .ring_attr = HIF_RX_EVENT,
-+	 .ring_info = "event from WM"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_R1_DONE,
-+	 .ring_size = 512,
-+	 .ring_attr = HIF_RX_EVENT,
-+	 .ring_info = "event from WA"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_R2_DONE,
-+	 .ring_size = 1024,
-+	 .ring_attr = HIF_RX_EVENT,
-+	 .ring_info = "STS WA band0"
-+	},
-+	{
-+	 .hw_int_mask = MT_DBG_INT_DMA0_R3_DONE,
-+	 .ring_size = 512,
-+	 .ring_attr = HIF_RX_EVENT,
-+	 .ring_info = "STS WA band1"
-+	},
-+};
-+
-+/* mibinfo related CRs. */
-+#define BN0_WF_MIB_TOP_BASE                                    0x820ed000
-+#define BN1_WF_MIB_TOP_BASE                                    0x820fd000
-+
-+#define BN0_WF_MIB_TOP_BTOCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x400) // D400
-+#define BN0_WF_MIB_TOP_BTBCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x428) // D428
-+#define BN0_WF_MIB_TOP_BTDCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x4F0) // D4F0
-+
-+#define BN0_WF_MIB_TOP_BSDR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x688) // D688
-+#define BN0_WF_MIB_TOP_BSDR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x690) // D690
-+
-+#define BN0_WF_MIB_TOP_BSDR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x518) // D518
-+#define BN0_WF_MIB_TOP_BSDR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x520) // D520
-+#define BN0_WF_MIB_TOP_BSDR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x528) // D528
-+#define BN0_WF_MIB_TOP_BSDR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x530) // D530
-+#define BN0_WF_MIB_TOP_BSDR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x538) // D538
-+
-+#define BN0_WF_MIB_TOP_BROCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x5B8) // D5B8
-+#define BN0_WF_MIB_TOP_BRBCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x5E0) // D5E0
-+#define BN0_WF_MIB_TOP_BRDCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x630) // D630
-+
-+#define BN0_WF_MIB_TOP_M0SDR0_BEACONTXCOUNT_MASK               0x0000FFFF // BEACONTXCOUNT[15..0]
-+
-+#define BN0_WF_MIB_TOP_M0SDR4_RX_FIFO_FULL_COUNT_MASK          0x0000FFFF // RX_FIFO_FULL_COUNT[15..0]
-+
-+#define BN0_WF_MIB_TOP_M0SDR5_RX_MPDU_COUNT_MASK               0xFFFFFFFF // RX_MPDU_COUNT[31..0]
-+
-+#define BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK          0x0000FFFF // CHANNEL_IDLE_COUNT[15..0]
-+
-+#define BN1_WF_MIB_TOP_BTOCR_ADDR                              (BN1_WF_MIB_TOP_BASE + 0x400) // D400
-+
-+#define BN0_WF_MIB_TOP_M0SDR7_VEC_MISS_COUNT_MASK              0x0000FFFF // VEC_MISS_COUNT[15..0]
-+#define BN0_WF_MIB_TOP_M0SDR8_DELIMITER_FAIL_COUNT_MASK        0x0000FFFF // DELIMITER_FAIL_COUNT[15..0]
-+#define BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK             0x00FFFFFF // CCA_NAV_TX_TIME[23..0]
-+
-+#define BN0_WF_MIB_TOP_M0SDR11_RX_LEN_MISMATCH_MASK            0x0000FFFF // RX_LEN_MISMATCH[15..0]
-+
-+#define BN0_WF_MIB_TOP_M0SDR16_P_CCA_TIME_MASK                 0x00FFFFFF // P_CCA_TIME[23..0]
-+#define BN0_WF_MIB_TOP_M0SDR17_S_CCA_TIME_MASK                 0x00FFFFFF // S_CCA_TIME[23..0]
-+#define BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK                  0x00FFFFFF // P_ED_TIME[23..0]
-+#define BN0_WF_MIB_TOP_M0SDR19_CCK_MDRDY_TIME_MASK             0x00FFFFFF // CCK_MDRDY_TIME[23..0]
-+#define BN0_WF_MIB_TOP_M0SDR20_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK 0x00FFFFFF  // OFDM_LG_MIXED_VHT_MDRDY_TIME[23..0]
-+#define BN0_WF_MIB_TOP_M0SDR21_OFDM_GREEN_MDRDY_TIME_MASK      0x00FFFFFF // OFDM_GREEN_MDRDY_TIME[23..0]
-+
-+#define BN0_WF_MIB_TOP_M0SDR22_ADDR                            (BN0_WF_MIB_TOP_BASE + 0x60) // D060
-+#define BN0_WF_MIB_TOP_M0SDR23_ADDR                            (BN0_WF_MIB_TOP_BASE + 0x64) // D064
-+
-+#define BN0_WF_MIB_TOP_M0SDR34_MUBF_TX_COUNT_MASK              0x0000FFFF                // MUBF_TX_COUNT[15..0]
-+
-+#define BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_MASK                 0xFFFF0000                // TX_40MHZ_CNT[31..16]
-+#define BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_SHFT                 16
-+#define BN0_WF_MIB_TOP_M0DR0_TX_20MHZ_CNT_MASK                 0x0000FFFF                // TX_20MHZ_CNT[15..0]
-+#define BN0_WF_MIB_TOP_M0DR0_TX_20MHZ_CNT_SHFT                 0
-+
-+#define BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_MASK                0xFFFF0000                // TX_160MHZ_CNT[31..16]
-+#define BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_SHFT                16
-+#define BN0_WF_MIB_TOP_M0DR1_TX_80MHZ_CNT_MASK                 0x0000FFFF                // TX_80MHZ_CNT[15..0]
-+#define BN0_WF_MIB_TOP_M0DR1_TX_80MHZ_CNT_SHFT                 0
-+
-+#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_MASK            0xFFFF0000                // TX_DDLMT_RNG2_CNT[31..16]
-+#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_SHFT            16
-+#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG1_CNT_MASK            0x0000FFFF                // TX_DDLMT_RNG1_CNT[15..0]
-+#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG1_CNT_SHFT            0
-+
-+#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_MASK            0xFFFF0000                // TX_DDLMT_RNG4_CNT[31..16]
-+#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_SHFT            16
-+#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG3_CNT_MASK            0x0000FFFF                // TX_DDLMT_RNG3_CNT[15..0]
-+#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG3_CNT_SHFT            0
-+
-+#define BN0_WF_MIB_TOP_M0DR10_MU_FAIL_PPDU_CNT_MASK            0x0000FFFF                // MU_FAIL_PPDU_CNT[15..0]
-+
-+#define BN0_WF_MIB_TOP_M0B0SDR0_ADDR                           (BN0_WF_MIB_TOP_BASE + 0x100) // D100
-+#define BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_MASK             0xFFFF0000                // RTSRETRYCOUNT[31..16]
-+#define BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_SHFT             16
-+#define BN0_WF_MIB_TOP_M0B0SDR0_RTSTXCOUNT_MASK                0x0000FFFF                // RTSTXCOUNT[15..0]
-+#define BN0_WF_MIB_TOP_M0B0SDR0_RTSTXCOUNT_SHFT                0
-+#define BN0_WF_MIB_TOP_M0B0SDR1_ADDR                           (BN0_WF_MIB_TOP_BASE + 0x104) // D104
-+#define BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_MASK              0xFFFF0000                // ACKFAILCOUNT[31..16]
-+#define BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_SHFT              16
-+#define BN0_WF_MIB_TOP_M0B0SDR1_BAMISSCOUNT_MASK               0x0000FFFF                // BAMISSCOUNT[15..0]
-+#define BN0_WF_MIB_TOP_M0B0SDR1_BAMISSCOUNT_SHFT               0
-+#define BN0_WF_MIB_TOP_M0B0SDR2_ADDR                           (BN0_WF_MIB_TOP_BASE + 0x108) // D108
-+#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_MASK          0xFFFF0000                // FRAMERETRY2COUNT[31..16]
-+#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_SHFT          16
-+#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRYCOUNT_MASK           0x0000FFFF                // FRAMERETRYCOUNT[15..0]
-+#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRYCOUNT_SHFT           0
-+#define BN0_WF_MIB_TOP_M0B0SDR3_ADDR                           (BN0_WF_MIB_TOP_BASE + 0x10C) // D10C
-+#define BN0_WF_MIB_TOP_M0B0SDR3_FRAMERETRY3COUNT_MASK          0x0000FFFF                // FRAMERETRY3COUNT[15..0]
-+#define BN0_WF_MIB_TOP_M0B0SDR3_FRAMERETRY3COUNT_SHFT          0
-+#define BN0_WF_MIB_TOP_M0DR12_TX_DDLMT_RNG0_CNT_MASK           0x0000FFFF                // TX_DDLMT_RNG0_CNT[15..0]
-+
-+
-+#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_MASK              0xFFFF0000                // TX_OK_COUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_SHFT              16
-+#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_MASK                0x0000FFFF                // TX_OK_COUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_SHFT                0
-+
-+#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_MASK            0xFFFF0000                // TX_DATA_COUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_SHFT            16
-+#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_MASK              0x0000FFFF                // TX_DATA_COUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_SHFT              0
-+
-+#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_MASK              0xFFFF0000                // RX_OK_COUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_SHFT              16
-+#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_MASK                0x0000FFFF                // RX_OK_COUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_SHFT                0
-+
-+#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_MASK            0xFFFF0000                // RX_DATA_COUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_SHFT            16
-+#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_MASK              0x0000FFFF                // RX_DATA_COUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_SHFT              0
-+
-+#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_MASK               0xFFFF0000                // RTSTXCOUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_SHFT               16
-+#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_MASK                 0x0000FFFF                // RTSTXCOUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_SHFT                 0
-+
-+#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_MASK            0xFFFF0000                // RTSRETRYCOUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_SHFT            16
-+#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_MASK              0x0000FFFF                // RTSRETRYCOUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_SHFT              0
-+
-+#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_MASK              0xFFFF0000                // BAMISSCOUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_SHFT              16
-+#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_MASK                0x0000FFFF                // BAMISSCOUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_SHFT                0
-+
-+#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_MASK             0xFFFF0000                // ACKFAILCOUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_SHFT             16
-+#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_MASK               0x0000FFFF                // ACKFAILCOUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_SHFT               0
-+
-+#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_MASK          0xFFFF0000                // FRAMERETRYCOUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_SHFT          16
-+#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_MASK            0x0000FFFF                // FRAMERETRYCOUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_SHFT            0
-+
-+#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_MASK         0xFFFF0000                // FRAMERETRY2COUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_SHFT         16
-+#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_MASK           0x0000FFFF                // FRAMERETRY2COUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_SHFT           0
-+
-+#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_MASK         0xFFFF0000                // FRAMERETRY3COUNT2np1[31..16]
-+#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_SHFT         16
-+#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_MASK           0x0000FFFF                // FRAMERETRY3COUNT2n[15..0]
-+#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_SHFT           0
-+/* TXD */
-+
-+#define MT_TXD1_ETYP			BIT(15)
-+#define MT_TXD1_VLAN			BIT(14)
-+#define MT_TXD1_RMVL			BIT(13)
-+#define MT_TXD1_AMS			BIT(13)
-+#define MT_TXD1_EOSP			BIT(12)
-+#define MT_TXD1_MRD			BIT(11)
-+
-+#define MT_TXD7_CTXD			BIT(26)
-+#define MT_TXD7_CTXD_CNT		GENMASK(25, 23)
-+#define MT_TXD7_TAT			GENMASK(9, 0)
-+
-+#endif
-+#endif
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-new file mode 100644
-index 0000000..53f98d1
---- /dev/null
-+++ b/mt7915/mtk_debugfs.c
-@@ -0,0 +1,2926 @@
-+#include<linux/inet.h>
-+#include "mt7915.h"
-+#include "mt7915_debug.h"
-+#include "mac.h"
-+#include "mcu.h"
-+
-+#ifdef MTK_DEBUG
-+#define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
-+#define LWTBL_IDX2BASE_DW		GENMASK(7, 2)
-+#define LWTBL_IDX2BASE(_id, _dw)	(MT_DBG_WTBL_BASE | \
-+					FIELD_PREP(LWTBL_IDX2BASE_ID, _id) | \
-+					FIELD_PREP(LWTBL_IDX2BASE_DW, _dw))
-+
-+#define UWTBL_IDX2BASE_ID		GENMASK(12, 6)
-+#define UWTBL_IDX2BASE_DW		GENMASK(5, 2)
-+#define UWTBL_IDX2BASE(_id, _dw)	(MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
-+					FIELD_PREP(UWTBL_IDX2BASE_ID, _id) | \
-+					FIELD_PREP(UWTBL_IDX2BASE_DW, _dw))
-+
-+#define KEYTBL_IDX2BASE_KEY		GENMASK(12, 6)
-+#define KEYTBL_IDX2BASE_DW		GENMASK(5, 2)
-+#define KEYTBL_IDX2BASE(_key, _dw)	(MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
-+					FIELD_PREP(KEYTBL_IDX2BASE_KEY, _key) | \
-+					FIELD_PREP(KEYTBL_IDX2BASE_DW, _dw))
-+
-+enum mt7915_wtbl_type {
-+	WTBL_TYPE_LMAC,		/* WTBL in LMAC */
-+	WTBL_TYPE_UMAC,		/* WTBL in UMAC */
-+	WTBL_TYPE_KEY,		/* Key Table */
-+	MAX_NUM_WTBL_TYPE
-+};
-+
-+static int mt7915_wtbl_read_raw(struct mt7915_dev *dev, u16 idx,
-+			        enum mt7915_wtbl_type type, u16 start_dw,
-+			        u16 len, void *buf)
-+{
-+	u32 *dest_cpy = (u32 *)buf;
-+	u32 size_dw = len;
-+	u32 src = 0;
-+
-+	if (!buf)
-+		return 0xFF;
-+
-+	if (type == WTBL_TYPE_LMAC) {
-+		mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR,
-+			FIELD_PREP(MT_DBG_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
-+		src = LWTBL_IDX2BASE(idx, start_dw);
-+	} else if (type == WTBL_TYPE_UMAC) {
-+		mt76_wr(dev,  MT_DBG_UWTBL_TOP_WDUCR,
-+			FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
-+		src = UWTBL_IDX2BASE(idx, start_dw);
-+	} else if (type == WTBL_TYPE_KEY) {
-+		mt76_wr(dev,  MT_DBG_UWTBL_TOP_WDUCR,
-+			MT_UWTBL_TOP_WDUCR_TARGET |
-+			FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
-+		src = KEYTBL_IDX2BASE(idx, start_dw);
-+	}
-+
-+	while (size_dw--) {
-+		*dest_cpy++ = mt76_rr(dev, src);
-+		src += 4;
-+	};
-+
-+	return 0;
-+}
-+
-+static int mt7915_wtbl_write_raw(struct mt7915_dev *dev, u16 idx,
-+			         enum mt7915_wtbl_type type, u16 start_dw,
-+			         u32 val)
-+{
-+	u32 addr = 0;
-+
-+	if (type == WTBL_TYPE_LMAC) {
-+		mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR,
-+			FIELD_PREP(MT_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
-+		addr = LWTBL_IDX2BASE(idx, start_dw);
-+	} else if (type == WTBL_TYPE_UMAC) {
-+		mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR,
-+			FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
-+		addr = UWTBL_IDX2BASE(idx, start_dw);
-+	} else if (type == WTBL_TYPE_KEY) {
-+		mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR,
-+			MT_UWTBL_TOP_WDUCR_TARGET |
-+			FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
-+		addr = KEYTBL_IDX2BASE(idx, start_dw);
-+	}
-+
-+	mt76_wr(dev, addr, val);
-+
-+	return 0;
-+}
-+
-+void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len)
-+{
-+	struct bin_debug_hdr *hdr;
-+	char *buf;
-+
-+	if (len > 1500 - sizeof(*hdr))
-+		len = 1500 - sizeof(*hdr);
-+
-+	buf = kzalloc(sizeof(*hdr) + len, GFP_KERNEL);
-+	if (!buf)
-+		return;
-+
-+	hdr = (struct bin_debug_hdr *)buf;
-+	hdr->magic_num = cpu_to_le32(PKT_BIN_DEBUG_MAGIC);
-+	hdr->serial_id = cpu_to_le16(dev->dbg.fwlog_seq++);
-+	hdr->msg_type = cpu_to_le16(type);
-+	hdr->len = cpu_to_le16(len);
-+	hdr->des_len = cpu_to_le16(des_len);
-+
-+	memcpy(buf + sizeof(*hdr), data, len);
-+
-+	mt7915_debugfs_rx_log(dev, buf, sizeof(*hdr) + len);
-+}
-+
-+static int
-+mt7915_fw_debug_module_set(void *data, u64 module)
-+{
-+	struct mt7915_dev *dev = data;
-+
-+	dev->dbg.fw_dbg_module = module;
-+	return 0;
-+}
-+
-+static int
-+mt7915_fw_debug_module_get(void *data, u64 *module)
-+{
-+	struct mt7915_dev *dev = data;
-+
-+	*module = dev->dbg.fw_dbg_module;
-+	return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_module, mt7915_fw_debug_module_get,
-+			 mt7915_fw_debug_module_set, "%lld\n");
-+
-+static int
-+mt7915_fw_debug_level_set(void *data, u64 level)
-+{
-+	struct mt7915_dev *dev = data;
-+
-+	dev->dbg.fw_dbg_lv = level;
-+	mt7915_mcu_fw_dbg_ctrl(dev, dev->dbg.fw_dbg_module, dev->dbg.fw_dbg_lv);
-+	return 0;
-+}
-+
-+static int
-+mt7915_fw_debug_level_get(void *data, u64 *level)
-+{
-+	struct mt7915_dev *dev = data;
-+
-+	*level = dev->dbg.fw_dbg_lv;
-+	return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_level, mt7915_fw_debug_level_get,
-+			 mt7915_fw_debug_level_set, "%lld\n");
-+
-+#define MAX_TX_MODE 12
-+static char *HW_TX_MODE_STR[] = {"CCK", "OFDM", "HT-Mix", "HT-GF", "VHT",
-+				 "N/A", "N/A", "N/A", "HE_SU", "HE_EXT_SU",
-+				 "HE_TRIG", "HE_MU", "N/A"};
-+static char *HW_TX_RATE_CCK_STR[] = {"1M", "2Mlong", "5.5Mlong", "11Mlong",
-+				     "N/A", "2Mshort", "5.5Mshort", "11Mshort",
-+				     "N/A"};
-+static char *HW_TX_RATE_OFDM_STR[] = {"6M", "9M", "12M", "18M", "24M", "36M",
-+				      "48M", "54M", "N/A"};
-+static char *fcap_str[] =  {"20MHz", "20/40MHz", "20/40/80MHz",
-+			    "20/40/80/160/80+80MHz"};
-+
-+static char *hw_rate_ofdm_str(u16 ofdm_idx)
-+{
-+	switch (ofdm_idx) {
-+	case 11: /* 6M */
-+		return HW_TX_RATE_OFDM_STR[0];
-+
-+	case 15: /* 9M */
-+		return HW_TX_RATE_OFDM_STR[1];
-+
-+	case 10: /* 12M */
-+		return HW_TX_RATE_OFDM_STR[2];
-+
-+	case 14: /* 18M */
-+		return HW_TX_RATE_OFDM_STR[3];
-+
-+	case 9: /* 24M */
-+		return HW_TX_RATE_OFDM_STR[4];
-+
-+	case 13: /* 36M */
-+		return HW_TX_RATE_OFDM_STR[5];
-+
-+	case 8: /* 48M */
-+		return HW_TX_RATE_OFDM_STR[6];
-+
-+	case 12: /* 54M */
-+		return HW_TX_RATE_OFDM_STR[7];
-+
-+	default:
-+		return HW_TX_RATE_OFDM_STR[8];
-+	}
-+}
-+
-+static char *hw_rate_str(u8 mode, u16 rate_idx)
-+{
-+	if (mode == 0)
-+		return rate_idx < 8 ? HW_TX_RATE_CCK_STR[rate_idx] : HW_TX_RATE_CCK_STR[8];
-+	else if (mode == 1)
-+		return hw_rate_ofdm_str(rate_idx);
-+	else
-+		return "MCS";
-+}
-+
-+static void parse_rate(struct seq_file *s, u16 rate_idx, u16 txrate)
-+{
-+	u16 txmode, mcs, nss, stbc;
-+
-+	txmode = FIELD_GET(GENMASK(9, 6), txrate);
-+	mcs = FIELD_GET(GENMASK(5, 0), txrate);
-+	nss = FIELD_GET(GENMASK(12, 10), txrate);
-+	stbc = FIELD_GET(BIT(13), txrate);
-+
-+	seq_printf(s, "\tRate%d(0x%x):TxMode=%d(%s), TxRate=%d(%s), Nsts=%d, STBC=%d\n",
-+			rate_idx + 1, txrate,
-+			txmode, (txmode < MAX_TX_MODE ? HW_TX_MODE_STR[txmode] : HW_TX_MODE_STR[MAX_TX_MODE]),
-+			mcs, hw_rate_str(txmode, mcs), nss, stbc);
-+}
-+
-+#define LWTBL_LEN_IN_DW 32
-+#define UWTBL_LEN_IN_DW 8
-+#define ONE_KEY_ENTRY_LEN_IN_DW 8
-+static int mt7915_sta_info(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	u8 lwtbl[LWTBL_LEN_IN_DW*4] = {0};
-+	u16 i = 0;
-+
-+	for (i=0; i < mt7915_wtbl_size(dev); i++) {
-+		mt7915_wtbl_read_raw(dev, i, WTBL_TYPE_LMAC, 0,
-+					LWTBL_LEN_IN_DW, lwtbl);
-+		if (lwtbl[4] || lwtbl[5] || lwtbl[6] || lwtbl[7] || lwtbl[0] || lwtbl[1])
-+			seq_printf(s, "wcid:%d\tAddr: %02x:%02x:%02x:%02x:%02x:%02x\n",
-+					i, lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
-+	}
-+
-+	return 0;
-+}
-+
-+static int mt7915_wtbl_read(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	u8 lwtbl[LWTBL_LEN_IN_DW*4] = {0};
-+	int x;
-+	u32 *addr = 0;
-+	u32 dw_value = 0;
-+
-+	mt7915_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_LMAC, 0,
-+				 LWTBL_LEN_IN_DW, lwtbl);
-+	seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
-+	seq_printf(s, "LMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
-+				MT_DBG_WTBLON_TOP_WDUCR,
-+				mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
-+				LWTBL_IDX2BASE(dev->wlan_idx, 0));
-+	for (x = 0; x < LWTBL_LEN_IN_DW; x++) {
-+		seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
-+					x,
-+					lwtbl[x * 4 + 3],
-+					lwtbl[x * 4 + 2],
-+					lwtbl[x * 4 + 1],
-+					lwtbl[x * 4]);
-+	}
-+
-+	seq_printf(s, "\n\tAddr: %02x:%02x:%02x:%02x:%02x:%02x(D0[B0~15], D1[B0~31])\n",
-+			  lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
-+
-+	// DW0, DW1
-+	seq_printf(s, "LWTBL DW 0/1\n\t");
-+	addr = (u32 *)&(lwtbl[0]);
-+	dw_value = *addr;
-+	seq_printf(s, "MUAR_IDX:%lu/ ",	FIELD_GET(GENMASK(21, 16),	dw_value));
-+	seq_printf(s, "RCA1:%ld/ ",	FIELD_GET(BIT(22),		dw_value));
-+	seq_printf(s, "KID:%lu/ ",	FIELD_GET(GENMASK(24, 23),	dw_value));
-+	seq_printf(s, "RCID:%ld/ ",	FIELD_GET(BIT(25),		dw_value));
-+	seq_printf(s, "FROM_DS:%ld\n\t",	FIELD_GET(BIT(26),		dw_value));
-+	seq_printf(s, "TO_DS:%ld/ ",	FIELD_GET(BIT(27),		dw_value));
-+	seq_printf(s, "RV:%ld/ ",	FIELD_GET(BIT(28),		dw_value));
-+	seq_printf(s, "RCA2:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
-+	seq_printf(s, "WPI_FLAG:%ld\n",	FIELD_GET(BIT(30),		dw_value));
-+
-+	// DW2
-+	seq_printf(s, "LWTBL DW 2\n\t");
-+	addr = (u32 *)&(lwtbl[2*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "AID12:%lu/ ",	FIELD_GET(GENMASK(11, 0),	dw_value));
-+	seq_printf(s, "SU:%ld/ ",	FIELD_GET(BIT(12),		dw_value));
-+	seq_printf(s, "SPP_EN:%ld/ ",	FIELD_GET(BIT(13),		dw_value));
-+	seq_printf(s, "WPI_EVEN:%ld\n\t",FIELD_GET(BIT(14),		dw_value));
-+	seq_printf(s, "CIPHER:%lu/ ",	FIELD_GET(GENMASK(20, 16),	dw_value));
-+	seq_printf(s, "CIPHER_IGTK:%lu/ ",FIELD_GET(GENMASK(22, 21),	dw_value));
-+	seq_printf(s, "AAD_OM:%ld\n\t",	FIELD_GET(BIT(15),		dw_value));
-+	seq_printf(s, "SW:%ld/ ",	FIELD_GET(BIT(24),		dw_value));
-+	seq_printf(s, "UL:%ld/ ",	FIELD_GET(BIT(25),		dw_value));
-+	seq_printf(s, "TX_POWER_SAVE:%ld\n\t", FIELD_GET(BIT(26),	dw_value));
-+	seq_printf(s, "QOS:%ld/ ",	FIELD_GET(BIT(27),		dw_value));
-+	seq_printf(s, "HT:%ld/ ",	FIELD_GET(BIT(28),		dw_value));
-+	seq_printf(s, "VHT:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
-+	seq_printf(s, "HE:%ld/ ",	FIELD_GET(BIT(30),		dw_value));
-+	seq_printf(s, "MESH:%ld\n",	FIELD_GET(BIT(31),		dw_value));
-+
-+	// DW3
-+	seq_printf(s, "LWTBL DW 3\n\t");
-+	addr = (u32 *)&(lwtbl[3*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "WMM_Q:%lu/ ",	FIELD_GET(GENMASK(1, 0),	dw_value));
-+	seq_printf(s, "RXD_DUP_MODE:%lu\n\t", FIELD_GET(GENMASK(3, 2),	dw_value));
-+	seq_printf(s, "VLAN2ETH:%ld/ ",	FIELD_GET(BIT(4),		dw_value));
-+	seq_printf(s, "BEAM_CHG:%ld/ ",	FIELD_GET(BIT(5),		dw_value));
-+	seq_printf(s, "DIS_BA256:%ld\n\t", FIELD_GET(BIT(6),		dw_value));
-+	seq_printf(s, "PFMU_IDX:%lu/ ",	FIELD_GET(GENMASK(15, 8),	dw_value));
-+	seq_printf(s, "ULPF_IDX:%lu\n\t", FIELD_GET(GENMASK(23, 16),	dw_value));
-+	seq_printf(s, "RIBF:%ld/ ",	FIELD_GET(BIT(24),		dw_value));
-+	seq_printf(s, "ULPF:%ld\n\t",	FIELD_GET(BIT(25),		dw_value));
-+	seq_printf(s, "IGN_FBK:%ld/ ",	FIELD_GET(BIT(26),		dw_value));
-+	seq_printf(s, "TBF:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
-+	seq_printf(s, "TBF_VHT:%ld/ ",	FIELD_GET(BIT(30),		dw_value));
-+	seq_printf(s, "TBF_HE:%ld\n",	FIELD_GET(BIT(31),		dw_value));
-+
-+	// DW4
-+	seq_printf(s, "LWTBL DW 4\n\t");
-+	addr = (u32 *)&(lwtbl[4*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "ANT_ID_STS0:%lu/ ", FIELD_GET(GENMASK(2, 0),	dw_value));
-+	seq_printf(s, "STS1:%lu/ ",	FIELD_GET(GENMASK(5, 3),	dw_value));
-+	seq_printf(s, "STS2:%lu/ ",	FIELD_GET(GENMASK(8, 6),	dw_value));
-+	seq_printf(s, "STS3:%lu\n\t",	FIELD_GET(GENMASK(11, 9),	dw_value));
-+	seq_printf(s, "ANT_ID_STS4:%lu/ ", FIELD_GET(GENMASK(14, 12),	dw_value));
-+	seq_printf(s, "STS5:%lu/ ",	FIELD_GET(GENMASK(17, 15),	dw_value));
-+	seq_printf(s, "STS6:%ld/ ",	FIELD_GET(GENMASK(20, 18),	dw_value));
-+	seq_printf(s, "STS7:%lu\n\t",	FIELD_GET(GENMASK(23, 21),	dw_value));
-+	seq_printf(s, "CASCAD:%ld/ ",	FIELD_GET(BIT(24),		dw_value));
-+	seq_printf(s, "LDPC_HT:%ld/ ",	FIELD_GET(BIT(25),		dw_value));
-+	seq_printf(s, "LDPC_VHT:%ld/ ", FIELD_GET(BIT(26),		dw_value));
-+	seq_printf(s, "LDPC_HE:%ld\n\t", FIELD_GET(BIT(27),		dw_value));
-+	seq_printf(s, "DIS_RHTR:%ld/ ",	FIELD_GET(BIT(28),		dw_value));
-+	seq_printf(s, "ALL_ACK:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
-+	seq_printf(s, "DROP:%ld/ ",	FIELD_GET(BIT(30),		dw_value));
-+	seq_printf(s, "ACK_EN:%ld\n",	FIELD_GET(BIT(31),		dw_value));
-+
-+	// DW5
-+	seq_printf(s, "LWTBL DW 5\n\t");
-+	addr = (u32 *)&(lwtbl[5*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "AF:%lu/ ",	FIELD_GET(GENMASK(2, 0),	dw_value));
-+	seq_printf(s, "AF_HE:%lu/ ",	FIELD_GET(GENMASK(4, 3),	dw_value));
-+	seq_printf(s, "RTS:%ld/ ",	FIELD_GET(BIT(5),		dw_value));
-+	seq_printf(s, "SMPS:%ld/ ",	FIELD_GET(BIT(6),		dw_value));
-+	seq_printf(s, "DYN_BW:%ld\n\t",	FIELD_GET(BIT(7),		dw_value));
-+	seq_printf(s, "MMSS:%lu/ ",	FIELD_GET(GENMASK(10, 8),	dw_value));
-+	seq_printf(s, "USR:%ld/ ",	FIELD_GET(BIT(11),		dw_value));
-+	seq_printf(s, "SR_RATE:%lu/ ",	FIELD_GET(GENMASK(14, 12),	dw_value));
-+	seq_printf(s, "SR_ABORT:%ld\n\t", FIELD_GET(BIT(15),		dw_value));
-+	seq_printf(s, "TX_POWER_OFFSET:%lu/ ", FIELD_GET(GENMASK(21, 16), dw_value));
-+	seq_printf(s, "WTBL_MPDU_SIZE:%lu\n\t", FIELD_GET(GENMASK(23, 22), dw_value));
-+	seq_printf(s, "PE:%lu/ ",	FIELD_GET(GENMASK(25, 24),	dw_value));
-+	seq_printf(s, "DOPPL:%ld/ ",	FIELD_GET(BIT(26),		dw_value));
-+	seq_printf(s, "TXOP_PS_CAP:%ld/ ", FIELD_GET(BIT(27),		dw_value));
-+	seq_printf(s, "DONOT_UPDATE_I_PSM:%ld\n\t", FIELD_GET(BIT(28),	dw_value));
-+	seq_printf(s, "I_PSM:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
-+	seq_printf(s, "PSM:%ld/ ",	FIELD_GET(BIT(30),		dw_value));
-+	seq_printf(s, "SKIP_TX:%ld\n",	FIELD_GET(BIT(31),		dw_value));
-+
-+	// DW6
-+	seq_printf(s, "LWTBL DW 6\n\t");
-+	seq_printf(s, "TID 0/1/2/3/4/5/6/7 BA_WIN_SIZE:");
-+	addr = (u32 *)&(lwtbl[6*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(3, 0),	dw_value));
-+	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(7, 4),	dw_value));
-+	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(11, 8),	dw_value));
-+	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(15, 12),	dw_value));
-+	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(19, 16),	dw_value));
-+	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(23, 20),	dw_value));
-+	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(27, 24),	dw_value));
-+	seq_printf(s, "%lu\n",	FIELD_GET(GENMASK(31, 28),	dw_value));
-+
-+	// DW7
-+	seq_printf(s, "LWTBL DW 7\n\t");
-+	addr = (u32 *)&(lwtbl[7*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "CBRN:%lu/ ",	FIELD_GET(GENMASK(2, 0),	dw_value));
-+	seq_printf(s, "DBNSS_EN:%ld/ ",	FIELD_GET(BIT(3),		dw_value));
-+	seq_printf(s, "BAF_EN:%ld/ ",	FIELD_GET(BIT(4),		dw_value));
-+	seq_printf(s, "RDGBA:%ld\n\t",	FIELD_GET(BIT(5),		dw_value));
-+	seq_printf(s, "RDG:%ld/ ",	FIELD_GET(BIT(6),		dw_value));
-+	seq_printf(s, "SPE_IDX:%lu/ ",	FIELD_GET(GENMASK(11, 7),	dw_value));
-+	seq_printf(s, "G2:%ld/ ",	FIELD_GET(BIT(12),		dw_value));
-+	seq_printf(s, "G4:%ld/ ",	FIELD_GET(BIT(13),		dw_value));
-+	seq_printf(s, "G8:%ld/ ",	FIELD_GET(BIT(14),		dw_value));
-+	seq_printf(s, "G16:%ld\n\t",	FIELD_GET(BIT(15),		dw_value));
-+	seq_printf(s, "G2_LTF:%lu/ ", 	FIELD_GET(GENMASK(17, 16),	dw_value));
-+	seq_printf(s, "G4_LTF:%lu/ ",	FIELD_GET(GENMASK(19, 18),	dw_value));
-+	seq_printf(s, "G8_LTF:%lu/ ",	FIELD_GET(GENMASK(21, 20),	dw_value));
-+	seq_printf(s, "G16_LTF:%lu\n\t", FIELD_GET(GENMASK(23, 22),	dw_value));
-+	seq_printf(s, "G2_HE:%lu/ ", 	FIELD_GET(GENMASK(25, 24),	dw_value));
-+	seq_printf(s, "G4_HE:%lu/ ",	FIELD_GET(GENMASK(27, 27),	dw_value));
-+	seq_printf(s, "G8_HE:%lu/ ",	FIELD_GET(GENMASK(29, 28),	dw_value));
-+	seq_printf(s, "G16_HE:%lu\n",	FIELD_GET(GENMASK(31, 30),	dw_value));
-+
-+	// DW8
-+	seq_printf(s, "LWTBL DW 8\n\t");
-+	addr = (u32 *)&(lwtbl[8*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "FAIL_CNT_AC0:%lu/ ", FIELD_GET(GENMASK(4, 0),	dw_value));
-+	seq_printf(s, "AC1:%lu/ ",	FIELD_GET(GENMASK(9, 5),	dw_value));
-+	seq_printf(s, "AC2:%lu/ ",	FIELD_GET(GENMASK(14, 10),	dw_value));
-+	seq_printf(s, "AC3:%lu\n\t",	FIELD_GET(GENMASK(19, 15),	dw_value));
-+	seq_printf(s, "PARTIAL_AID:%lu/ ", FIELD_GET(GENMASK(28, 20),	dw_value));
-+	seq_printf(s, "CHK_PER:%lu\n",	FIELD_GET(BIT(31),		dw_value));
-+
-+	// DW9
-+	seq_printf(s, "LWTBL DW 9\n\t");
-+	addr = (u32 *)&(lwtbl[9*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "RX_AVG_MPDU:%lu/ ",	FIELD_GET(GENMASK(13, 0), dw_value));
-+	seq_printf(s, "PRITX_SW_MODE:%ld/ ",	FIELD_GET(BIT(16),	dw_value));
-+	seq_printf(s, "PRITX_PLR:%ld\n\t",	FIELD_GET(BIT(17),	dw_value));
-+	seq_printf(s, "PRITX_DCM:%ld/ ",	FIELD_GET(BIT(18),	dw_value));
-+	seq_printf(s, "PRITX_ER160:%ld/ ",	FIELD_GET(BIT(19),	dw_value));
-+	seq_printf(s, "PRITX_ERSU:%lu\n\t",	FIELD_GET(BIT(20),	dw_value));
-+	seq_printf(s, "MPDU_FAIL_CNT:%lu/ ",	FIELD_GET(GENMASK(25, 23), dw_value));
-+	seq_printf(s, "MPDU_OK_CNT:%lu/ ",	FIELD_GET(GENMASK(28, 26), dw_value));
-+	seq_printf(s, "RATE_IDX:%lu\n\t",	FIELD_GET(GENMASK(31, 29), dw_value));
-+	seq_printf(s, "FCAP:%s\n", fcap_str[FIELD_GET(GENMASK(22, 21), dw_value)]);
-+
-+	// DW10
-+	seq_printf(s, "LWTBL DW 10\n");
-+	addr = (u32 *)&(lwtbl[10*4]);
-+	dw_value = *addr;
-+	parse_rate(s, 0, FIELD_GET(GENMASK(13, 0), dw_value));
-+	parse_rate(s, 1, FIELD_GET(GENMASK(29, 16), dw_value));
-+	// DW11
-+	seq_printf(s, "LWTBL DW 11\n");
-+	addr = (u32 *)&(lwtbl[11*4]);
-+	dw_value = *addr;
-+	parse_rate(s, 2, FIELD_GET(GENMASK(13, 0), dw_value));
-+	parse_rate(s, 3, FIELD_GET(GENMASK(29, 16), dw_value));
-+	// DW12
-+	seq_printf(s, "LWTBL DW 12\n");
-+	addr = (u32 *)&(lwtbl[12*4]);
-+	dw_value = *addr;
-+	parse_rate(s, 4, FIELD_GET(GENMASK(13, 0), dw_value));
-+	parse_rate(s, 5, FIELD_GET(GENMASK(29, 16), dw_value));
-+	// DW13
-+	seq_printf(s, "LWTBL DW 13\n");
-+	addr = (u32 *)&(lwtbl[13*4]);
-+	dw_value = *addr;
-+	parse_rate(s, 6, FIELD_GET(GENMASK(13, 0), dw_value));
-+	parse_rate(s, 7, FIELD_GET(GENMASK(29, 16), dw_value));
-+
-+	//DW28
-+	seq_printf(s, "LWTBL DW 28\n\t");
-+	addr = (u32 *)&(lwtbl[28*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "OM_INFO:%lu/ ",	FIELD_GET(GENMASK(11, 0), dw_value));
-+	seq_printf(s, "OM_RXD_DUP_MODE:%u\n\t",	!!(dw_value & BIT(12)) );
-+
-+	//DW29
-+	seq_printf(s, "LWTBL DW 29\n");
-+	addr = (u32 *)&(lwtbl[29*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "USER_RSSI:%lu/ ",	FIELD_GET(GENMASK(8, 0), dw_value));
-+	seq_printf(s, "USER_SNR:%lu/ ", FIELD_GET(GENMASK(14, 9), dw_value));
-+	seq_printf(s, "RAPID_REACTION_RATE:%lu/ ",	FIELD_GET(GENMASK(26, 16), dw_value));
-+	seq_printf(s, "HT_AMSDU(Read Only):%u/ ",	!!(dw_value & BIT(30)) );
-+	seq_printf(s, "AMSDU_CROSS_LG(Read Only):%u\n\t ", !!(dw_value & BIT(31)));
-+
-+	//DW30
-+	seq_printf(s, "LWTBL DW 30\n\t");
-+	addr = (u32 *)&(lwtbl[30*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "RCPI 0:%lu/ ",	FIELD_GET(GENMASK(7, 0), dw_value));
-+	seq_printf(s, "RCPI 1:%lu/ ",	FIELD_GET(GENMASK(15, 8), dw_value));
-+	seq_printf(s, "RCPI 2:%lu/ ",	FIELD_GET(GENMASK(23, 16), dw_value));
-+	seq_printf(s, "RCPI 3:%lu\n\t", FIELD_GET(GENMASK(31, 24), dw_value));
-+
-+	//DW31
-+	seq_printf(s, "LWTBL DW 31\n\t");
-+	addr = (u32 *)&(lwtbl[31*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "RCPI 4:%lu/ ",	FIELD_GET(GENMASK(7, 0), dw_value));
-+	seq_printf(s, "RCPI 5:%lu/ ",	FIELD_GET(GENMASK(15, 8), dw_value));
-+	seq_printf(s, "RCPI 6:%lu/ ",	FIELD_GET(GENMASK(23, 16), dw_value));
-+	seq_printf(s, "RCPI 7:%lu\n\t", FIELD_GET(GENMASK(31, 24), dw_value));
-+
-+	return 0;
-+}
-+
-+static int mt7915_uwtbl_read(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	u8 uwtbl[UWTBL_LEN_IN_DW * 4] = {0};
-+	u8 keytbl[ONE_KEY_ENTRY_LEN_IN_DW*4] = {0};
-+	int x;
-+	u32 *addr = 0;
-+	u32 dw_value = 0;
-+	u32 amsdu_len = 0;
-+	u32 u2SN = 0;
-+	u16 keyloc0, keyloc1;
-+
-+	mt7915_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC, 0,
-+				 UWTBL_LEN_IN_DW, uwtbl);
-+	seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
-+	seq_printf(s, "UMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
-+		   MT_DBG_WTBLON_TOP_WDUCR,
-+		   mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
-+		   UWTBL_IDX2BASE(dev->wlan_idx, 0));
-+	for (x = 0; x < UWTBL_LEN_IN_DW; x++) {
-+		seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
-+			   x,
-+			   uwtbl[x * 4 + 3],
-+			   uwtbl[x * 4 + 2],
-+			   uwtbl[x * 4 + 1],
-+			   uwtbl[x * 4]);
-+	}
-+
-+	/* UMAC WTBL DW 0 */
-+	seq_printf(s, "\nUWTBL PN\n\t");
-+	addr = (u32 *)&(uwtbl[0]);
-+	dw_value = *addr;
-+	seq_printf(s, "PN0:%lu/ ", FIELD_GET(GENMASK(7, 0), dw_value));
-+	seq_printf(s, "PN1:%lu/ ", FIELD_GET(GENMASK(15, 8), dw_value));
-+	seq_printf(s, "PN2:%lu\n\t", FIELD_GET(GENMASK(23, 16), dw_value));
-+	seq_printf(s, "PN3:%lu/ ", FIELD_GET(GENMASK(31, 24), dw_value));
-+
-+	addr = (u32 *)&(uwtbl[1 * 4]);
-+	dw_value = *addr;
-+	seq_printf(s, "PN4:%lu/ ", FIELD_GET(GENMASK(7, 0), dw_value));
-+	seq_printf(s, "PN5:%lu\n", FIELD_GET(GENMASK(15, 8), dw_value));
-+
-+	/* UMAC WTBL DW SN part */
-+	seq_printf(s, "\nUWTBL SN\n");
-+	addr = (u32 *)&(uwtbl[2 * 4]);
-+	dw_value = *addr;
-+	seq_printf(s, "TID0_AC0_SN:%lu\n", FIELD_GET(GENMASK(11, 0), dw_value));
-+	seq_printf(s, "TID1_AC1_SN:%lu\n", FIELD_GET(GENMASK(23, 12), dw_value));
-+
-+	u2SN = FIELD_GET(GENMASK(31, 24), dw_value);
-+	addr = (u32 *)&(uwtbl[3 * 4]);
-+	dw_value = *addr;
-+	u2SN |= FIELD_GET(GENMASK(3, 0), dw_value);
-+	seq_printf(s, "TID2_AC2_SN:%u\n", u2SN);
-+	seq_printf(s, "TID3_AC3_SN:%lu\n", FIELD_GET(GENMASK(15, 4), dw_value));
-+	seq_printf(s, "TID4_SN:%lu\n", FIELD_GET(GENMASK(27, 16), dw_value));
-+
-+	u2SN = FIELD_GET(GENMASK(31, 28), dw_value);
-+	addr = (u32 *)&(uwtbl[4 * 4]);
-+	dw_value = *addr;
-+	u2SN |= FIELD_GET(GENMASK(7, 0), dw_value);
-+	seq_printf(s, "TID5_SN:%u\n", u2SN);
-+	seq_printf(s, "TID6_SN:%lu\n", FIELD_GET(GENMASK(19, 8), dw_value));
-+	seq_printf(s, "TID7_SN:%lu\n", FIELD_GET(GENMASK(31, 20), dw_value));
-+
-+	addr = (u32 *)&(uwtbl[1 * 4]);
-+	dw_value = *addr;
-+	seq_printf(s, "COM_SN:%lu\n", FIELD_GET(GENMASK(27, 16), dw_value));
-+
-+	/* UMAC WTBL DW 0 */
-+	seq_printf(s, "\nUWTBL others\n");
-+
-+	addr = (u32 *)&(uwtbl[5 * 4]);
-+	dw_value = *addr;
-+	keyloc0 = FIELD_GET(GENMASK(10, 0), dw_value);
-+	keyloc1 = FIELD_GET(GENMASK(26, 16), dw_value);
-+	seq_printf(s, "\tKey Loc 1/2:%lu/%lu\n",
-+		   FIELD_GET(GENMASK(10, 0), dw_value),
-+		   FIELD_GET(GENMASK(26, 16), dw_value));
-+	seq_printf(s, "\tUWTBL_QOS:%lu\n", FIELD_GET(BIT(27), dw_value));
-+	seq_printf(s, "\tUWTBL_HT_VHT_HE:%lu\n", FIELD_GET(BIT(28), dw_value));
-+
-+	addr = (u32 *)&(uwtbl[6*4]);
-+	dw_value = *addr;
-+	seq_printf(s, "\tHW AMSDU Enable:%lu\n", FIELD_GET(BIT(9), dw_value));
-+
-+	amsdu_len = FIELD_GET(GENMASK(5, 0), dw_value);
-+	if (amsdu_len == 0)
-+		seq_printf(s, "\tHW AMSDU Len:invalid (WTBL value=0x%x)\n", amsdu_len);
-+	else if (amsdu_len == 1)
-+		seq_printf(s, "\tHW AMSDU Len:%d~%d (WTBL value=0x%x)\n",
-+			   1,
-+			   255,
-+			   amsdu_len);
-+	else
-+		seq_printf(s, "\tHW AMSDU Len:%d~%d (WTBL value=0x%x)\n",
-+			   256 * (amsdu_len - 1),
-+			   256 * (amsdu_len - 1) + 255,
-+			   amsdu_len
-+			   );
-+	seq_printf(s, "\tHW AMSDU Num:%lu (WTBL value=0x%lx)\n",
-+		   FIELD_GET(GENMASK(8, 6), dw_value) + 1,
-+		   FIELD_GET(GENMASK(8, 6), dw_value));
-+
-+	/* Parse KEY link */
-+	seq_printf(s, "\n\tkeyloc0:%d\n", keyloc0);
-+	if(keyloc0 != GENMASK(10, 0)) {
-+		mt7915_wtbl_read_raw(dev, keyloc0, WTBL_TYPE_KEY,
-+					 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
-+		seq_printf(s, "KEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
-+			   MT_DBG_WTBLON_TOP_WDUCR,
-+			   mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
-+			   KEYTBL_IDX2BASE(keyloc0, 0));
-+
-+		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
-+			seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
-+				   x,
-+				   keytbl[x * 4 + 3],
-+				   keytbl[x * 4 + 2],
-+				   keytbl[x * 4 + 1],
-+				   keytbl[x * 4]);
-+		}
-+	}
-+
-+	seq_printf(s, "\n\tkeyloc1:%d\n", keyloc1);
-+	if(keyloc1 != GENMASK(26, 16)) {
-+		mt7915_wtbl_read_raw(dev, keyloc1, WTBL_TYPE_KEY,
-+					 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
-+		seq_printf(s, "KEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
-+			   MT_DBG_WTBLON_TOP_WDUCR,
-+			   mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
-+			   KEYTBL_IDX2BASE(keyloc1, 0));
-+
-+		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
-+			seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
-+				   x,
-+				   keytbl[x * 4 + 3],
-+				   keytbl[x * 4 + 2],
-+				   keytbl[x * 4 + 1],
-+				   keytbl[x * 4]);
-+		}
-+	}
-+	return 0;
-+}
-+
-+static void
-+dump_dma_tx_ring_info(struct seq_file *s, struct mt7915_dev *dev,  char *str, u32 ring_base)
-+{
-+	u32 base, cnt, cidx, didx, queue_cnt;
-+
-+	base= mt76_rr(dev, ring_base);
-+	cnt = mt76_rr(dev, ring_base + 4);
-+	cidx = mt76_rr(dev, ring_base + 8);
-+	didx = mt76_rr(dev, ring_base + 12);
-+	queue_cnt = (cidx >= didx) ? (cidx - didx) : (cidx - didx + cnt);
-+
-+	seq_printf(s, "%20s %10x %10x %10x %10x %10x\n", str, base, cnt, cidx, didx, queue_cnt);
-+}
-+
-+static void
-+dump_dma_rx_ring_info(struct seq_file *s, struct mt7915_dev *dev,  char *str, u32 ring_base)
-+{
-+	u32 base, cnt, cidx, didx, queue_cnt;
-+
-+	base= mt76_rr(dev, ring_base);
-+	cnt = mt76_rr(dev, ring_base + 4);
-+	cidx = mt76_rr(dev, ring_base + 8);
-+	didx = mt76_rr(dev, ring_base + 12);
-+	queue_cnt = (didx > cidx) ? (didx - cidx - 1) : (didx - cidx + cnt - 1);
-+
-+	seq_printf(s, "%20s %10x %10x %10x %10x %10x\n", str, base, cnt, cidx, didx, queue_cnt);
-+}
-+
-+static void
-+mt7915_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
-+{
-+	u32 sys_ctrl[10] = {};
-+
-+	/* HOST DMA */
-+	sys_ctrl[0] = mt76_rr(dev, MT_DBG_INT_SOURCE_CSR);
-+	sys_ctrl[1] = mt76_rr(dev, MT_DBG_INT_MASK_CSR);
-+	sys_ctrl[2] = mt76_rr(dev, MT_DBG_WFDMA0_INT_SOURCE_CSR);
-+	sys_ctrl[3] = mt76_rr(dev, MT_DBG_WFDMA0_INT_MASK_CSR);
-+	sys_ctrl[4] = mt76_rr(dev, MT_DBG_WFDMA1_INT_SOURCE_CSR);
-+	sys_ctrl[5] = mt76_rr(dev, MT_DBG_WFDMA1_INT_MASK_CSR);
-+	sys_ctrl[6] = mt76_rr(dev, MT_DBG_WFDMA0_GLO_CFG);
-+	sys_ctrl[7] = mt76_rr(dev, MT_DBG_WFDMA1_GLO_CFG);
-+	seq_printf(s, "HOST_DMA Configuration\n");
-+	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
-+			"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
-+	seq_printf(s, "%10s %10x %10x\n",
-+			"Merge", sys_ctrl[0], sys_ctrl[1]);
-+	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
-+			"DMA0", sys_ctrl[2], sys_ctrl[3], sys_ctrl[6],
-+			FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_TX_DMA_EN, sys_ctrl[6]),
-+			FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_RX_DMA_EN, sys_ctrl[6]),
-+			FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_TX_BUSY_MASK, sys_ctrl[6]),
-+			FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_RX_BUSY_MASK, sys_ctrl[6]));
-+
-+	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
-+			"DMA1", sys_ctrl[4], sys_ctrl[5], sys_ctrl[7],
-+			FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_TX_DMA_EN, sys_ctrl[7]),
-+			FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_RX_DMA_EN, sys_ctrl[7]),
-+			FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_TX_BUSY_MASK, sys_ctrl[7]),
-+			FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_RX_BUSY_MASK, sys_ctrl[7]));
-+
-+	sys_ctrl[0] = mt76_rr(dev, MT_DBG_INT1_SOURCE_CSR);
-+	sys_ctrl[1] = mt76_rr(dev, MT_DBG_INT1_MASK_CSR);
-+	sys_ctrl[2] = mt76_rr(dev, MT_DBG_WFDMA0_PCIE1_INT_SOURCE_CSR);
-+	sys_ctrl[3] = mt76_rr(dev, MT_DBG_WFDMA0_PCIE1_INT_MASK_CSR);
-+	sys_ctrl[4] = mt76_rr(dev, MT_DBG_WFDMA1_PCIE1_INT_SOURCE_CSR);
-+	sys_ctrl[5] = mt76_rr(dev, MT_DBG_WFDMA1_PCIE1_INT_MASK_CSR);
-+	sys_ctrl[6] = mt76_rr(dev, MT_DBG_WFDMA0_PCIE1_GLO_CFG);
-+	sys_ctrl[7] = mt76_rr(dev, MT_DBG_WFDMA1_PCIE1_GLO_CFG);
-+	seq_printf(s, "%10s %10x %10x\n",
-+		      "MergeP1", sys_ctrl[0], sys_ctrl[1]);
-+	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
-+		      "DMA0P1", sys_ctrl[2], sys_ctrl[3], sys_ctrl[6],
-+		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_DMA_EN, sys_ctrl[6]),
-+		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_DMA_EN, sys_ctrl[6]),
-+		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_BUSY_MASK, sys_ctrl[6]),
-+		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_BUSY_MASK, sys_ctrl[6]));
-+	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
-+		      "DMA1P1", sys_ctrl[4], sys_ctrl[5], sys_ctrl[7],
-+		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_DMA_EN, sys_ctrl[7]),
-+		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_DMA_EN, sys_ctrl[7]),
-+		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_BUSY_MASK, sys_ctrl[7]),
-+		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_BUSY_MASK, sys_ctrl[7]));
-+
-+	seq_printf(s, "HOST_DMA0 Ring Configuration\n");
-+	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_rx_ring_info(s, dev, "R0:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
-+	dump_dma_rx_ring_info(s, dev, "R1:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
-+
-+	seq_printf(s, "HOST_DMA0 PCIe 1 Ring Configuration\n");
-+	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_rx_ring_info(s, dev, "R1:Data1(MAC2H)", MT_DBG_WFDMA0_PCIE1_RX1_CTRL0);
-+
-+	seq_printf(s, "HOST_DMA1 Ring Configuration\n");
-+	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_tx_ring_info(s, dev, "T16:FWDL", MT_DBG_TX_RING_CTRL(0));
-+	dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)", MT_DBG_TX_RING_CTRL(1));
-+	dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)", MT_DBG_TX_RING_CTRL(2));
-+	dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_TX_RING_CTRL(3));
-+	dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)", MT_DBG_TX_RING_CTRL(4));
-+	dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", MT_DBG_RX_EVENT_RING_CTRL(0));
-+	dump_dma_rx_ring_info(s, dev, "R1:Event0(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(1));
-+	dump_dma_rx_ring_info(s, dev, "R2:Event1(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
-+
-+	seq_printf(s, "HOST_DMA1 PCIe 1 Ring Configuration\n");
-+	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_WFDMA1_PCIE1_TX19_CTRL0);
-+	dump_dma_rx_ring_info(s, dev, "R2:Event1(WA2H)", MT_DBG_WFDMA1_PCIE1_RX2_CTRL0);
-+}
-+
-+static void
-+mt7915_show_mcu_dma_info(struct seq_file *s, struct mt7915_dev *dev)
-+{
-+	u32 sys_ctrl[9] = {};
-+
-+	/* MCU DMA information */
-+	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR);
-+	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR);
-+	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR);
-+
-+	sys_ctrl[3] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_ADDR);
-+	sys_ctrl[4] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_HOST_INT_STA_ADDR);
-+	sys_ctrl[5] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_HOST_INT_ENA_ADDR);
-+	sys_ctrl[6] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_ADDR);
-+	sys_ctrl[7] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_STA_ADDR);
-+	sys_ctrl[8] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_ENA_ADDR);
-+
-+	seq_printf(s, "MCU_DMA Configuration\n");
-+	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
-+		      "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
-+	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
-+		      "DMA0", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
-+		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
-+		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
-+		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
-+		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
-+
-+	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
-+		      "DMA1", sys_ctrl[4], sys_ctrl[5], sys_ctrl[3],
-+		      (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
-+		      (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
-+		      (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
-+		      (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
-+	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
-+		      "DMA1P1", sys_ctrl[7], sys_ctrl[8], sys_ctrl[6],
-+		      (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
-+		      (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
-+		      (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
-+		      (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
-+
-+	seq_printf(s, "MCU_DMA0 Ring Configuration\n");
-+	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_tx_ring_info(s, dev, "T0:TXD(WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T1:TXCMD(WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T2:TXD(WA2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R0:Data(MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R1:TxDone(MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R2:SPL(MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R3:TxDone(MAC2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R4:TXS(MAC2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
-+
-+	seq_printf(s, "MCU_DMA1 Ring Configuration\n");
-+	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_tx_ring_info(s, dev, "T0:Event(WM2H)", WF_WFDMA_MCU_DMA1_WPDMA_TX_RING0_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T1:Event0(WA2H)", WF_WFDMA_MCU_DMA1_WPDMA_TX_RING1_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T2:Event1(WA2H)", WF_WFDMA_MCU_DMA1_WPDMA_TX_RING2_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R0:FWDL", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING0_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R1:Cmd(H2WM)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING1_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R2:TXD0(H2WA)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING2_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R3:TXD1(H2WA)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING3_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R4:Cmd(H2WA)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING4_CTRL0_ADDR);
-+
-+	seq_printf(s, "MCU_DMA1 PCIe 1 Ring Configuration\n");
-+	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_tx_ring_info(s, dev, "T2:Event1(WA2H)", WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_TX_RING2_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R3:TXD1(H2WA)", WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR);
-+}
-+
-+static void
-+mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
-+{
-+	u32 sys_ctrl[5] = {};
-+
-+	/* HOST DMA */
-+	sys_ctrl[0] = mt76_rr(dev, MT_DBG_INT_SOURCE_CSR);
-+	sys_ctrl[1] = mt76_rr(dev, MT_DBG_INT_MASK_CSR);
-+	sys_ctrl[2] = mt76_rr(dev, MT_DBG_WFDMA0_INT_SOURCE_CSR);
-+	sys_ctrl[3] = mt76_rr(dev, MT_DBG_WFDMA0_INT_MASK_CSR);
-+	sys_ctrl[4] = mt76_rr(dev, MT_DBG_WFDMA0_GLO_CFG);
-+
-+	seq_printf(s, "HOST_DMA Configuration\n");
-+	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
-+			"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
-+	seq_printf(s, "%10s %10x %10x\n",
-+			"Merge", sys_ctrl[0], sys_ctrl[1]);
-+	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
-+			"DMA0", sys_ctrl[2], sys_ctrl[3], sys_ctrl[4],
-+			FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_EN_MASK, sys_ctrl[4]),
-+			FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_EN_MASK, sys_ctrl[4]),
-+			FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_BUSY_MASK, sys_ctrl[4]),
-+			FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_BUSY_MASK, sys_ctrl[4]));
-+
-+
-+	seq_printf(s, "HOST_DMA0 Ring Configuration\n");
-+	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_tx_ring_info(s, dev, "T16:FWDL", MT_DBG_TX_RING_CTRL(0));
-+	dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)",	MT_DBG_TX_RING_CTRL(1));
-+	dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)",  MT_DBG_TX_RING_CTRL(2));
-+	dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)",  MT_DBG_TX_RING_CTRL(3));
-+	dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)",	MT_DBG_TX_RING_CTRL(4));
-+	dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", MT_DBG_RX_DATA_RING_CTRL(0));
-+	dump_dma_rx_ring_info(s, dev, "R1:Event(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(1));
-+	dump_dma_rx_ring_info(s, dev, "R2:TxDone(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
-+	dump_dma_rx_ring_info(s, dev, "R3:TxDone1(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(3));
-+	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
-+	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
-+}
-+
-+static void
-+mt7986_show_mcu_dma_info(struct seq_file *s, struct mt7915_dev *dev)
-+{
-+	u32 sys_ctrl[3] = {};
-+
-+	/* MCU DMA information */
-+	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR);
-+	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR);
-+	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR);
-+
-+	seq_printf(s, "MCU_DMA Configuration\n");
-+	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
-+		      "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
-+	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
-+		      "DMA0", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
-+		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
-+		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
-+		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
-+		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
-+
-+	seq_printf(s, "MCU_DMA0 Ring Configuration\n");
-+	seq_printf(s, "%22s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_tx_ring_info(s, dev, "T0:Event (WM2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T1:Event (WA2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T2:TxDone (WA2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T3:TxDone1 (WA2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T4:TXD (WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T5:TXCMD (WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T6:TXD (WA2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R0:FWDL", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R1:Cmd (H2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R2:TXD (H2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R3:TXD1 (H2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R4:Cmd (H2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R5:Data (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R6:TxDone/STS (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R7:RPT (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R8:TxDone/STS (MAC2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R9:Data1 (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR);
-+
-+}
-+
-+static void
-+mt7915_show_dma_info(struct seq_file *s, struct mt7915_dev *dev)
-+{
-+	u32 sys_ctrl[10] = {};
-+
-+	if(is_mt7915(&dev->mt76)) {
-+		mt7915_show_host_dma_info(s, dev);
-+		mt7915_show_mcu_dma_info(s, dev);
-+	} else {
-+		mt7986_show_host_dma_info(s, dev);
-+		mt7986_show_mcu_dma_info(s, dev);
-+	}
-+
-+	/* MEM DMA information */
-+	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR);
-+	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR);
-+	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR);
-+
-+	seq_printf(s, "MEM_DMA Configuration\n");
-+	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
-+		      "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
-+	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
-+		      "MEM", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
-+		      (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
-+		      (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
-+		      (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
-+		      (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
-+
-+	seq_printf(s, "MEM_DMA Ring Configuration\n");
-+	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
-+		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
-+	dump_dma_tx_ring_info(s, dev, "T0:CmdEvent(WM2WA)", WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR);
-+	dump_dma_tx_ring_info(s, dev, "T1:CmdEvent(WA2WM)", WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R0:CmdEvent(WM2WA)", WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR);
-+	dump_dma_rx_ring_info(s, dev, "R1:CmdEvent(WA2WM)", WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR);
-+}
-+
-+static int mt7915_trinfo_read(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	const struct hif_pci_tx_ring_desc *tx_ring_layout;
-+	const struct hif_pci_rx_ring_desc *rx_ring_layout;
-+	u32 tx_ring_num, rx_ring_num;
-+	u32 tbase[5], tcnt[5];
-+	u32 tcidx[5], tdidx[5];
-+	u32 rbase[6], rcnt[6];
-+	u32 rcidx[6], rdidx[6];
-+	int idx;
-+
-+	if(is_mt7915(&dev->mt76)) {
-+		tx_ring_layout = &mt7915_tx_ring_layout[0];
-+		rx_ring_layout = &mt7915_rx_ring_layout[0];
-+		tx_ring_num = ARRAY_SIZE(mt7915_tx_ring_layout);
-+		rx_ring_num = ARRAY_SIZE(mt7915_rx_ring_layout);
-+	} else {
-+		tx_ring_layout = &mt7986_tx_ring_layout[0];
-+		rx_ring_layout = &mt7986_rx_ring_layout[0];
-+		tx_ring_num = ARRAY_SIZE(mt7986_tx_ring_layout);
-+		rx_ring_num = ARRAY_SIZE(mt7986_rx_ring_layout);
-+	}
-+
-+	for (idx = 0; idx < tx_ring_num; idx++) {
-+		tbase[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx));
-+		tcnt[idx]  = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx) + 0x04);
-+		tcidx[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx) + 0x08);
-+		tdidx[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx) + 0x0c);
-+	}
-+
-+	for (idx = 0; idx < rx_ring_num; idx++) {
-+		if (idx < 2) {
-+			rbase[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx));
-+			rcnt[idx]  = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx) + 0x04);
-+			rcidx[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx) + 0x08);
-+			rdidx[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx) + 0x0c);
-+		} else {
-+			rbase[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2));
-+			rcnt[idx]  = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2) + 0x04);
-+			rcidx[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2) + 0x08);
-+			rdidx[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2) + 0x0c);
-+		}
-+	}
-+
-+	seq_printf(s, "=================================================\n");
-+	seq_printf(s, "TxRing Configuration\n");
-+	seq_printf(s, "%4s %10s %8s %1s %6s %6s %6s %6s\n",
-+		      "Idx", "Attr", "Reg", "Base", "Cnt", "CIDX", "DIDX",
-+		      "QCnt");
-+	for (idx = 0; idx < tx_ring_num; idx++) {
-+		u32 queue_cnt;
-+
-+		queue_cnt = (tcidx[idx] >= tdidx[idx]) ?
-+			    (tcidx[idx] - tdidx[idx]) :
-+			    (tcidx[idx] - tdidx[idx] + tcnt[idx]);
-+		seq_printf(s, "%4d %8s %8x %10x %6x %6x %6x %6x\n",
-+			   idx, tx_ring_layout[idx].ring_info,
-+			   MT_DBG_TX_RING_CTRL(idx), tbase[idx],
-+			   tcnt[idx], tcidx[idx], tdidx[idx], queue_cnt);
-+	}
-+
-+	seq_printf(s, "RxRing Configuration\n");
-+	seq_printf(s, "%4s %10s %8s %10s %6s %6s %6s %6s\n",
-+		      "Idx", "Attr", "Reg", "Base", "Cnt", "CIDX", "DIDX",
-+		      "QCnt");
-+
-+	for (idx = 0; idx < rx_ring_num; idx++) {
-+		u32 queue_cnt;
-+
-+		queue_cnt = (rdidx[idx] > rcidx[idx]) ?
-+			    (rdidx[idx] - rcidx[idx] - 1) :
-+			    (rdidx[idx] - rcidx[idx] + rcnt[idx] - 1);
-+		seq_printf(s, "%4d %8s %8x %10x %6x %6x %6x %6x\n",
-+			   idx, rx_ring_layout[idx].ring_info,
-+			   (idx < 2) ? MT_DBG_RX_DATA_RING_CTRL(idx): MT_DBG_RX_EVENT_RING_CTRL(idx - 2),
-+			   rbase[idx], rcnt[idx], rcidx[idx], rdidx[idx], queue_cnt);
-+	}
-+
-+	mt7915_show_dma_info(s, dev);
-+	return 0;
-+}
-+
-+static int mt7915_drr_info(struct seq_file *s, void *data)
-+{
-+#define DL_AC_START	0x00
-+#define DL_AC_END	0x0F
-+#define UL_AC_START	0x10
-+#define UL_AC_END	0x1F
-+
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	u32 drr_sta_status[16];
-+	u32 drr_ctrl_def_val = 0x80220000, drr_ctrl_val = 0;
-+	bool is_show = false;
-+	int idx, sta_line = 0, sta_no = 0, max_sta_line = (mt7915_wtbl_size(dev) + 31) / 32;
-+	seq_printf(s, "DRR Table STA Info:\n");
-+
-+	for (idx = DL_AC_START; idx <= DL_AC_END; idx++) {
-+		is_show = true;
-+		drr_ctrl_val = (drr_ctrl_def_val | idx);
-+		mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
-+		drr_sta_status[0] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
-+		drr_sta_status[1] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
-+		drr_sta_status[2] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
-+		drr_sta_status[3] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
-+		drr_sta_status[4] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
-+		drr_sta_status[5] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
-+		drr_sta_status[6] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
-+		drr_sta_status[7] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
-+
-+		if (is_mt7915(&dev->mt76) && max_sta_line > 8) {
-+			drr_ctrl_val = (drr_ctrl_def_val | idx | 1 << 10);
-+			mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
-+			drr_sta_status[8] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
-+			drr_sta_status[9] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
-+			drr_sta_status[10] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
-+			drr_sta_status[11] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
-+			drr_sta_status[12] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
-+			drr_sta_status[13] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
-+			drr_sta_status[14] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
-+			drr_sta_status[15] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
-+		}
-+		if (!is_mt7915(&dev->mt76))
-+			max_sta_line = 8;
-+
-+		for (sta_line = 0; sta_line < max_sta_line; sta_line++) {
-+			if (drr_sta_status[sta_line] > 0) {
-+				for (sta_no = 0; sta_no < 32; sta_no++) {
-+					if (((drr_sta_status[sta_line] & (0x1 << sta_no)) >> sta_no)) {
-+						if (is_show) {
-+							seq_printf(s, "\n DL AC%02d Queue Non-Empty STA:\n", idx);
-+							is_show = false;
-+						}
-+						seq_printf(s, "%d ", sta_no + (sta_line * 32));
-+					}
-+				}
-+			}
-+		}
-+	}
-+
-+	for (idx = UL_AC_START; idx <= UL_AC_END; idx++) {
-+		is_show = true;
-+		drr_ctrl_val = (drr_ctrl_def_val | idx);
-+		mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
-+		drr_sta_status[0] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
-+		drr_sta_status[1] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
-+		drr_sta_status[2] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
-+		drr_sta_status[3] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
-+		drr_sta_status[4] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
-+		drr_sta_status[5] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
-+		drr_sta_status[6] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
-+		drr_sta_status[7] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
-+
-+		if (is_mt7915(&dev->mt76) && max_sta_line > 8) {
-+			drr_ctrl_val = (drr_ctrl_def_val | idx | 1 << 10);
-+			mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
-+			drr_sta_status[8] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
-+			drr_sta_status[9] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
-+			drr_sta_status[10] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
-+			drr_sta_status[11] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
-+			drr_sta_status[12] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
-+			drr_sta_status[13] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
-+			drr_sta_status[14] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
-+			drr_sta_status[15] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
-+		}
-+
-+		if (!is_mt7915(&dev->mt76))
-+			max_sta_line = 8;
-+
-+		for (sta_line = 0; sta_line < max_sta_line; sta_line++) {
-+			if (drr_sta_status[sta_line] > 0) {
-+				for (sta_no = 0; sta_no < 32; sta_no++) {
-+					if (((drr_sta_status[sta_line] & (0x1 << sta_no)) >> sta_no)) {
-+						if (is_show) {
-+							seq_printf(s, "\n UL AC%02d Queue Non-Empty STA:\n", idx);
-+							is_show = false;
-+						}
-+						seq_printf(s, "%d ", sta_no + (sta_line * 32));
-+					}
-+				}
-+			}
-+		}
-+	}
-+
-+	for (idx = DL_AC_START; idx <= DL_AC_END; idx++) {
-+		drr_ctrl_def_val = 0x80420000;
-+		drr_ctrl_val = (drr_ctrl_def_val | idx);
-+		mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
-+		drr_sta_status[0] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
-+		drr_sta_status[1] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
-+		drr_sta_status[2] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
-+		drr_sta_status[3] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
-+		drr_sta_status[4] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
-+		drr_sta_status[5] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
-+		drr_sta_status[6] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
-+		drr_sta_status[7] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
-+
-+		if (is_mt7915(&dev->mt76) && max_sta_line > 8) {
-+			drr_ctrl_val = (drr_ctrl_def_val | idx | 1<<10);
-+			mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
-+			drr_sta_status[8] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
-+			drr_sta_status[9] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
-+			drr_sta_status[10] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
-+			drr_sta_status[11] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
-+			drr_sta_status[12] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
-+			drr_sta_status[13] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
-+			drr_sta_status[14] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
-+			drr_sta_status[15] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
-+		}
-+
-+		seq_printf(s, "\nBSSGrp[%d]:\n", idx);
-+		if (!is_mt7915(&dev->mt76))
-+			max_sta_line = 8;
-+
-+		for (sta_line = 0; sta_line < max_sta_line; sta_line++) {
-+			seq_printf(s, "0x%08x ", drr_sta_status[sta_line]);
-+
-+			if ((sta_line % 4) == 3)
-+				seq_printf(s, "\n");
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+#define CR_NUM_OF_AC 17
-+
-+typedef enum _ENUM_UMAC_PORT_T {
-+	ENUM_UMAC_HIF_PORT_0         = 0,
-+	ENUM_UMAC_CPU_PORT_1         = 1,
-+	ENUM_UMAC_LMAC_PORT_2        = 2,
-+	ENUM_PLE_CTRL_PSE_PORT_3     = 3,
-+	ENUM_UMAC_PSE_PLE_PORT_TOTAL_NUM = 4
-+} ENUM_UMAC_PORT_T, *P_ENUM_UMAC_PORT_T;
-+
-+/* N9 MCU QUEUE LIST */
-+typedef enum _ENUM_UMAC_CPU_P_QUEUE_T {
-+	ENUM_UMAC_CTX_Q_0 = 0,
-+	ENUM_UMAC_CTX_Q_1 = 1,
-+	ENUM_UMAC_CTX_Q_2 = 2,
-+	ENUM_UMAC_CTX_Q_3 = 3,
-+	ENUM_UMAC_CRX     = 0,
-+	ENUM_UMAC_CIF_QUEUE_TOTAL_NUM = 4
-+} ENUM_UMAC_CPU_P_QUEUE_T, *P_ENUM_UMAC_CPU_P_QUEUE_T;
-+
-+/* LMAC PLE TX QUEUE LIST */
-+typedef enum _ENUM_UMAC_LMAC_PLE_TX_P_QUEUE_T {
-+	ENUM_UMAC_LMAC_PLE_TX_Q_00           = 0x00,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_01           = 0x01,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_02           = 0x02,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_03           = 0x03,
-+
-+	ENUM_UMAC_LMAC_PLE_TX_Q_10           = 0x04,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_11           = 0x05,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_12           = 0x06,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_13           = 0x07,
-+
-+	ENUM_UMAC_LMAC_PLE_TX_Q_20           = 0x08,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_21           = 0x09,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_22           = 0x0a,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_23           = 0x0b,
-+
-+	ENUM_UMAC_LMAC_PLE_TX_Q_30           = 0x0c,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_31           = 0x0d,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_32           = 0x0e,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_33           = 0x0f,
-+
-+	ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0      = 0x10,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_BMC_0       = 0x11,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_BNC_0       = 0x12,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0      = 0x13,
-+
-+	ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1      = 0x14,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_BMC_1       = 0x15,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_BNC_1       = 0x16,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1      = 0x17,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_NAF         = 0x18,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_NBCN        = 0x19,
-+	ENUM_UMAC_LMAC_PLE_TX_Q_RELEASE     = 0x1f, /* DE suggests not to use 0x1f, it's only for hw free queue */
-+	ENUM_UMAC_LMAC_QUEUE_TOTAL_NUM      = 24,
-+
-+} ENUM_UMAC_LMAC_TX_P_QUEUE_T, *P_ENUM_UMAC_LMAC_TX_P_QUEUE_T;
-+
-+typedef struct _EMPTY_QUEUE_INFO_T {
-+	char *QueueName;
-+	u32 Portid;
-+	u32 Queueid;
-+} EMPTY_QUEUE_INFO_T, *P_EMPTY_QUEUE_INFO_T;
-+
-+static EMPTY_QUEUE_INFO_T ple_queue_empty_info[] = {
-+	{"CPU Q0",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_0},
-+	{"CPU Q1",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_1},
-+	{"CPU Q2",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_2},
-+	{"CPU Q3",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_3},
-+	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 4~7 not defined */
-+	{"ALTX Q0", ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0}, /* Q16 */
-+	{"BMC Q0",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_BMC_0},
-+	{"BCN Q0",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_BNC_0},
-+	{"PSMP Q0", ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0},
-+	{"ALTX Q1", ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1},
-+	{"BMC Q1",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_BMC_1},
-+	{"BCN Q1",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_BNC_1},
-+	{"PSMP Q1", ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1},
-+	{"NAF Q",   ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_NAF},
-+	{"NBCN Q",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_NBCN},
-+	{NULL, 0, 0}, {NULL, 0, 0}, /* 18, 19 not defined */
-+	{"FIXFID Q", ENUM_UMAC_LMAC_PORT_2, 0x1a},
-+	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0},
-+	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 21~29 not defined */
-+	{"RLS Q",   ENUM_PLE_CTRL_PSE_PORT_3, 0x7e},
-+	{"RLS2 Q",  ENUM_PLE_CTRL_PSE_PORT_3, 0x7f}
-+};
-+
-+static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
-+	{"AC00Q", ENUM_UMAC_LMAC_PORT_2, 0x40},
-+	{"AC01Q", ENUM_UMAC_LMAC_PORT_2, 0x41},
-+	{"AC02Q", ENUM_UMAC_LMAC_PORT_2, 0x42},
-+	{"AC03Q", ENUM_UMAC_LMAC_PORT_2, 0x43},
-+	{"AC10Q", ENUM_UMAC_LMAC_PORT_2, 0x44},
-+	{"AC11Q", ENUM_UMAC_LMAC_PORT_2, 0x45},
-+	{"AC12Q", ENUM_UMAC_LMAC_PORT_2, 0x46},
-+	{"AC13Q", ENUM_UMAC_LMAC_PORT_2, 0x47},
-+	{"AC20Q", ENUM_UMAC_LMAC_PORT_2, 0x48},
-+	{"AC21Q", ENUM_UMAC_LMAC_PORT_2, 0x49},
-+	{"AC22Q", ENUM_UMAC_LMAC_PORT_2, 0x4a},
-+	{"AC23Q", ENUM_UMAC_LMAC_PORT_2, 0x4b},
-+	{"AC30Q", ENUM_UMAC_LMAC_PORT_2, 0x4c},
-+	{"AC31Q", ENUM_UMAC_LMAC_PORT_2, 0x4d},
-+	{"AC32Q", ENUM_UMAC_LMAC_PORT_2, 0x4e},
-+	{"AC33Q", ENUM_UMAC_LMAC_PORT_2, 0x4f},
-+	{"ALTX Q0", ENUM_UMAC_LMAC_PORT_2, 0x50},
-+	{"TF Q0", ENUM_UMAC_LMAC_PORT_2, 0x51},
-+	{"TWT TSF-TF Q0", ENUM_UMAC_LMAC_PORT_2, 0x52},
-+	{"TWT DL Q0", ENUM_UMAC_LMAC_PORT_2, 0x53},
-+	{"TWT UL Q0", ENUM_UMAC_LMAC_PORT_2, 0x54},
-+	{"ALTX Q1", ENUM_UMAC_LMAC_PORT_2, 0x55},
-+	{"TF Q1", ENUM_UMAC_LMAC_PORT_2, 0x56},
-+	{"TWT TSF-TF Q1", ENUM_UMAC_LMAC_PORT_2, 0x57},
-+	{"TWT DL Q1", ENUM_UMAC_LMAC_PORT_2, 0x58},
-+	{"TWT UL Q1", ENUM_UMAC_LMAC_PORT_2, 0x59},
-+	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0},
-+};
-+
-+
-+
-+static char* sta_ctrl_reg[] = {"ENABLE", "DISABLE", "PAUSE"};
-+static u32 chip_show_sta_acq_info(struct seq_file *s, struct mt7915_dev *dev, u32 *ple_stat,
-+				  u32 *sta_pause, u32 *dis_sta_map,
-+				  u32 dumptxd)
-+{
-+	int i, j;
-+	u32 total_nonempty_cnt = 0;
-+	u32 ac_num = 9, all_ac_num;
-+
-+	/* TDO: ac_num = 16 for mt7986 */
-+	if (!is_mt7915(&dev->mt76))
-+		ac_num = 17;
-+
-+	all_ac_num = ac_num * 4;
-+
-+	for (j = 0; j < all_ac_num; j++) { /* show AC Q info */
-+		for (i = 0; i < 32; i++) {
-+			if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
-+				u32 hfid, tfid, pktcnt, ac_n = j / ac_num, ctrl = 0;
-+				u32 sta_num = i + (j % ac_num) * 32, fl_que_ctrl[3] = {0};
-+				//struct wifi_dev *wdev = wdev_search_by_wcid(pAd, sta_num);
-+				u32 wmmidx = 0;
-+				struct mt7915_sta *msta;
-+				struct mt76_wcid *wcid;
-+				struct ieee80211_sta *sta = NULL;
-+
-+				wcid = rcu_dereference(dev->mt76.wcid[sta_num]);
-+				sta = wcid_to_sta(wcid);
-+				if (!sta) {
-+					printk("ERROR!! no found STA wcid=%d\n", sta_num);
-+					continue;
-+				}
-+				msta = container_of(wcid, struct mt7915_sta, wcid);
-+				wmmidx = msta->vif->mt76.wmm_idx;
-+
-+				seq_printf(s, "\tSTA%d AC%d: ", sta_num, ac_n);
-+
-+				fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
-+				fl_que_ctrl[0] |= (ENUM_UMAC_LMAC_PORT_2 << MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
-+				fl_que_ctrl[0] |= (ac_n << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
-+				fl_que_ctrl[0] |= sta_num;
-+				mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
-+				fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
-+				fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
-+				hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK, fl_que_ctrl[1]);
-+				tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK, fl_que_ctrl[1]);
-+				pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK, fl_que_ctrl[2]);
-+				seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x",
-+						  tfid, hfid, pktcnt);
-+
-+				if (((sta_pause[j % 6] & 0x1 << i) >> i) == 1)
-+					ctrl = 2;
-+
-+				if (((dis_sta_map[j % 6] & 0x1 << i) >> i) == 1)
-+					ctrl = 1;
-+
-+				seq_printf(s, " ctrl = %s", sta_ctrl_reg[ctrl]);
-+				seq_printf(s, " (wmmidx=%d)\n", wmmidx);
-+
-+				total_nonempty_cnt++;
-+
-+				// TODO
-+				//if (pktcnt > 0 && dumptxd > 0)
-+				//	ShowTXDInfo(pAd, hfid);
-+			}
-+		}
-+	}
-+
-+	return total_nonempty_cnt;
-+}
-+
-+static void chip_show_txcmdq_info(struct seq_file *s, struct mt7915_dev *dev, u32 ple_txcmd_stat)
-+{
-+	int i;
-+
-+	seq_printf(s, "Nonempty TXCMD Q info:\n");
-+	for (i = 0; i < 32; i++) {
-+		if (((ple_txcmd_stat & (0x1 << i)) >> i) == 0) {
-+			u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
-+
-+			if (ple_txcmd_queue_empty_info[i].QueueName != NULL) {
-+				seq_printf(s, "\t%s: ", ple_txcmd_queue_empty_info[i].QueueName);
-+				fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
-+				fl_que_ctrl[0] |= (ple_txcmd_queue_empty_info[i].Portid <<
-+							MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
-+				fl_que_ctrl[0] |= (ple_txcmd_queue_empty_info[i].Queueid <<
-+							MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
-+			} else
-+				continue;
-+
-+			mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
-+			fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
-+			fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
-+			hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK, fl_que_ctrl[1]);
-+			tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK, fl_que_ctrl[1]);
-+			pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK, fl_que_ctrl[2]);
-+			seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x\n",
-+					  tfid, hfid, pktcnt);
-+		}
-+	}
-+}
-+
-+static void chip_get_ple_acq_stat(struct mt7915_dev *dev, u32 *ple_stat)
-+{
-+	int i;
-+	int cr_num = 9, all_cr_num;
-+	u32 ac , index;
-+
-+	/* TDO: cr_num = 16 for mt7986 */
-+	if(!is_mt7915(&dev->mt76))
-+		cr_num = 17;
-+
-+	all_cr_num =  cr_num * 4;
-+
-+	ple_stat[0] = mt76_rr(dev, MT_DBG_PLE_QUEUE_EMPTY);
-+
-+	for(i = 0; i < all_cr_num; i++) {
-+		ac = i / cr_num;
-+		index = i % cr_num;
-+		ple_stat[i + 1] =
-+			mt76_rr(dev, MT_DBG_PLE_AC_QEMPTY(ac, index));
-+
-+	}
-+}
-+
-+static void chip_get_dis_sta_map(struct mt7915_dev *dev, u32 *dis_sta_map)
-+{
-+	int i;
-+	u32 ac_num = 9;
-+
-+	/* TDO: ac_num = 16 for mt7986 */
-+	if (!is_mt7915(&dev->mt76))
-+		ac_num = 17;
-+
-+	for(i = 0; i < ac_num; i++) {
-+		dis_sta_map[i] = mt76_rr(dev, MT_DBG_PLE_DIS_STA_MAP(i));
-+	}
-+}
-+
-+static void chip_get_sta_pause(struct mt7915_dev *dev, u32 *sta_pause)
-+{
-+	int i;
-+	u32 ac_num = 9;
-+
-+	/* TDO: ac_num = 16 for mt7986 */
-+	if (!is_mt7915(&dev->mt76))
-+		ac_num = 17;
-+
-+	for(i = 0; i < ac_num; i++) {
-+		sta_pause[i] = mt76_rr(dev, MT_DBG_PLE_STATION_PAUSE(i));
-+	}
-+}
-+
-+static int mt7915_pleinfo_read(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	u32 ple_buf_ctrl, pg_sz, pg_num;
-+	u32 ple_stat[70] = {0}, pg_flow_ctrl[8] = {0};
-+	u32 ple_native_txcmd_stat;
-+	u32 ple_txcmd_stat;
-+	u32 sta_pause[CR_NUM_OF_AC] = {0}, dis_sta_map[CR_NUM_OF_AC] = {0};
-+	u32 fpg_cnt, ffa_cnt, fpg_head, fpg_tail, hif_max_q, hif_min_q;
-+	u32 rpg_hif, upg_hif, cpu_max_q, cpu_min_q, rpg_cpu, upg_cpu;
-+	int i, j;
-+	u32 ac_num = 9, all_ac_num;
-+
-+	/* TDO: ac_num = 16 for mt7986 */
-+	if (!is_mt7915(&dev->mt76))
-+		ac_num = 17;
-+
-+	all_ac_num = ac_num * 4;
-+
-+	ple_buf_ctrl = mt76_rr(dev, MT_DBG_PLE_PBUF_CTRL_ADDR);
-+	chip_get_ple_acq_stat(dev, ple_stat);
-+	ple_txcmd_stat = mt76_rr(dev, MT_DBG_PLE_TXCMD_Q_EMPTY);
-+	ple_native_txcmd_stat = mt76_rr(dev, MT_DBG_PLE_NATIVE_TXCMD_Q_EMPTY);
-+	pg_flow_ctrl[0] = mt76_rr(dev, MT_DBG_PLE_FREEPG_CNT);
-+	pg_flow_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FREEPG_HEAD_TAIL);
-+	pg_flow_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_GROUP);
-+	pg_flow_ctrl[3] = mt76_rr(dev, MT_DBG_PLE_HIF_PG_INFO);
-+	pg_flow_ctrl[4] = mt76_rr(dev, MT_DBG_PLE_PG_CPU_GROUP);
-+	pg_flow_ctrl[5] = mt76_rr(dev, MT_DBG_PLE_CPU_PG_INFO);
-+	pg_flow_ctrl[6] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_TXCMD_GROUP);
-+	pg_flow_ctrl[7] = mt76_rr(dev, MT_DBG_PLE_HIF_TXCMD_PG_INFO);
-+	chip_get_dis_sta_map(dev, dis_sta_map);
-+	chip_get_sta_pause(dev, sta_pause);
-+
-+	seq_printf(s, "PLE Configuration Info:\n");
-+	seq_printf(s, "\tPacket Buffer Control(0x%x): 0x%08x\n",
-+		      MT_DBG_PLE_PBUF_CTRL_ADDR, ple_buf_ctrl);
-+
-+	pg_sz = FIELD_GET(MT_DBG_PLE_PBUF_CTRL_PAGE_SIZE_MASK, ple_buf_ctrl);
-+	seq_printf(s, "\t\tPage Size=%d(%d bytes per page)\n",
-+		       pg_sz, (pg_sz == 1 ? 128 : 64));
-+	seq_printf(s, "\t\tPage Offset=%ld(in unit of 2KB)\n",
-+		        FIELD_GET(MT_DBG_PLE_PBUF_CTRL_OFFSET_MASK, ple_buf_ctrl));
-+
-+	pg_num = FIELD_GET(MT_DBG_PLE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK, ple_buf_ctrl);
-+	seq_printf(s, "\t\tTotal Page=%d pages\n", pg_num);
-+
-+	/* Page Flow Control */
-+	seq_printf(s, "PLE Page Flow Control:\n");
-+	seq_printf(s, "\tFree page counter(0x%x): 0x%08x\n",
-+		      MT_DBG_PLE_FREEPG_CNT, pg_flow_ctrl[0]);
-+	fpg_cnt = FIELD_GET(MT_DBG_PLE_FREEPG_CNT_FREEPG_CNT_MASK, pg_flow_ctrl[0]);
-+
-+	seq_printf(s, "\t\tThe toal page number of free=0x%03x\n", fpg_cnt);
-+	ffa_cnt = FIELD_GET(MT_DBG_PLE_FREEPG_CNT_FFA_CNT_MASK, pg_flow_ctrl[0]);
-+
-+	seq_printf(s, "\t\tThe free page numbers of free for all=0x%03x\n", ffa_cnt);
-+	seq_printf(s, "\tFree page head and tail(0x%x): 0x%08x\n",
-+	              MT_DBG_PLE_FREEPG_HEAD_TAIL, pg_flow_ctrl[1]);
-+
-+	fpg_head = FIELD_GET(MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK, pg_flow_ctrl[1]);
-+	fpg_tail = FIELD_GET(MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK, pg_flow_ctrl[1]);
-+	seq_printf(s, "\t\tThe tail/head page of free page list=0x%03x/0x%03x\n", fpg_tail, fpg_head);
-+	seq_printf(s, "\tReserved page counter of HIF group(0x%x): 0x%08x\n",
-+	              MT_DBG_PLE_PG_HIF_GROUP, pg_flow_ctrl[2]);
-+	seq_printf(s, "\tHIF group page status(0x%x): 0x%08x\n",
-+	              MT_DBG_PLE_HIF_PG_INFO, pg_flow_ctrl[3]);
-+
-+	hif_min_q = FIELD_GET(MT_DBG_PLE_PG_HIF_GROUP_HIF_MIN_QUOTA_MASK, pg_flow_ctrl[2]);
-+	hif_max_q = FIELD_GET(MT_DBG_PLE_PG_HIF_GROUP_HIF_MAX_QUOTA_MASK, pg_flow_ctrl[2]);
-+	seq_printf(s, "\t\tThe max/min quota pages of HIF group=0x%03x/0x%03x\n", hif_max_q, hif_min_q);
-+
-+	rpg_hif = FIELD_GET(MT_DBG_PLE_HIF_PG_INFO_HIF_RSV_CNT_MASK, pg_flow_ctrl[3]);
-+	upg_hif = FIELD_GET(MT_DBG_PLE_HIF_PG_INFO_HIF_SRC_CNT_MASK, pg_flow_ctrl[3]);
-+	seq_printf(s, "\t\tThe used/reserved pages of HIF group=0x%03x/0x%03x\n", upg_hif, rpg_hif);
-+
-+	seq_printf(s, "\tReserved page counter of HIF_TXCMD group(0x%x): 0x%08x\n",
-+		      MT_DBG_PLE_PG_HIF_TXCMD_GROUP, pg_flow_ctrl[6]);
-+	seq_printf(s, "\tHIF_TXCMD group page status(0x%x): 0x%08x\n",
-+	              MT_DBG_PLE_HIF_TXCMD_PG_INFO, pg_flow_ctrl[7]);
-+	cpu_min_q = FIELD_GET(MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MIN_QUOTA_MASK, pg_flow_ctrl[6]);
-+	cpu_max_q = FIELD_GET(MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MAX_QUOTA_MASK, pg_flow_ctrl[6]);
-+	seq_printf(s, "\t\tThe max/min quota pages of HIF_TXCMD group=0x%03x/0x%03x\n", cpu_max_q, cpu_min_q);
-+
-+	rpg_cpu = FIELD_GET(MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK, pg_flow_ctrl[7]);
-+	upg_cpu = FIELD_GET(MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK, pg_flow_ctrl[7]);
-+	seq_printf(s, "\t\tThe used/reserved pages of HIF_TXCMD group=0x%03x/0x%03x\n", upg_cpu, rpg_cpu);
-+
-+	seq_printf(s, "\tReserved page counter of CPU group(0x%x): 0x%08x\n",
-+			MT_DBG_PLE_PG_CPU_GROUP, pg_flow_ctrl[4]);
-+	seq_printf(s, "\tCPU group page status(0x%x): 0x%08x\n",
-+			MT_DBG_PLE_CPU_PG_INFO, pg_flow_ctrl[5]);
-+	cpu_min_q = FIELD_GET(MT_DBG_PLE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK, pg_flow_ctrl[4]);
-+	cpu_max_q = FIELD_GET(MT_DBG_PLE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK, pg_flow_ctrl[4]);
-+	seq_printf(s, "\t\tThe max/min quota pages of CPU group=0x%03x/0x%03x\n", cpu_max_q, cpu_min_q);
-+
-+	rpg_cpu = FIELD_GET(MT_DBG_PLE_CPU_PG_INFO_CPU_RSV_CNT_MASK, pg_flow_ctrl[5]);
-+	upg_cpu = FIELD_GET(MT_DBG_PLE_CPU_PG_INFO_CPU_SRC_CNT_MASK, pg_flow_ctrl[5]);
-+	seq_printf(s, "\t\tThe used/reserved pages of CPU group=0x%03x/0x%03x\n", upg_cpu, rpg_cpu);
-+
-+	if ((ple_stat[0] & MT_DBG_PLE_Q_EMPTY_ALL_AC_EMPTY_MASK) == 0) {
-+		for (j = 0; j < all_ac_num; j++) {
-+			if (j % ac_num == 0) {
-+				seq_printf(s, "\n\tNonempty AC%d Q of STA#: ", j / ac_num);
-+			}
-+
-+			for (i = 0; i < 32; i++) {
-+				if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
-+					seq_printf(s, "%d ", i + (j % ac_num) * 32);
-+				}
-+			}
-+		}
-+
-+		seq_printf(s, "\n");
-+	}
-+
-+	seq_printf(s, "non-native/native txcmd queue empty = %d/%d\n", ple_txcmd_stat, ple_native_txcmd_stat);
-+
-+	seq_printf(s, "Nonempty Q info:\n");
-+
-+	for (i = 0; i < 32; i++) {
-+		if (((ple_stat[0] & (0x1 << i)) >> i) == 0) {
-+			u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
-+
-+			if (ple_queue_empty_info[i].QueueName != NULL) {
-+				seq_printf(s, "\t%s: ", ple_queue_empty_info[i].QueueName);
-+				fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
-+				fl_que_ctrl[0] |= (ple_queue_empty_info[i].Portid << MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
-+				fl_que_ctrl[0] |= (ple_queue_empty_info[i].Queueid << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
-+			} else
-+				continue;
-+
-+			if (ple_queue_empty_info[i].Queueid >= ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0 &&
-+				ple_queue_empty_info[i].Queueid <= ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0)
-+				/* band0 set TGID 0, bit31 = 0 */
-+				mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x0);
-+			else if (ple_queue_empty_info[i].Queueid >= ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1 &&
-+				ple_queue_empty_info[i].Queueid <= ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1)
-+				/* band1 set TGID 1, bit31 = 1 */
-+				mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x80000000);
-+
-+			mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
-+			fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
-+			fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
-+			hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK, fl_que_ctrl[1]);
-+			tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK, fl_que_ctrl[1]);
-+			pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK, fl_que_ctrl[2]);
-+			seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x\n",
-+				      tfid, hfid, pktcnt);
-+
-+			/* TODO */
-+			//if (pktcnt > 0 && dumptxd > 0)
-+			//	ShowTXDInfo(pAd, hfid);
-+		}
-+	}
-+
-+	chip_show_sta_acq_info(s, dev, ple_stat, sta_pause, dis_sta_map, 0/*dumptxd*/);
-+	chip_show_txcmdq_info(s, dev, ple_native_txcmd_stat);
-+
-+	return 0;
-+}
-+
-+typedef enum _ENUM_UMAC_PLE_CTRL_P3_QUEUE_T {
-+	ENUM_UMAC_PLE_CTRL_P3_Q_0X1E            = 0x1e,
-+	ENUM_UMAC_PLE_CTRL_P3_Q_0X1F            = 0x1f,
-+	ENUM_UMAC_PLE_CTRL_P3_TOTAL_NUM         = 2
-+} ENUM_UMAC_PLE_CTRL_P3_QUEUE_T, *P_ENUM_UMAC_PLE_CTRL_P3_QUEUE_T;
-+
-+static EMPTY_QUEUE_INFO_T pse_queue_empty_info[] = {
-+	{"CPU Q0",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_0},
-+	{"CPU Q1",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_1},
-+	{"CPU Q2",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_2},
-+	{"CPU Q3",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_3},
-+	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 4~7 not defined */
-+	{"HIF Q0", ENUM_UMAC_HIF_PORT_0,    0}, /* Q8 */
-+	{"HIF Q1", ENUM_UMAC_HIF_PORT_0,    1},
-+	{"HIF Q2", ENUM_UMAC_HIF_PORT_0,    2},
-+	{"HIF Q3", ENUM_UMAC_HIF_PORT_0,    3},
-+	{"HIF Q4", ENUM_UMAC_HIF_PORT_0,    4},
-+	{"HIF Q5", ENUM_UMAC_HIF_PORT_0,    5},
-+	{NULL, 0, 0}, {NULL, 0, 0},  /* 14~15 not defined */
-+	{"LMAC Q",  ENUM_UMAC_LMAC_PORT_2,    0},
-+	{"MDP TX Q", ENUM_UMAC_LMAC_PORT_2, 1},
-+	{"MDP RX Q", ENUM_UMAC_LMAC_PORT_2, 2},
-+	{"SEC TX Q", ENUM_UMAC_LMAC_PORT_2, 3},
-+	{"SEC RX Q", ENUM_UMAC_LMAC_PORT_2, 4},
-+	{"SFD_PARK Q", ENUM_UMAC_LMAC_PORT_2, 5},
-+	{"MDP_TXIOC Q", ENUM_UMAC_LMAC_PORT_2, 6},
-+	{"MDP_RXIOC Q", ENUM_UMAC_LMAC_PORT_2, 7},
-+	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 24~30 not defined */
-+	{"RLS Q",  ENUM_PLE_CTRL_PSE_PORT_3, ENUM_UMAC_PLE_CTRL_P3_Q_0X1F}
-+};
-+
-+static int mt7915_pseinfo_read(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	u32 pse_buf_ctrl, pg_sz, pg_num;
-+	u32 pse_stat, pg_flow_ctrl[22] = {0};
-+	u32 fpg_cnt, ffa_cnt, fpg_head, fpg_tail;
-+	u32 max_q, min_q, rsv_pg, used_pg;
-+	int i;
-+
-+	pse_buf_ctrl     = mt76_rr(dev, MT_DBG_PSE_PBUF_CTRL);
-+	pse_stat         = mt76_rr(dev, MT_DBG_PSE_QUEUE_EMPTY);
-+	pg_flow_ctrl[0]  = mt76_rr(dev, MT_DBG_PSE_FREEPG_CNT);
-+	pg_flow_ctrl[1]  = mt76_rr(dev, MT_DBG_PSE_FREEPG_HEAD_TAIL);
-+	pg_flow_ctrl[2]  = mt76_rr(dev, MT_DBG_PSE_PG_HIF0_GROUP);
-+	pg_flow_ctrl[3]  = mt76_rr(dev, MT_DBG_PSE_HIF0_PG_INFO);
-+	pg_flow_ctrl[4]  = mt76_rr(dev, MT_DBG_PSE_PG_HIF1_GROUP);
-+	pg_flow_ctrl[5]  = mt76_rr(dev, MT_DBG_PSE_HIF1_PG_INFO);
-+	pg_flow_ctrl[6]  = mt76_rr(dev, MT_DBG_PSE_PG_CPU_GROUP);
-+	pg_flow_ctrl[7]  = mt76_rr(dev, MT_DBG_PSE_CPU_PG_INFO);
-+	pg_flow_ctrl[8]  = mt76_rr(dev, MT_DBG_PSE_PG_LMAC0_GROUP);
-+	pg_flow_ctrl[9]  = mt76_rr(dev, MT_DBG_PSE_LMAC0_PG_INFO);
-+	pg_flow_ctrl[10] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC1_GROUP);
-+	pg_flow_ctrl[11] = mt76_rr(dev, MT_DBG_PSE_LMAC1_PG_INFO);
-+	pg_flow_ctrl[12] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC2_GROUP);
-+	pg_flow_ctrl[13] = mt76_rr(dev, MT_DBG_PSE_LMAC2_PG_INFO);
-+	pg_flow_ctrl[14] = mt76_rr(dev, MT_DBG_PSE_PG_PLE_GROUP);
-+	pg_flow_ctrl[15] = mt76_rr(dev, MT_DBG_PSE_PLE_PG_INFO);
-+	pg_flow_ctrl[16] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC3_GROUP);
-+	pg_flow_ctrl[17] = mt76_rr(dev, MT_DBG_PSE_LMAC3_PG_INFO);
-+	pg_flow_ctrl[18] = mt76_rr(dev, MT_DBG_PSE_PG_MDP_GROUP);
-+	pg_flow_ctrl[19] = mt76_rr(dev, MT_DBG_PSE_MDP_PG_INFO);
-+	pg_flow_ctrl[20] = mt76_rr(dev, MT_DBG_PSE_PG_PLE1_GROUP);
-+	pg_flow_ctrl[21] = mt76_rr(dev,MT_DBG_PSE_PLE1_PG_INFO);
-+
-+	/* Configuration Info */
-+	seq_printf(s, "PSE Configuration Info:\n");
-+	seq_printf(s, "\tPacket Buffer Control(0x82068014): 0x%08x\n", pse_buf_ctrl);
-+	pg_sz = FIELD_GET(MT_DBG_PSE_PBUF_CTRL_PAGE_SIZE_CFG_MASK, pse_buf_ctrl);
-+
-+	seq_printf(s, "\t\tPage Size=%d(%d bytes per page)\n", pg_sz, (pg_sz == 1 ? 256 : 128));
-+	seq_printf(s, "\t\tPage Offset=%ld(in unit of 64KB)\n",
-+			 FIELD_GET(MT_DBG_PSE_PBUF_CTRL_PBUF_OFFSET_MASK, pse_buf_ctrl));
-+	pg_num = FIELD_GET(MT_DBG_PSE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK, pse_buf_ctrl);
-+
-+	seq_printf(s, "\t\tTotal page numbers=%d pages\n", pg_num);
-+
-+	/* Page Flow Control */
-+	seq_printf(s, "PSE Page Flow Control:\n");
-+	seq_printf(s, "\tFree page counter(0x82068100): 0x%08x\n", pg_flow_ctrl[0]);
-+	fpg_cnt = FIELD_GET(MT_DBG_PSE_FREEPG_CNT_FREEPG_CNT_MASK, pg_flow_ctrl[0]);
-+	seq_printf(s, "\t\tThe toal page number of free=0x%03x\n", fpg_cnt);
-+
-+	ffa_cnt =  FIELD_GET(MT_DBG_PSE_FREEPG_CNT_FFA_CNT_MASK, pg_flow_ctrl[0]);
-+	seq_printf(s, "\t\tThe free page numbers of free for all=0x%03x\n", ffa_cnt);
-+
-+	seq_printf(s, "\tFree page head and tail(0x82068104): 0x%08x\n", pg_flow_ctrl[1]);
-+	fpg_head =  FIELD_GET(MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK, pg_flow_ctrl[1]);
-+
-+	fpg_tail = FIELD_GET(MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK, pg_flow_ctrl[1]);
-+	seq_printf(s, "\t\tThe tail/head page of free page list=0x%03x/0x%03x\n", fpg_tail, fpg_head);
-+	seq_printf(s, "\tReserved page counter of HIF0 group(0x82068110): 0x%08x\n", pg_flow_ctrl[2]);
-+	seq_printf(s, "\tHIF0 group page status(0x82068114): 0x%08x\n", pg_flow_ctrl[3]);
-+	min_q = FIELD_GET(MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MIN_QUOTA_MASK, pg_flow_ctrl[2]);
-+	max_q =  FIELD_GET(MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MAX_QUOTA_MASK, pg_flow_ctrl[2]);
-+	seq_printf(s, "\t\tThe max/min quota pages of HIF0 group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_HIF0_PG_INFO_HIF0_RSV_CNT_MASK, pg_flow_ctrl[3]);;
-+	used_pg = FIELD_GET(MT_DBG_PSE_HIF0_PG_INFO_HIF0_SRC_CNT_MASK, pg_flow_ctrl[3]);
-+	seq_printf(s, "\t\tThe used/reserved pages of HIF0 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+	seq_printf(s, "\tReserved page counter of HIF1 group(0x82068118): 0x%08x\n", pg_flow_ctrl[4]);
-+	seq_printf(s, "\tHIF1 group page status(0x8206811c): 0x%08x\n", pg_flow_ctrl[5]);
-+	min_q = FIELD_GET(MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MIN_QUOTA_MASK, pg_flow_ctrl[4]);
-+	max_q = FIELD_GET(MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MAX_QUOTA_MASK, pg_flow_ctrl[4]);
-+	seq_printf(s, "\t\tThe max/min quota pages of HIF1 group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_HIF1_PG_INFO_HIF1_RSV_CNT_MASK, pg_flow_ctrl[5]);
-+	used_pg = FIELD_GET(MT_DBG_PSE_HIF1_PG_INFO_HIF1_SRC_CNT_MASK, pg_flow_ctrl[5]);
-+
-+	seq_printf(s, "\t\tThe used/reserved pages of HIF1 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+	seq_printf(s, "\tReserved page counter of CPU group(0x82068150): 0x%08x\n", pg_flow_ctrl[6]);
-+	seq_printf(s, "\tCPU group page status(0x82068154): 0x%08x\n", pg_flow_ctrl[7]);
-+	min_q = FIELD_GET(MT_DBG_PSE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK, pg_flow_ctrl[6]);
-+	max_q = FIELD_GET(MT_DBG_PSE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK, pg_flow_ctrl[6]);
-+	seq_printf(s, "\t\tThe max/min quota pages of CPU group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_CPU_PG_INFO_CPU_RSV_CNT_MASK, pg_flow_ctrl[7]);
-+	used_pg = FIELD_GET(MT_DBG_PSE_CPU_PG_INFO_CPU_SRC_CNT_MASK, pg_flow_ctrl[7]);
-+	seq_printf(s, "\t\tThe used/reserved pages of CPU group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+	seq_printf(s, "\tReserved page counter of LMAC0 group(0x82068170): 0x%08x\n", pg_flow_ctrl[8]);
-+	seq_printf(s, "\tLMAC0 group page status(0x82068174): 0x%08x\n", pg_flow_ctrl[9]);
-+	min_q = FIELD_GET(MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MIN_QUOTA_MASK, pg_flow_ctrl[8]);
-+	max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MAX_QUOTA_MASK, pg_flow_ctrl[8]);
-+	seq_printf(s, "\t\tThe max/min quota pages of LMAC0 group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_RSV_CNT_MASK, pg_flow_ctrl[9]);
-+	used_pg = FIELD_GET(MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_SRC_CNT_MASK, pg_flow_ctrl[9]);
-+	seq_printf(s, "\t\tThe used/reserved pages of LMAC0 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+	seq_printf(s, "\tReserved page counter of LMAC1 group(0x82068178): 0x%08x\n", pg_flow_ctrl[10]);
-+	seq_printf(s, "\tLMAC1 group page status(0x8206817c): 0x%08x\n", pg_flow_ctrl[11]);
-+	min_q = FIELD_GET(MT_DBG_TOP_PG_LMAC1_GROUP_LMAC1_MIN_QUOTA_MASK, pg_flow_ctrl[10]);
-+	max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC1_GROUP_LMAC1_MAX_QUOTA_MASK, pg_flow_ctrl[10]);
-+	seq_printf(s, "\t\tThe max/min quota pages of LMAC1 group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_RSV_CNT_MASK, pg_flow_ctrl[11]);
-+	used_pg = FIELD_GET(MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_SRC_CNT_MASK, pg_flow_ctrl[11]);
-+	seq_printf(s, "\t\tThe used/reserved pages of LMAC1 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+	seq_printf(s, "\tReserved page counter of LMAC2 group(0x82068180): 0x%08x\n", pg_flow_ctrl[11]);
-+	seq_printf(s, "\tLMAC2 group page status(0x82068184): 0x%08x\n", pg_flow_ctrl[12]);
-+	min_q = FIELD_GET(MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MIN_QUOTA_MASK, pg_flow_ctrl[12]);
-+	max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MAX_QUOTA_MASK, pg_flow_ctrl[12]);
-+	seq_printf(s, "\t\tThe max/min quota pages of LMAC2 group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_RSV_CNT_MASK, pg_flow_ctrl[13]);
-+	used_pg = FIELD_GET(MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_SRC_CNT_MASK, pg_flow_ctrl[13]);
-+	seq_printf(s, "\t\tThe used/reserved pages of LMAC2 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+
-+	seq_printf(s, "\tReserved page counter of LMAC3 group(0x82068188): 0x%08x\n", pg_flow_ctrl[16]);
-+	seq_printf(s, "\tLMAC3 group page status(0x8206818c): 0x%08x\n", pg_flow_ctrl[17]);
-+	min_q = FIELD_GET(MT_DBG_TOP_PG_LMAC3_GROUP_LMAC3_MIN_QUOTA_MASK, pg_flow_ctrl[16]);
-+	max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC3_GROUP_LMAC3_MAX_QUOTA_MASK, pg_flow_ctrl[16]);
-+	seq_printf(s, "\t\tThe max/min quota pages of LMAC3 group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_RSV_CNT_MASK, pg_flow_ctrl[17]);
-+	used_pg = FIELD_GET(MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_SRC_CNT_MASK, pg_flow_ctrl[17]);
-+	seq_printf(s, "\t\tThe used/reserved pages of LMAC3 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+
-+	seq_printf(s, "\tReserved page counter of PLE group(0x82068160): 0x%08x\n", pg_flow_ctrl[14]);
-+	seq_printf(s, "\tPLE group page status(0x82068164): 0x%08x\n", pg_flow_ctrl[15]);
-+	min_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MIN_QUOTA_MASK, pg_flow_ctrl[14]);
-+	max_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MAX_QUOTA_MASK, pg_flow_ctrl[14]);
-+	seq_printf(s, "\t\tThe max/min quota pages of PLE group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_RSV_CNT_MASK, pg_flow_ctrl[15]);
-+	used_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_SRC_CNT_MASK, pg_flow_ctrl[15]);
-+	seq_printf(s, "\t\tThe used/reserved pages of PLE group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+
-+	seq_printf(s, "\tReserved page counter of PLE1 group(0x82068168): 0x%08x\n", pg_flow_ctrl[14]);
-+	seq_printf(s, "\tPLE1 group page status(0x8206816c): 0x%08x\n", pg_flow_ctrl[15]);
-+	min_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MIN_QUOTA_MASK, pg_flow_ctrl[20]);
-+	max_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MAX_QUOTA_MASK, pg_flow_ctrl[20]);
-+	seq_printf(s, "\t\tThe max/min quota pages of PLE1 group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_RSV_CNT_MASK, pg_flow_ctrl[21]);
-+	used_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_SRC_CNT_MASK, pg_flow_ctrl[21]);
-+	seq_printf(s, "\t\tThe used/reserved pages of PLE1 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+
-+	seq_printf(s, "\tReserved page counter of MDP group(0x82068198): 0x%08x\n", pg_flow_ctrl[18]);
-+	seq_printf(s, "\tMDP group page status(0x8206819c): 0x%08x\n", pg_flow_ctrl[19]);
-+	min_q = FIELD_GET(MT_DBG_PSE_PG_MDP_GROUP_MDP_MIN_QUOTA_MASK, pg_flow_ctrl[18]);
-+	max_q = FIELD_GET(MT_DBG_PSE_PG_MDP_GROUP_MDP_MAX_QUOTA_MASK, pg_flow_ctrl[18]);
-+	seq_printf(s, "\t\tThe max/min quota pages of MDP group=0x%03x/0x%03x\n", max_q, min_q);
-+	rsv_pg = FIELD_GET(MT_DBG_PSE_MDP_PG_INFO_MDP_RSV_CNT_MASK, pg_flow_ctrl[19]);
-+	used_pg = FIELD_GET(MT_DBG_PSE_MDP_PG_INFO_MDP_SRC_CNT_MASK, pg_flow_ctrl[19]);
-+	seq_printf(s, "\t\tThe used/reserved pages of MDP group=0x%03x/0x%03x\n", used_pg, rsv_pg);
-+
-+	/* Queue Empty Status */
-+	seq_printf(s, "PSE Queue Empty Status:\n");
-+	seq_printf(s, "\tQUEUE_EMPTY(0x820680b0): 0x%08x\n", pse_stat);
-+	seq_printf(s, "\t\tCPU Q0/1/2/3 empty=%ld/%ld/%ld/%ld\n",
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q0_EMPTY_MASK, pse_stat),
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q1_EMPTY_MASK, pse_stat),
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q2_EMPTY_MASK, pse_stat),
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q3_EMPTY_MASK, pse_stat));
-+
-+	seq_printf(s, "\t\tHIF Q0/1/2/3/4/5 empty=%ld/%ld/%ld/%ld/%ld/%ld\n",
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_0_EMPTY_MASK, pse_stat),
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_1_EMPTY_MASK, pse_stat),
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_2_EMPTY_MASK, pse_stat),
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_3_EMPTY_MASK, pse_stat),
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_4_EMPTY_MASK, pse_stat),
-+			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_5_EMPTY_MASK, pse_stat));
-+
-+	seq_printf(s, "\t\tLMAC TX Q empty=%ld\n",
-+			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_LMAC_TX_QUEUE_EMPTY_MASK, pse_stat));
-+	seq_printf(s, "\t\tMDP TX Q/RX Q empty=%ld/%ld\n",
-+			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_TX_QUEUE_EMPTY_MASK, pse_stat),
-+			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_RX_QUEUE_EMPTY_MASK, pse_stat));
-+	seq_printf(s, "\t\tSEC TX Q/RX Q empty=%ld/%ld\n",
-+			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_SEC_TX_QUEUE_EMPTY_MASK, pse_stat),
-+			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_SEC_RX_QUEUE_EMPTY_SHFT, pse_stat));
-+	seq_printf(s, "\t\tSFD PARK Q empty=%ld\n",
-+			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_SFD_PARK_QUEUE_EMPTY_MASK, pse_stat));
-+	seq_printf(s, "\t\tMDP TXIOC Q/RXIOC Q empty=%ld/%ld\n",
-+			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_TXIOC_QUEUE_EMPTY_MASK, pse_stat),
-+			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_RXIOC_QUEUE_EMPTY_MASK, pse_stat));
-+	seq_printf(s, "\t\tRLS Q empty=%ld\n",
-+		FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_RLS_Q_EMTPY_MASK, pse_stat));
-+	seq_printf(s, "Nonempty Q info:\n");
-+
-+	for (i = 0; i < 31; i++) {
-+		if (((pse_stat & (0x1 << i)) >> i) == 0) {
-+			u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
-+
-+			if (pse_queue_empty_info[i].QueueName != NULL) {
-+				seq_printf(s, "\t%s: ", pse_queue_empty_info[i].QueueName);
-+				fl_que_ctrl[0] |= MT_DBG_PSE_FL_QUE_CTRL_0_EXECUTE_MASK;
-+				fl_que_ctrl[0] |= (pse_queue_empty_info[i].Portid << MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_PID_SHFT);
-+				fl_que_ctrl[0] |= (pse_queue_empty_info[i].Queueid << MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_QID_SHFT);
-+			} else
-+				continue;
-+
-+			fl_que_ctrl[0] |= (0x1 << 31);
-+
-+			mt76_wr(dev,  MT_DBG_PSE_FL_QUE_CTRL_0_ADDR, fl_que_ctrl[0]);
-+			fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PSE_FL_QUE_CTRL_2_ADDR);
-+			fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PSE_FL_QUE_CTRL_3_ADDR);
-+
-+			hfid = FIELD_GET(MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_HEAD_FID_MASK, fl_que_ctrl[1]);
-+			tfid = FIELD_GET(MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_TAIL_FID_MASK, fl_que_ctrl[1]);
-+			pktcnt = FIELD_GET(MT_DBG_PSE_FL_QUE_CTRL_3_QUEUE_PKT_NUM_MASK, fl_que_ctrl[2]);
-+			seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x\n",
-+					  tfid, hfid, pktcnt);
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+static int mt7915_mibinfo_read_per_band(struct seq_file *s, int band_idx)
-+{
-+#define BSS_NUM	4
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	u32 mac_val0, mac_val, mac_val1, idx, band_offset = 0;
-+	u32 msdr6, msdr7, msdr8, msdr9, msdr10, msdr16, msdr17, msdr18, msdr19, msdr20, msdr21;
-+	u32 mbxsdr[BSS_NUM][7];
-+	u32 mbtcr[16], mbtbcr[16], mbrcr[16], mbrbcr[16];
-+	u32 btcr[BSS_NUM], btbcr[BSS_NUM], brcr[BSS_NUM], brbcr[BSS_NUM], btdcr[BSS_NUM], brdcr[BSS_NUM];
-+	u32 mu_cnt[5];
-+	u32 ampdu_cnt[3];
-+	unsigned long per;
-+
-+	seq_printf(s, "Band %d MIB Status\n", band_idx);
-+	seq_printf(s, "===============================\n");
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SCR0(band_idx));
-+	seq_printf(s, "MIB Status Control=0x%x\n", mac_val);
-+	if (is_mt7915(&dev->mt76)) {
-+		mac_val = mt76_rr(dev, MT_DBG_MIB_M0PBSCR(band_idx));
-+		seq_printf(s, "MIB Per-BSS Status Control=0x%x\n", mac_val);
-+	}
-+
-+	msdr6 = mt76_rr(dev, MT_DBG_MIB_M0SDR6(band_idx));
-+	msdr7 = mt76_rr(dev, MT_DBG_MIB_M0SDR7(band_idx));
-+	msdr8 = mt76_rr(dev, MT_DBG_MIB_M0SDR8(band_idx));
-+	msdr9 = mt76_rr(dev, MT_DBG_MIB_M0SDR9(band_idx));
-+	msdr10 = mt76_rr(dev, MT_DBG_MIB_M0SDR10(band_idx));
-+	msdr16 = mt76_rr(dev, MT_DBG_MIB_M0SDR16(band_idx));
-+	msdr17 = mt76_rr(dev, MT_DBG_MIB_M0SDR17(band_idx));
-+	msdr18 = mt76_rr(dev, MT_DBG_MIB_M0SDR18(band_idx));
-+	msdr19 = mt76_rr(dev, MT_DBG_MIB_M0SDR19(band_idx));
-+	msdr20 = mt76_rr(dev, MT_DBG_MIB_M0SDR20(band_idx));
-+	msdr21 = mt76_rr(dev, MT_DBG_MIB_M0SDR21(band_idx));
-+	ampdu_cnt[0] = mt76_rr(dev, MT_DBG_MIB_M0SDR12(band_idx));
-+	ampdu_cnt[1] = mt76_rr(dev, MT_DBG_MIB_M0SDR14(band_idx));
-+	ampdu_cnt[2] = mt76_rr(dev, MT_DBG_MIB_M0SDR15(band_idx));
-+	ampdu_cnt[1] &= MT_DBG_MIB_M0SDR14_AMPDU_MASK;
-+	ampdu_cnt[2] &= MT_DBG_MIB_M0SDR15_AMPDU_ACKED_MASK;
-+
-+	seq_printf(s, "===Phy/Timing Related Counters===\n");
-+	seq_printf(s, "\tChannelIdleCnt=0x%x\n", msdr6 & BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK);
-+	seq_printf(s, "\tCCA_NAV_Tx_Time=0x%x\n", msdr9 & BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK);
-+	seq_printf(s, "\tRx_MDRDY_CNT=0x%lx\n", msdr10 & MT_DBG_MIB_M0SDR10_RX_MDRDY_COUNT_MASK);
-+	seq_printf(s, "\tCCK_MDRDY_TIME=0x%x, OFDM_MDRDY_TIME=0x%x, OFDM_GREEN_MDRDY_TIME=0x%x\n",
-+			 msdr19 & BN0_WF_MIB_TOP_M0SDR19_CCK_MDRDY_TIME_MASK,
-+			 msdr20 & BN0_WF_MIB_TOP_M0SDR20_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK,
-+			 msdr21 & BN0_WF_MIB_TOP_M0SDR21_OFDM_GREEN_MDRDY_TIME_MASK);
-+	seq_printf(s, "\tPrim CCA Time=0x%x\n", msdr16 & BN0_WF_MIB_TOP_M0SDR16_P_CCA_TIME_MASK);
-+	seq_printf(s, "\tSec CCA Time=0x%x\n", msdr17 & BN0_WF_MIB_TOP_M0SDR17_S_CCA_TIME_MASK);
-+	seq_printf(s, "\tPrim ED Time=0x%x\n", msdr18 & BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK);
-+
-+	seq_printf(s, "===Tx Related Counters(Generic)===\n");
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR0(band_idx));
-+	dev->dbg.bcn_total_cnt[band_idx] += (mac_val & BN0_WF_MIB_TOP_M0SDR0_BEACONTXCOUNT_MASK);
-+	seq_printf(s, "\tBeaconTxCnt=0x%x\n",dev->dbg.bcn_total_cnt[band_idx]);
-+	dev->dbg.bcn_total_cnt[band_idx] = 0;
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0DR0(band_idx));
-+	seq_printf(s, "\tTx 20MHz Cnt=0x%x\n", mac_val & BN0_WF_MIB_TOP_M0DR0_TX_20MHZ_CNT_MASK);
-+	seq_printf(s, "\tTx 40MHz Cnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_SHFT);
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0DR1(band_idx));
-+	seq_printf(s, "\tTx 80MHz Cnt=0x%x\n", mac_val & BN0_WF_MIB_TOP_M0DR1_TX_80MHZ_CNT_MASK);
-+	seq_printf(s, "\tTx 160MHz Cnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_SHFT);
-+	seq_printf(s, "\tAMPDU Cnt=0x%x\n", ampdu_cnt[0]);
-+	seq_printf(s, "\tAMPDU MPDU Cnt=0x%x\n", ampdu_cnt[1]);
-+	seq_printf(s, "\tAMPDU MPDU Ack Cnt=0x%x\n", ampdu_cnt[2]);
-+	per = (ampdu_cnt[2] == 0 ? 0 : 1000 * (ampdu_cnt[1] - ampdu_cnt[2]) / ampdu_cnt[1]);
-+	seq_printf(s, "\tAMPDU MPDU PER=%ld.%1ld%%\n", per / 10, per % 10);
-+
-+	seq_printf(s, "===MU Related Counters===\n");
-+	mu_cnt[0] = mt76_rr(dev, MT_DBG_MIB_MUBF(band_idx));
-+	mu_cnt[1] = mt76_rr(dev, MT_DBG_MIB_M0DR8(band_idx));
-+	mu_cnt[2] = mt76_rr(dev, MT_DBG_MIB_M0DR9(band_idx));
-+	mu_cnt[3] = mt76_rr(dev, MT_DBG_MIB_M0DR10(band_idx));
-+	mu_cnt[4] = mt76_rr(dev, MT_DBG_MIB_M0DR11(band_idx));
-+	seq_printf(s, "\tMUBF_TX_COUNT=0x%x\n", mu_cnt[0] & BN0_WF_MIB_TOP_M0SDR34_MUBF_TX_COUNT_MASK);
-+	seq_printf(s, "\tMU_TX_MPDU_COUNT(Ok+Fail)=0x%x\n", mu_cnt[1]);
-+	seq_printf(s, "\tMU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[2]);
-+	seq_printf(s, "\tMU_TO_SU_PPDU_COUNT=0x%x\n", mu_cnt[3] & BN0_WF_MIB_TOP_M0DR10_MU_FAIL_PPDU_CNT_MASK);
-+	seq_printf(s, "\tSU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[4]);
-+
-+	seq_printf(s, "===Rx Related Counters(Generic)===\n");
-+	seq_printf(s, "\tVector Mismacth Cnt=0x%x\n", msdr7 & BN0_WF_MIB_TOP_M0SDR7_VEC_MISS_COUNT_MASK);
-+	seq_printf(s, "\tDelimiter Fail Cnt=0x%x\n", msdr8 & BN0_WF_MIB_TOP_M0SDR8_DELIMITER_FAIL_COUNT_MASK);
-+
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR3(band_idx));
-+	seq_printf(s, "\tRxFCSErrCnt=0x%lx\n", __DBG_FIELD_GET(DBG_MIB_RX_FCS_ERROR_COUNT, mac_val));
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR4(band_idx));
-+	seq_printf(s, "\tRxFifoFullCnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0SDR4_RX_FIFO_FULL_COUNT_MASK));
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR11(band_idx));
-+	seq_printf(s, "\tRxLenMismatch=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0SDR11_RX_LEN_MISMATCH_MASK));
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR5(band_idx));
-+	seq_printf(s, "\tRxMPDUCnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0SDR5_RX_MPDU_COUNT_MASK));
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR22(band_idx));
-+	seq_printf(s, "\tRx AMPDU Cnt=0x%x\n", mac_val);
-+	/* TODO: shiang-MT7615, is MIB_M0SDR23 used for Rx total byte count for all or just AMPDU only??? */
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR23(band_idx));
-+	seq_printf(s, "\tRx Total ByteCnt=0x%x\n", mac_val);
-+
-+	if (is_mt7915(&dev->mt76)) {
-+		band_offset = WF_WTBLON_TOP_B1BTCRn_ADDR - WF_WTBLON_TOP_B0BTCRn_ADDR;//check
-+		seq_printf(s, "===Per-BSS Related Tx/Rx Counters===\n");
-+		seq_printf(s, "BSS Idx   TxCnt/DataCnt  TxByteCnt  RxCnt/DataCnt  RxByteCnt\n");
-+
-+		for (idx = 0; idx < BSS_NUM; idx++) {
-+			btcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BTCRn_ADDR + band_offset + idx * 4);
-+			btbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BTBCRn_ADDR + band_offset + idx * 4);
-+			brcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BRCRn_ADDR + band_offset + idx * 4);
-+			brbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BRBCRn_ADDR + band_offset + idx * 4);
-+			btdcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BTDCRn_ADDR + band_offset + idx * 4);
-+			brdcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BRDCRn_ADDR + band_offset + idx * 4);
-+		}
-+
-+		for (idx = 0; idx < BSS_NUM; idx++) {
-+			seq_printf(s, "%d\t 0x%x/0x%x\t 0x%x \t 0x%x/0x%x \t 0x%x\n",
-+				      idx, btcr[idx], btdcr[idx], btbcr[idx],
-+				      brcr[idx], brdcr[idx], brbcr[idx]);
-+		}
-+
-+		band_offset = (BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE) * band_idx;
-+		seq_printf(s, "===Per-MBSS Related MIB Counters===\n");
-+		seq_printf(s, "BSS Idx   RTSTx/RetryCnt  BAMissCnt  AckFailCnt  FrmRetry1/2/3Cnt\n");
-+
-+		for (idx = 0; idx < BSS_NUM; idx++) {
-+			mbxsdr[idx][0] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR0_ADDR + band_offset + idx * 0x10);
-+			mbxsdr[idx][1] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR1_ADDR + band_offset + idx * 0x10);
-+			mbxsdr[idx][2] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR2_ADDR + band_offset + idx * 0x10);
-+			mbxsdr[idx][3] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR3_ADDR + band_offset + idx * 0x10);
-+		}
-+
-+		for (idx = 0; idx < BSS_NUM; idx++) {
-+			seq_printf(s, "%d:\t0x%08x/0x%08x  0x%08x \t 0x%08x \t  0x%08x/0x%08x/0x%08x\n",
-+				      idx, (mbxsdr[idx][0] & BN0_WF_MIB_TOP_M0B0SDR0_RTSTXCOUNT_MASK),
-+				      (mbxsdr[idx][0] & BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_MASK) >> BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_SHFT,
-+				      (mbxsdr[idx][1] & BN0_WF_MIB_TOP_M0B0SDR1_BAMISSCOUNT_MASK),
-+				      (mbxsdr[idx][1] & BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_MASK) >> BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_SHFT,
-+				      (mbxsdr[idx][2] & BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRYCOUNT_MASK),
-+				      (mbxsdr[idx][2] & BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_MASK) >> BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_SHFT,
-+				      (mbxsdr[idx][3] & BN0_WF_MIB_TOP_M0B0SDR3_FRAMERETRY3COUNT_MASK));
-+		}
-+
-+		band_offset = WF_WTBLON_TOP_B1BTCRn_ADDR - WF_WTBLON_TOP_B0BTCRn_ADDR;
-+		seq_printf(s, "===Per-MBSS Related Tx/Rx Counters===\n");
-+		seq_printf(s, "MBSSIdx   TxCnt  TxByteCnt  RxCnt  RxByteCnt\n");
-+
-+		for (idx = 0; idx < 16; idx++) {
-+			mbtcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBTCRn_ADDR + band_offset + idx * 4);
-+			mbtbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBTBCRn_ADDR + band_offset + idx * 4);
-+			mbrcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBRCRn_ADDR + band_offset + idx * 4);
-+			mbrbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBRBCRn_ADDR + band_offset + idx * 4);
-+		}
-+
-+		for (idx = 0; idx < 16; idx++) {
-+			seq_printf(s, "%d\t 0x%08x\t 0x%08x \t 0x%08x \t 0x%08x\n",
-+						idx, mbtcr[idx], mbtbcr[idx], mbrcr[idx], mbrbcr[idx]);
-+		}
-+		return 0;
-+	} else {
-+		u32 btocr[BSS_NUM], mbtocr[16],mbrocr[16], brocr[BSS_NUM];
-+		u8 bss_nums = BSS_NUM;
-+
-+		band_offset = (BN1_WF_MIB_TOP_BTOCR_ADDR - BN0_WF_MIB_TOP_BTOCR_ADDR) * band_idx;
-+		seq_printf(s, "===Per-BSS Related Tx/Rx Counters===\n");
-+		seq_printf(s, "BSS Idx   TxCnt/DataCnt  TxByteCnt  RxCnt/DataCnt  RxByteCnt\n");
-+
-+		for (idx = 0; idx < BSS_NUM; idx++) {
-+			btocr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BTOCR_ADDR + band_offset + (idx >> 1) * 4));
-+			btdcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BTDCR_ADDR + band_offset + (idx >> 1) * 4));
-+			btbcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + (idx * 4)));
-+			brocr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BROCR_ADDR + band_offset + (idx >> 1) * 4));
-+			brdcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BRDCR_ADDR + band_offset + (idx >> 1) * 4));
-+			brbcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BRBCR_ADDR + band_offset + (idx * 4)));
-+
-+			if ((idx % 2) == 0) {
-+				btocr[idx] = ((btocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_SHFT);
-+				btdcr[idx] = ((btdcr[idx] & BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_SHFT);
-+				brocr[idx] = ((brocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_SHFT);
-+				brdcr[idx] = ((brdcr[idx] & BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_SHFT);
-+			} else {
-+				btocr[idx] = ((btocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_SHFT);
-+				btdcr[idx] = ((btdcr[idx] & BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_SHFT);
-+				brocr[idx] = ((brocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_SHFT);
-+				brdcr[idx] = ((brdcr[idx] & BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_SHFT);
-+			}
-+		}
-+
-+		for (idx = 0; idx < BSS_NUM; idx++) {
-+			seq_printf(s, "%d\t 0x%x/0x%x\t 0x%x \t 0x%x/0x%x \t 0x%x\n",
-+							idx, btocr[idx], btdcr[idx], btbcr[idx], brocr[idx], brdcr[idx], brbcr[idx]);
-+		}
-+
-+		band_offset = (BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE) * band_idx;
-+		seq_printf(s, "===Per-MBSS Related MIB Counters===\n");
-+		seq_printf(s, "BSS Idx   RTSTx/RetryCnt  BAMissCnt  AckFailCnt  FrmRetry1/2/3Cnt\n");
-+
-+		for (idx = 0; idx < BSS_NUM; idx++) {
-+			mbxsdr[idx][0] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR0_ADDR + band_offset + ((idx >> 1) * 4));
-+			mbxsdr[idx][1] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR1_ADDR + band_offset + ((idx >> 1) * 4));
-+			mbxsdr[idx][2] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR2_ADDR + band_offset + ((idx >> 1) * 4));
-+			mbxsdr[idx][3] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR3_ADDR + band_offset + ((idx >> 1) * 4));
-+			mbxsdr[idx][4] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR4_ADDR + band_offset + ((idx >> 1) * 4));
-+			mbxsdr[idx][5] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR5_ADDR + band_offset + ((idx >> 1) * 4));
-+			mbxsdr[idx][6] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR6_ADDR + band_offset + ((idx >> 1) * 4));
-+
-+			if ((idx % 2) == 0) {
-+				mbxsdr[idx][0] = ((mbxsdr[idx][0] & BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_SHFT);
-+				mbxsdr[idx][1] = ((mbxsdr[idx][1] & BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_SHFT);
-+				mbxsdr[idx][2] = ((mbxsdr[idx][2] & BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_SHFT);
-+				mbxsdr[idx][3] = ((mbxsdr[idx][3] & BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_SHFT);
-+				mbxsdr[idx][4] = ((mbxsdr[idx][4] & BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_SHFT);
-+				mbxsdr[idx][5] = ((mbxsdr[idx][5] & BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_SHFT);
-+				mbxsdr[idx][6] = ((mbxsdr[idx][6] & BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_SHFT);
-+			} else {
-+				mbxsdr[idx][0] = ((mbxsdr[idx][0] & BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_SHFT);
-+				mbxsdr[idx][1] = ((mbxsdr[idx][1] & BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_SHFT);
-+				mbxsdr[idx][2] = ((mbxsdr[idx][2] & BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_SHFT);
-+				mbxsdr[idx][3] = ((mbxsdr[idx][3] & BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_SHFT);
-+				mbxsdr[idx][4] = ((mbxsdr[idx][4] & BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_SHFT);
-+				mbxsdr[idx][5] = ((mbxsdr[idx][5] & BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_SHFT);
-+				mbxsdr[idx][6] = ((mbxsdr[idx][6] & BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_SHFT);
-+			}
-+		}
-+
-+		for (idx = 0; idx < BSS_NUM; idx++) {
-+			seq_printf(s, "%d:\t0x%x/0x%x  0x%x \t 0x%x \t  0x%x/0x%x/0x%x\n",
-+				      idx,
-+				      mbxsdr[idx][0], mbxsdr[idx][1], mbxsdr[idx][2], mbxsdr[idx][3],
-+				      mbxsdr[idx][4], mbxsdr[idx][5], mbxsdr[idx][6]);
-+		}
-+
-+		band_offset = (BN1_WF_MIB_TOP_BTOCR_ADDR - BN0_WF_MIB_TOP_BTOCR_ADDR) * band_idx;
-+		seq_printf(s, "===Per-MBSS Related Tx/Rx Counters===\n");
-+		seq_printf(s, "MBSSIdx   TxCnt  TxByteCnt  RxCnt  RxByteCnt\n");
-+
-+		for (idx = 0; idx < 16; idx++) {
-+			mbtocr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTOCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + ((idx >> 1) * 4)));
-+			mbtbcr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + (idx * 4)));
-+			mbrocr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BROCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + ((idx >> 1) * 4)));
-+			mbrbcr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BRBCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + (idx * 4)));
-+
-+			if ((idx % 2) == 0) {
-+				mbtocr[idx] = ((mbtocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_SHFT);
-+				mbrocr[idx] = ((mbrocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_SHFT);
-+			} else {
-+				mbtocr[idx] = ((mbtocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_SHFT);
-+				mbrocr[idx] = ((mbrocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_SHFT);
-+			}
-+		}
-+
-+		for (idx = 0; idx < 16; idx++) {
-+			seq_printf(s, "%d\t 0x%08x\t 0x%08x \t 0x%08x \t 0x%08x\n",
-+						idx, mbtocr[idx], mbtbcr[idx], mbrocr[idx], mbrbcr[idx]);
-+		}
-+	}
-+
-+	seq_printf(s, "===Dummy delimiter insertion result===\n");
-+	mac_val0 = mt76_rr(dev, MT_DBG_MIB_M0DR11(band_idx));
-+	mac_val = mt76_rr(dev, MT_DBG_MIB_M0DR6(band_idx));
-+	mac_val1 = mt76_rr(dev, MT_DBG_MIB_M0DR7(band_idx));
-+	seq_printf(s, "Range0 = %d\t Range1 = %d\t Range2 = %d\t Range3 = %d\t Range4 = %d\n",
-+				(mac_val0 & BN0_WF_MIB_TOP_M0DR12_TX_DDLMT_RNG0_CNT_MASK),
-+				(mac_val & BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG1_CNT_MASK),
-+				(mac_val & BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_SHFT,
-+				(mac_val1 & BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG3_CNT_MASK),
-+				(mac_val1 & BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_SHFT);
-+
-+	return 0;
-+}
-+
-+static int mt7915_mibinfo_band0(struct seq_file *s, void *data)
-+{
-+	mt7915_mibinfo_read_per_band(s, 0);
-+	return 0;
-+}
-+
-+static int mt7915_mibinfo_band1(struct seq_file *s, void *data)
-+{
-+	mt7915_mibinfo_read_per_band(s, 1);
-+	return 0;
-+}
-+
-+static int mt7915_token_read(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	int id, count = 0;
-+	struct mt76_txwi_cache *txwi;
-+
-+	seq_printf(s, "Cut through token:\n");
-+	spin_lock_bh(&dev->mt76.token_lock);
-+	idr_for_each_entry(&dev->mt76.token, txwi, id) {
-+		seq_printf(s, "%4d ", id);
-+		count++;
-+		if (count % 8 == 0)
-+			seq_printf(s, "\n");
-+	}
-+	spin_unlock_bh(&dev->mt76.token_lock);
-+	seq_printf(s, "\n");
-+
-+	return 0;
-+}
-+
-+struct txd_l {
-+	u32 txd_0;
-+	u32 txd_1;
-+	u32 txd_2;
-+	u32 txd_3;
-+	u32 txd_4;
-+	u32 txd_5;
-+	u32 txd_6;
-+	u32 txd_7;
-+} __packed;
-+
-+char *pkt_ft_str[] = {"cut_through", "store_forward", "cmd", "PDA_FW_Download"};
-+char *hdr_fmt_str[] = {
-+	"Non-80211-Frame",
-+	"Command-Frame",
-+	"Normal-80211-Frame",
-+	"enhanced-80211-Frame",
-+};
-+/* TMAC_TXD_1.hdr_format */
-+#define TMI_HDR_FT_NON_80211	0x0
-+#define TMI_HDR_FT_CMD		0x1
-+#define TMI_HDR_FT_NOR_80211	0x2
-+#define TMI_HDR_FT_ENH_80211	0x3
-+
-+void mt7915_dump_tmac_info(u8 *tmac_info)
-+{
-+	struct txd_l *txd = (struct txd_l *)tmac_info;
-+
-+	printk("txd raw data: size=%d\n", MT_TXD_SIZE);
-+	print_hex_dump(KERN_ERR , "", DUMP_PREFIX_OFFSET, 16, 1, tmac_info, MT_TXD_SIZE, false);
-+
-+	printk("TMAC_TXD Fields:\n");
-+	printk("\tTMAC_TXD_0:\n");
-+
-+	/* DW0 */
-+	/* TX Byte Count [15:0]  */
-+	printk("\t\tTxByteCnt = %ld\n", FIELD_GET(MT_TXD0_TX_BYTES, txd->txd_0));
-+
-+	/* PKT_FT: Packet Format [24:23] */
-+	printk("\t\tpkt_ft = %ld(%s)\n",
-+			FIELD_GET(MT_TXD0_PKT_FMT, txd->txd_0),
-+			pkt_ft_str[FIELD_GET(MT_TXD0_PKT_FMT, txd->txd_0)]);
-+
-+	/* Q_IDX [31:25]  */
-+	printk("\t\tQueID =0x%lx\n", FIELD_GET(MT_TXD0_Q_IDX, txd->txd_0));
-+
-+	printk("\tTMAC_TXD_1:\n");
-+
-+	/* DW1 */
-+	/* WLAN Indec [9:0] */
-+	printk("\t\tWlan Index = %ld\n", FIELD_GET(MT_TXD1_WLAN_IDX, txd->txd_1));
-+
-+	/* VTA [10] */
-+	printk("\t\tVTA = %d\n", ((txd->txd_1 & MT_TXD1_VTA) ? 1 : 0));
-+
-+	/* HF: Header Format [17:16] */
-+	printk("\t\tHdrFmt = %ld(%s)\n",
-+			FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1),
-+			FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1) < 4 ?
-+			hdr_fmt_str[FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1)] : "N/A");
-+
-+	switch (FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1)) {
-+	case TMI_HDR_FT_NON_80211:
-+		/* MRD [11], EOSP [12], RMVL [13], VLAN [14], ETYPE [15] */
-+		printk("\t\t\tMRD = %d, EOSP = %d,\
-+				RMVL = %d, VLAN = %d, ETYP = %d\n",
-+				(txd->txd_1 & MT_TXD1_MRD) ? 1 : 0,
-+				(txd->txd_1 & MT_TXD1_EOSP) ? 1 : 0,
-+				(txd->txd_1 & MT_TXD1_RMVL) ? 1 : 0,
-+				(txd->txd_1 & MT_TXD1_VLAN) ? 1 : 0,
-+				(txd->txd_1 & MT_TXD1_ETYP) ? 1 : 0);
-+		break;
-+	case TMI_HDR_FT_NOR_80211:
-+		/* HEADER_LENGTH [15:11] */
-+		printk("\t\t\tHeader Len = %ld(WORD)\n", FIELD_GET(MT_TXD1_HDR_INFO, txd->txd_1));
-+		break;
-+
-+	case TMI_HDR_FT_ENH_80211:
-+		/* EOSP [12], AMS [13]  */
-+		printk("\t\t\tEOSP = %d, AMS = %d\n",
-+				(txd->txd_1 & MT_TXD1_EOSP) ? 1 : 0,
-+				(txd->txd_1 & MT_TXD1_AMS) ? 1 : 0);
-+		break;
-+	}
-+
-+	/* Header Padding [19:18] */
-+	printk("\t\tHdrPad = %ld\n", FIELD_GET(MT_TXD1_HDR_PAD, txd->txd_1));
-+
-+	/* TID [22:20] */
-+	printk("\t\tTID = %ld\n", FIELD_GET(MT_TXD1_TID, txd->txd_1));
-+
-+
-+	/* UtxB/AMSDU_C/AMSDU [23] */
-+	printk("\t\tamsdu = %d\n", ((txd->txd_1 & MT_TXD1_AMSDU) ? 1 : 0));
-+
-+	/* OM [29:24] */
-+	printk("\t\town_mac = %ld\n", FIELD_GET(MT_TXD1_OWN_MAC, txd->txd_1));
-+
-+
-+	/* TGID [30] */
-+	printk("\t\tTGID = %d\n", ((txd->txd_1 & MT_TXD1_TGID) ? 1 : 0));
-+
-+
-+	/* FT [31] */
-+	printk("\t\tTxDFormatType = %d\n", (txd->txd_1 & MT_TXD1_LONG_FORMAT) ? 1 : 0);
-+
-+	printk("\tTMAC_TXD_2:\n");
-+	/* DW2 */
-+	/* Subtype [3:0] */
-+	printk("\t\tsub_type = %ld\n", FIELD_GET(MT_TXD2_SUB_TYPE, txd->txd_2));
-+
-+	/* Type[5:4] */
-+	printk("\t\tfrm_type = %ld\n", FIELD_GET(MT_TXD2_FRAME_TYPE, txd->txd_2));
-+
-+	/* NDP [6] */
-+	printk("\t\tNDP = %d\n", ((txd->txd_2 & MT_TXD2_NDP) ? 1 : 0));
-+
-+	/* NDPA [7] */
-+	printk("\t\tNDPA = %d\n", ((txd->txd_2 & MT_TXD2_NDPA) ? 1 : 0));
-+
-+	/* SD [8] */
-+	printk("\t\tSounding = %d\n", ((txd->txd_2 & MT_TXD2_SOUNDING) ? 1 : 0));
-+
-+	/* RTS [9] */
-+	printk("\t\tRTS = %d\n", ((txd->txd_2 & MT_TXD2_RTS) ? 1 : 0));
-+
-+	/* BM [10] */
-+	printk("\t\tbc_mc_pkt = %d\n", ((txd->txd_2 & MT_TXD2_MULTICAST) ? 1 : 0));
-+
-+	/* B [11]  */
-+	printk("\t\tBIP = %d\n", ((txd->txd_2 & MT_TXD2_BIP) ? 1 : 0));
-+
-+	/* DU [12] */
-+	printk("\t\tDuration = %d\n", ((txd->txd_2 & MT_TXD2_DURATION) ? 1 : 0));
-+
-+	/* HE [13] */
-+	printk("\t\tHE(HTC Exist) = %d\n", ((txd->txd_2 & MT_TXD2_HTC_VLD) ? 1 : 0));
-+
-+	/* FRAG [15:14] */
-+	printk("\t\tFRAG = %ld\n", FIELD_GET(MT_TXD2_FRAG, txd->txd_2));
-+
-+
-+	/* Remaining Life Time [23:16]*/
-+	printk("\t\tReamingLife/MaxTx time = %ld (unit: 64TU)\n",
-+		FIELD_GET(MT_TXD2_MAX_TX_TIME, txd->txd_2));
-+
-+	/* Power Offset [29:24] */
-+	printk("\t\tpwr_offset = %ld\n", FIELD_GET(MT_TXD2_POWER_OFFSET, txd->txd_2));
-+
-+	/* FRM [30] */
-+	printk("\t\tfix rate mode = %d\n", (txd->txd_2 & MT_TXD2_FIXED_RATE) ? 1 : 0);
-+
-+	/* FR[31] */
-+	printk("\t\tfix rate = %d\n", (txd->txd_2 & MT_TXD2_FIX_RATE) ? 1 : 0);
-+
-+
-+	printk("\tTMAC_TXD_3:\n");
-+
-+	/* DW3 */
-+	/* NA [0] */
-+	printk("\t\tNoAck = %d\n", (txd->txd_3 & MT_TXD3_NO_ACK) ? 1 : 0);
-+
-+	/* PF [1] */
-+	printk("\t\tPF = %d\n", (txd->txd_3 & MT_TXD3_PROTECT_FRAME) ? 1 : 0);
-+
-+	/* EMRD [2] */
-+	printk("\t\tEMRD = %d\n", (txd->txd_3 & MT_TXD3_EMRD) ? 1 : 0);
-+
-+	/* EEOSP [3] */
-+	printk("\t\tEEOSP = %d\n", (txd->txd_3 & MT_TXD3_EEOSP) ? 1 : 0);
-+
-+	/* DAS [4] */
-+	printk("\t\tda_select = %d\n", (txd->txd_3 & MT_TXD3_DAS) ? 1 : 0);
-+
-+	/* TM [5] */
-+	printk("\t\ttm = %d\n", (txd->txd_3 & MT_TXD3_TIMING_MEASURE) ? 1 : 0);
-+
-+	/* TX Count [10:6] */
-+	printk("\t\ttx_cnt = %ld\n", FIELD_GET(MT_TXD3_TX_COUNT, txd->txd_3));
-+
-+	/* Remaining TX Count [15:11] */
-+	printk("\t\tremain_tx_cnt = %ld\n", FIELD_GET(MT_TXD3_REM_TX_COUNT, txd->txd_3));
-+
-+	/* SN [27:16] */
-+	printk("\t\tsn = %ld\n", FIELD_GET(MT_TXD3_SEQ, txd->txd_3));
-+
-+	/* BA_DIS [28] */
-+	printk("\t\tba dis = %d\n", (txd->txd_3 & MT_TXD3_BA_DISABLE) ? 1 : 0);
-+
-+	/* Power Management [29] */
-+	printk("\t\tpwr_mgmt = 0x%x\n", (txd->txd_3 & MT_TXD3_SW_POWER_MGMT) ? 1 : 0);
-+
-+	/* PN_VLD [30] */
-+	printk("\t\tpn_vld = %d\n", (txd->txd_3 & MT_TXD3_PN_VALID) ? 1 : 0);
-+
-+	/* SN_VLD [31] */
-+	printk("\t\tsn_vld = %d\n", (txd->txd_3 & MT_TXD3_SN_VALID) ? 1 : 0);
-+
-+
-+	/* DW4 */
-+	printk("\tTMAC_TXD_4:\n");
-+
-+	/* PN_LOW [31:0] */
-+	printk("\t\tpn_low = 0x%lx\n", FIELD_GET(MT_TXD4_PN_LOW, txd->txd_4));
-+
-+
-+	/* DW5 */
-+	printk("\tTMAC_TXD_5:\n");
-+
-+	/* PID [7:0] */
-+	printk("\t\tpid = %ld\n", FIELD_GET(MT_TXD5_PID, txd->txd_5));
-+
-+	/* TXSFM [8] */
-+	printk("\t\ttx_status_fmt = %d\n", (txd->txd_5 & MT_TXD5_TX_STATUS_FMT) ? 1 : 0);
-+
-+	/* TXS2M [9] */
-+	printk("\t\ttx_status_2_mcu = %d\n", (txd->txd_5 & MT_TXD5_TX_STATUS_MCU) ? 1 : 0);
-+
-+	/* TXS2H [10] */
-+	printk("\t\ttx_status_2_host = %d\n", (txd->txd_5 & MT_TXD5_TX_STATUS_HOST) ? 1 : 0);
-+
-+	/* ADD_BA [14] */
-+	printk("\t\tADD_BA = %d\n", (txd->txd_5 & MT_TXD5_ADD_BA) ? 1 : 0);
-+
-+	/* MD [15] */
-+	printk("\t\tMD = %d\n", (txd->txd_5 & MT_TXD5_MD) ? 1 : 0);
-+
-+	/* PN_HIGH [31:16]  */
-+	printk("\t\tpn_high = 0x%lx\n", FIELD_GET(MT_TXD5_PN_HIGH, txd->txd_5));
-+
-+	/* DW6 */
-+	printk("\tTMAC_TXD_6:\n");
-+
-+	if (txd->txd_2 & MT_TXD2_FIX_RATE) {
-+		/* Fixed BandWidth mode [2:0] */
-+		printk("\t\tbw = %ld\n",
-+		       FIELD_GET(MT_TXD6_BW, txd->txd_6) | (txd->txd_6 & MT_TXD6_FIXED_BW));
-+
-+		/* DYN_BW [3] */
-+		printk("\t\tdyn_bw = %d\n", (txd->txd_6 & MT_TXD6_DYN_BW) ? 1 : 0);
-+
-+		/* ANT_ID [7:4] */
-+		printk("\t\tant_id = %ld\n", FIELD_GET(MT_TXD6_ANT_ID, txd->txd_6));
-+
-+		/* SPE_IDX_SEL [10] */
-+		printk("\t\tspe_idx_sel = %d\n", (txd->txd_6 & MT_TXD6_SPE_ID_IDX) ? 1 : 0);
-+
-+		/* LDPC [11] */
-+		printk("\t\tldpc = %d\n", (txd->txd_6 & MT_TXD6_LDPC) ? 1 : 0);
-+
-+		/* HELTF Type[13:12] */
-+		printk("\t\tHELTF Type = %ld\n", FIELD_GET(MT_TXD6_HELTF, txd->txd_6));
-+
-+		/* GI Type [15:14] */
-+		printk("\t\tGI = %ld\n", FIELD_GET(MT_TXD6_SGI, txd->txd_6));
-+
-+		/* Rate to be Fixed [29:16] */
-+		printk("\t\ttx_rate = 0x%lx\n", FIELD_GET(MT_TXD6_TX_RATE, txd->txd_6));
-+	}
-+
-+	/* TXEBF [30] */
-+	printk("\t\ttxebf = %d\n", (txd->txd_6 & MT_TXD6_TX_EBF)  ? 1 : 0);
-+
-+	/* TXIBF [31] */
-+	printk("\t\ttxibf = %d\n", (txd->txd_6 & MT_TXD6_TX_IBF) ? 1 : 0);
-+
-+	/* DW7 */
-+	printk("\tTMAC_TXD_7:\n");
-+
-+	if ((txd->txd_1 & MT_TXD1_VTA) == 0) {
-+		/* SW Tx Time [9:0] */
-+		printk("\t\tsw_tx_time = %ld\n", FIELD_GET(MT_TXD7_TX_TIME, txd->txd_7));
-+	} else {
-+		/* TXD Arrival Time [9:0] */
-+		printk("\t\tat = %ld\n", FIELD_GET(MT_TXD7_TAT, txd->txd_7));
-+	}
-+
-+	/* HW_AMSDU_CAP [10] */
-+	printk("\t\thw amsdu cap = %d\n",(txd->txd_7 & MT_TXD7_HW_AMSDU) ? 1 : 0);
-+
-+	/* SPE_IDX [15:11] */
-+	if (txd->txd_2 & MT_TXD2_FIX_RATE) {
-+		printk("\t\tspe_idx = 0x%lx\n", FIELD_GET(MT_TXD7_SPE_IDX, txd->txd_7));
-+	}
-+
-+	/* PSE_FID [27:16] */
-+	printk("\t\tpse_fid = 0x%lx\n", FIELD_GET(MT_TXD7_PSE_FID, txd->txd_7));
-+
-+	/* Subtype [19:16] */
-+	printk("\t\tpp_sub_type=%ld\n", FIELD_GET(MT_TXD7_SUB_TYPE, txd->txd_7));
-+
-+	/* Type [21:20] */
-+	printk("\t\tpp_type=%ld\n", FIELD_GET(MT_TXD7_TYPE, txd->txd_7));
-+
-+	/* CTXD_CNT [25:23] */
-+	printk("\t\tctxd cnt=0x%lx\n", FIELD_GET(MT_TXD7_CTXD_CNT, txd->txd_7));
-+
-+	/* CTXD [26] */
-+	printk("\t\tctxd = %d\n", (txd->txd_7 & MT_TXD7_CTXD) ? 1 : 0);
-+
-+	/* I [28]  */
-+	printk("\t\ti = %d\n", (txd->txd_7 & MT_TXD7_IP_SUM) ? 1 : 0);
-+
-+	/* UT [29] */
-+	printk("\t\tUT = %d\n", (txd->txd_7 & MT_TXD7_UDP_TCP_SUM) ? 1 : 0);
-+
-+	/* TXDLEN [31:30] */
-+	printk("\t\t txd len= %ld\n", FIELD_GET(MT_TXD7_TXD_LEN, txd->txd_7));
-+}
-+
-+
-+static int mt7915_token_txd_read(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	struct mt76_txwi_cache *t;
-+	u8* txwi;
-+
-+	seq_printf(s, "\n");
-+	spin_lock_bh(&dev->mt76.token_lock);
-+
-+	t = idr_find(&dev->mt76.token, dev->dbg.token_idx);
-+
-+	spin_unlock_bh(&dev->mt76.token_lock);
-+	if (t != NULL) {
-+		struct mt76_dev *mdev = &dev->mt76;
-+		txwi = ((u8*)(t)) - (mdev->drv->txwi_size);
-+		mt7915_dump_tmac_info((u8*) txwi);
-+		seq_printf(s, "\n");
-+		printk("[SKB]\n");
-+		print_hex_dump(KERN_ERR , "", DUMP_PREFIX_OFFSET, 16, 1, (u8 *)t->skb->data, t->skb->len, false);
-+		seq_printf(s, "\n");
-+	}
-+	return 0;
-+}
-+
-+static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	u32 ple_stat[8] = {0}, total_amsdu = 0;
-+	u8 i;
-+
-+	for (i = 0; i < 8; i++)
-+		ple_stat[i] = mt76_rr(dev, MT_DBG_PLE_AMSDU_PACK_MSDU_CNT(i));
-+
-+	seq_printf(s, "TXD counter status of MSDU:\n");
-+
-+	for (i = 0; i < 8; i++)
-+		total_amsdu += ple_stat[i];
-+
-+	for (i = 0; i < 8; i++) {
-+		seq_printf(s, "AMSDU pack count of %d MSDU in TXD: 0x%x ", i + 1, ple_stat[i]);
-+		if (total_amsdu != 0)
-+			seq_printf(s, "(%d%%)\n", ple_stat[i] * 100 / total_amsdu);
-+		else
-+			seq_printf(s, "\n");
-+	}
-+
-+	return 0;
-+
-+}
-+
-+static int mt7915_agginfo_read_per_band(struct seq_file *s, int band_idx)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	u32 value, idx, agg_rang_sel[15], ampdu_cnt[11], total_ampdu = 0;
-+
-+	seq_printf(s, "Band %d AGG Status\n", band_idx);
-+	seq_printf(s, "===============================\n");
-+	value = mt76_rr(dev, MT_DBG_AGG_AALCR0(band_idx));
-+	seq_printf(s, "AC00 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC01 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC02 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC03 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
-+
-+	value = mt76_rr(dev, MT_DBG_AGG_AALCR1(band_idx));
-+	seq_printf(s, "AC10 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC11 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC12 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC13 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
-+
-+	value = mt76_rr(dev, MT_DBG_AGG_AALCR2(band_idx));
-+	seq_printf(s, "AC20 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC21 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC22 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC23 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
-+
-+	value = mt76_rr(dev, MT_DBG_AGG_AALCR3(band_idx));
-+	seq_printf(s, "AC30 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC31 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC32 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
-+	seq_printf(s, "AC33 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
-+
-+	value = mt76_rr(dev, MT_DBG_AGG_AALCR4(band_idx));
-+	seq_printf(s, "ALTX Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR4_ALTX0_AGG_LIMIT_MASK, value));
-+
-+	value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 0));
-+	seq_printf(s, "Winsize0 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE0_MASK, value));
-+	seq_printf(s, "Winsize1 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE1_MASK, value));
-+	seq_printf(s, "Winsize2 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE2_MASK, value));
-+	seq_printf(s, "Winsize3 limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE3_MASK, value));
-+
-+	value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 1));
-+	seq_printf(s, "Winsize4 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE4_MASK, value));
-+	seq_printf(s, "Winsize5 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE5_MASK, value));
-+	seq_printf(s, "Winsize6 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE6_MASK, value));
-+	seq_printf(s, "Winsize7 limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE7_MASK, value));
-+
-+	value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 2));
-+	seq_printf(s, "Winsize8 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZE8_MASK, value));
-+	seq_printf(s, "Winsize9 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZE9_MASK, value));
-+	seq_printf(s, "WinsizeA limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZEA_MASK, value));
-+	seq_printf(s, "WinsizeB limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZEB_MASK, value));
-+
-+
-+	value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 3));
-+	seq_printf(s, "WinsizeC limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR3_WINSIZEC_MASK, value));
-+	seq_printf(s, "WinsizeD limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR3_WINSIZED_MASK, value));
-+	seq_printf(s, "WinsizeE limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR3_WINSIZEE_MASK, value));
-+
-+	seq_printf(s, "===AMPDU Related Counters===\n");
-+
-+	value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 0));
-+	agg_rang_sel[0] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL0_MASK, value);
-+	agg_rang_sel[1] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL1_MASK, value);
-+	agg_rang_sel[2] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL2_MASK, value);
-+	agg_rang_sel[3] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL3_MASK, value);
-+
-+	value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 1));
-+	agg_rang_sel[4] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL4_MASK, value);
-+	agg_rang_sel[5] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL5_MASK, value);
-+	agg_rang_sel[6] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL6_MASK, value);
-+	agg_rang_sel[7] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL7_MASK, value);
-+
-+	value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 2));
-+	agg_rang_sel[8] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL8_MASK, value);
-+	agg_rang_sel[9] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL9_MASK, value);
-+	agg_rang_sel[10] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL10_MASK, value);
-+	agg_rang_sel[11] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL11_MASK, value);
-+
-+	value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 3));
-+	agg_rang_sel[12] = FIELD_GET(MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL12_MASK, value);
-+	agg_rang_sel[13] = FIELD_GET(MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL13_MASK, value);
-+	agg_rang_sel[14] = FIELD_GET(MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL14_MASK, value);
-+
-+	/* Need to add 1 after read from AGG_RANG_SEL CR */
-+	for (idx = 0; idx < 15; idx++)
-+		agg_rang_sel[idx]++;
-+
-+	ampdu_cnt[3] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 0));
-+	ampdu_cnt[4] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 1));
-+	ampdu_cnt[5] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 2));
-+	ampdu_cnt[6] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 3));
-+	ampdu_cnt[7] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 0));
-+	ampdu_cnt[8] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 1));
-+	ampdu_cnt[9] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 2));
-+	ampdu_cnt[10] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 3));
-+
-+	seq_printf(s, "\tTx Agg Range: \t%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d\n",
-+			 agg_rang_sel[0],
-+			 agg_rang_sel[0] + 1, agg_rang_sel[1],
-+			 agg_rang_sel[1] + 1, agg_rang_sel[2],
-+			 agg_rang_sel[2] + 1, agg_rang_sel[3],
-+			 agg_rang_sel[3] + 1, agg_rang_sel[4],
-+			 agg_rang_sel[4] + 1, agg_rang_sel[5],
-+			 agg_rang_sel[5] + 1, agg_rang_sel[6],
-+			 agg_rang_sel[6] + 1, agg_rang_sel[7]);
-+
-+#define BIT_0_to_15_MASK 0x0000FFFF
-+#define BIT_15_to_31_MASK 0xFFFF0000
-+#define SHFIT_16_BIT 16
-+
-+	for (idx = 3; idx < 11; idx++)
-+		total_ampdu = total_ampdu + (ampdu_cnt[idx] & BIT_0_to_15_MASK) + ((ampdu_cnt[idx] & BIT_15_to_31_MASK) >> SHFIT_16_BIT);
-+
-+	seq_printf(s, "\t\t\t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx\n",
-+			 (ampdu_cnt[3]) & MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK,
-+			 FIELD_GET(MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK, ampdu_cnt[3]),
-+			 (ampdu_cnt[4]) & MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK,
-+			 FIELD_GET(MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK, ampdu_cnt[4]),
-+			 (ampdu_cnt[5]) & MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK,
-+			 FIELD_GET(MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK, ampdu_cnt[5]),
-+			 (ampdu_cnt[6]) & MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK,
-+			 FIELD_GET(MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK, ampdu_cnt[6]));
-+
-+	if (total_ampdu != 0) {
-+		seq_printf(s, "\t\t\t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%)\n",
-+				((ampdu_cnt[3]) & MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK) * 100 / total_ampdu,
-+				FIELD_GET(MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK, ampdu_cnt[3]) * 100 / total_ampdu,
-+				((ampdu_cnt[4]) & MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK) * 100 / total_ampdu,
-+				FIELD_GET(MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK, ampdu_cnt[4]) * 100 / total_ampdu,
-+				((ampdu_cnt[5]) & MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK) * 100 / total_ampdu,
-+				FIELD_GET(MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK, ampdu_cnt[5]) * 100 / total_ampdu,
-+				((ampdu_cnt[6]) & MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK) * 100 / total_ampdu,
-+				 FIELD_GET(MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK, ampdu_cnt[6]) * 100 / total_ampdu);
-+		}
-+
-+		seq_printf(s, "\t\t\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~256\n",
-+			 agg_rang_sel[7] + 1, agg_rang_sel[8],
-+			 agg_rang_sel[8] + 1, agg_rang_sel[9],
-+			 agg_rang_sel[9] + 1, agg_rang_sel[10],
-+			 agg_rang_sel[10] + 1, agg_rang_sel[11],
-+			 agg_rang_sel[11] + 1, agg_rang_sel[12],
-+			 agg_rang_sel[12] + 1, agg_rang_sel[13],
-+			 agg_rang_sel[13] + 1, agg_rang_sel[14],
-+			 agg_rang_sel[14] + 1);
-+
-+		seq_printf(s, "\t\t\t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx\n",
-+			(ampdu_cnt[7]) & MT_DBG_MIB_M0DR13_TRX_AGG_RANGE8_CNT_MASK,
-+			FIELD_GET(MT_DBG_MIB_M0DR13_TRX_AGG_RANGE9_CNT_MASK, ampdu_cnt[7]),
-+			(ampdu_cnt[8]) & MT_DBG_MIB_M0DR14_TRX_AGG_RANGE10_CNT_MASK,
-+			FIELD_GET(MT_DBG_MIB_M0DR14_TRX_AGG_RANGE11_CNT_MASK, ampdu_cnt[8]),
-+			(ampdu_cnt[9]) & MT_DBG_MIB_M0DR15_TRX_AGG_RANGE12_CNT_MASK,
-+			FIELD_GET(MT_DBG_MIB_M0DR15_TRX_AGG_RANGE13_CNT_MASK, ampdu_cnt[9]),
-+			(ampdu_cnt[10]) & MT_DBG_MIB_M0DR16_TRX_AGG_RANGE14_CNT_MASK,
-+			FIELD_GET(MT_DBG_MIB_M0DR16_TRX_AGG_RANGE15_CNT_MASK, ampdu_cnt[10]));
-+
-+	if (total_ampdu != 0) {
-+		seq_printf(s, "\t\t\t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%)\n",
-+		       ((ampdu_cnt[7]) & MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK) * 100 / total_ampdu,
-+			FIELD_GET(MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK, ampdu_cnt[7]) * 100 / total_ampdu,
-+			((ampdu_cnt[8]) & MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK) * 100 / total_ampdu,
-+			FIELD_GET(MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK, ampdu_cnt[8]) * 100 / total_ampdu,
-+			((ampdu_cnt[9]) & MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK) * 100 / total_ampdu,
-+			FIELD_GET(MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK, ampdu_cnt[9]) * 100 / total_ampdu,
-+			((ampdu_cnt[10]) & MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK) * 100 / total_ampdu,
-+			FIELD_GET(MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK, ampdu_cnt[10]) * 100 / total_ampdu);
-+	}
-+
-+	return 0;
-+}
-+
-+static int mt7915_agginfo_read_band0(struct seq_file *s, void *data)
-+{
-+	mt7915_agginfo_read_per_band(s, 0);
-+	return 0;
-+}
-+
-+static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
-+{
-+	mt7915_agginfo_read_per_band(s, 1);
-+	return 0;
-+}
-+
-+/*usage: <en> <num> <len>
-+	en: BIT(16) 0: sw amsdu  1: hw amsdu
-+	num: GENMASK(15, 8) range 1-8
-+	len: GENMASK(7, 0) unit: 256 bytes */
-+static int mt7915_sta_tx_amsdu_set(void *data, u64 tx_amsdu)
-+{
-+/* UWTBL DW 6 */
-+#define WTBL_AMSDU_LEN_MASK              GENMASK(5, 0)
-+#define WTBL_AMSDU_NUM_MASK              GENMASK(8, 6)
-+#define WTBL_AMSDU_EN_MASK               BIT(9)
-+#define UWTBL_HW_AMSDU_DW                 6
-+
-+	struct mt7915_dev *dev = data;
-+	u32 len = FIELD_GET(GENMASK(7, 0), tx_amsdu);
-+	u32 num = FIELD_GET(GENMASK(15, 8), tx_amsdu);
-+	u32 uwtbl;
-+
-+	mt7915_mcu_set_amsdu_algo(dev, dev->wlan_idx, 0);
-+
-+	mt7915_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC,
-+			UWTBL_HW_AMSDU_DW, 1, &uwtbl);
-+
-+	if (len) {
-+		uwtbl &= ~WTBL_AMSDU_LEN_MASK;
-+		uwtbl |= FIELD_PREP(WTBL_AMSDU_LEN_MASK, len);
-+	}
-+
-+	uwtbl &= ~WTBL_AMSDU_NUM_MASK;
-+	uwtbl |= FIELD_PREP(WTBL_AMSDU_NUM_MASK, num);
-+
-+	if (tx_amsdu & BIT(16))
-+		uwtbl |= WTBL_AMSDU_EN_MASK;
-+
-+	mt7915_wtbl_write_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC,
-+			UWTBL_HW_AMSDU_DW, uwtbl);
-+
-+	return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_tx_amsdu, NULL,
-+			 mt7915_sta_tx_amsdu_set, "%llx\n");
-+
-+static int mt7915_red_enable_set(void *data, u64 en)
-+{
-+	struct mt7915_dev *dev = data;
-+
-+	return mt7915_mcu_set_red(dev, en);
-+}
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_red_en, NULL,
-+			 mt7915_red_enable_set, "%llx\n");
-+
-+static int mt7915_red_show_sta_set(void *data, u64 wlan_idx)
-+{
-+	struct mt7915_dev *dev = data;
-+
-+	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
-+			  MCU_WA_PARAM_RED_SHOW_STA,
-+			  wlan_idx, 0, true);
-+
-+	return 0;
-+}
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_red_show_sta, NULL,
-+			 mt7915_red_show_sta_set, "%llx\n");
-+
-+static int mt7915_red_target_dly_set(void *data, u64 delay)
-+{
-+	struct mt7915_dev *dev = data;
-+
-+	if (delay > 0 && delay <= 32767)
-+		mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
-+				  MCU_WA_PARAM_RED_TARGET_DELAY,
-+				  delay, 0, true);
-+
-+	return 0;
-+}
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_red_target_dly, NULL,
-+			 mt7915_red_target_dly_set, "%llx\n");
-+
-+static int
-+mt7915_txpower_level_set(void *data, u64 val)
-+{
-+	struct mt7915_dev *dev = data;
-+	struct mt7915_phy *ext_phy = mt7915_ext_phy(dev);
-+	mt7915_mcu_set_txpower_level(&dev->phy, val);
-+	if (ext_phy)
-+		mt7915_mcu_set_txpower_level(ext_phy, val);
-+
-+	return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
-+			 mt7915_txpower_level_set, "%lld\n");
-+
-+/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
-+static int
-+mt7915_wa_set(void *data, u64 val)
-+{
-+	struct mt7915_dev *dev = data;
-+	u32 arg1, arg2, arg3;
-+
-+	arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
-+	arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
-+	arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
-+
-+	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), arg1, arg2, arg3, false);
-+
-+	return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_set, NULL, mt7915_wa_set,
-+			 "0x%llx\n");
-+/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_query */
-+static int
-+mt7915_wa_query(void *data, u64 val)
-+{
-+	struct mt7915_dev *dev = data;
-+	u32 arg1, arg2, arg3;
-+
-+	arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
-+	arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
-+	arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
-+
-+	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(QUERY), arg1, arg2, arg3, false);
-+
-+	return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_query, NULL, mt7915_wa_query,
-+					 "0x%llx\n");
-+/* set wa debug level
-+     usage:
-+	echo 0x[arg] > fw_wa_debug
-+	bit0 : DEBUG_WIFI_TX
-+	bit1 : DEBUG_CMD_EVENT
-+	bit2 : DEBUG_RED
-+	bit3 : DEBUG_WARN
-+	bit4 : DEBUG_WIFI_RX
-+	bit5 : DEBUG_TIME_STAMP
-+	bit6 : DEBUG_TX_FREE_DONE_EVENT
-+	bit12 : DEBUG_WIFI_TXD */
-+static int
-+mt7915_wa_debug(void *data, u64 val)
-+{
-+	struct mt7915_dev *dev = data;
-+	u32 arg;
-+
-+	arg = FIELD_GET(GENMASK_ULL(15, 0), val);
-+
-+	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(DEBUG), arg, 0, 0, false);
-+
-+	return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
-+			 "0x%llx\n");
-+
-+int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	u32 device_id = (dev->mt76.rev) >> 16;
-+	int i = 0;
-+
-+	for (i = 0; i < ARRAY_SIZE(dbg_reg_s); i++) {
-+		if (device_id == dbg_reg_s[i].id) {
-+			dev->dbg_reg = &dbg_reg_s[i];
-+			break;
-+		}
-+	}
-+
-+	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
-+
-+	debugfs_create_file("fw_debug_module", 0600, dir, dev,
-+			    &fops_fw_debug_module);
-+	debugfs_create_file("fw_debug_level", 0600, dir, dev,
-+			    &fops_fw_debug_level);
-+
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "sta_info", dir,
-+				    mt7915_sta_info);
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
-+				    mt7915_wtbl_read);
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "uwtbl_info", dir,
-+				    mt7915_uwtbl_read);
-+
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "tr_info", dir,
-+				    mt7915_trinfo_read);
-+
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "drr_info", dir,
-+				    mt7915_drr_info);
-+
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "ple_info", dir,
-+				    mt7915_pleinfo_read);
-+
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "pse_info", dir,
-+				    mt7915_pseinfo_read);
-+
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info0", dir,
-+				    mt7915_mibinfo_band0);
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info1", dir,
-+				    mt7915_mibinfo_band1);
-+
-+	debugfs_create_u32("token_idx", 0600, dir, &dev->dbg.token_idx);
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "token", dir,
-+				    mt7915_token_read);
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "token_txd", dir,
-+				    mt7915_token_txd_read);
-+
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "amsdu_info", dir,
-+				    mt7915_amsduinfo_read);
-+
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info0", dir,
-+				    mt7915_agginfo_read_band0);
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info1", dir,
-+				    mt7915_agginfo_read_band1);
-+
-+	debugfs_create_file("tx_amsdu", 0600, dir, dev, &fops_tx_amsdu);
-+
-+	debugfs_create_file("fw_wa_query", 0600, dir, dev, &fops_wa_query);
-+	debugfs_create_file("fw_wa_set", 0600, dir, dev, &fops_wa_set);
-+	debugfs_create_file("fw_wa_debug", 0600, dir, dev, &fops_wa_debug);
-+
-+	debugfs_create_file("red_en", 0600, dir, dev,
-+			    &fops_red_en);
-+	debugfs_create_file("red_show_sta", 0600, dir, dev,
-+			    &fops_red_show_sta);
-+	debugfs_create_file("red_target_dly", 0600, dir, dev,
-+			    &fops_red_target_dly);
-+
-+	debugfs_create_file("txpower_level", 0400, dir, dev,
-+			    &fops_txpower_level);
-+
-+	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
-+
-+	return 0;
-+}
-+#endif
-diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
-new file mode 100644
-index 0000000..143dae2
---- /dev/null
-+++ b/mt7915/mtk_mcu.c
-@@ -0,0 +1,51 @@
-+#include <linux/firmware.h>
-+#include <linux/fs.h>
-+#include<linux/inet.h>
-+#include "mt7915.h"
-+#include "mcu.h"
-+#include "mac.h"
-+
-+int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_sku_val {
-+		u8 format_id;
-+		u8 val;
-+		u8 band;
-+		u8 _rsv;
-+	} __packed req = {
-+		.format_id = 1,
-+		.band = phy->mt76->band_idx,
-+		.val = !!drop_level,
-+	};
-+	int ret;
-+
-+	ret = mt76_mcu_send_msg(&dev->mt76,
-+				MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
-+				sizeof(req), true);
-+	if (ret)
-+		return ret;
-+
-+	req.format_id = 2;
-+	if ((drop_level > 90 && drop_level < 100) || !drop_level)
-+		req.val = 0;
-+	else if (drop_level > 60 && drop_level <= 90)
-+		/* reduce Pwr for 1 dB. */
-+		req.val = 2;
-+	else if (drop_level > 30 && drop_level <= 60)
-+		/* reduce Pwr for 3 dB. */
-+		req.val = 6;
-+	else if (drop_level > 15 && drop_level <= 30)
-+		/* reduce Pwr for 6 dB. */
-+		req.val = 12;
-+	else if (drop_level > 9 && drop_level <= 15)
-+		/* reduce Pwr for 9 dB. */
-+		req.val = 18;
-+	else if (drop_level > 0 && drop_level <= 9)
-+		/* reduce Pwr for 12 dB. */
-+		req.val = 24;
-+
-+	return mt76_mcu_send_msg(&dev->mt76,
-+				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
-+				 sizeof(req), true);
-+}
-diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a10..3d51d9e 100644
---- a/tools/fwlog.c
-+++ b/tools/fwlog.c
-@@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
- 	return path;
- }
- 
--static int mt76_set_fwlog_en(const char *phyname, bool en)
-+static int mt76_set_fwlog_en(const char *phyname, bool en, char *val)
- {
- 	FILE *f = fopen(debugfs_path(phyname, "fw_debug_bin"), "w");
- 
-@@ -35,7 +35,13 @@ static int mt76_set_fwlog_en(const char *phyname, bool en)
- 		return 1;
- 	}
- 
--	fprintf(f, "7");
-+	if (en && val)
-+		fprintf(f, "%s", val);
-+	else if (en)
-+		fprintf(f, "7");
-+	else
-+		fprintf(f, "0");
-+
- 	fclose(f);
- 
- 	return 0;
-@@ -76,6 +82,7 @@ static void handle_signal(int sig)
- 
- int mt76_fwlog(const char *phyname, int argc, char **argv)
- {
-+#define BUF_SIZE 1504
- 	struct sockaddr_in local = {
- 		.sin_family = AF_INET,
- 		.sin_addr.s_addr = INADDR_ANY,
-@@ -84,9 +91,10 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
- 		.sin_family = AF_INET,
- 		.sin_port = htons(55688),
- 	};
--	char buf[1504];
-+	char *buf = calloc(BUF_SIZE, sizeof(char));
-+	FILE *logfile = NULL;
- 	int ret = 0;
--	int yes = 1;
-+	/* int yes = 1; */
- 	int s, fd;
- 
- 	if (argc < 1) {
-@@ -99,19 +107,28 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
- 		return 1;
- 	}
- 
-+	if (argc == 3) {
-+		fprintf(stdout, "start logging to file %s\n", argv[2]);
-+		logfile = fopen(argv[2], "wb");
-+		if (!logfile) {
-+			perror("fopen");
-+			return 1;
-+		}
-+	}
-+
- 	s = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
- 	if (s < 0) {
- 		perror("socket");
- 		return 1;
- 	}
- 
--	setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes));
-+	/* setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes)); */
- 	if (bind(s, (struct sockaddr *)&local, sizeof(local)) < 0) {
- 		perror("bind");
- 		return 1;
- 	}
- 
--	if (mt76_set_fwlog_en(phyname, true))
-+	if (mt76_set_fwlog_en(phyname, true, argv[1]))
- 		return 1;
- 
- 	fd = open(debugfs_path(phyname, "fwlog_data"), O_RDONLY);
-@@ -145,8 +162,8 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
- 		if (!r)
- 			continue;
- 
--		if (len > sizeof(buf)) {
--			fprintf(stderr, "Length error: %d > %d\n", len, (int)sizeof(buf));
-+		if (len > BUF_SIZE) {
-+			fprintf(stderr, "Length error: %d > %d\n", len, BUF_SIZE);
- 			ret = 1;
- 			break;
- 		}
-@@ -164,14 +181,19 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
- 			break;
- 		}
- 
--		/* send buf */
--		sendto(s, buf, len, 0, (struct sockaddr *)&remote, sizeof(remote));
-+		if (logfile)
-+			fwrite(buf, 1, len, logfile);
-+		else
-+			/* send buf */
-+			sendto(s, buf, len, 0, (struct sockaddr *)&remote, sizeof(remote));
- 	}
- 
- 	close(fd);
- 
- out:
--	mt76_set_fwlog_en(phyname, false);
-+	mt76_set_fwlog_en(phyname, false, NULL);
-+	free(buf);
-+	fclose(logfile);
- 
- 	return ret;
- }
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
deleted file mode 100644
index ce4f6ae..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ /dev/null
@@ -1,918 +0,0 @@
-From 26caea08dc572c3d938aeb8c9471e857f865f103 Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
-
----
- mt76_connac_mcu.h |   2 +
- mt7915/Makefile   |   4 +-
- mt7915/init.c     |  39 ++++
- mt7915/mcu.c      | 111 ++++++++++++
- mt7915/mcu.h      |  76 ++++++++
- mt7915/mt7915.h   |  20 ++
- mt7915/vendor.c   | 452 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h   |  60 ++++++
- 8 files changed, 762 insertions(+), 2 deletions(-)
- create mode 100644 mt7915/vendor.c
- create mode 100644 mt7915/vendor.h
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9d0d613..26e7cf6 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -998,6 +998,7 @@ enum {
- 	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
- 	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
- 	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
-+	MCU_EXT_EVENT_CSI_REPORT = 0xc2,
- };
- 
- /* unified event table */
-@@ -1191,6 +1192,7 @@ enum {
- 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
- 	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
- 	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
-+	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- };
- 
- enum {
-diff --git a/mt7915/Makefile b/mt7915/Makefile
-index a42866e..14ce98a 100644
---- a/mt7915/Makefile
-+++ b/mt7915/Makefile
-@@ -1,9 +1,9 @@
- # SPDX-License-Identifier: ISC
--
-+EXTRA_CFLAGS += -DCONFIG_MTK_VENDOR
- obj-$(CONFIG_MT7915E) += mt7915e.o
- 
- mt7915e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
--	     debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o
-+	     debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o vendor.o
- 
- mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
- mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
-diff --git a/mt7915/init.c b/mt7915/init.c
-index b23a2fb..844a92f 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -658,6 +658,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
- 	/* init wiphy according to mphy and phy */
- 	mt7915_init_wiphy(phy);
- 
-+#ifdef CONFIG_MTK_VENDOR
-+	INIT_LIST_HEAD(&phy->csi.csi_list);
-+	spin_lock_init(&phy->csi.csi_lock);
-+	mt7915_vendor_register(phy);
-+#endif
-+
- 	ret = mt76_register_phy(mphy, true, mt76_rates,
- 				ARRAY_SIZE(mt76_rates));
- 	if (ret)
-@@ -1164,6 +1170,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
- 	}
- }
- 
-+#ifdef CONFIG_MTK_VENDOR
-+static int mt7915_unregister_features(struct mt7915_phy *phy)
-+{
-+	struct csi_data *c, *tmp_c;
-+
-+	spin_lock_bh(&phy->csi.csi_lock);
-+	phy->csi.enable = 0;
-+
-+	list_for_each_entry_safe(c, tmp_c, &phy->csi.csi_list, node) {
-+		list_del(&c->node);
-+		kfree(c);
-+	}
-+	spin_unlock_bh(&phy->csi.csi_lock);
-+
-+
-+	return 0;
-+}
-+#endif
-+
- static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
- {
- 	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1172,6 +1197,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
- 	if (!phy)
- 		return;
- 
-+#ifdef CONFIG_MTK_VENDOR
-+	mt7915_unregister_features(phy);
-+#endif
-+
- 	mt7915_unregister_thermal(phy);
- 	mt76_unregister_phy(mphy);
- 	ieee80211_free_hw(mphy->hw);
-@@ -1184,6 +1213,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
- 	mt7915_dma_cleanup(dev);
- 	tasklet_disable(&dev->irq_tasklet);
- 
-+#ifdef CONFIG_MTK_VENDOR
-+	mt7915_unregister_features(&dev->phy);
-+#endif
-+
- 	if (is_mt7986(&dev->mt76))
- 		mt7986_wmac_disable(dev);
- }
-@@ -1224,6 +1257,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
- 	dev->mt76.test_ops = &mt7915_testmode_ops;
- #endif
- 
-+#ifdef CONFIG_MTK_VENDOR
-+	INIT_LIST_HEAD(&dev->phy.csi.csi_list);
-+	spin_lock_init(&dev->phy.csi.csi_lock);
-+	mt7915_vendor_register(&dev->phy);
-+#endif
-+
- 	ret = mt76_register_device(&dev->mt76, true, mt76_rates,
- 				   ARRAY_SIZE(mt76_rates));
- 	if (ret)
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 644e6a8..788f3fb 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
- module_param(sr_scene_detect, bool, 0644);
- MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
- 
-+#ifdef CONFIG_MTK_VENDOR
-+static int mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb);
-+#endif
-+
- static u8
- mt7915_mcu_get_sta_nss(u16 mcs_map)
- {
-@@ -371,6 +375,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
- 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
- 		mt7915_mcu_rx_log_message(dev, skb);
- 		break;
-+#ifdef CONFIG_MTK_VENDOR
-+	case MCU_EXT_EVENT_CSI_REPORT:
-+		mt7915_mcu_report_csi(dev, skb);
-+		break;
-+#endif
- 	case MCU_EXT_EVENT_BCC_NOTIFY:
- 		mt7915_mcu_rx_bcc_notify(dev, skb);
- 		break;
-@@ -3775,6 +3784,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
- 				 &req, sizeof(req), true);
- }
- 
-+#ifdef CONFIG_MTK_VENDOR
-+int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
-+			u8 cfg, u8 v1, u32 v2, u8 *mac_addr)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_mcu_csi req = {
-+		.band = phy != &dev->phy,
-+		.mode = mode,
-+		.cfg = cfg,
-+		.v1 = v1,
-+		.v2 = cpu_to_le32(v2),
-+	};
-+
-+	if (is_valid_ether_addr(mac_addr))
-+		ether_addr_copy(req.mac_addr, mac_addr);
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CSI_CTRL), &req,
-+				 sizeof(req), false);
-+}
-+
-+static int
-+mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
-+{
-+	struct mt76_connac2_mcu_rxd *rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
-+	struct mt7915_phy *phy = &dev->phy;
-+	struct mt7915_mcu_csi_report *cr;
-+	struct csi_data *csi;
-+	int len, i;
-+
-+	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
-+
-+	len = le16_to_cpu(rxd->len) - sizeof(struct mt76_connac2_mcu_rxd) + 24;
-+	if (len < sizeof(*cr))
-+		return -EINVAL;
-+
-+	cr = (struct mt7915_mcu_csi_report *)skb->data;
-+
-+	if (phy->csi.interval &&
-+	    le32_to_cpu(cr->ts) < phy->csi.last_record + phy->csi.interval)
-+		return 0;
-+
-+	csi = kzalloc(sizeof(*csi), GFP_KERNEL);
-+	if (!csi)
-+		return -ENOMEM;
-+
-+#define SET_CSI_DATA(_field)	csi->_field = le32_to_cpu(cr->_field)
-+	SET_CSI_DATA(ch_bw);
-+	SET_CSI_DATA(rssi);
-+	SET_CSI_DATA(snr);
-+	SET_CSI_DATA(data_num);
-+	SET_CSI_DATA(data_bw);
-+	SET_CSI_DATA(pri_ch_idx);
-+	SET_CSI_DATA(info);
-+	SET_CSI_DATA(rx_mode);
-+	SET_CSI_DATA(h_idx);
-+	SET_CSI_DATA(ts);
-+
-+	SET_CSI_DATA(band);
-+	if (csi->band && !phy->mt76->band_idx)
-+		phy = mt7915_ext_phy(dev);
-+#undef SET_CSI_DATA
-+
-+	for (i = 0; i < csi->data_num; i++) {
-+		csi->data_i[i] = le16_to_cpu(cr->data_i[i]);
-+		csi->data_q[i] = le16_to_cpu(cr->data_q[i]);
-+	}
-+
-+	memcpy(csi->ta, cr->ta, ETH_ALEN);
-+	csi->tx_idx = le32_get_bits(cr->trx_idx, GENMASK(31, 16));
-+	csi->rx_idx = le32_get_bits(cr->trx_idx, GENMASK(15, 0));
-+
-+	INIT_LIST_HEAD(&csi->node);
-+	spin_lock_bh(&phy->csi.csi_lock);
-+
-+	if (!phy->csi.enable) {
-+		kfree(csi);
-+		spin_unlock_bh(&phy->csi.csi_lock);
-+		return 0;
-+	}
-+
-+	list_add_tail(&csi->node, &phy->csi.csi_list);
-+	phy->csi.count++;
-+
-+	if (phy->csi.count > CSI_MAX_BUF_NUM) {
-+		struct csi_data *old;
-+
-+		old = list_first_entry(&phy->csi.csi_list,
-+				       struct csi_data, node);
-+
-+		list_del(&old->node);
-+		kfree(old);
-+		phy->csi.count--;
-+	}
-+
-+	if (csi->h_idx & BIT(15)) /* last chain */
-+		phy->csi.last_record = csi->ts;
-+	spin_unlock_bh(&phy->csi.csi_lock);
-+
-+	return 0;
-+}
-+#endif
-+
- #ifdef MTK_DEBUG
- int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
- {
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aa89106..f3dedd5 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -532,4 +532,80 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
- 	return txpower;
- }
- 
-+#ifdef CONFIG_MTK_VENDOR
-+struct mt7915_mcu_csi {
-+	u8 band;
-+	u8 mode;
-+	u8 cfg;
-+	u8 v1;
-+	__le32 v2;
-+	u8 mac_addr[ETH_ALEN];
-+	u8 _rsv[34];
-+} __packed;
-+
-+struct csi_tlv {
-+	__le32 tag;
-+	__le32 len;
-+} __packed;
-+
-+#define CSI_MAX_COUNT	256
-+#define CSI_MAX_BUF_NUM	3000
-+
-+struct mt7915_mcu_csi_report {
-+	struct csi_tlv _t0;
-+	__le32 ver;
-+	struct csi_tlv _t1;
-+	__le32 ch_bw;
-+	struct csi_tlv _t2;
-+	__le32 rssi;
-+	struct csi_tlv _t3;
-+	__le32 snr;
-+	struct csi_tlv _t4;
-+	__le32 band;
-+	struct csi_tlv _t5;
-+	__le32 data_num;
-+	struct csi_tlv _t6;
-+	__le16 data_i[CSI_MAX_COUNT];
-+	struct csi_tlv _t7;
-+	__le16 data_q[CSI_MAX_COUNT];
-+	struct csi_tlv _t8;
-+	__le32 data_bw;
-+	struct csi_tlv _t9;
-+	__le32 pri_ch_idx;
-+	struct csi_tlv _t10;
-+	u8 ta[8];
-+	struct csi_tlv _t11;
-+	__le32 info;
-+	struct csi_tlv _t12;
-+	__le32 rx_mode;
-+	struct csi_tlv _t17;
-+	__le32 h_idx;
-+	struct csi_tlv _t18;
-+	__le32 trx_idx;
-+	struct csi_tlv _t19;
-+	__le32 ts;
-+} __packed;
-+
-+struct csi_data {
-+	u8 ch_bw;
-+	u16 data_num;
-+	s16 data_i[CSI_MAX_COUNT];
-+	s16 data_q[CSI_MAX_COUNT];
-+	u8 band;
-+	s8 rssi;
-+	u8 snr;
-+	u32 ts;
-+	u8 data_bw;
-+	u8 pri_ch_idx;
-+	u8 ta[ETH_ALEN];
-+	u32 info;
-+	u8 rx_mode;
-+	u32 h_idx;
-+	u16 tx_idx;
-+	u16 rx_idx;
-+
-+	struct list_head node;
-+};
-+#endif
-+
- #endif
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index afe2ec7..53e1315 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -293,6 +293,20 @@ struct mt7915_phy {
- 		u8 spe_idx;
- 	} test;
- #endif
-+
-+#ifdef CONFIG_MTK_VENDOR
-+	struct {
-+		struct list_head csi_list;
-+		spinlock_t csi_lock;
-+		u32 count;
-+		bool mask;
-+		bool reorder;
-+		bool enable;
-+
-+		u32 interval;
-+		u32 last_record;
-+	} csi;
-+#endif
- };
- 
- struct mt7915_dev {
-@@ -674,6 +688,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 			 bool pci, int *irq);
- 
-+#ifdef CONFIG_MTK_VENDOR
-+void mt7915_vendor_register(struct mt7915_phy *phy);
-+int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
-+			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
-+#endif
-+
- #ifdef MTK_DEBUG
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
- int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-new file mode 100644
-index 0000000..98fd9c2
---- /dev/null
-+++ b/mt7915/vendor.c
-@@ -0,0 +1,452 @@
-+// SPDX-License-Identifier: ISC
-+/*
-+ * Copyright (C) 2020, MediaTek Inc. All rights reserved.
-+ */
-+
-+#include <net/netlink.h>
-+
-+#include "mt7915.h"
-+#include "mcu.h"
-+#include "vendor.h"
-+
-+static const struct nla_policy
-+csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
-+	[MTK_VENDOR_ATTR_CSI_CTRL_CFG] = {.type = NLA_NESTED },
-+	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR] = { .type = NLA_NESTED },
-+	[MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL] = { .type = NLA_U32 },
-+	[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM] = { .type = NLA_U16 },
-+	[MTK_VENDOR_ATTR_CSI_CTRL_DATA] = { .type = NLA_NESTED },
-+};
-+
-+struct csi_null_tone {
-+	u8 start;
-+	u8 end;
-+};
-+
-+struct csi_reorder{
-+	u8 dest;
-+	u8 start;
-+	u8 end;
-+};
-+
-+struct csi_mask {
-+	struct csi_null_tone null[10];
-+	u8 pilot[8];
-+	struct csi_reorder ro[3];
-+};
-+
-+static const struct csi_mask csi_mask_groups[] = {
-+	/* OFDM */
-+	{ .null = { { 0 }, { 27, 37 } },
-+	  .ro = { {0, 0, 63} },
-+	},
-+	{ .null = { { 0, 69 }, { 96 }, { 123, 127 } },
-+	  .ro = { { 0, 96 }, { 38, 70, 95 }, { 1, 97, 122 } },
-+	},
-+	{ .null = { { 0, 5 }, { 32 }, { 59, 127 } },
-+	  .ro = { { 0, 32 }, { 38, 6, 31 }, { 1, 33, 58 } },
-+	},
-+	{ .null = { { 0, 5 }, { 32 }, { 59, 69 }, { 96 }, { 123, 127 } },
-+	  .ro = { { 0, 0, 127 } },
-+	},
-+	{ .null = { { 0, 133 }, { 160 }, { 187, 255 } },
-+	  .ro = { { 0, 160 }, { 1, 161, 186 }, { 38, 134, 159 } },
-+	},
-+	{ .null = { { 0, 197 }, { 224 }, { 251, 255 } },
-+	  .ro = { { 0, 224 }, { 1, 225, 250 }, { 38, 198, 223 } },
-+	},
-+	{ .null = { { 0, 5 }, { 32 }, { 59, 255 } },
-+	  .ro = { { 0, 32 }, { 1, 33, 58 }, { 38, 6, 31 } },
-+	},
-+	{ .null = { { 0, 69 }, { 96 }, { 123, 255 } },
-+	  .ro = { { 0, 96 }, { 1, 97, 122 }, { 38, 70, 95 } },
-+	},
-+	{ .null = { { 0, 133 }, { 160 }, { 187, 197 }, { 224 }, { 251, 255 } },
-+	  .ro = { { 0, 192 }, { 2, 198, 250 }, { 74, 134, 186 } },
-+	},
-+	{ .null = { { 0, 5 }, { 32 }, { 59, 69 }, { 96 }, { 123, 255 } },
-+	  .ro = { { 0, 64 }, { 2, 70, 122 }, { 74, 6, 58 } },
-+	},
-+	{ .null = { { 0, 5 }, { 32 }, { 59, 69 }, { 96 }, { 123, 133 },
-+		    { 160 }, { 187, 197 }, { 224 }, { 251, 255 } },
-+	  .ro = { { 0, 0, 255 } },
-+	},
-+
-+	/* HT/VHT */
-+	{ .null = { { 0 }, { 29, 35 } },
-+	  .pilot = { 7, 21, 43, 57 },
-+	  .ro = { { 0, 0, 63 } },
-+	},
-+	{ .null = { { 0, 67 }, { 96 }, { 125, 127 } },
-+	  .pilot = { 75, 89, 103, 117 },
-+	  .ro = { { 0, 96 }, { 36, 68, 95 }, { 1, 97, 124 } },
-+	},
-+	{ .null = { { 0, 3 }, { 32 }, { 61, 127 } },
-+	  .pilot = { 11, 25, 39, 53 },
-+	  .ro = { { 0, 32 }, { 36, 4, 31 }, { 1, 33, 60 } },
-+	},
-+	{ .null = { { 0, 1 }, { 59, 69 }, { 127 } },
-+	  .pilot = { 11, 25, 53, 75, 103, 117 },
-+	  .ro = { { 0, 0, 127 } },
-+	},
-+	{ .null = { { 0, 131 }, { 160 }, { 189, 255 } },
-+	  .pilot = { 139, 153, 167, 181 },
-+	  .ro = { { 0, 160 }, { 1, 161, 188 }, { 36, 132, 159 } },
-+	},
-+	{ .null = { { 0, 195 }, { 224 }, { 253 }, { 255 } },
-+	  .pilot = { 203, 217, 231, 245 },
-+	  .ro = { { 0, 224 }, { 1, 225, 252 }, { 36, 196, 223 } },
-+	},
-+	{ .null = { { 0, 3 }, { 32 }, { 61, 255 } },
-+	  .pilot = { 11, 25, 39, 53 },
-+	  .ro = { { 0, 32 }, { 1, 33, 60 }, { 36, 4, 31 } },
-+	},
-+	{ .null = { { 0, 67 }, { 96 }, { 125, 255 } },
-+	  .pilot = { 75, 89, 103, 117 },
-+	  .ro = { { 0, 96 }, { 1, 97, 124 }, { 36, 68, 95 } },
-+	},
-+	{ .null = { { 0, 133 }, { 191, 193 }, { 251, 255 } },
-+	  .pilot = { 139, 167, 181, 203, 217, 245 },
-+	  .ro = { { 0, 192 }, { 2, 194, 250 }, { 70, 134, 190 } },
-+	},
-+	{ .null = { { 0, 5 }, { 63, 65 }, { 123, 127 } },
-+	  .pilot = { 11, 39, 53, 75, 89, 117 },
-+	  .ro = { { 0, 64 }, { 2, 66, 122 }, { 70, 6, 62 } },
-+	},
-+	{ .null = { { 0, 1 }, { 123, 133 }, { 255 } },
-+	  .pilot = { 11, 39, 75, 103, 153, 181, 217, 245 },
-+	  .ro = { { 0, 0, 255 } },
-+	},
-+
-+	/* HE */
-+	{ .null = { { 0 }, { 31, 33 } },
-+	  .pilot = { 12, 29, 35, 52 },
-+	  .ro = { { 0, 0, 63 } },
-+	},
-+	{ .null = { { 30, 34 }, { 96 } },
-+	  .pilot = { 4, 21, 43, 60, 70, 87, 105, 122 },
-+	  .ro = { { 0, 96 }, { 34, 66, 95 }, { 1, 97, 126 } },
-+	},
-+	{ .null = { { 32 }, { 94, 98 } },
-+	  .pilot = { 6, 23, 41, 58, 68, 85, 107, 124 },
-+	  .ro = { { 0, 32 }, { 34, 2, 31 }, { 1, 31, 62 } },
-+	},
-+	{ .null = { { 0 }, { 62, 66 } },
-+	  .pilot = { 9, 26, 36, 53, 75, 92, 102, 119 },
-+	  .ro = { { 0, 0, 127 } },
-+	},
-+	{ .null = { { 30, 34 }, { 160 } },
-+	  .pilot = { 4, 21, 43, 60, 137, 154, 166, 183 },
-+	  .ro = { { 0, 160 }, { 1, 161, 190 }, { 34, 130, 159 } },
-+	},
-+	{ .null = { { 94, 98 }, { 224 } },
-+	  .pilot = { 68, 85, 107, 124, 201, 218, 230, 247 },
-+	  .ro = { { 0, 224 }, { 1, 225, 254 }, { 34, 194, 223 } },
-+	},
-+	{ .null = { { 32 }, { 158, 162 } },
-+	  .pilot = { 9, 26, 38, 55, 132, 149, 171, 188 },
-+	  .ro = { { 0, 32 }, { 1, 33, 62 }, { 34, 2, 31 } },
-+	},
-+	{ .null = { { 96 }, { 222, 226 } },
-+	  .pilot = { 73, 90, 102, 119, 196, 213, 235, 252 },
-+	  .ro = { { 0, 96 }, { 1, 97, 126 }, { 34, 66, 95 } },
-+	},
-+	{ .null = { { 62, 66 }, { 192 } },
-+	  .pilot = { 36, 53, 75, 92, 169, 186, 198, 215 },
-+	  .ro = { { 0, 192 }, { 1, 193, 253 }, { 67, 131, 191 } },
-+	},
-+	{ .null = { { 64 }, { 190, 194 } },
-+	  .pilot = { 41, 58, 70, 87, 164, 181, 203, 220 },
-+	  .ro = { { 0, 64 }, { 1, 65, 125 }, { 67, 3, 63 } },
-+	},
-+	{ .null = { { 0 }, { 126, 130 } },
-+	  .pilot = { 6, 23, 100, 117, 139, 156, 233, 250 },
-+	  .ro = { { 0, 0, 255 } },
-+	},
-+};
-+
-+static inline u8 csi_group_idx(u8 mode, u8 ch_bw, u8 data_bw, u8 pri_ch_idx)
-+{
-+	if (ch_bw < 2 || data_bw < 1)
-+		return mode * 11 + ch_bw * ch_bw + pri_ch_idx;
-+	else
-+		return mode * 11 + ch_bw * ch_bw + (data_bw + 1) * 2 + pri_ch_idx;
-+}
-+
-+static int mt7915_vendor_csi_ctrl(struct wiphy *wiphy,
-+				  struct wireless_dev *wdev,
-+				  const void *data,
-+				  int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_CSI_CTRL];
-+	int err;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_CSI_CTRL_MAX, data, data_len,
-+			csi_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (tb[MTK_VENDOR_ATTR_CSI_CTRL_CFG]) {
-+		u8 mode = 0, type = 0, v1 = 0, v2 = 0;
-+		u8 mac_addr[ETH_ALEN] = {};
-+		struct nlattr *cur;
-+		int rem;
-+
-+		nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_CSI_CTRL_CFG], rem) {
-+			switch(nla_type(cur)) {
-+			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE:
-+				mode = nla_get_u8(cur);
-+				break;
-+			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE:
-+				type = nla_get_u8(cur);
-+				break;
-+			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1:
-+				v1 = nla_get_u8(cur);
-+				break;
-+			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2:
-+				v2 = nla_get_u8(cur);
-+				break;
-+			default:
-+				return -EINVAL;
-+			};
-+		}
-+
-+		if (tb[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR]) {
-+			int idx = 0;
-+
-+			nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR], rem) {
-+				mac_addr[idx++] = nla_get_u8(cur);
-+			}
-+		}
-+
-+		mt7915_mcu_set_csi(phy, mode, type, v1, v2, mac_addr);
-+
-+		spin_lock_bh(&phy->csi.csi_lock);
-+
-+		phy->csi.enable = !!mode;
-+
-+		if (mode == 2 && type == 5) {
-+			if (v1 >= 1)
-+				phy->csi.mask = 1;
-+			if (v1 == 2)
-+				phy->csi.reorder = 1;
-+		}
-+
-+		/* clean up old csi stats */
-+		if ((mode == 0 || mode == 2) && !list_empty(&phy->csi.csi_list)) {
-+			struct csi_data *c, *tmp_c;
-+
-+			list_for_each_entry_safe(c, tmp_c, &phy->csi.csi_list,
-+						 node) {
-+				list_del(&c->node);
-+				kfree(c);
-+				phy->csi.count--;
-+			}
-+		} else if (mode == 1) {
-+			phy->csi.last_record = 0;
-+		}
-+
-+		spin_unlock_bh(&phy->csi.csi_lock);
-+	}
-+
-+	if (tb[MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL])
-+		phy->csi.interval = nla_get_u32(tb[MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL]);
-+
-+	return 0;
-+}
-+
-+static void
-+mt7915_vendor_csi_tone_mask(struct mt7915_phy *phy, struct csi_data *csi)
-+{
-+	static const u8 mode_map[] = {
-+		[MT_PHY_TYPE_OFDM] = 0,
-+		[MT_PHY_TYPE_HT] = 1,
-+		[MT_PHY_TYPE_VHT] = 1,
-+		[MT_PHY_TYPE_HE_SU] = 2,
-+	};
-+	const struct csi_mask *cmask;
-+	int i;
-+
-+	if (csi->rx_mode == MT_PHY_TYPE_CCK || !phy->csi.mask)
-+		return;
-+
-+	if (csi->data_bw == IEEE80211_STA_RX_BW_40)
-+		csi->pri_ch_idx /= 2;
-+
-+	cmask = &csi_mask_groups[csi_group_idx(mode_map[csi->rx_mode],
-+					       csi->ch_bw,
-+					       csi->data_bw,
-+					       csi->pri_ch_idx)];
-+
-+	for (i = 0; i < 10; i++) {
-+		const struct csi_null_tone *ntone = &cmask->null[i];
-+		u8 start = ntone->start;
-+		u8 end = ntone->end;
-+		int j;
-+
-+		if (!start && !end && i > 0)
-+			break;
-+
-+		if (!end)
-+			end = start;
-+
-+		for (j = start; j <= end; j++) {
-+			csi->data_i[j] = 0;
-+			csi->data_q[j] = 0;
-+		}
-+	}
-+
-+	for (i = 0; i < 8; i++) {
-+		u8 pilot = cmask->pilot[i];
-+
-+		if (!pilot)
-+			break;
-+
-+		csi->data_i[pilot] = 0;
-+		csi->data_q[pilot] = 0;
-+	}
-+
-+	if (!phy->csi.reorder)
-+		return;
-+
-+	for (i = 0; i < 3; i++) {
-+		const struct csi_reorder *ro = &cmask->ro[i];
-+		u8 dest = ro->dest;
-+		u8 start = ro->start;
-+		u8 end = ro->end;
-+
-+		if (!dest && !start && !end)
-+			break;
-+
-+		if (dest == start)
-+			continue;
-+
-+		if (end) {
-+			memmove(&csi->data_i[dest], &csi->data_i[start],
-+				end - start + 1);
-+			memmove(&csi->data_q[dest], &csi->data_q[start],
-+				end - start + 1);
-+		} else {
-+			csi->data_i[dest] = csi->data_i[start];
-+			csi->data_q[dest] = csi->data_q[start];
-+		}
-+	}
-+}
-+
-+static int
-+mt7915_vendor_csi_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			    struct sk_buff *skb, const void *data, int data_len,
-+			    unsigned long *storage)
-+{
-+#define RESERVED_SET	BIT(31)
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_CSI_CTRL];
-+	int err = 0;
-+
-+	if (*storage & RESERVED_SET) {
-+		if ((*storage & GENMASK(15, 0)) == 0)
-+			return -ENOENT;
-+		(*storage)--;
-+	}
-+
-+	if (data) {
-+		err = nla_parse(tb, MTK_VENDOR_ATTR_CSI_CTRL_MAX, data, data_len,
-+				csi_ctrl_policy, NULL);
-+		if (err)
-+			return err;
-+	}
-+
-+	if (!(*storage & RESERVED_SET) && tb[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM]) {
-+		*storage = nla_get_u16(tb[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM]);
-+		*storage |= RESERVED_SET;
-+	}
-+
-+	spin_lock_bh(&phy->csi.csi_lock);
-+
-+	if (!list_empty(&phy->csi.csi_list)) {
-+		struct csi_data *csi;
-+		void *a, *b;
-+		int i;
-+
-+		csi = list_first_entry(&phy->csi.csi_list, struct csi_data, node);
-+
-+		mt7915_vendor_csi_tone_mask(phy, csi);
-+
-+		a = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_CTRL_DATA);
-+
-+		if (nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_VER, 1) ||
-+		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_RSSI, csi->rssi) ||
-+		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_SNR, csi->snr) ||
-+		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_BW, csi->data_bw) ||
-+		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_CH_IDX, csi->pri_ch_idx) ||
-+		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_MODE, csi->rx_mode))
-+			goto out;
-+
-+		if (nla_put_u16(skb, MTK_VENDOR_ATTR_CSI_DATA_TX_ANT, csi->tx_idx) ||
-+		    nla_put_u16(skb, MTK_VENDOR_ATTR_CSI_DATA_RX_ANT, csi->rx_idx))
-+			goto out;
-+
-+		if (nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_INFO, csi->info) ||
-+		    nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_H_IDX, csi->h_idx) ||
-+		    nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_TS, csi->ts))
-+			goto out;
-+
-+		b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_TA);
-+			for (i = 0; i < ARRAY_SIZE(csi->ta); i++)
-+				if (nla_put_u8(skb, i, csi->ta[i]))
-+					goto out;
-+		nla_nest_end(skb, b);
-+
-+		b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_I);
-+			for (i = 0; i < ARRAY_SIZE(csi->data_i); i++)
-+				if (nla_put_u16(skb, i, csi->data_i[i]))
-+					goto out;
-+		nla_nest_end(skb, b);
-+
-+		b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_Q);
-+			for (i = 0; i < ARRAY_SIZE(csi->data_q); i++)
-+				if (nla_put_u16(skb, i, csi->data_q[i]))
-+					goto out;
-+		nla_nest_end(skb, b);
-+
-+		nla_nest_end(skb, a);
-+
-+		list_del(&csi->node);
-+		kfree(csi);
-+		phy->csi.count--;
-+
-+		err = phy->csi.count;
-+	}
-+out:
-+	spin_unlock_bh(&phy->csi.csi_lock);
-+
-+	return err;
-+}
-+
-+static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_csi_ctrl,
-+		.dumpit = mt7915_vendor_csi_ctrl_dump,
-+		.policy = csi_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_CSI_CTRL_MAX,
-+	}
-+};
-+
-+void mt7915_vendor_register(struct mt7915_phy *phy)
-+{
-+	phy->mt76->hw->wiphy->vendor_commands = mt7915_vendor_commands;
-+	phy->mt76->hw->wiphy->n_vendor_commands = ARRAY_SIZE(mt7915_vendor_commands);
-+}
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-new file mode 100644
-index 0000000..9d3db2a
---- /dev/null
-+++ b/mt7915/vendor.h
-@@ -0,0 +1,60 @@
-+#ifndef __MT7915_VENDOR_H
-+#define __MT7915_VENDOR_H
-+
-+#define MTK_NL80211_VENDOR_ID	0x0ce7
-+
-+enum mtk_nl80211_vendor_subcmds {
-+	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
-+};
-+
-+enum mtk_vendor_attr_csi_ctrl {
-+	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG,
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
-+	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
-+	MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
-+	MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
-+
-+	MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
-+
-+	MTK_VENDOR_ATTR_CSI_CTRL_DATA,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
-+	MTK_VENDOR_ATTR_CSI_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_csi_data {
-+	MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
-+	MTK_VENDOR_ATTR_CSI_DATA_PAD,
-+
-+	MTK_VENDOR_ATTR_CSI_DATA_VER,
-+	MTK_VENDOR_ATTR_CSI_DATA_TS,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSSI,
-+	MTK_VENDOR_ATTR_CSI_DATA_SNR,
-+	MTK_VENDOR_ATTR_CSI_DATA_BW,
-+	MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
-+	MTK_VENDOR_ATTR_CSI_DATA_TA,
-+	MTK_VENDOR_ATTR_CSI_DATA_I,
-+	MTK_VENDOR_ATTR_CSI_DATA_Q,
-+	MTK_VENDOR_ATTR_CSI_DATA_INFO,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
-+	MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
-+	MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
-+	MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
-+	MTK_VENDOR_ATTR_CSI_DATA_MODE,
-+	MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_CSI_DATA,
-+	MTK_VENDOR_ATTR_CSI_DATA_MAX =
-+		NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
-+};
-+
-+#endif
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
deleted file mode 100644
index ede5ef3..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
+++ /dev/null
@@ -1,549 +0,0 @@
-From c831c0051618899509eb479fe3c07033b906bb56 Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
-
----
- mt76_connac_mcu.h |   2 +
- mt7915/mac.c      |   4 +
- mt7915/main.c     |   3 +
- mt7915/mt7915.h   |  34 +++++
- mt7915/vendor.c   | 359 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h   |  38 +++++
- 6 files changed, 440 insertions(+)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 26e7cf6..841fcde 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1192,6 +1192,8 @@ enum {
- 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
- 	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
- 	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
-+	/* for vendor csi and air monitor */
-+	MCU_EXT_CMD_SMESH_CTRL = 0xae,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- };
- 
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 149527d..015f270 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -548,6 +548,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
- 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
- 			qos_ctl = *ieee80211_get_qos_ctl(hdr);
- 		}
-+#ifdef CONFIG_MTK_VENDOR
-+		if (phy->amnt_ctrl.enable)
-+			mt7915_vendor_amnt_fill_rx(phy, skb);
-+#endif
- 	} else {
- 		status->flag |= RX_FLAG_8023;
- 		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
-diff --git a/mt7915/main.c b/mt7915/main.c
-index f6edab6..04f248f 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -702,6 +702,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	if (ret)
- 		return ret;
- 
-+#ifdef CONFIG_MTK_VENDOR
-+	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
-+#endif
- 	return mt7915_mcu_add_rate_ctrl(dev, vif, sta, false);
- }
- 
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 53e1315..29082b6 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -249,6 +249,35 @@ struct mt7915_hif {
- 	int irq;
- };
- 
-+#ifdef CONFIG_MTK_VENDOR
-+#define MT7915_AIR_MONITOR_MAX_ENTRY	16
-+#define MT7915_AIR_MONITOR_MAX_GROUP	MT7915_AIR_MONITOR_MAX_ENTRY >> 2
-+
-+struct mt7915_air_monitor_group {
-+	bool enable;
-+	bool used[2];
-+};
-+
-+struct mt7915_air_monitor_entry {
-+	bool enable;
-+
-+	u8 group_idx;
-+	u8 group_used_idx;
-+	u8 muar_idx;
-+	u8 addr[ETH_ALEN];
-+	unsigned int last_seen;
-+	s8 rssi[4];
-+	struct ieee80211_sta *sta;
-+};
-+
-+struct mt7915_air_monitor_ctrl {
-+	u8 enable;
-+
-+	struct mt7915_air_monitor_group group[MT7915_AIR_MONITOR_MAX_GROUP];
-+	struct mt7915_air_monitor_entry entry[MT7915_AIR_MONITOR_MAX_ENTRY];
-+};
-+#endif
-+
- struct mt7915_phy {
- 	struct mt76_phy *mt76;
- 	struct mt7915_dev *dev;
-@@ -306,6 +335,8 @@ struct mt7915_phy {
- 		u32 interval;
- 		u32 last_record;
- 	} csi;
-+
-+	struct mt7915_air_monitor_ctrl amnt_ctrl;
- #endif
- };
- 
-@@ -692,6 +723,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- void mt7915_vendor_register(struct mt7915_phy *phy);
- int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
- 			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
-+void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
-+int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
-+				  struct ieee80211_sta *sta);
- #endif
- 
- #ifdef MTK_DEBUG
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2..b94d787 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -430,6 +430,353 @@ out:
- 	return err;
- }
- 
-+static const struct nla_policy
-+amnt_ctrl_policy[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL] = {
-+	[MTK_VENDOR_ATTR_AMNT_CTRL_SET] = {.type = NLA_NESTED },
-+	[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP] = { .type = NLA_NESTED },
-+};
-+
-+static const struct nla_policy
-+amnt_set_policy[NUM_MTK_VENDOR_ATTRS_AMNT_SET] = {
-+	[MTK_VENDOR_ATTR_AMNT_SET_INDEX] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_AMNT_SET_MACADDR] = { .type = NLA_NESTED },
-+};
-+
-+static const struct nla_policy
-+amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
-+	[MTK_VENDOR_ATTR_AMNT_DUMP_INDEX] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_AMNT_DUMP_LEN] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT] = { .type = NLA_NESTED },
-+};
-+
-+struct mt7915_amnt_data {
-+	u8 idx;
-+	u8 addr[ETH_ALEN];
-+	s8 rssi[4];
-+	u32 last_seen;
-+};
-+
-+struct mt7915_smesh {
-+	u8 band;
-+	u8 write;
-+	u8 enable;
-+	bool a2;
-+	bool a1;
-+	bool data;
-+	bool mgnt;
-+	bool ctrl;
-+} __packed;
-+
-+struct mt7915_smesh_event {
-+	u8 band;
-+	__le32 value;
-+} __packed;
-+
-+static int
-+mt7915_vendor_smesh_ctrl(struct mt7915_phy *phy, u8 write,
-+			 u8 enable, u32 *value)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_smesh req = {
-+		.band = phy != &dev->phy,
-+		.write = write,
-+		.enable = enable,
-+		.a2 = 1,
-+		.a1 = 1,
-+		.data = 1,
-+	};
-+	struct mt7915_smesh_event *res;
-+	struct sk_buff *skb;
-+	int ret = 0;
-+
-+	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(SMESH_CTRL),
-+					&req, sizeof(req), !write, &skb);
-+
-+	if (ret || write)
-+		return ret;
-+
-+	res = (struct mt7915_smesh_event *) skb->data;
-+
-+	if (!value)
-+		return -EINVAL;
-+
-+	*value = res->value;
-+
-+	dev_kfree_skb(skb);
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_vendor_amnt_muar(struct mt7915_phy *phy, u8 muar_idx, u8 *addr)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 mode;
-+		u8 force_clear;
-+		u8 clear_bitmap[8];
-+		u8 entry_count;
-+		u8 write;
-+		u8 band;
-+
-+		u8 index;
-+		u8 bssid;
-+		u8 addr[ETH_ALEN];
-+	} __packed req = {
-+		.entry_count = 1,
-+		.write = 1,
-+		.band = phy != &dev->phy,
-+		.index = muar_idx,
-+	};
-+
-+	ether_addr_copy(req.addr, addr);
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
-+				 sizeof(req), true);
-+}
-+
-+static int
-+mt7915_vendor_amnt_set_en(struct mt7915_phy *phy, u8 enable)
-+{
-+	u32 status;
-+	int ret;
-+
-+	ret = mt7915_vendor_smesh_ctrl(phy, 0, enable, &status);
-+	if (ret)
-+		return ret;
-+
-+	status = status & 0xff;
-+
-+	if (status == enable)
-+		return 0;
-+
-+	ret = mt7915_vendor_smesh_ctrl(phy, 1, enable, &status);
-+	if (ret)
-+		return ret;
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_vendor_amnt_set_addr(struct mt7915_phy *phy, u8 index, u8 *addr)
-+{
-+	struct mt7915_air_monitor_ctrl *amnt_ctrl = &phy->amnt_ctrl;
-+	struct mt7915_air_monitor_group *group;
-+	struct mt7915_air_monitor_entry *entry = &amnt_ctrl->entry[index];
-+	const u8 zero_addr[ETH_ALEN] = {};
-+	int enable = !ether_addr_equal(addr, zero_addr);
-+	int ret, i, j;
-+
-+	if (enable == 1 && entry->enable == 1) {
-+		ether_addr_copy(entry->addr, addr);
-+	} else if (enable == 1 && entry->enable == 0){
-+		for (i = 0; i < MT7915_AIR_MONITOR_MAX_GROUP; i++) {
-+			group = &(amnt_ctrl->group[i]);
-+			if (group->used[0] == 0)
-+				j = 0;
-+			else
-+				j = 1;
-+
-+			group->enable = 1;
-+			group->used[j] = 1;
-+			entry->enable = 1;
-+			entry->group_idx = i;
-+			entry->group_used_idx = j;
-+			entry->muar_idx = 32 + 2 * i + 2 * i + 2 * j;
-+			ether_addr_copy(entry->addr, addr);
-+			break;
-+		}
-+	} else {
-+		group = &(amnt_ctrl->group[entry->group_idx]);
-+
-+		group->used[entry->group_used_idx] = 0;
-+		if (group->used[0] == 0 && group->used[1] == 0)
-+			group->enable = 0;
-+
-+		entry->enable = 0;
-+		ether_addr_copy(entry->addr, addr);
-+	}
-+
-+	amnt_ctrl->enable &= ~(1 << entry->group_idx);
-+	amnt_ctrl->enable |= entry->enable << entry->group_idx;
-+	ret = mt7915_vendor_amnt_muar(phy, entry->muar_idx, addr);
-+	if (ret)
-+		return ret;
-+
-+	return mt7915_vendor_amnt_set_en(phy, amnt_ctrl->enable);
-+}
-+
-+void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb)
-+{
-+	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
-+	struct mt7915_air_monitor_ctrl *ctrl = &phy->amnt_ctrl;
-+	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
-+	__le16 fc = hdr->frame_control;
-+	u8 addr[ETH_ALEN];
-+	int i;
-+
-+	if (!ieee80211_has_fromds(fc))
-+		ether_addr_copy(addr, hdr->addr2);
-+	else if (ieee80211_has_tods(fc))
-+		ether_addr_copy(addr, hdr->addr4);
-+	else
-+		ether_addr_copy(addr, hdr->addr3);
-+
-+	for (i = 0; i < MT7915_AIR_MONITOR_MAX_ENTRY; i++) {
-+		struct mt7915_air_monitor_entry *entry;
-+
-+		if (ether_addr_equal(addr, ctrl->entry[i].addr)) {
-+			entry = &ctrl->entry[i];
-+			entry->rssi[0] = status->chain_signal[0];
-+			entry->rssi[1] = status->chain_signal[1];
-+			entry->rssi[2] = status->chain_signal[2];
-+			entry->rssi[3] = status->chain_signal[3];
-+			entry->last_seen = jiffies;
-+		}
-+	}
-+
-+	if (ieee80211_has_tods(fc) &&
-+	    !ether_addr_equal(hdr->addr3, phy->mt76->macaddr))
-+		return;
-+	else if (!ether_addr_equal(hdr->addr1, phy->mt76->macaddr))
-+		return;
-+}
-+
-+int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
-+				  struct ieee80211_sta *sta)
-+{
-+	u8 zero[ETH_ALEN] = {};
-+	int i;
-+
-+	if (!phy->amnt_ctrl.enable)
-+		return 0;
-+
-+	for (i = 0; i < MT7915_AIR_MONITOR_MAX_ENTRY; i++)
-+		if (ether_addr_equal(sta->addr, phy->amnt_ctrl.entry[i].addr))
-+			return mt7915_vendor_amnt_set_addr(phy, i, zero);
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_vendor_amnt_ctrl(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			const void *data, int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
-+	struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_SET];
-+	struct nlattr *cur;
-+	u8 index = 0, i = 0;
-+	u8 mac_addr[ETH_ALEN] = {};
-+	int err, rem;
-+
-+	err = nla_parse(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX, data, data_len,
-+			amnt_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_SET])
-+		return -EINVAL;
-+
-+	err = nla_parse_nested(tb2, MTK_VENDOR_ATTR_AMNT_SET_MAX,
-+		tb1[MTK_VENDOR_ATTR_AMNT_CTRL_SET], amnt_set_policy, NULL);
-+
-+	if (!tb2[MTK_VENDOR_ATTR_AMNT_SET_INDEX] ||
-+		!tb2[MTK_VENDOR_ATTR_AMNT_SET_MACADDR])
-+		return -EINVAL;
-+
-+	index = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_SET_INDEX]);
-+	nla_for_each_nested(cur, tb2[MTK_VENDOR_ATTR_AMNT_SET_MACADDR], rem) {
-+		mac_addr[i++] = nla_get_u8(cur);
-+	}
-+
-+	return mt7915_vendor_amnt_set_addr(phy, index, mac_addr);
-+}
-+
-+static int
-+mt7915_amnt_dump(struct mt7915_phy *phy, struct sk_buff *skb,
-+		 u8 amnt_idx, int *attrtype)
-+{
-+	struct mt7915_air_monitor_entry *entry =
-+			&phy->amnt_ctrl.entry[amnt_idx];
-+	struct mt7915_amnt_data data;
-+	u32 last_seen = 0;
-+
-+	if (entry->enable == 0)
-+		return 0;
-+
-+	last_seen = jiffies_to_msecs(jiffies - entry->last_seen);
-+
-+	data.idx = amnt_idx;
-+	ether_addr_copy(data.addr, entry->addr);
-+	data.rssi[0] = entry->rssi[0];
-+	data.rssi[1] = entry->rssi[1];
-+	data.rssi[2] = entry->rssi[2];
-+	data.rssi[3] = entry->rssi[3];
-+	data.last_seen = last_seen;
-+
-+	nla_put(skb, (*attrtype)++, sizeof(struct mt7915_amnt_data), &data);
-+
-+	return 1;
-+}
-+
-+static int
-+mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
-+	struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP];
-+	void *a, *b;
-+	int err = 0, attrtype = 0, i, len = 0;
-+	u8 amnt_idx;
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	err = nla_parse(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX, data, data_len,
-+			amnt_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP])
-+		return -EINVAL;
-+
-+	err = nla_parse_nested(tb2, MTK_VENDOR_ATTR_AMNT_DUMP_MAX,
-+			       tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP],
-+			       amnt_dump_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_INDEX])
-+		return -EINVAL;
-+
-+	amnt_idx = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_DUMP_INDEX]);
-+
-+	a = nla_nest_start(skb, MTK_VENDOR_ATTR_AMNT_CTRL_DUMP);
-+	b = nla_nest_start(skb, MTK_VENDOR_ATTR_AMNT_DUMP_RESULT);
-+
-+	if (amnt_idx != 0xff) {
-+		len += mt7915_amnt_dump(phy, skb, amnt_idx, &attrtype);
-+	} else {
-+		for (i = 0; i < MT7915_AIR_MONITOR_MAX_ENTRY; i++) {
-+			len += mt7915_amnt_dump(phy, skb, i, &attrtype);
-+		}
-+	}
-+
-+	nla_nest_end(skb, b);
-+
-+	nla_put_u8(skb, MTK_VENDOR_ATTR_AMNT_DUMP_LEN, len);
-+
-+	nla_nest_end(skb, a);
-+
-+	return len + 1;
-+}
-+
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -442,6 +789,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.dumpit = mt7915_vendor_csi_ctrl_dump,
- 		.policy = csi_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_CSI_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_amnt_ctrl,
-+		.dumpit = mt7915_vendor_amnt_ctrl_dump,
-+		.policy = amnt_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a..976817f 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -4,6 +4,7 @@
- #define MTK_NL80211_VENDOR_ID	0x0ce7
- 
- enum mtk_nl80211_vendor_subcmds {
-+	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
- 	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
- };
- 
-@@ -57,4 +58,41 @@ enum mtk_vendor_attr_csi_data {
- 		NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
- };
- 
-+enum mtk_vendor_attr_mnt_ctrl {
-+	MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_AMNT_CTRL_SET,
-+	MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
-+	MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_mnt_set {
-+	MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_AMNT_SET_INDEX,
-+	MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_AMNT_SET,
-+	MTK_VENDOR_ATTR_AMNT_SET_MAX =
-+		NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
-+};
-+
-+enum mtk_vendor_attr_mnt_dump {
-+	MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
-+	MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
-+	MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
-+	MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
-+};
-+
- #endif
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
deleted file mode 100644
index 766a685..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From 49d393ab26f28cec6713ebf967a8f4b6e44b158d Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Wed, 22 Jun 2022 10:45:53 +0800
-Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
- debugfs
-
----
- mt7915/init.c        |  1 +
- mt7915/mcu.c         | 11 ++++++++---
- mt7915/mcu.h         |  6 ++++++
- mt7915/mtk_debugfs.c | 33 +++++++++++++++++++++++++++++++++
- 4 files changed, 48 insertions(+), 3 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 844a92f..00ddab7 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -693,6 +693,7 @@ static void mt7915_init_work(struct work_struct *work)
- 	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
- 	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
- 	mt7915_txbf_init(dev);
-+	dev->dbg.muru_onoff = OFDMA_DL | MUMIMO_UL | MUMIMO_DL;
- }
- 
- void mt7915_wfsys_reset(struct mt7915_dev *dev)
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 788f3fb..ce07eee 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -876,13 +876,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 
- 	muru = (struct sta_rec_muru *)tlv;
- 
--	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
--			       mvif->cap.vht_mu_ebfer ||
--			       mvif->cap.vht_mu_ebfee;
-+	muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
-+			        mvif->cap.vht_mu_ebfer ||
-+			        mvif->cap.vht_mu_ebfee) &&
-+			       !!(dev->dbg.muru_onoff & MUMIMO_DL);
- 	if (!is_mt7915(&dev->mt76))
- 		muru->cfg.mimo_ul_en = true;
- 	muru->cfg.ofdma_dl_en = true;
- 
-+	muru->cfg.mimo_ul_en = !!(dev->dbg.muru_onoff & MUMIMO_UL);
-+	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
-+	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
-+
- 	if (sta->deflink.vht_cap.vht_supported)
- 		muru->mimo_dl.vht_mu_bfee =
- 			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f3dedd5..b6840b2 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -608,4 +608,10 @@ struct csi_data {
- };
- #endif
- 
-+/* MURU */
-+#define OFDMA_DL                       BIT(0)
-+#define OFDMA_UL                       BIT(1)
-+#define MUMIMO_DL                      BIT(2)
-+#define MUMIMO_UL                      BIT(3)
-+
- #endif
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 53f98d1..2719a8d 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -2481,6 +2481,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
- 	return 0;
- }
- 
-+static int mt7915_muru_onoff_get(void *data, u64 *val)
-+{
-+       struct mt7915_dev *dev = data;
-+
-+       *val = dev->dbg.muru_onoff;
-+
-+       printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
-+               !!(dev->dbg.muru_onoff & MUMIMO_UL),
-+               !!(dev->dbg.muru_onoff & MUMIMO_DL),
-+               !!(dev->dbg.muru_onoff & OFDMA_UL),
-+               !!(dev->dbg.muru_onoff & OFDMA_DL));
-+
-+       return 0;
-+}
-+
-+static int mt7915_muru_onoff_set(void *data, u64 val)
-+{
-+       struct mt7915_dev *dev = data;
-+
-+       if (val > 15) {
-+               printk("Wrong value! The value is between 0 ~ 15.\n");
-+               goto exit;
-+       }
-+
-+       dev->dbg.muru_onoff = val;
-+exit:
-+       return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_muru_onoff, mt7915_muru_onoff_get,
-+                       mt7915_muru_onoff_set, "%llx\n");
-+
- static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
- {
- 	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -2860,6 +2892,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- 
- 	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
- 
-+	debugfs_create_file("muru_onoff", 0600, dir, dev, &fops_muru_onoff);
- 	debugfs_create_file("fw_debug_module", 0600, dir, dev,
- 			    &fops_fw_debug_module);
- 	debugfs_create_file("fw_debug_level", 0600, dir, dev,
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
deleted file mode 100644
index 13a328e..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
+++ /dev/null
@@ -1,1138 +0,0 @@
-From 8b3bb58a14f4419cf9842c96115107faf46e30bb Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1005/1009] mt76: mt7915: certification patches
-
----
- mt76_connac_mcu.h    |   1 +
- mt7915/mac.c         |  23 +++
- mt7915/main.c        |  15 +-
- mt7915/mcu.c         | 466 +++++++++++++++++++++++++++++++++++++++++++
- mt7915/mcu.h         | 207 ++++++++++++++++++-
- mt7915/mt7915.h      |  13 ++
- mt7915/mtk_debugfs.c |   7 +-
- mt7915/vendor.c      | 187 +++++++++++++++++
- mt7915/vendor.h      |  42 ++++
- 9 files changed, 956 insertions(+), 5 deletions(-)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 841fcde..18ae3ac 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1194,6 +1194,7 @@ enum {
- 	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
- 	/* for vendor csi and air monitor */
- 	MCU_EXT_CMD_SMESH_CTRL = 0xae,
-+	MCU_EXT_CMD_CERT_CFG = 0xb7,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- };
- 
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 015f270..229e68c 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -8,6 +8,7 @@
- #include "../dma.h"
- #include "mac.h"
- #include "mcu.h"
-+#include "vendor.h"
- 
- #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
- 
-@@ -2021,6 +2022,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
- 	phy->trb_ts = trb;
- }
- 
-+#ifdef CONFIG_MTK_VENDOR
-+void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
-+{
-+	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
-+	struct mt7915_dev *dev = msta->vif->phy->dev;
-+	u32 *changed = data;
-+
-+	spin_lock_bh(&dev->sta_poll_lock);
-+	msta->changed |= *changed;
-+	if (list_empty(&msta->rc_list))
-+		list_add_tail(&msta->rc_list, &dev->sta_rc_list);
-+	spin_unlock_bh(&dev->sta_poll_lock);
-+}
-+#endif
-+
- void mt7915_mac_sta_rc_work(struct work_struct *work)
- {
- 	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2043,6 +2059,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
- 		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
- 		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
- 
-+#ifdef CONFIG_MTK_VENDOR
-+		if (changed & CAPI_RFEATURE_CHANGED) {
-+			mt7915_mcu_set_rfeature_starec(&changed, dev, vif, sta);
-+			spin_lock_bh(&dev->sta_poll_lock);
-+			continue;
-+		}
-+#endif
- 		if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
- 			       IEEE80211_RC_NSS_CHANGED |
- 			       IEEE80211_RC_BW_CHANGED))
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 04f248f..2c4e392 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -678,6 +678,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	bool ext_phy = mvif->phy != &dev->phy;
-+#ifdef CONFIG_MTK_VENDOR
-+	struct mt7915_phy *phy;
-+#endif
- 	int ret, idx;
- 
- 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -705,7 +708,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- #ifdef CONFIG_MTK_VENDOR
- 	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
- #endif
--	return mt7915_mcu_add_rate_ctrl(dev, vif, sta, false);
-+	ret = mt7915_mcu_add_rate_ctrl(dev, vif, sta, false);
-+	if (ret)
-+		return ret;
-+
-+#ifdef CONFIG_MTK_VENDOR
-+	if (dev->dbg.muru_onoff & MUMIMO_DL_CERT) {
-+		phy = mvif->mt76.band_idx ? mt7915_ext_phy(dev) : &dev->phy;
-+		mt7915_mcu_set_mimo(phy, 0);
-+	}
-+#endif
-+	return 0;
- }
- 
- void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ce07eee..c459258 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3889,6 +3889,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
- 
- 	return 0;
- }
-+void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
-+{
-+	u8 mode, val;
-+	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mt7915_dev *dev =  mvif->phy->dev;
-+
-+	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
-+	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
-+
-+	switch (mode) {
-+	case RATE_PARAM_FIXED_OFDMA:
-+		if (val == 3) /* DL 20 and 80 */
-+			dev->dbg.muru_onoff = OFDMA_DL; /* Enable OFDMA DL only */
-+		else
-+			dev->dbg.muru_onoff = val;
-+		break;
-+	case RATE_PARAM_FIXED_MIMO:
-+		if (val == 0)
-+			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
-+		break;
-+	}
-+}
-+
-+void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
-+		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+{
-+	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
-+	struct mt7915_vif *mvif = msta->vif;
-+	struct sta_rec_ra_fixed *ra;
-+	struct sk_buff *skb;
-+	struct tlv *tlv;
-+	u8 mode, val;
-+	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
-+
-+	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
-+	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
-+
-+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, &msta->wcid, len);
-+	if (IS_ERR(skb))
-+		return;
-+
-+	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
-+	ra = (struct sta_rec_ra_fixed *)tlv;
-+
-+	switch (mode) {
-+	case RATE_PARAM_FIXED_GI:
-+		ra->field = cpu_to_le32(RATE_PARAM_FIXED_GI);
-+		ra->phy.sgi = val * 85;
-+		break;
-+	case RATE_PARAM_FIXED_HE_LTF:
-+		ra->field = cpu_to_le32(RATE_PARAM_FIXED_HE_LTF);
-+		ra->phy.he_ltf = val * 85;
-+		break;
-+	case RATE_PARAM_FIXED_MCS:
-+		ra->field = cpu_to_le32(RATE_PARAM_FIXED_MCS);
-+		ra->phy.mcs = val;
-+		break;
-+	}
-+
-+	mt76_mcu_skb_send_msg(&dev->mt76, skb,
-+			      MCU_EXT_CMD(STA_REC_UPDATE), true);
-+}
-+
-+int mt7915_mcu_set_mu_prot_frame_th(struct mt7915_phy *phy, u32 val)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		__le32 cmd;
-+		__le32 threshold;
-+	} __packed req = {
-+		.cmd = cpu_to_le32(MURU_SET_PROT_FRAME_THR),
-+		.threshold = val,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
-+			sizeof(req), false);
-+}
-+
-+int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		__le32 cmd;
-+		u8 override;
-+	} __packed req = {
-+		.cmd = cpu_to_le32(MURU_SET_CERT_MU_EDCA_OVERRIDE),
-+		.override = val,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
-+			sizeof(req), false);
-+}
-+
-+int mt7915_mcu_set_muru_cfg(struct mt7915_phy *phy, struct mt7915_muru *muru)
-+{
-+        struct mt7915_dev *dev = phy->dev;
-+        struct {
-+                __le32 cmd;
-+                struct mt7915_muru muru;
-+        } __packed req = {
-+                .cmd = cpu_to_le32(MURU_SET_MANUAL_CFG),
-+        };
-+
-+        memcpy(&req.muru, muru, sizeof(struct mt7915_muru));
-+
-+        return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
-+                                 sizeof(req), false);
-+}
-+
-+int mt7915_set_muru_cfg(struct mt7915_phy *phy, u8 action, u8 val)
-+{
-+	struct mt7915_muru muru;
-+	struct mt7915_muru_dl *dl = &muru.dl;
-+	struct mt7915_muru_ul *ul = &muru.ul;
-+	struct mt7915_muru_comm *comm = &muru.comm;
-+
-+        memset(&muru, 0, sizeof(muru));
-+
-+	switch (action) {
-+	case MURU_DL_USER_CNT:
-+		dl->user_num = val;
-+		comm->ppdu_format |= MURU_PPDU_HE_MU;
-+		comm->sch_type |= MURU_OFDMA_SCH_TYPE_DL;
-+		muru.cfg_comm = cpu_to_le32(MURU_COMM_SET);
-+		muru.cfg_dl = cpu_to_le32(MURU_USER_CNT);
-+		return mt7915_mcu_set_muru_cfg(phy, &muru);
-+	case MURU_UL_USER_CNT:
-+		ul->user_num = val;
-+		comm->ppdu_format |= MURU_PPDU_HE_TRIG;
-+		comm->sch_type |= MURU_OFDMA_SCH_TYPE_UL;
-+		muru.cfg_comm = cpu_to_le32(MURU_COMM_SET);
-+		muru.cfg_ul = cpu_to_le32(MURU_USER_CNT);
-+		return mt7915_mcu_set_muru_cfg(phy, &muru);
-+	default:
-+		return 0;
-+        }
-+}
-+
-+void mt7915_mcu_set_ppdu_tx_type(struct mt7915_phy *phy, u8 ppdu_type)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		__le32 cmd;
-+		u8 enable_su;
-+	} __packed ppdu_type_req = {
-+		.cmd = cpu_to_le32(MURU_SET_SUTX),
-+	};
-+
-+	switch(ppdu_type) {
-+	case CAPI_SU:
-+		ppdu_type_req.enable_su = 1;
-+		mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
-+				  &ppdu_type_req, sizeof(ppdu_type_req), false);
-+		mt7915_set_muru_cfg(phy, MURU_DL_USER_CNT, 0);
-+		break;
-+	case CAPI_MU:
-+		ppdu_type_req.enable_su = 0;
-+		mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
-+				  &ppdu_type_req, sizeof(ppdu_type_req), false);
-+		break;
-+	default:
-+		break;
-+	}
-+}
-+
-+void mt7915_mcu_set_nusers_ofdma(struct mt7915_phy *phy, u8 type, u8 ofdma_user_cnt)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		__le32 cmd;
-+		u8 enable_su;
-+	} __packed nusers_ofdma_req = {
-+		.cmd = cpu_to_le32(MURU_SET_SUTX),
-+		.enable_su = 0,
-+	};
-+
-+	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
-+			  &nusers_ofdma_req, sizeof(nusers_ofdma_req), false);
-+
-+	mt7915_mcu_set_mu_dl_ack_policy(phy, MU_DL_ACK_POLICY_SU_BAR);
-+	mt7915_mcu_set_mu_prot_frame_th(phy, 9999);
-+	switch(type) {
-+	case MURU_UL_USER_CNT:
-+		mt7915_set_muru_cfg(phy, MURU_UL_USER_CNT, ofdma_user_cnt);
-+		break;
-+	case MURU_DL_USER_CNT:
-+	default:
-+		mt7915_set_muru_cfg(phy, MURU_DL_USER_CNT, ofdma_user_cnt);
-+		break;
-+	}
-+}
-+
-+void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction)
-+{
-+#define MUMIMO_SET_FIXED_RATE		10
-+#define MUMIMO_SET_FIXED_GRP_RATE	11
-+#define MUMIMO_SET_FORCE_MU		12
-+	struct mt7915_dev *dev = phy->dev;
-+	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
-+	struct {
-+		__le32 cmd;
-+		__le16 sub_cmd;
-+		__le16 disable_ra;
-+	} __packed fixed_rate_req = {
-+		.cmd = cpu_to_le32(MURU_SET_MUMIMO_CTRL),
-+		.sub_cmd = cpu_to_le16(MUMIMO_SET_FIXED_RATE),
-+		.disable_ra = cpu_to_le16(1),
-+	};
-+	struct {
-+		__le32 cmd;
-+		__le32 sub_cmd;
-+		struct {
-+			u8 user_cnt:2;
-+			u8 rsv:2;
-+			u8 ns0:1;
-+			u8 ns1:1;
-+			u8 ns2:1;
-+			u8 ns3:1;
-+
-+			__le16 wlan_id_user0;
-+			__le16 wlan_id_user1;
-+			__le16 wlan_id_user2;
-+			__le16 wlan_id_user3;
-+
-+			u8 dl_mcs_user0:4;
-+			u8 dl_mcs_user1:4;
-+			u8 dl_mcs_user2:4;
-+			u8 dl_mcs_user3:4;
-+
-+			u8 ul_mcs_user0:4;
-+			u8 ul_mcs_user1:4;
-+			u8 ul_mcs_user2:4;
-+			u8 ul_mcs_user3:4;
-+
-+			u8 ru_alloc;
-+			u8 cap;
-+			u8 gi;
-+			u8 dl_ul;
-+		} grp_rate_conf;
-+	} fixed_grp_rate_req = {
-+		.cmd = cpu_to_le32(MURU_SET_MUMIMO_CTRL),
-+		.sub_cmd = cpu_to_le32(MUMIMO_SET_FIXED_GRP_RATE),
-+		.grp_rate_conf = {
-+			.user_cnt = 1,
-+			.ru_alloc = 134,
-+			.gi = 0,
-+			.cap = 1,
-+			.dl_ul = 0,
-+			.wlan_id_user0 = cpu_to_le16(1),
-+			.dl_mcs_user0 = 2,
-+			.wlan_id_user1 = cpu_to_le16(2),
-+			.dl_mcs_user1 = 2,
-+		},
-+	};
-+	struct {
-+		__le32 cmd;
-+		__le16 sub_cmd;
-+		bool force_mu;
-+	} __packed force_mu_req = {
-+		.cmd = cpu_to_le32(MURU_SET_MUMIMO_CTRL),
-+		.sub_cmd = cpu_to_le16(MUMIMO_SET_FORCE_MU),
-+		.force_mu = true,
-+	};
-+
-+	switch (chandef->width) {
-+	case NL80211_CHAN_WIDTH_20_NOHT:
-+	case NL80211_CHAN_WIDTH_20:
-+		fixed_grp_rate_req.grp_rate_conf.ru_alloc = 122;
-+		break;
-+	case NL80211_CHAN_WIDTH_80:
-+	default:
-+		break;
-+	}
-+
-+	mt7915_mcu_set_mu_dl_ack_policy(phy, MU_DL_ACK_POLICY_SU_BAR);
-+
-+	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
-+			&fixed_rate_req, sizeof(fixed_rate_req), false);
-+	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
-+			&fixed_grp_rate_req, sizeof(fixed_grp_rate_req), false);
-+	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
-+			&force_mu_req, sizeof(force_mu_req), false);
-+}
-+
-+void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		__le32 cmd;
-+		u8 enable;
-+        } __packed req = {
-+		.cmd = cpu_to_le32(MURU_SET_20M_DYN_ALGO),
-+		.enable = enable,
-+        };
-+
-+	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
-+			&req, sizeof(req), false);
-+}
-+
-+void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type)
-+{
-+#define CFGINFO_CERT_CFG 4
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		struct basic_info{
-+			u8 dbdc_idx;
-+			u8 rsv[3];
-+			__le32 tlv_num;
-+			u8 tlv_buf[0];
-+		} hdr;
-+		struct cert_cfg{
-+			__le16 tag;
-+			__le16 length;
-+			u8 cert_program;
-+			u8 rsv[3];
-+		} tlv;
-+	} req = {
-+		.hdr = {
-+			.dbdc_idx = phy != &dev->phy,
-+			.tlv_num = cpu_to_le32(1),
-+		},
-+		.tlv = {
-+			.tag = cpu_to_le16(CFGINFO_CERT_CFG),
-+			.length = cpu_to_le16(sizeof(struct cert_cfg)),
-+			.cert_program = type, /* 1: CAPI Enable */
-+		}
-+	};
-+
-+	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CERT_CFG),
-+			  &req, sizeof(req), false);
-+}
-+
-+void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
-+{
-+#define BF_CMD_CFG_PHY		36
-+#define BF_PHY_SMTH_INTL_BYPASS 0
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 cmd_category_id;
-+		u8 action;
-+		u8 band_idx;
-+		u8 smthintbypass;
-+		u8 rsv[12];
-+	} req = {
-+		.cmd_category_id = BF_CMD_CFG_PHY,
-+		.action = BF_PHY_SMTH_INTL_BYPASS,
-+		.band_idx = phy != &dev->phy,
-+		.smthintbypass = val,
-+	};
-+
-+	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
-+			&req, sizeof(req), false);
-+}
-+
-+int mt7915_mcu_set_bsrp_ctrl(struct mt7915_phy *phy, u16 interval,
-+			u16 ru_alloc, u32 ppdu_dur, u8 trig_flow, u8 ext_cmd)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		__le32 cmd;
-+		__le16 bsrp_interval;
-+		__le16 bsrp_ru_alloc;
-+		__le32 ppdu_duration;
-+		u8 trigger_flow;
-+		u8 ext_cmd_bsrp;
-+	} __packed req = {
-+		.cmd = cpu_to_le32(MURU_SET_BSRP_CTRL),
-+		.bsrp_interval = cpu_to_le16(interval),
-+		.bsrp_ru_alloc = cpu_to_le16(ru_alloc),
-+		.ppdu_duration = cpu_to_le32(ppdu_dur),
-+		.trigger_flow = trig_flow,
-+		.ext_cmd_bsrp = ext_cmd,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
-+				sizeof(req), false);
-+}
-+
-+int mt7915_mcu_set_mu_dl_ack_policy(struct mt7915_phy *phy, u8 policy_num)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		__le32 cmd;
-+		u8 ack_policy;
-+	} __packed req = {
-+		.cmd = cpu_to_le32(MURU_SET_MU_DL_ACK_POLICY),
-+		.ack_policy = policy_num,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
-+				sizeof(req), false);
-+}
-+
-+int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
-+			u8 v1, u8 v2, u8 v3)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 cmd_category_id;
-+		u8 action;
-+		u8 read_clear;
-+		u8 vht_opt;
-+		u8 he_opt;
-+		u8 glo_opt;
-+		__le16 wlan_idx;
-+		u8 sound_interval;
-+		u8 sound_stop;
-+		u8 max_sound_sta;
-+		u8 tx_time;
-+		u8 mcs;
-+		bool ldpc;
-+		u8 inf;
-+		u8 rsv;
-+	} __packed req = {
-+		.cmd_category_id = BF_CMD_TXSND_INFO,
-+		.action = action,
-+	};
-+
-+	switch (action) {
-+	case BF_SND_CFG_OPT:
-+		req.vht_opt = v1;
-+		req.he_opt = v2;
-+		req.glo_opt = v3;
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
-+				sizeof(req), false);
-+}
-+
-+int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig_type)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	int ret = 0;
-+	struct {
-+		__le32 cmd;
-+		u8 trig_type;
-+	} __packed req = {
-+		.cmd = cpu_to_le32(MURU_SET_TRIG_TYPE),
-+		.trig_type = trig_type,
-+	};
-+
-+	if (enable) {
-+		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
-+					 sizeof(req), false);
-+		if (ret)
-+			return ret;
-+	}
-+
-+	switch (trig_type) {
-+	case CAPI_BASIC:
-+		return mt7915_mcu_set_bsrp_ctrl(phy, 5, 67, 0, 0, enable);
-+	case CAPI_BRP:
-+		return mt7915_mcu_set_txbf_sound_info(phy, BF_SND_CFG_OPT,
-+				0x0, 0x0, 0x1b);
-+	case CAPI_MU_BAR:
-+		return mt7915_mcu_set_mu_dl_ack_policy(phy,
-+				MU_DL_ACK_POLICY_MU_BAR);
-+	case CAPI_BSRP:
-+		return mt7915_mcu_set_bsrp_ctrl(phy, 5, 67, 4, 0, enable);
-+	default:
-+		return 0;
-+	}
-+}
- #endif
- 
- #ifdef MTK_DEBUG
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b6840b2..d7322fe 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -415,10 +415,14 @@ enum {
- 	RATE_PARAM_FIXED = 3,
- 	RATE_PARAM_MMPS_UPDATE = 5,
- 	RATE_PARAM_FIXED_HE_LTF = 7,
--	RATE_PARAM_FIXED_MCS,
-+	RATE_PARAM_FIXED_MCS = 8,
- 	RATE_PARAM_FIXED_GI = 11,
- 	RATE_PARAM_AUTO = 20,
- 	RATE_PARAM_SPE_UPDATE = 22,
-+#ifdef CONFIG_MTK_VENDOR
-+	RATE_PARAM_FIXED_MIMO = 30,
-+	RATE_PARAM_FIXED_OFDMA = 31,
-+#endif
- };
- 
- #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -430,6 +434,9 @@ enum {
- #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
- #define RATE_CFG_HE_LTF			GENMASK(31, 28)
- 
-+#define RATE_CFG_MODE			GENMASK(15, 8)
-+#define RATE_CFG_VAL			GENMASK(7, 0)
-+
- enum {
- 	TX_POWER_LIMIT_ENABLE,
- 	TX_POWER_LIMIT_TABLE = 0x4,
-@@ -613,5 +620,203 @@ struct csi_data {
- #define OFDMA_UL                       BIT(1)
- #define MUMIMO_DL                      BIT(2)
- #define MUMIMO_UL                      BIT(3)
-+#define MUMIMO_DL_CERT                 BIT(4)
-+
-+#ifdef CONFIG_MTK_VENDOR
-+struct mt7915_muru_comm {
-+   u8 ppdu_format;
-+   u8 sch_type;
-+   u8 band;
-+   u8 wmm_idx;
-+   u8 spe_idx;
-+   u8 proc_type;
-+};
-+
-+struct mt7915_muru_dl {
-+   u8 user_num;
-+   u8 tx_mode;
-+   u8 bw;
-+   u8 gi;
-+   u8 ltf;
-+   /* sigB */
-+   u8 mcs;
-+   u8 dcm;
-+   u8 cmprs;
-+
-+   u8 ru[8];
-+   u8 c26[2];
-+   u8 ack_policy;
-+
-+   struct {
-+	   __le16 wlan_idx;
-+       u8 ru_alloc_seg;
-+       u8 ru_idx;
-+       u8 ldpc;
-+       u8 nss;
-+       u8 mcs;
-+       u8 mu_group_idx;
-+       u8 vht_groud_id;
-+       u8 vht_up;
-+       u8 he_start_stream;
-+       u8 he_mu_spatial;
-+       u8 ack_policy;
-+       __le16 tx_power_alpha;
-+   } usr[16];
-+};
-+
-+struct mt7915_muru_ul {
-+   u8 user_num;
-+
-+   /* UL TX */
-+   u8 trig_type;
-+   __le16 trig_cnt;
-+   __le16 trig_intv;
-+   u8 bw;
-+   u8 gi_ltf;
-+   __le16 ul_len;
-+   u8 pad;
-+   u8 trig_ta[ETH_ALEN];
-+   u8 ru[8];
-+   u8 c26[2];
-+
-+   struct {
-+       __le16 wlan_idx;
-+       u8 ru_alloc;
-+       u8 ru_idx;
-+       u8 ldpc;
-+       u8 nss;
-+       u8 mcs;
-+       u8 target_rssi;
-+       __le32 trig_pkt_size;
-+   } usr[16];
-+
-+   /* HE TB RX Debug */
-+   __le32 rx_hetb_nonsf_en_bitmap;
-+   __le32 rx_hetb_cfg[2];
-+
-+   /* DL TX */
-+   u8 ba_type;
-+};
-+
-+struct mt7915_muru {
-+   __le32 cfg_comm;
-+   __le32 cfg_dl;
-+   __le32 cfg_ul;
-+
-+   struct mt7915_muru_comm comm;
-+   struct mt7915_muru_dl dl;
-+   struct mt7915_muru_ul ul;
-+};
-+
-+#define MURU_PPDU_HE_TRIG      BIT(2)
-+#define MURU_PPDU_HE_MU                 BIT(3)
-+
-+#define MURU_OFDMA_SCH_TYPE_DL          BIT(0)
-+#define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
-+
-+/* Common Config */
-+#define MURU_COMM_PPDU_FMT              BIT(0)
-+#define MURU_COMM_SCH_TYPE              BIT(1)
-+#define MURU_COMM_SET                   (MURU_COMM_PPDU_FMT | MURU_COMM_SCH_TYPE)
-+/* DL&UL User config*/
-+#define MURU_USER_CNT                   BIT(4)
-+
-+enum {
-+   CAPI_SU,
-+   CAPI_MU,
-+   CAPI_ER_SU,
-+   CAPI_TB,
-+   CAPI_LEGACY
-+};
-+
-+enum {
-+   CAPI_BASIC,
-+   CAPI_BRP,
-+   CAPI_MU_BAR,
-+   CAPI_MU_RTS,
-+   CAPI_BSRP,
-+   CAPI_GCR_MU_BAR,
-+   CAPI_BQRP,
-+   CAPI_NDP_FRP
-+};
-+
-+enum {
-+   MURU_SET_BSRP_CTRL = 1,
-+   MURU_SET_SUTX = 16,
-+   MURU_SET_MUMIMO_CTRL = 17,
-+   MURU_SET_MANUAL_CFG = 100,
-+   MURU_SET_MU_DL_ACK_POLICY = 200,
-+   MURU_SET_TRIG_TYPE = 201,
-+   MURU_SET_20M_DYN_ALGO = 202,
-+   MURU_SET_PROT_FRAME_THR = 204,
-+   MURU_SET_CERT_MU_EDCA_OVERRIDE = 205,
-+};
-+
-+enum {
-+   MU_DL_ACK_POLICY_MU_BAR = 3,
-+   MU_DL_ACK_POLICY_TF_FOR_ACK = 4,
-+  MU_DL_ACK_POLICY_SU_BAR = 5,
-+};
-+
-+enum {
-+   BF_SOUNDING_OFF = 0,
-+   BF_SOUNDING_ON,
-+   BF_DATA_PACKET_APPLY,
-+   BF_PFMU_MEM_ALLOCATE,
-+   BF_PFMU_MEM_RELEASE,
-+   BF_PFMU_TAG_READ,
-+   BF_PFMU_TAG_WRITE,
-+   BF_PROFILE_READ,
-+   BF_PROFILE_WRITE,
-+   BF_PN_READ,
-+   BF_PN_WRITE,
-+   BF_PFMU_MEM_ALLOC_MAP_READ,
-+   BF_AID_SET,
-+   BF_STA_REC_READ,
-+   BF_PHASE_CALIBRATION,
-+   BF_IBF_PHASE_COMP,
-+   BF_LNA_GAIN_CONFIG,
-+   BF_PROFILE_WRITE_20M_ALL,
-+   BF_APCLIENT_CLUSTER,
-+   BF_AWARE_CTRL,
-+   BF_HW_ENABLE_STATUS_UPDATE,
-+   BF_REPT_CLONED_STA_TO_NORMAL_STA,
-+   BF_GET_QD,
-+   BF_BFEE_HW_CTRL,
-+   BF_PFMU_SW_TAG_WRITE,
-+   BF_MOD_EN_CTRL,
-+   BF_DYNSND_EN_INTR,
-+   BF_DYNSND_CFG_DMCS_TH,
-+   BF_DYNSND_EN_PFID_INTR,
-+   BF_CONFIG,
-+   BF_PFMU_DATA_WRITE,
-+   BF_FBRPT_DBG_INFO_READ,
-+   BF_CMD_TXSND_INFO,
-+   BF_CMD_PLY_INFO,
-+   BF_CMD_MU_METRIC,
-+   BF_CMD_TXCMD,
-+   BF_CMD_CFG_PHY,
-+   BF_CMD_SND_CNT,
-+   BF_CMD_MAX
-+};
-+
-+enum {
-+   BF_SND_READ_INFO = 0,
-+   BF_SND_CFG_OPT,
-+   BF_SND_CFG_INTV,
-+   BF_SND_STA_STOP,
-+   BF_SND_CFG_MAX_STA,
-+   BF_SND_CFG_BFRP,
-+   BF_SND_CFG_INF
-+};
-+
-+enum {
-+   MURU_UPDATE = 0,
-+   MURU_DL_USER_CNT,
-+   MURU_UL_USER_CNT,
-+   MURU_DL_INIT,
-+   MURU_UL_INIT,
-+};
-+#endif
- 
- #endif
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 29082b6..9fdb80b 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -720,6 +720,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 			 bool pci, int *irq);
- 
- #ifdef CONFIG_MTK_VENDOR
-+void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta);
-+void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
-+void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
-+		       struct ieee80211_vif *vif, struct ieee80211_sta *sta);
-+int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig_type);
-+int mt7915_mcu_set_mu_dl_ack_policy(struct mt7915_phy *phy, u8 policy_num);
-+void mt7915_mcu_set_ppdu_tx_type(struct mt7915_phy *phy, u8 ppdu_type);
-+void mt7915_mcu_set_nusers_ofdma(struct mt7915_phy *phy, u8 type, u8 ofdma_user_cnt);
-+void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
-+void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
-+int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
-+void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
-+void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val);
- void mt7915_vendor_register(struct mt7915_phy *phy);
- int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
- 			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 2719a8d..b03ae39 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -2487,7 +2487,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
- 
-        *val = dev->dbg.muru_onoff;
- 
--       printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
-+	   printk("cert mumimo dl:%d, mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
-+               !!(dev->dbg.muru_onoff & MUMIMO_DL_CERT),
-                !!(dev->dbg.muru_onoff & MUMIMO_UL),
-                !!(dev->dbg.muru_onoff & MUMIMO_DL),
-                !!(dev->dbg.muru_onoff & OFDMA_UL),
-@@ -2500,8 +2501,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
- {
-        struct mt7915_dev *dev = data;
- 
--       if (val > 15) {
--               printk("Wrong value! The value is between 0 ~ 15.\n");
-+       if (val > 31) {
-+               printk("Wrong value! The value is between 0 ~ 31.\n");
-                goto exit;
-        }
- 
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787..7456c57 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
- 	[MTK_VENDOR_ATTR_CSI_CTRL_DATA] = { .type = NLA_NESTED },
- };
- 
-+static const struct nla_policy
-+wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE] = {.type = NLA_U16 },
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
-+};
-+
-+static const struct nla_policy
-+rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
-+	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG] = { .type = NLA_NESTED },
-+	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY] = { .type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF] = { .type = NLA_U8 },
-+};
-+
- struct csi_null_tone {
- 	u8 start;
- 	u8 end;
-@@ -777,6 +800,148 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
- 	return len + 1;
- }
- 
-+static int mt7915_vendor_rfeature_ctrl(struct wiphy *wiphy,
-+				  struct wireless_dev *wdev,
-+				  const void *data,
-+				  int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL];
-+	int err;
-+	u32 val;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX, data, data_len,
-+			rfeature_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	val = CAPI_RFEATURE_CHANGED;
-+
-+	if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI]) {
-+		val |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_GI)|
-+			FIELD_PREP(RATE_CFG_VAL, nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI]));
-+		ieee80211_iterate_stations_atomic(hw, mt7915_capi_sta_rc_work, &val);
-+		ieee80211_queue_work(hw, &dev->rc_work);
-+	}
-+	else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF]) {
-+		val |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_HE_LTF)|
-+			FIELD_PREP(RATE_CFG_VAL, nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF]));
-+                ieee80211_iterate_stations_atomic(hw, mt7915_capi_sta_rc_work, &val);
-+		ieee80211_queue_work(hw, &dev->rc_work);
-+	}
-+	else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG]) {
-+		u8 enable, trig_type;
-+		int rem;
-+		struct nlattr *cur;
-+
-+		nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG], rem) {
-+			switch(nla_type(cur)) {
-+			case MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN:
-+				enable = nla_get_u8(cur);
-+				break;
-+			case MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE:
-+				trig_type = nla_get_u8(cur);
-+				break;
-+			default:
-+				return -EINVAL;
-+			};
-+		}
-+
-+		err = mt7915_mcu_set_rfeature_trig_type(phy, enable, trig_type);
-+		if (err)
-+			return err;
-+	}
-+	else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY]) {
-+		u8 ack_policy;
-+
-+		ack_policy = nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY]);
-+#define HE_TB_PPDU_ACK 4
-+		switch (ack_policy) {
-+		case HE_TB_PPDU_ACK:
-+			return mt7915_mcu_set_mu_dl_ack_policy(phy, ack_policy);
-+		default:
-+			return 0;
-+		}
-+	}
-+	else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF]) {
-+		u8 trig_txbf;
-+
-+		trig_txbf = nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF]);
-+		/* CAPI only issues trig_txbf=disable */
-+	}
-+
-+	return 0;
-+}
-+
-+static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
-+				  struct wireless_dev *wdev,
-+				  const void *data,
-+				  int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL];
-+	int err;
-+	u8 val8;
-+	u16 val16;
-+	u32 val32;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX, data, data_len,
-+			wireless_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	val32 = CAPI_WIRELESS_CHANGED;
-+
-+	if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS]) {
-+		val32 &= ~CAPI_WIRELESS_CHANGED;
-+		val32 |= CAPI_RFEATURE_CHANGED |
-+			FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_MCS) |
-+			FIELD_PREP(RATE_CFG_VAL, nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS]));
-+		ieee80211_iterate_stations_atomic(hw, mt7915_capi_sta_rc_work, &val32);
-+		ieee80211_queue_work(hw, &dev->rc_work);
-+	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA]) {
-+		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA]);
-+		val32 |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_OFDMA) |
-+			 FIELD_PREP(RATE_CFG_VAL, val8);
-+		ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
-+			mt7915_set_wireless_vif, &val32);
-+		if (val8 == 3) /* DL20and80 */
-+			mt7915_mcu_set_dynalgo(phy, 1); /* Enable dynamic algo */
-+	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]) {
-+		val16 = nla_get_u16(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]);
-+		hw->max_tx_aggregation_subframes = val16;
-+		hw->max_rx_aggregation_subframes = val16;
-+	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA]) {
-+		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA]);
-+		mt7915_mcu_set_mu_edca(phy, val8);
-+	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE]) {
-+		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE]);
-+		mt7915_mcu_set_ppdu_tx_type(phy, val8);
-+	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA]) {
-+		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA]);
-+		if (FIELD_GET(OFDMA_UL, dev->dbg.muru_onoff) == 1)
-+			mt7915_mcu_set_nusers_ofdma(phy, MURU_UL_USER_CNT, val8);
-+		else
-+			mt7915_mcu_set_nusers_ofdma(phy, MURU_DL_USER_CNT, val8);
-+	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO]) {
-+		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO]);
-+		val32 |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_MIMO) |
-+			 FIELD_PREP(RATE_CFG_VAL, val8);
-+		ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
-+			mt7915_set_wireless_vif, &val32);
-+	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]) {
-+		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
-+		mt7915_mcu_set_cert(phy, val8); /* Cert Enable for OMI */
-+		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
-+	}
-+
-+	return 0;
-+}
-+
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -801,6 +966,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.dumpit = mt7915_vendor_amnt_ctrl_dump,
- 		.policy = amnt_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_rfeature_ctrl,
-+		.policy = rfeature_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_wireless_ctrl,
-+		.policy = wireless_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f..1b08321 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -6,6 +6,48 @@
- enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
- 	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
-+	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
-+	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
-+};
-+
-+enum mtk_capi_control_changed {
-+	CAPI_RFEATURE_CHANGED		= BIT(16),
-+	CAPI_WIRELESS_CHANGED		= BIT(17),
-+};
-+
-+enum mtk_vendor_attr_wireless_ctrl {
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT = 9,
-+
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA, /* reserve */
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_rfeature_ctrl {
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
-+	MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
-+	NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
- };
- 
- enum mtk_vendor_attr_csi_ctrl {
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
deleted file mode 100644
index 3eb0db6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 74d79b063e48e2756c635d388c9cea3ca50d4239 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Fri, 27 May 2022 15:51:48 +0800
-Subject: [PATCH 1006/1009] mt76: mt7915: add support for runtime set in-band
- discovery
-
-Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
----
- mt7915/mcu.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index c459258..3baed2c 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -1993,8 +1993,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
- 	u8 *buf, interval;
- 	int len;
- 
--	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
--	    vif->bss_conf.fils_discovery.max_interval) {
-+	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
- 		interval = vif->bss_conf.fils_discovery.max_interval;
- 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
- 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2029,7 +2028,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
- 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
- 	discov->tx_interval = interval;
- 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
--	discov->enable = true;
-+	discov->enable = !!(interval);
- 
- 	buf = (u8 *)tlv + sizeof(*discov);
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
deleted file mode 100644
index f55a73a..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From dd853ac02efd5973f494c700e2a668446c66c9a7 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Wed, 22 Jun 2022 10:53:43 +0800
-Subject: [PATCH 1007/1009] mt76: mt7915: add mt76 vendor muru onoff command
-
----
- mt7915/mcu.c    |  7 +++++++
- mt7915/mcu.h    |  1 +
- mt7915/vendor.c | 43 +++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h | 12 ++++++++++++
- 4 files changed, 63 insertions(+)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3baed2c..7728e82 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3908,6 +3908,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
- 		if (val == 0)
- 			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
- 		break;
-+	case RATE_PARAM_AUTO_HEMU:
-+		if (val < 0 || val > 15) {
-+			printk("Wrong value! The value is between 0-15.\n");
-+			break;
-+		}
-+		dev->dbg.muru_onoff = val;
-+		break;
- 	}
- }
- 
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d7322fe..eaadd33 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -422,6 +422,7 @@ enum {
- #ifdef CONFIG_MTK_VENDOR
- 	RATE_PARAM_FIXED_MIMO = 30,
- 	RATE_PARAM_FIXED_OFDMA = 31,
-+	RATE_PARAM_AUTO_HEMU = 32,
- #endif
- };
- 
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7456c57..c755184 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
-+	[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
-+};
-+
- static const struct nla_policy
- rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
- 	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
-@@ -942,6 +947,33 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
- 	return 0;
- }
- 
-+static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
-+				  struct wireless_dev *wdev,
-+				  const void *data,
-+				  int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL];
-+	int err;
-+	u8 val8;
-+	u32 val32 = 0;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_HEMU_CTRL_MAX, data, data_len,
-+			hemu_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (tb[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF]) {
-+		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF]);
-+		val32 |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_AUTO_HEMU) |
-+			 FIELD_PREP(RATE_CFG_VAL, val8);
-+		ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
-+			mt7915_set_wireless_vif, &val32);
-+	}
-+
-+	return 0;
-+}
-+
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -988,6 +1020,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.doit = mt7915_vendor_wireless_ctrl,
- 		.policy = wireless_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_hemu_ctrl,
-+		.policy = hemu_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321..a8e4ebf 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
- 	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
- 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
-+	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
- };
- 
- enum mtk_capi_control_changed {
-@@ -33,6 +34,17 @@ enum mtk_vendor_attr_wireless_ctrl {
- 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
- };
- 
-+enum mtk_vendor_attr_hemu_ctrl {
-+	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
-+	MTK_VENDOR_ATTR_HEMU_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_HEMU_CTRL - 1
-+};
-+
- enum mtk_vendor_attr_rfeature_ctrl {
- 	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
deleted file mode 100644
index 04b4fd0..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 7ac624cb503877d455453ce736ce1abd42cbd218 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 1008/1009] mt76: mt7915: drop undefined action frame
-
----
- mt7915/mac.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 229e68c..fc7b790 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -761,6 +761,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 			  struct mt76_tx_info *tx_info)
- {
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
-+	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)tx_info->skb->data;
-+	__le16 fc = hdr->frame_control;
- 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
- 	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -791,6 +793,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
- 	t->skb = tx_info->skb;
- 
-+	if (ieee80211_is_action(fc) &&
-+	    mgmt->u.action.category == 0xff)
-+		return -1;
-+
- 	id = mt76_token_consume(mdev, &t);
- 	if (id < 0)
- 		return id;
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
deleted file mode 100644
index c50fef0..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 301531f8ae836dd93d9b61a2435acd27ba6eb738 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
-
----
- mt76.h               |  4 ++++
- mt76_connac_mcu.c    |  9 +++++++++
- mt7915/mtk_debugfs.c | 19 +++++++++++++++++++
- 3 files changed, 32 insertions(+)
-
-diff --git a/mt76.h b/mt76.h
-index 1037d23..beea57d 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -837,6 +837,10 @@ struct mt76_dev {
- 		struct mt76_usb usb;
- 		struct mt76_sdio sdio;
- 	};
-+
-+	struct mt76_connac2_patch_hdr *patch_hdr;
-+	struct mt76_connac2_fw_trailer *wm_hdr;
-+	struct mt76_connac2_fw_trailer *wa_hdr;
- };
- 
- struct mt76_power_limits {
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 5a047e6..cf6ec55 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -2968,6 +2968,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
- 		 sizeof(dev->hw->wiphy->fw_version),
- 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
- 
-+	dev->wm_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
-+	memcpy(dev->wm_hdr, hdr, sizeof(*hdr));
-+
- 	release_firmware(fw);
- 
- 	if (!fw_wa)
-@@ -2993,6 +2996,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
- 		goto out;
- 	}
- 
-+	dev->wa_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
-+	memcpy(dev->wa_hdr, hdr, sizeof(*hdr));
-+
- 	snprintf(dev->hw->wiphy->fw_version,
- 		 sizeof(dev->hw->wiphy->fw_version),
- 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -3063,6 +3069,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
- 	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
- 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
- 
-+	dev->patch_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
-+	memcpy(dev->patch_hdr, hdr, sizeof(*hdr));
-+
- 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
- 		struct mt76_connac2_patch_sec *sec;
- 		u32 len, addr, mode;
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index b03ae39..583bc19 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -2722,6 +2722,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
- 	return 0;
- }
- 
-+static int mt7915_dump_version(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	struct mt76_dev *mdev = NULL;
-+	seq_printf(s, "Version: 2.2.8.0\n");
-+
-+	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
-+		return 0;
-+
-+	mdev = &dev->mt76;
-+	seq_printf(s, "Rom Patch Build Time: %.16s\n", mdev->patch_hdr->build_date);
-+	seq_printf(s, "WM Patch Build Time: %.16s\n", mdev->wm_hdr->build_date);
-+	seq_printf(s, "WA Patch Build Time: %.16s\n", mdev->wa_hdr->build_date);
-+	return 0;
-+}
-+
- /*usage: <en> <num> <len>
- 	en: BIT(16) 0: sw amsdu  1: hw amsdu
- 	num: GENMASK(15, 8) range 1-8
-@@ -2955,6 +2971,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- 
- 	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
- 
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
-+				    mt7915_dump_version);
-+
- 	return 0;
- }
- #endif
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-testmode-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-testmode-rework-testmode-init-registers.patch
deleted file mode 100644
index 2a37f4b..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-testmode-rework-testmode-init-registers.patch
+++ /dev/null
@@ -1,478 +0,0 @@
-From d6067c8dc5b9e8264efb1c1f8ac27d416364dee0 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1111/1131] mt76: testmode: rework testmode init registers
-
----
- mac80211.c        |   3 +-
- mt76.h            |   5 ++
- mt76_connac_mcu.h |   1 +
- mt7915/mcu.h      |   1 +
- mt7915/mmio.c     |   2 +
- mt7915/regs.h     |  16 +++++-
- mt7915/testmode.c | 134 +++++++++++++++++++++++++++++++++++-----------
- mt7915/testmode.h |  28 ++++++++++
- testmode.c        |   6 ++-
- testmode.h        |   3 ++
- 10 files changed, 164 insertions(+), 35 deletions(-)
-
-diff --git a/mac80211.c b/mac80211.c
-index 7fe7f68..19d9efb 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -775,7 +775,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
- 	}
- 
- #ifdef CONFIG_NL80211_TESTMODE
--	if (phy->test.state == MT76_TM_STATE_RX_FRAMES) {
-+	if (!(phy->test.flag & MT_TM_FW_RX_COUNT) &&
-+	    phy->test.state == MT76_TM_STATE_RX_FRAMES) {
- 		phy->test.rx_stats.packets[q]++;
- 		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
- 			phy->test.rx_stats.fcs_error[q]++;
-diff --git a/mt76.h b/mt76.h
-index beea57d..4822ffb 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -637,6 +637,8 @@ struct mt76_testmode_ops {
- 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
- };
- 
-+#define MT_TM_FW_RX_COUNT	BIT(0)
-+
- struct mt76_testmode_data {
- 	enum mt76_testmode_state state;
- 
-@@ -668,6 +670,8 @@ struct mt76_testmode_data {
- 
- 	u8 addr[3][ETH_ALEN];
- 
-+	u8 flag;
-+
- 	u32 tx_pending;
- 	u32 tx_queued;
- 	u16 tx_queued_limit;
-@@ -675,6 +679,7 @@ struct mt76_testmode_data {
- 	struct {
- 		u64 packets[__MT_RXQ_MAX];
- 		u64 fcs_error[__MT_RXQ_MAX];
-+		u64 len_mismatch;
- 	} rx_stats;
- };
- 
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18ae3ac..18d6c66 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1188,6 +1188,7 @@ enum {
- 	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
- 	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
- 	MCU_EXT_CMD_MURU_CTRL = 0x9f,
-+	MCU_EXT_CMD_RX_STAT = 0xa4,
- 	MCU_EXT_CMD_SET_SPR = 0xa8,
- 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
- 	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index eaadd33..2e97db7 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -9,6 +9,7 @@
- enum {
- 	MCU_ATE_SET_TRX = 0x1,
- 	MCU_ATE_SET_FREQ_OFFSET = 0xa,
-+	MCU_ATE_SET_PHY_COUNT = 0x11,
- 	MCU_ATE_SET_SLOT_TIME = 0x13,
- 	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
- };
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index afa558c..07de3cb 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
- };
- 
- static const u32 mt7915_offs[] = {
-+	[TMAC_TCR2]		= 0x05c,
- 	[TMAC_CDTR]		= 0x090,
- 	[TMAC_ODTR]		= 0x094,
- 	[TMAC_ATCR]		= 0x098,
-@@ -192,6 +193,7 @@ static const u32 mt7915_offs[] = {
- };
- 
- static const u32 mt7916_offs[] = {
-+	[TMAC_TCR2]		= 0x004,
- 	[TMAC_CDTR]		= 0x0c8,
- 	[TMAC_ODTR]		= 0x0cc,
- 	[TMAC_ATCR]		= 0x00c,
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index c8e478a..d6a05f1 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -48,6 +48,7 @@ enum reg_rev {
- };
- 
- enum offs_rev {
-+	TMAC_TCR2,
- 	TMAC_CDTR,
- 	TMAC_ODTR,
- 	TMAC_ATCR,
-@@ -198,6 +199,12 @@ enum offs_rev {
- #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
- #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
- 
-+#define MT_MDP_TOP_DBG_WDT_CTRL			MT_MDP(0x0d0)
-+#define MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK	BIT(7)
-+
-+#define MT_MDP_TOP_DBG_CTRL			MT_MDP(0x0dc)
-+#define MT_MDP_TOP_DBG_CTRL_ENQ_MODE		BIT(30)
-+
- /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
- #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
- #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -206,6 +213,9 @@ enum offs_rev {
- #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
- #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
- 
-+#define MT_TMAC_TCR2(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_TCR2))
-+#define MT_TMAC_TCR2_SCH_DET_DIS	BIT(19)
-+
- #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
-  #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
- #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -485,8 +495,10 @@ enum offs_rev {
- #define MT_AGG_PCR0_VHT_PROT		BIT(13)
- #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
- 
--#define MT_AGG_PCR1_RTS0_NUM_THRES	GENMASK(31, 23)
--#define MT_AGG_PCR1_RTS0_LEN_THRES	GENMASK(19, 0)
-+#define MT_AGG_PCR1_RTS0_NUM_THRES		GENMASK(31, 23)
-+#define MT_AGG_PCR1_RTS0_LEN_THRES		GENMASK(19, 0)
-+#define MT_AGG_PCR1_RTS0_NUM_THRES_MT7916	GENMASK(29, 24)
-+#define MT_AGG_PCR1_RTS0_LEN_THRES_MT7916	GENMASK(22, 0)
- 
- #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
- #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0d76ae3..4693919 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -30,7 +30,7 @@ struct reg_band {
- 		{ _list.band[0] = MT_##_reg(0, _idx);	\
- 		  _list.band[1] = MT_##_reg(1, _idx); }
- 
--#define TM_REG_MAX_ID	17
-+#define TM_REG_MAX_ID	20
- static struct reg_band reg_backup_list[TM_REG_MAX_ID];
- 
- 
-@@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
- 				 sizeof(req), false);
- }
- 
-+static int
-+mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_tm_cmd req = {
-+		.testmode_en = 1,
-+		.param_idx = MCU_ATE_SET_PHY_COUNT,
-+		.param.cfg.enable = control,
-+		.param.cfg.band = phy != &dev->phy,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-+				 sizeof(req), false);
-+}
-+
- static int
- mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
- {
-@@ -336,7 +351,7 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
- {
- 	int n_regs = ARRAY_SIZE(reg_backup_list);
- 	struct mt7915_dev *dev = phy->dev;
--	u32 *b = phy->test.reg_backup;
-+	u32 *b = phy->test.reg_backup, val;
- 	u8 band = phy->mt76->band_idx;
- 	int i;
- 
-@@ -349,18 +364,28 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
- 	REG_BAND(reg_backup_list[6], AGG_MRCR);
- 	REG_BAND(reg_backup_list[7], TMAC_TFCR0);
- 	REG_BAND(reg_backup_list[8], TMAC_TCR0);
--	REG_BAND(reg_backup_list[9], AGG_ATCR1);
--	REG_BAND(reg_backup_list[10], AGG_ATCR3);
--	REG_BAND(reg_backup_list[11], TMAC_TRCR0);
--	REG_BAND(reg_backup_list[12], TMAC_ICR0);
--	REG_BAND_IDX(reg_backup_list[13], ARB_DRNGR0, 0);
--	REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 1);
--	REG_BAND(reg_backup_list[15], WF_RFCR);
--	REG_BAND(reg_backup_list[16], WF_RFCR1);
-+	REG_BAND(reg_backup_list[9], TMAC_TCR2);
-+	REG_BAND(reg_backup_list[10], AGG_ATCR1);
-+	REG_BAND(reg_backup_list[11], AGG_ATCR3);
-+	REG_BAND(reg_backup_list[12], TMAC_TRCR0);
-+	REG_BAND(reg_backup_list[13], TMAC_ICR0);
-+	REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 0);
-+	REG_BAND_IDX(reg_backup_list[15], ARB_DRNGR0, 1);
-+	REG_BAND(reg_backup_list[16], WF_RFCR);
-+	REG_BAND(reg_backup_list[17], WF_RFCR1);
-+
-+	if (is_mt7916(&dev->mt76)) {
-+		reg_backup_list[18].band[band] = MT_MDP_TOP_DBG_WDT_CTRL;
-+		reg_backup_list[19].band[band] = MT_MDP_TOP_DBG_CTRL;
-+	}
- 
- 	if (phy->mt76->test.state == MT76_TM_STATE_OFF) {
--		for (i = 0; i < n_regs; i++)
--			mt76_wr(dev, reg_backup_list[i].band[band], b[i]);
-+		for (i = 0; i < n_regs; i++) {
-+			u8 reg = reg_backup_list[i].band[band];
-+
-+			if (reg)
-+				mt76_wr(dev, reg, b[i]);
-+		}
- 		return;
- 	}
- 
-@@ -380,8 +405,13 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
- 		   MT_AGG_PCR0_BW40_PROT | MT_AGG_PCR0_BW80_PROT);
- 	mt76_set(dev, MT_AGG_PCR0(band, 0), MT_AGG_PCR0_PTA_WIN_DIS);
- 
--	mt76_wr(dev, MT_AGG_PCR0(band, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
--		MT_AGG_PCR1_RTS0_LEN_THRES);
-+	if (is_mt7915(&dev->mt76))
-+		val = MT_AGG_PCR1_RTS0_NUM_THRES | MT_AGG_PCR1_RTS0_LEN_THRES;
-+	else
-+		val = MT_AGG_PCR1_RTS0_NUM_THRES_MT7916 |
-+		      MT_AGG_PCR1_RTS0_LEN_THRES_MT7916;
-+
-+	mt76_wr(dev, MT_AGG_PCR0(band, 1), val);
- 
- 	mt76_clear(dev, MT_AGG_MRCR(band), MT_AGG_MRCR_BAR_CNT_LIMIT |
- 		   MT_AGG_MRCR_LAST_RTS_CTS_RN | MT_AGG_MRCR_RTS_FAIL_LIMIT |
-@@ -394,10 +424,19 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
- 
- 	mt76_wr(dev, MT_TMAC_TFCR0(band), 0);
- 	mt76_clear(dev, MT_TMAC_TCR0(band), MT_TMAC_TCR0_TBTT_STOP_CTRL);
-+	mt76_set(dev, MT_TMAC_TCR2(band), MT_TMAC_TCR2_SCH_DET_DIS);
- 
- 	/* config rx filter for testmode rx */
- 	mt76_wr(dev, MT_WF_RFCR(band), 0xcf70a);
- 	mt76_wr(dev, MT_WF_RFCR1(band), 0);
-+
-+	if (is_mt7916(&dev->mt76)) {
-+		/* enable MDP Tx block mode */
-+		mt76_clear(dev, MT_MDP_TOP_DBG_WDT_CTRL,
-+			   MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK);
-+		mt76_clear(dev, MT_MDP_TOP_DBG_CTRL,
-+			   MT_MDP_TOP_DBG_CTRL_ENQ_MODE);
-+	}
- }
- 
- static void
-@@ -417,6 +456,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
- 	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
- 	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
- 
-+	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
-+
- 	if (!en)
- 		mt7915_tm_set_tam_arb(phy, en, 0);
- }
-@@ -479,18 +520,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
- }
- 
-+static int
-+mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
-+{
-+#define CMD_RX_STAT_BAND	0x3
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt7915_tm_rx_stat_band *rs_band;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct sk_buff *skb;
-+	struct {
-+		u8 format_id;
-+		u8 band;
-+		u8 _rsv[2];
-+	} __packed req = {
-+		.format_id = CMD_RX_STAT_BAND,
-+		.band = phy->mt76->band_idx,
-+	};
-+	int ret;
-+
-+	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(RX_STAT),
-+					&req, sizeof(req), true, &skb);
-+	if (ret)
-+		return ret;
-+
-+	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
-+	/* pr_info("mdrdy_cnt = %d\n", le32_to_cpu(rs_band->mdrdy_cnt)); */
-+	/* pr_info("fcs_err = %d\n", le16_to_cpu(rs_band->fcs_err)); */
-+	/* pr_info("len_mismatch = %d\n", le16_to_cpu(rs_band->len_mismatch)); */
-+	/* pr_info("fcs_ok = %d\n", le16_to_cpu(rs_band->fcs_succ)); */
-+
-+	if (!clear) {
-+		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
-+
-+		td->rx_stats.packets[q] += le32_to_cpu(rs_band->mdrdy_cnt);
-+		td->rx_stats.fcs_error[q] += le16_to_cpu(rs_band->fcs_err);
-+		td->rx_stats.len_mismatch += le16_to_cpu(rs_band->len_mismatch);
-+	}
-+
-+	dev_kfree_skb(skb);
-+
-+	return 0;
-+}
-+
- static void
- mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
- {
- 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
- 
- 	if (en) {
--		struct mt7915_dev *dev = phy->dev;
--
- 		mt7915_tm_update_channel(phy);
- 
- 		/* read-clear */
--		mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
-+		mt7915_tm_get_rx_stats(phy, true);
-+
-+		/* clear fw count */
-+		mt7915_tm_set_phy_count(phy, 0);
-+		mt7915_tm_set_phy_count(phy, 1);
-+
- 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
- 	}
- }
-@@ -721,12 +807,8 @@ static int
- mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
- {
- 	struct mt7915_phy *phy = mphy->priv;
--	struct mt7915_dev *dev = phy->dev;
--	enum mt76_rxq_id q;
- 	void *rx, *rssi;
--	u16 fcs_err;
- 	int i;
--	u32 cnt;
- 
- 	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
- 	if (!rx)
-@@ -770,15 +852,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
- 
- 	nla_nest_end(msg, rx);
- 
--	cnt = mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
--	fcs_err = is_mt7915(&dev->mt76) ? FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK, cnt) :
--		FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK_MT7916, cnt);
--
--	q = phy->mt76->band_idx ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
--	mphy->test.rx_stats.packets[q] += fcs_err;
--	mphy->test.rx_stats.fcs_error[q] += fcs_err;
--
--	return 0;
-+	return mt7915_tm_get_rx_stats(phy, false);
- }
- 
- const struct mt76_testmode_ops mt7915_testmode_ops = {
-diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac3..a1c54c8 100644
---- a/mt7915/testmode.h
-+++ b/mt7915/testmode.h
-@@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
- 	u8 rsv;
- };
- 
-+struct mt7915_tm_cfg {
-+	u8 enable;
-+	u8 band;
-+	u8 _rsv[2];
-+};
-+
- struct mt7915_tm_cmd {
- 	u8 testmode_en;
- 	u8 param_idx;
-@@ -43,6 +49,7 @@ struct mt7915_tm_cmd {
- 		struct mt7915_tm_freq_offset freq;
- 		struct mt7915_tm_slot_time slot;
- 		struct mt7915_tm_clean_txq clean;
-+		struct mt7915_tm_cfg cfg;
- 		u8 test[72];
- 	} param;
- } __packed;
-@@ -102,4 +109,25 @@ enum {
- 	TAM_ARB_OP_MODE_FORCE_SU = 5,
- };
- 
-+struct mt7915_tm_rx_stat_band {
-+	u8 category;
-+
-+	/* mac */
-+	__le16 fcs_err;
-+	__le16 len_mismatch;
-+	__le16 fcs_succ;
-+	__le32 mdrdy_cnt;
-+	/* phy */
-+	__le16 fcs_err_cck;
-+	__le16 fcs_err_ofdm;
-+	__le16 pd_cck;
-+	__le16 pd_ofdm;
-+	__le16 sig_err_cck;
-+	__le16 sfd_err_cck;
-+	__le16 sig_err_ofdm;
-+	__le16 tag_err_ofdm;
-+	__le16 mdrdy_cnt_cck;
-+	__le16 mdrdy_cnt_ofdm;
-+};
-+
- #endif
-diff --git a/testmode.c b/testmode.c
-index 0accc71..1d0d5d3 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
--	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
--			   &td->tx_antenna_mask, 0, 0xff) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask, 1, 0xff) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
- 			   &td->tx_duty_cycle, 0, 99) ||
-@@ -560,6 +559,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
- 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
- 			      MT76_TM_STATS_ATTR_PAD) ||
- 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
-+			      MT76_TM_STATS_ATTR_PAD) ||
-+	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
-+			      td->rx_stats.len_mismatch,
- 			      MT76_TM_STATS_ATTR_PAD))
- 		return -EMSGSIZE;
- 
-diff --git a/testmode.h b/testmode.h
-index 5e2792d..8961326 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -101,6 +101,8 @@ enum mt76_testmode_attr {
-  * @MT76_TM_STATS_ATTR_RX_FCS_ERROR: number of rx packets with FCS error (u64)
-  * @MT76_TM_STATS_ATTR_LAST_RX: information about the last received packet
-  *	see &enum mt76_testmode_rx_attr
-+ * @MT76_TM_STATS_ATTR_RX_LEN_MISMATCH: number of rx packets with length
-+ *	mismatch error (u64)
-  */
- enum mt76_testmode_stats_attr {
- 	MT76_TM_STATS_ATTR_UNSPEC,
-@@ -113,6 +115,7 @@ enum mt76_testmode_stats_attr {
- 	MT76_TM_STATS_ATTR_RX_PACKETS,
- 	MT76_TM_STATS_ATTR_RX_FCS_ERROR,
- 	MT76_TM_STATS_ATTR_LAST_RX,
-+	MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
- 
- 	/* keep last */
- 	NUM_MT76_TM_STATS_ATTRS,
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
deleted file mode 100644
index 7ea329f..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
+++ /dev/null
@@ -1,2929 +0,0 @@
-From 152f71de255dfaf82baeecf1d554152bc2ef3db2 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1112/1131] mt76: testmode: additional supports
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- dma.c             |    3 +-
- mac80211.c        |   12 +
- mt76.h            |  108 ++++-
- mt76_connac_mcu.c |    4 +
- mt76_connac_mcu.h |    2 +
- mt7915/init.c     |    2 +-
- mt7915/mac.c      |   37 +-
- mt7915/main.c     |    2 +-
- mt7915/mcu.c      |   10 +-
- mt7915/mcu.h      |   28 +-
- mt7915/mmio.c     |    2 +
- mt7915/mt7915.h   |   14 +-
- mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1172 ++++++++++++++++++++++++++++++++++++++++++---
- mt7915/testmode.h |  278 +++++++++++
- testmode.c        |  275 +++++++++--
- testmode.h        |   75 +++
- tools/fields.c    |   80 ++++
- tx.c              |    3 +-
- 19 files changed, 1963 insertions(+), 147 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index fc24b35..dc8d888 100644
---- a/dma.c
-+++ b/dma.c
-@@ -539,8 +539,7 @@ free:
- 	if (mt76_is_testmode_skb(dev, skb, &hw)) {
- 		struct mt76_phy *phy = hw->priv;
- 
--		if (tx_info.skb == phy->test.tx_skb)
--			phy->test.tx_done--;
-+		phy->test.tx_done--;
- 	}
- #endif
- 
-diff --git a/mac80211.c b/mac80211.c
-index 19d9efb..2e0e011 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
- 	CHAN5G(60, 5300),
- 	CHAN5G(64, 5320),
- 
-+	CHAN5G(68, 5340),
-+	CHAN5G(80, 5400),
-+	CHAN5G(84, 5420),
-+	CHAN5G(88, 5440),
-+	CHAN5G(92, 5460),
-+	CHAN5G(96, 5480),
-+
- 	CHAN5G(100, 5500),
- 	CHAN5G(104, 5520),
- 	CHAN5G(108, 5540),
-@@ -75,6 +82,11 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
- 	CHAN5G(165, 5825),
- 	CHAN5G(169, 5845),
- 	CHAN5G(173, 5865),
-+
-+	CHAN5G(184, 4920),
-+	CHAN5G(188, 4940),
-+	CHAN5G(192, 4960),
-+	CHAN5G(196, 4980),
- };
- 
- static const struct ieee80211_channel mt76_channels_6ghz[] = {
-diff --git a/mt76.h b/mt76.h
-index 4822ffb..58258e1 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -635,6 +635,21 @@ struct mt76_testmode_ops {
- 	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
- 			  enum mt76_testmode_state new_state);
- 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
-+	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
-+};
-+
-+struct mt76_testmode_entry_data {
-+	struct sk_buff *tx_skb;
-+
-+	u16 tx_mpdu_len;
-+	u8 tx_rate_idx;
-+	u8 tx_rate_nss;
-+	u8 tx_rate_ldpc;
-+
-+	u8 addr[3][ETH_ALEN];
-+	u8 aid;
-+	u8 ru_alloc;
-+	u8 ru_idx;
- };
- 
- #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -643,16 +658,11 @@ struct mt76_testmode_data {
- 	enum mt76_testmode_state state;
- 
- 	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
--	struct sk_buff *tx_skb;
- 
- 	u32 tx_count;
--	u16 tx_mpdu_len;
- 
- 	u8 tx_rate_mode;
--	u8 tx_rate_idx;
--	u8 tx_rate_nss;
- 	u8 tx_rate_sgi;
--	u8 tx_rate_ldpc;
- 	u8 tx_rate_stbc;
- 	u8 tx_ltf;
- 
-@@ -668,10 +678,37 @@ struct mt76_testmode_data {
- 	u8 tx_power[4];
- 	u8 tx_power_control;
- 
--	u8 addr[3][ETH_ALEN];
-+	struct list_head tm_entry_list;
-+	struct mt76_wcid *cur_entry;
-+	u8 entry_num;
-+	union {
-+		struct mt76_testmode_entry_data ed;
-+		struct {
-+			/* must be the same as mt76_testmode_entry_data */
-+			struct sk_buff *tx_skb;
-+
-+			u16 tx_mpdu_len;
-+			u8 tx_rate_idx;
-+			u8 tx_rate_nss;
-+			u8 tx_rate_ldpc;
-+
-+			u8 addr[3][ETH_ALEN];
-+			u8 aid;
-+			u8 ru_alloc;
-+			u8 ru_idx;
-+		};
-+	};
- 
- 	u8 flag;
- 
-+	struct {
-+		u8 type;
-+		u8 enable;
-+	} cfg;
-+
-+	u8 txbf_act;
-+	u16 txbf_param[8];
-+
- 	u32 tx_pending;
- 	u32 tx_queued;
- 	u16 tx_queued_limit;
-@@ -1135,6 +1172,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
- #endif
- }
- 
-+#ifdef CONFIG_NL80211_TESTMODE
-+static inline struct mt76_wcid *
-+mt76_testmode_first_entry(struct mt76_phy *phy)
-+{
-+	if (list_empty(&phy->test.tm_entry_list) && !phy->test.aid)
-+		return &phy->dev->global_wcid;
-+
-+	return list_first_entry(&phy->test.tm_entry_list,
-+				typeof(struct mt76_wcid),
-+				list);
-+}
-+
-+static inline struct mt76_testmode_entry_data *
-+mt76_testmode_entry_data(struct mt76_phy *phy, struct mt76_wcid *wcid)
-+{
-+	if (!wcid)
-+		return NULL;
-+	if (wcid == &phy->dev->global_wcid)
-+		return &phy->test.ed;
-+
-+	return (struct mt76_testmode_entry_data *)((u8 *)wcid +
-+						   phy->hw->sta_data_size);
-+}
-+
-+#define mt76_tm_for_each_entry(phy, wcid, ed)				\
-+	for (wcid = mt76_testmode_first_entry(phy),			\
-+	     ed = mt76_testmode_entry_data(phy, wcid);			\
-+	     ((phy->test.aid &&						\
-+	       !list_entry_is_head(wcid, &phy->test.tm_entry_list, list)) ||	\
-+	      (!phy->test.aid && wcid == &phy->dev->global_wcid)) && ed;	\
-+	     wcid = list_next_entry(wcid, list),			\
-+	     ed = mt76_testmode_entry_data(phy, wcid))
-+#endif
-+
-+static inline bool __mt76_is_testmode_skb(struct mt76_phy *phy,
-+					  struct sk_buff *skb)
-+{
-+#ifdef CONFIG_NL80211_TESTMODE
-+	struct mt76_testmode_entry_data *ed = &phy->test.ed;
-+	struct mt76_wcid *wcid;
-+
-+	if (skb == ed->tx_skb)
-+		return true;
-+
-+	mt76_tm_for_each_entry(phy, wcid, ed)
-+		if (skb == ed->tx_skb)
-+			return true;
-+	return false;
-+#else
-+	return false;
-+#endif
-+}
-+
- static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
- 					struct sk_buff *skb,
- 					struct ieee80211_hw **hw)
-@@ -1145,7 +1235,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
- 	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
- 		struct mt76_phy *phy = dev->phys[i];
- 
--		if (phy && skb == phy->test.tx_skb) {
-+		if (phy && mt76_testmode_enabled(phy) &&
-+		    __mt76_is_testmode_skb(phy, skb)) {
- 			*hw = dev->phys[i]->hw;
- 			return true;
- 		}
-@@ -1247,7 +1338,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
- 		       struct netlink_callback *cb, void *data, int len);
- int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
--int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
-+int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len,
-+			   struct sk_buff **tx_skb, u8 (*addr)[ETH_ALEN]);
- 
- static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
- {
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index cf6ec55..291a7c1 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_MESH_POINT:
- 	case NL80211_IFTYPE_AP:
-+	case NL80211_IFTYPE_MONITOR:
- 		if (vif->p2p)
- 			conn_type = CONNECTION_P2P_GC;
- 		else
-@@ -575,6 +576,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
- 	rx->rca2 = 1;
- 	rx->rv = 1;
- 
-+	if (vif->type == NL80211_IFTYPE_MONITOR)
-+		rx->rca1 = 0;
-+
- 	if (!is_connac_v1(dev))
- 		return;
- 
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18d6c66..a8ce98c 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -994,6 +994,7 @@ enum {
- 	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
- 	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
- 	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
-+	MCU_EXT_EVENT_BF_STATUS_READ = 0x35,
- 	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
- 	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
- 	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1195,6 +1196,7 @@ enum {
- 	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
- 	/* for vendor csi and air monitor */
- 	MCU_EXT_CMD_SMESH_CTRL = 0xae,
-+	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
- 	MCU_EXT_CMD_CERT_CFG = 0xb7,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- };
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 00ddab7..e044f50 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -687,7 +687,7 @@ static void mt7915_init_work(struct work_struct *work)
- 	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
- 				 init_work);
- 
--	mt7915_mcu_set_eeprom(dev);
-+	mt7915_mcu_set_eeprom(dev, dev->flash_mode);
- 	mt7915_mac_init(dev);
- 	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
- 	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index fc7b790..0746e4b 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -628,16 +628,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
- {
- #ifdef CONFIG_NL80211_TESTMODE
- 	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_testmode_entry_data *ed;
-+	struct mt76_wcid *wcid;
- 	const struct ieee80211_rate *r;
--	u8 bw, mode, nss = td->tx_rate_nss;
--	u8 rate_idx = td->tx_rate_idx;
-+	u8 bw, mode, nss, rate_idx, ldpc;
- 	u16 rateval = 0;
- 	u32 val;
- 	bool cck = false;
- 	int band;
- 
--	if (skb != phy->mt76->test.tx_skb)
-+	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
-+	txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
-+					  phy->test.spe_idx));
-+
-+	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU) {
-+		txwi[1] |= cpu_to_le32(BIT(18));
-+		txwi[2] = 0;
-+		txwi[3] &= ~cpu_to_le32(MT_TXD3_NO_ACK);
-+		le32p_replace_bits(&txwi[3], 0x1f, MT_TXD3_REM_TX_COUNT);
-+
- 		return;
-+	}
-+
-+	mt76_tm_for_each_entry(phy->mt76, wcid, ed)
-+		if (ed->tx_skb == skb)
-+			break;
-+
-+	if (!ed)
-+		return;
-+
-+	nss = ed->tx_rate_nss;
-+	rate_idx = ed->tx_rate_idx;
-+	ldpc = ed->tx_rate_ldpc;
- 
- 	switch (td->tx_rate_mode) {
- 	case MT76_TM_TX_MODE_HT:
-@@ -727,13 +749,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
- 	if (mode >= MT_PHY_TYPE_HE_SU)
- 		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
- 
--	if (td->tx_rate_ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
-+	if (ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
- 		val |= MT_TXD6_LDPC;
- 
- 	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
-+	if (phy->test.bf_en)
-+		val |= MT_TXD6_TX_IBF | MT_TXD6_TX_EBF;
-+
- 	txwi[6] |= cpu_to_le32(val);
--	txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
--					  phy->test.spe_idx));
- #endif
- }
- 
-@@ -1483,7 +1506,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
- 		goto out;
- 
- 	/* set the necessary init items */
--	ret = mt7915_mcu_set_eeprom(dev);
-+	ret = mt7915_mcu_set_eeprom(dev, dev->flash_mode);
- 	if (ret)
- 		goto out;
- 
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 2c4e392..4c3d822 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
- 	mvif->phy = phy;
- 	mvif->mt76.band_idx = phy->mt76->band_idx;
- 
--	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
-+	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP && vif->type != NL80211_IFTYPE_MONITOR);
- 	if (ext_phy)
- 		mvif->mt76.wmm_idx += 2;
- 
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7728e82..85450ea 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -383,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
- 	case MCU_EXT_EVENT_BCC_NOTIFY:
- 		mt7915_mcu_rx_bcc_notify(dev, skb);
- 		break;
-+#ifdef CONFIG_NL80211_TESTMODE
-+	case MCU_EXT_EVENT_BF_STATUS_READ:
-+		mt7915_tm_txbf_status_read(dev, skb);
-+		break;
-+#endif
- 	default:
- 		break;
- 	}
-@@ -414,6 +419,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
- 	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
- 	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
- 	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
-+	    rxd->ext_eid == MCU_EXT_EVENT_BF_STATUS_READ ||
- 	    !rxd->seq)
- 		mt7915_mcu_rx_unsolicited_event(dev, skb);
- 	else
-@@ -2798,14 +2804,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
- 	return 0;
- }
- 
--int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
-+int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
- {
- 	struct mt7915_mcu_eeprom req = {
- 		.buffer_mode = EE_MODE_EFUSE,
- 		.format = EE_FORMAT_WHOLE,
- 	};
- 
--	if (dev->flash_mode)
-+	if (flash_mode)
- 		return mt7915_mcu_set_eeprom_flash(dev);
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 2e97db7..4d86c7f 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -8,10 +8,15 @@
- 
- enum {
- 	MCU_ATE_SET_TRX = 0x1,
-+	MCU_ATE_SET_TSSI = 0x5,
-+	MCU_ATE_SET_DPD = 0x6,
-+	MCU_ATE_SET_RATE_POWER_OFFSET = 0x7,
-+	MCU_ATE_SET_THERMAL_COMP = 0x8,
- 	MCU_ATE_SET_FREQ_OFFSET = 0xa,
- 	MCU_ATE_SET_PHY_COUNT = 0x11,
- 	MCU_ATE_SET_SLOT_TIME = 0x13,
- 	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
-+	MCU_ATE_SET_MU_RX_AID = 0x1e,
- };
- 
- struct mt7915_mcu_thermal_ctrl {
-@@ -471,6 +476,12 @@ enum {
- 
- enum {
- 	MT_BF_SOUNDING_ON = 1,
-+	MT_BF_DATA_PACKET_APPLY = 2,
-+	MT_BF_PFMU_TAG_READ = 5,
-+	MT_BF_PFMU_TAG_WRITE = 6,
-+	MT_BF_PHASE_CAL = 14,
-+	MT_BF_IBF_PHASE_COMP = 15,
-+	MT_BF_PROFILE_WRITE_ALL = 17,
- 	MT_BF_TYPE_UPDATE = 20,
- 	MT_BF_MODULE_UPDATE = 25
- };
-@@ -717,10 +728,19 @@ struct mt7915_muru {
- #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
- 
- /* Common Config */
--#define MURU_COMM_PPDU_FMT              BIT(0)
--#define MURU_COMM_SCH_TYPE              BIT(1)
--#define MURU_COMM_SET                   (MURU_COMM_PPDU_FMT | MURU_COMM_SCH_TYPE)
--/* DL&UL User config*/
-+/* #define MURU_COMM_PPDU_FMT              BIT(0) */
-+/* #define MURU_COMM_SCH_TYPE              BIT(1) */
-+/* #define MURU_COMM_SET                   (MURU_COMM_PPDU_FMT | MURU_COMM_SCH_TYPE) */
-+#define MURU_COMM_PPDU_FMT     BIT(0)
-+#define MURU_COMM_SCH_TYPE     BIT(1)
-+#define MURU_COMM_BAND         BIT(2)
-+#define MURU_COMM_WMM          BIT(3)
-+#define MURU_COMM_SPE_IDX      BIT(4)
-+#define MURU_COMM_PROC_TYPE        BIT(5)
-+#define MURU_COMM_SET      (MURU_COMM_PPDU_FMT | MURU_COMM_BAND | \
-+				MURU_COMM_WMM | MURU_COMM_SPE_IDX)
-+
-+/* DL&UL User config */
- #define MURU_USER_CNT                   BIT(4)
- 
- enum {
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 07de3cb..26881fd 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
- 	[ARB_DRNGR0]		= 0x194,
- 	[ARB_SCR]		= 0x080,
- 	[RMAC_MIB_AIRTIME14]	= 0x3b8,
-+	[AGG_AALCR0]		= 0x048,
- 	[AGG_AWSCR0]		= 0x05c,
- 	[AGG_PCR0]		= 0x06c,
- 	[AGG_ACR0]		= 0x084,
-@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
- 	[ARB_DRNGR0]		= 0x1e0,
- 	[ARB_SCR]		= 0x000,
- 	[RMAC_MIB_AIRTIME14]	= 0x0398,
-+	[AGG_AALCR0]		= 0x028,
- 	[AGG_AWSCR0]		= 0x030,
- 	[AGG_PCR0]		= 0x040,
- 	[AGG_ACR0]		= 0x054,
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9fdb80b..4336f20 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -320,6 +320,9 @@ struct mt7915_phy {
- 		u8 last_snr;
- 
- 		u8 spe_idx;
-+
-+		bool bf_en;
-+		bool bf_ever_en;
- 	} test;
- #endif
- 
-@@ -419,6 +422,14 @@ struct mt7915_dev {
- 	void __iomem *dcm;
- 	void __iomem *sku;
- 
-+#ifdef CONFIG_NL80211_TESTMODE
-+	struct {
-+		void *txbf_phase_cal;
-+		void *txbf_pfmu_data;
-+		void *txbf_pfmu_tag;
-+	} test;
-+#endif
-+
- #ifdef MTK_DEBUG
- 	u16 wlan_idx;
- 	struct {
-@@ -590,7 +601,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
- 				   struct ieee80211_vif *vif,
- 				   struct ieee80211_sta *sta,
- 				   void *data, u32 field);
--int mt7915_mcu_set_eeprom(struct mt7915_dev *dev);
-+int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
- int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
- int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
- int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -628,6 +639,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
- int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
- void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
- void mt7915_mcu_exit(struct mt7915_dev *dev);
-+int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
- 
- static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
- {
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index d6a05f1..e876848 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -62,6 +62,7 @@ enum offs_rev {
- 	ARB_DRNGR0,
- 	ARB_SCR,
- 	RMAC_MIB_AIRTIME14,
-+	AGG_AALCR0,
- 	AGG_AWSCR0,
- 	AGG_PCR0,
- 	AGG_ACR0,
-@@ -482,6 +483,8 @@ enum offs_rev {
- #define MT_WF_AGG_BASE(_band)		((_band) ? 0x820f2000 : 0x820e2000)
- #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
- 
-+#define MT_AGG_AALCR0(_band, _n)	MT_WF_AGG(_band, (__OFFS(AGG_AALCR0) +	\
-+			                                  (_n) * 4))
- #define MT_AGG_AWSCR0(_band, _n)	MT_WF_AGG(_band, (__OFFS(AGG_AWSCR0) +	\
- 							  (_n) * 4))
- #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4693919..e0ba088 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -9,6 +9,9 @@
- enum {
- 	TM_CHANGED_TXPOWER,
- 	TM_CHANGED_FREQ_OFFSET,
-+	TM_CHANGED_AID,
-+	TM_CHANGED_CFG,
-+	TM_CHANGED_TXBF_ACT,
- 
- 	/* must be last */
- 	NUM_TM_CHANGED
-@@ -17,6 +20,9 @@ enum {
- static const u8 tm_change_map[] = {
- 	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
- 	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
-+	[TM_CHANGED_AID] = MT76_TM_ATTR_AID,
-+	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
-+	[TM_CHANGED_TXBF_ACT] = MT76_TM_ATTR_TXBF_ACT,
- };
- 
- struct reg_band {
-@@ -33,6 +39,38 @@ struct reg_band {
- #define TM_REG_MAX_ID	20
- static struct reg_band reg_backup_list[TM_REG_MAX_ID];
- 
-+static void mt7915_tm_update_entry(struct mt7915_phy *phy);
-+
-+static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
-+{
-+	static const u8 width_to_bw[] = {
-+		[NL80211_CHAN_WIDTH_40] = TM_CBW_40MHZ,
-+		[NL80211_CHAN_WIDTH_80] = TM_CBW_80MHZ,
-+		[NL80211_CHAN_WIDTH_80P80] = TM_CBW_8080MHZ,
-+		[NL80211_CHAN_WIDTH_160] = TM_CBW_160MHZ,
-+		[NL80211_CHAN_WIDTH_5] = TM_CBW_5MHZ,
-+		[NL80211_CHAN_WIDTH_10] = TM_CBW_10MHZ,
-+		[NL80211_CHAN_WIDTH_20] = TM_CBW_20MHZ,
-+		[NL80211_CHAN_WIDTH_20_NOHT] = TM_CBW_20MHZ,
-+	};
-+
-+	if (width >= ARRAY_SIZE(width_to_bw))
-+		return 0;
-+
-+	return width_to_bw[width];
-+}
-+
-+static void
-+mt7915_tm_update_channel(struct mt7915_phy *phy)
-+{
-+	mutex_unlock(&phy->dev->mt76.mutex);
-+	mt7915_set_channel(phy);
-+	mutex_lock(&phy->dev->mt76.mutex);
-+
-+	mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(SET_RX_PATH));
-+
-+	mt7915_tm_update_entry(phy);
-+}
- 
- static int
- mt7915_tm_set_tx_power(struct mt7915_phy *phy)
-@@ -119,18 +157,28 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
- }
- 
- static int
--mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
-+mt7915_tm_clean_hwq(struct mt7915_phy *phy)
- {
-+	struct mt76_testmode_entry_data *ed;
-+	struct mt76_wcid *wcid;
- 	struct mt7915_dev *dev = phy->dev;
- 	struct mt7915_tm_cmd req = {
- 		.testmode_en = 1,
- 		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
--		.param.clean.wcid = wcid,
- 		.param.clean.band = phy->mt76->band_idx,
- 	};
- 
--	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
--				 sizeof(req), false);
-+	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
-+		int ret;
-+
-+		req.param.clean.wcid = wcid->idx;
-+		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
-+					&req, sizeof(req), false);
-+		if (ret)
-+			return ret;
-+	}
-+
-+	return 0;
- }
- 
- static int
-@@ -141,7 +189,7 @@ mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
- 		.testmode_en = 1,
- 		.param_idx = MCU_ATE_SET_PHY_COUNT,
- 		.param.cfg.enable = control,
--		.param.cfg.band = phy != &dev->phy,
-+		.param.cfg.band = phy->mt76->band_idx,
- 	};
- 
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-@@ -182,12 +230,738 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
- 	return mt7915_mcu_set_muru_ctrl(dev, MURU_SET_ARB_OP_MODE, op_mode);
- }
- 
-+static int
-+mt7915_tm_set_cfg(struct mt7915_phy *phy)
-+{
-+	static const u8 cfg_cmd[] = {
-+		[MT76_TM_CFG_TSSI] = MCU_ATE_SET_TSSI,
-+		[MT76_TM_CFG_DPD] = MCU_ATE_SET_DPD,
-+		[MT76_TM_CFG_RATE_POWER_OFFSET] = MCU_ATE_SET_RATE_POWER_OFFSET,
-+		[MT76_TM_CFG_THERMAL_COMP] = MCU_ATE_SET_THERMAL_COMP,
-+	};
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_tm_cmd req = {
-+		.testmode_en = !(phy->mt76->test.state == MT76_TM_STATE_OFF),
-+		.param_idx = cfg_cmd[td->cfg.type],
-+		.param.cfg.enable = td->cfg.enable,
-+		.param.cfg.band = phy->mt76->band_idx,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-+				 sizeof(req), false);
-+}
-+
-+static int
-+mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
-+		   struct ieee80211_sta *sta, u8 pfmu_idx, u8 nr,
-+		   u8 nc, bool ebf)
-+{
-+	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct sk_buff *skb;
-+	struct sta_rec_bf *bf;
-+	struct tlv *tlv;
-+	u8 ndp_rate;
-+
-+	if (nr == 1)
-+		ndp_rate = 8;
-+	else if (nr == 2)
-+		ndp_rate = 16;
-+	else
-+		ndp_rate = 24;
-+
-+	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
-+					    &msta->wcid);
-+	if (IS_ERR(skb))
-+		return PTR_ERR(skb);
-+
-+	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BF, sizeof(*bf));
-+	bf = (struct sta_rec_bf *)tlv;
-+
-+	bf->pfmu = cpu_to_le16(pfmu_idx);
-+	bf->sounding_phy = 1;
-+	bf->bf_cap = ebf;
-+	bf->ncol = nc;
-+	bf->nrow = nr;
-+	bf->ndp_rate = ndp_rate;
-+	bf->ibf_timeout = 0xff;
-+	bf->tx_mode = MT_PHY_TYPE_HT;
-+
-+	if (ebf) {
-+		bf->mem[0].row = 0;
-+		bf->mem[1].row = 1;
-+		bf->mem[2].row = 2;
-+		bf->mem[3].row = 3;
-+	} else {
-+		bf->mem[0].row = 4;
-+		bf->mem[1].row = 5;
-+		bf->mem[2].row = 6;
-+		bf->mem[3].row = 7;
-+	}
-+
-+	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
-+				     MCU_EXT_CMD(STA_REC_UPDATE), true);
-+}
-+
-+static int
-+mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_testmode_entry_data *ed;
-+	struct ieee80211_sband_iftype_data *sdata;
-+	struct ieee80211_supported_band *sband;
-+	struct ieee80211_sta *sta;
-+	struct mt7915_sta *msta;
-+	int tid, ret;
-+
-+	if (td->entry_num >= MT76_TM_MAX_ENTRY_NUM)
-+		return -EINVAL;
-+
-+	sta = kzalloc(sizeof(*sta) + phy->mt76->hw->sta_data_size +
-+		      sizeof(*ed), GFP_KERNEL);
-+	if (!sta)
-+		return -ENOMEM;
-+
-+	msta = (struct mt7915_sta *)sta->drv_priv;
-+	ed = mt76_testmode_entry_data(phy->mt76, &msta->wcid);
-+	memcpy(ed, &td->ed, sizeof(*ed));
-+
-+	if (phy->mt76->chandef.chan->band == NL80211_BAND_5GHZ) {
-+		sband = &phy->mt76->sband_5g.sband;
-+		sdata = phy->iftype[NL80211_BAND_5GHZ];
-+	} else if (phy->mt76->chandef.chan->band == NL80211_BAND_6GHZ) {
-+		sband = &phy->mt76->sband_6g.sband;
-+		sdata = phy->iftype[NL80211_BAND_6GHZ];
-+	} else {
-+		sband = &phy->mt76->sband_2g.sband;
-+		sdata = phy->iftype[NL80211_BAND_2GHZ];
-+	}
-+
-+	memcpy(sta->addr, ed->addr[0], ETH_ALEN);
-+	if (phy->test.bf_en) {
-+		u8 addr[ETH_ALEN] = {0x00, 0x11, 0x11, 0x11, 0x11, 0x11};
-+
-+		memcpy(sta->addr, addr, ETH_ALEN);
-+	}
-+
-+	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
-+		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
-+	if (td->tx_rate_mode >= MT76_TM_TX_MODE_VHT)
-+		memcpy(&sta->deflink.vht_cap, &sband->vht_cap, sizeof(sta->deflink.vht_cap));
-+	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_SU)
-+		memcpy(&sta->deflink.he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
-+		       sizeof(sta->deflink.he_cap));
-+	sta->aid = aid;
-+	sta->wme = 1;
-+
-+	ret = mt7915_mac_sta_add(&phy->dev->mt76, phy->monitor_vif, sta);
-+	if (ret) {
-+		kfree(sta);
-+		return ret;
-+	}
-+
-+	/* prevent from starting tx ba session */
-+	for (tid = 0; tid < 8; tid++)
-+		set_bit(tid, &msta->ampdu_state);
-+
-+	list_add_tail(&msta->wcid.list, &td->tm_entry_list);
-+	td->entry_num++;
-+
-+	return 0;
-+}
-+
-+static void
-+mt7915_tm_entry_remove(struct mt7915_phy *phy, u8 aid)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_wcid *wcid, *tmp;
-+
-+	if (list_empty(&td->tm_entry_list))
-+		return;
-+
-+	list_for_each_entry_safe(wcid, tmp, &td->tm_entry_list, list) {
-+		struct mt76_testmode_entry_data *ed;
-+		struct mt7915_dev *dev = phy->dev;
-+		struct ieee80211_sta *sta;
-+
-+		ed = mt76_testmode_entry_data(phy->mt76, wcid);
-+		if (aid && ed->aid != aid)
-+			continue;
-+
-+		sta = wcid_to_sta(wcid);
-+		mt7915_mac_sta_remove(&dev->mt76, phy->monitor_vif, sta);
-+		mt76_wcid_mask_clear(dev->mt76.wcid_mask, wcid->idx);
-+
-+		list_del_init(&wcid->list);
-+		kfree(sta);
-+		phy->mt76->test.entry_num--;
-+	}
-+}
-+
-+static int
-+mt7915_tm_set_entry(struct mt7915_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_testmode_entry_data *ed;
-+	struct mt76_wcid *wcid;
-+
-+	if (!td->aid) {
-+		if (td->state > MT76_TM_STATE_IDLE)
-+			mt76_testmode_set_state(phy->mt76, MT76_TM_STATE_IDLE);
-+		mt7915_tm_entry_remove(phy, td->aid);
-+		return 0;
-+	}
-+
-+	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
-+		if (ed->aid == td->aid) {
-+			struct sk_buff *skb;
-+
-+			local_bh_disable();
-+			skb = ed->tx_skb;
-+			memcpy(ed, &td->ed, sizeof(*ed));
-+			ed->tx_skb = skb;
-+			local_bh_enable();
-+
-+			return 0;
-+		}
-+	}
-+
-+	return mt7915_tm_entry_add(phy, td->aid);
-+}
-+
-+static void
-+mt7915_tm_update_entry(struct mt7915_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_testmode_entry_data *ed, tmp;
-+	struct mt76_wcid *wcid, *last;
-+
-+	if (!td->aid || phy->test.bf_en)
-+		return;
-+
-+	memcpy(&tmp, &td->ed, sizeof(tmp));
-+	last = list_last_entry(&td->tm_entry_list,
-+			       struct mt76_wcid, list);
-+
-+	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
-+		memcpy(&td->ed, ed, sizeof(td->ed));
-+		mt7915_tm_entry_remove(phy, td->aid);
-+		mt7915_tm_entry_add(phy, td->aid);
-+		if (wcid == last)
-+			break;
-+	}
-+
-+	memcpy(&td->ed, &tmp, sizeof(td->ed));
-+}
-+
-+static int
-+mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt7915_dev *dev = phy->dev;
-+	bool enable = val[0];
-+	void *phase_cal, *pfmu_data, *pfmu_tag;
-+	u8 addr[ETH_ALEN] = {0x00, 0x22, 0x22, 0x22, 0x22, 0x22};
-+
-+	if (!enable) {
-+		phy->test.bf_en = 0;
-+		return 0;
-+	}
-+
-+	if (!dev->test.txbf_phase_cal) {
-+		phase_cal = devm_kzalloc(dev->mt76.dev,
-+					 sizeof(struct mt7915_tm_txbf_phase) *
-+					 MAX_PHASE_GROUP_NUM,
-+					 GFP_KERNEL);
-+		if (!phase_cal)
-+			return -ENOMEM;
-+
-+		dev->test.txbf_phase_cal = phase_cal;
-+	}
-+
-+	if (!dev->test.txbf_pfmu_data) {
-+		pfmu_data = devm_kzalloc(dev->mt76.dev, 512, GFP_KERNEL);
-+		if (!pfmu_data)
-+			return -ENOMEM;
-+
-+		dev->test.txbf_pfmu_data = pfmu_data;
-+	}
-+
-+	if (!dev->test.txbf_pfmu_tag) {
-+		pfmu_tag = devm_kzalloc(dev->mt76.dev,
-+					sizeof(struct mt7915_tm_pfmu_tag), GFP_KERNEL);
-+		if (!pfmu_tag)
-+			return -ENOMEM;
-+
-+		dev->test.txbf_pfmu_tag = pfmu_tag;
-+	}
-+
-+	memcpy(phy->monitor_vif->addr, addr, ETH_ALEN);
-+	mt7915_mcu_add_dev_info(phy, phy->monitor_vif, true);
-+
-+	td->tx_rate_mode = MT76_TM_TX_MODE_HT;
-+	td->tx_mpdu_len = 1024;
-+	td->tx_rate_sgi = 0;
-+	td->tx_ipg = 100;
-+	phy->test.bf_en = 1;
-+
-+	return mt7915_tm_set_trx(phy, TM_MAC_TX, true);
-+}
-+
-+static int
-+mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 category;
-+		u8 wlan_idx_lo;
-+		u8 bw;
-+		u8 jp_band;
-+		u8 dbdc_idx;
-+		bool read_from_e2p;
-+		bool disable;
-+		u8 wlan_idx_hi;
-+		u8 buf[40];
-+	} __packed req = {
-+		.category = MT_BF_IBF_PHASE_COMP,
-+		.bw = val[0],
-+		.jp_band = (val[2] == 1) ? 1 : 0,
-+		.dbdc_idx = phy->mt76->band_idx,
-+		.read_from_e2p = val[3],
-+		.disable = val[4],
-+	};
-+	struct mt7915_tm_txbf_phase *phase =
-+		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
-+
-+	wait_event_timeout(dev->mt76.tx_wait, phase[val[2]].status != 0, HZ);
-+	memcpy(req.buf, &phase[val[2]].phase, sizeof(req.buf));
-+
-+	pr_info("ibf cal process: phase comp info\n");
-+	print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, 16, 1,
-+		       &req, sizeof(req), 0);
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
-+				 sizeof(req), true);
-+}
-+
-+static int
-+mt7915_tm_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 format_id;
-+		u8 pfmu_idx;
-+		bool bfer;
-+		u8 dbdc_idx;
-+	} __packed req = {
-+		.format_id = MT_BF_PFMU_TAG_READ,
-+		.pfmu_idx = pfmu_idx,
-+		.bfer = 1,
-+		.dbdc_idx = phy != &dev->phy,
-+	};
-+	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
-+
-+	tag->t1.pfmu_idx = 0;
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
-+				 sizeof(req), true);
-+}
-+
-+static int
-+mt7915_tm_txbf_profile_tag_write(struct mt7915_phy *phy, u8 pfmu_idx,
-+				 struct mt7915_tm_pfmu_tag *tag)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 format_id;
-+		u8 pfmu_idx;
-+		bool bfer;
-+		u8 dbdc_idx;
-+		u8 buf[64];
-+	} __packed req = {
-+		.format_id = MT_BF_PFMU_TAG_WRITE,
-+		.pfmu_idx = pfmu_idx,
-+		.bfer = 1,
-+		.dbdc_idx = phy != &dev->phy,
-+	};
-+
-+	memcpy(req.buf, tag, sizeof(*tag));
-+	wait_event_timeout(dev->mt76.tx_wait, tag->t1.pfmu_idx != 0, HZ);
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
-+				 sizeof(req), false);
-+}
-+
-+static int
-+mt7915_tm_txbf_apply_tx(struct mt7915_phy *phy, u16 wlan_idx, bool ebf,
-+			bool ibf, bool phase_cal)
-+{
-+#define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
-+#define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 category;
-+		u8 wlan_idx_lo;
-+		bool ebf;
-+		bool ibf;
-+		bool mu_txbf;
-+		bool phase_cal;
-+		u8 wlan_idx_hi;
-+		u8 _rsv;
-+	} __packed req = {
-+		.category = MT_BF_DATA_PACKET_APPLY,
-+		.wlan_idx_lo = to_wcid_lo(wlan_idx),
-+		.ebf = ebf,
-+		.ibf = ibf,
-+		.phase_cal = phase_cal,
-+		.wlan_idx_hi = to_wcid_hi(wlan_idx),
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
-+				 sizeof(req), false);
-+}
-+
-+static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
-+				   struct mt76_wcid *wcid)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_testmode_entry_data *ed = mt76_testmode_entry_data(phy->mt76, wcid);
-+	struct ieee80211_sta *sta = wcid_to_sta(wcid);
-+	struct sta_phy rate = {};
-+
-+	if (!sta)
-+		return 0;
-+
-+	rate.type = MT_PHY_TYPE_HT;
-+	rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
-+	rate.nss = ed->tx_rate_nss;
-+	rate.mcs = ed->tx_rate_idx;
-+	rate.ldpc = (rate.bw || ed->tx_rate_ldpc) * GENMASK(2, 0);
-+
-+	return mt7915_mcu_set_fixed_rate_ctrl(dev, phy->monitor_vif, sta,
-+					      &rate, RATE_PARAM_FIXED);
-+}
-+
-+static int
-+mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
-+{
-+	bool bf_on = val[0], update = val[3];
-+	/* u16 wlan_idx = val[2]; */
-+	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_wcid *wcid;
-+
-+	if (bf_on) {
-+		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
-+		mt7915_tm_txbf_profile_tag_read(phy, 2);
-+		tag->t1.invalid_prof = false;
-+		mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
-+
-+		phy->test.bf_ever_en = true;
-+
-+		if (update)
-+			mt7915_tm_txbf_apply_tx(phy, 1, 0, 1, 1);
-+	} else {
-+		if (!phy->test.bf_ever_en) {
-+			if (update)
-+				mt7915_tm_txbf_apply_tx(phy, 1, 0, 0, 0);
-+		} else {
-+			phy->test.bf_ever_en = false;
-+
-+			mt7915_tm_txbf_profile_tag_read(phy, 2);
-+			tag->t1.invalid_prof = true;
-+			mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
-+		}
-+	}
-+
-+	wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
-+	mt7915_tm_txbf_set_rate(phy, wcid);
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
-+{
-+	static const u8 mode_to_lm[] = {
-+		[MT76_TM_TX_MODE_CCK] = 0,
-+		[MT76_TM_TX_MODE_OFDM] = 0,
-+		[MT76_TM_TX_MODE_HT] = 1,
-+		[MT76_TM_TX_MODE_VHT] = 2,
-+		[MT76_TM_TX_MODE_HE_SU] = 3,
-+		[MT76_TM_TX_MODE_HE_EXT_SU] = 3,
-+		[MT76_TM_TX_MODE_HE_TB] = 3,
-+		[MT76_TM_TX_MODE_HE_MU] = 3,
-+	};
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_wcid *wcid;
-+	struct ieee80211_vif *vif = phy->monitor_vif;
-+	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
-+	u8 pfmu_idx = val[0], nc = val[2], nr;
-+	int ret;
-+
-+	if (td->tx_antenna_mask == 3)
-+		nr = 1;
-+	else if (td->tx_antenna_mask == 7)
-+		nr = 2;
-+	else
-+		nr = 3;
-+
-+	memset(tag, 0, sizeof(*tag));
-+	tag->t1.pfmu_idx = pfmu_idx;
-+	tag->t1.ebf = ebf;
-+	tag->t1.nr = nr;
-+	tag->t1.nc = nc;
-+	tag->t1.invalid_prof = true;
-+
-+	tag->t1.snr_sts4 = 0xc0;
-+	tag->t1.snr_sts5 = 0xff;
-+	tag->t1.snr_sts6 = 0xff;
-+	tag->t1.snr_sts7 = 0xff;
-+
-+	if (ebf) {
-+		tag->t1.row_id1 = 0;
-+		tag->t1.row_id2 = 1;
-+		tag->t1.row_id3 = 2;
-+		tag->t1.row_id4 = 3;
-+		tag->t1.lm = mode_to_lm[MT76_TM_TX_MODE_HT];
-+	} else {
-+		tag->t1.row_id1 = 4;
-+		tag->t1.row_id2 = 5;
-+		tag->t1.row_id3 = 6;
-+		tag->t1.row_id4 = 7;
-+		tag->t1.lm = mode_to_lm[MT76_TM_TX_MODE_OFDM];
-+
-+		tag->t2.ibf_timeout = 0xff;
-+		tag->t2.ibf_nr = nr;
-+	}
-+
-+	ret = mt7915_tm_txbf_profile_tag_write(phy, pfmu_idx, tag);
-+	if (ret)
-+		return ret;
-+
-+	wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
-+	ret = mt7915_tm_add_txbf(phy, vif, wcid_to_sta(wcid), pfmu_idx, nr, nc, ebf);
-+	if (ret)
-+		return ret;
-+
-+	if (!ebf)
-+		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
-+{
-+#define GROUP_L		0
-+#define GROUP_M		1
-+#define GROUP_H		2
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 category;
-+		u8 group_l_m_n;
-+		u8 group;
-+		bool sx2;
-+		u8 cal_type;
-+		u8 lna_gain_level;
-+		u8 _rsv[2];
-+	} __packed req = {
-+		.category = MT_BF_PHASE_CAL,
-+		.group = val[0],
-+		.group_l_m_n = val[1],
-+		.sx2 = val[2],
-+		.cal_type = val[3],
-+		.lna_gain_level = 0, /* for test purpose */
-+	};
-+	struct mt7915_tm_txbf_phase *phase =
-+		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
-+
-+	phase[req.group].status = 0;
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
-+				 sizeof(req), true);
-+}
-+
-+int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
-+{
-+#define BF_PFMU_TAG	16
-+#define BF_CAL_PHASE	21
-+	u8 format_id;
-+
-+	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
-+	format_id = *(u8 *)skb->data;
-+
-+	if (format_id == BF_PFMU_TAG) {
-+		struct mt7915_tm_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
-+
-+		skb_pull(skb, 8);
-+		memcpy(tag, skb->data, sizeof(struct mt7915_tm_pfmu_tag));
-+	} else if (format_id == BF_CAL_PHASE) {
-+		struct mt7915_tm_ibf_cal_info *cal;
-+		struct mt7915_tm_txbf_phase *phase =
-+			(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
-+
-+		cal = (struct mt7915_tm_ibf_cal_info *)skb->data;
-+		switch (cal->cal_type) {
-+		case IBF_PHASE_CAL_NORMAL:
-+		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
-+			if (cal->group_l_m_n != GROUP_M)
-+				break;
-+			phase = &phase[cal->group];
-+			memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
-+			phase->status = cal->status;
-+			break;
-+		case IBF_PHASE_CAL_VERIFY:
-+		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
-+			break;
-+		default:
-+			break;
-+		}
-+	}
-+
-+	wake_up(&dev->mt76.tx_wait);
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	u16 pfmu_idx = val[0];
-+	u16 subc_id = val[1];
-+	u16 angle11 = val[2];
-+	u16 angle21 = val[3];
-+	u16 angle31 = val[4];
-+	u16 angle41 = val[5];
-+	s16 phi11 = 0, phi21 = 0, phi31 = 0;
-+	struct mt7915_tm_pfmu_data *pfmu_data;
-+
-+	if (subc_id > 63)
-+		return -EINVAL;
-+
-+	if (td->tx_antenna_mask == 2) {
-+		phi11 = (s16)(angle21 - angle11);
-+	} else if (td->tx_antenna_mask == 3) {
-+		phi11 = (s16)(angle31 - angle11);
-+		phi21 = (s16)(angle31 - angle21);
-+	} else {
-+		phi11 = (s16)(angle41 - angle11);
-+		phi21 = (s16)(angle41 - angle21);
-+		phi31 = (s16)(angle41 - angle31);
-+	}
-+
-+	pfmu_data = (struct mt7915_tm_pfmu_data *)phy->dev->test.txbf_pfmu_data;
-+	pfmu_data = &pfmu_data[subc_id];
-+
-+	if (subc_id < 32)
-+		pfmu_data->subc_idx = cpu_to_le16(subc_id + 224);
-+	else
-+		pfmu_data->subc_idx = cpu_to_le16(subc_id - 32);
-+	pfmu_data->phi11 = cpu_to_le16(phi11);
-+	pfmu_data->phi21 = cpu_to_le16(phi21);
-+	pfmu_data->phi31 = cpu_to_le16(phi31);
-+
-+	if (subc_id == 63) {
-+		struct mt7915_dev *dev = phy->dev;
-+		struct {
-+			u8 format_id;
-+			u8 pfmu_idx;
-+			u8 dbdc_idx;
-+			u8 _rsv;
-+			u8 buf[512];
-+		} __packed req = {
-+			.format_id = MT_BF_PROFILE_WRITE_ALL,
-+			.pfmu_idx = pfmu_idx,
-+			.dbdc_idx = phy != &dev->phy,
-+		};
-+
-+		memcpy(req.buf, dev->test.txbf_pfmu_data, 512);
-+
-+		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
-+					 &req, sizeof(req), true);
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
-+{
-+	struct mt7915_tm_txbf_phase *phase, *p;
-+	struct mt7915_dev *dev = phy->dev;
-+	u8 *eeprom = dev->mt76.eeprom.data;
-+	u16 offset;
-+	bool is_7976;
-+	int i;
-+
-+	is_7976 = mt7915_check_adie(dev, false) || is_mt7916(&dev->mt76);
-+	offset = is_7976 ? 0x60a : 0x651;
-+
-+	phase = (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
-+	for (i = 0; i < MAX_PHASE_GROUP_NUM; i++) {
-+		p = &phase[i];
-+
-+		if (!p->status)
-+			continue;
-+
-+		/* copy phase cal data to eeprom */
-+		memcpy(eeprom + offset + i * sizeof(p->phase), &p->phase,
-+		       sizeof(p->phase));
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_tm_set_txbf(struct mt7915_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	u16 *val = td->txbf_param;
-+
-+	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u\n",
-+		td->txbf_act, val[0], val[1], val[2], val[3], val[4]);
-+
-+	switch (td->txbf_act) {
-+	case MT76_TM_TXBF_ACT_INIT:
-+		return mt7915_tm_txbf_init(phy, val);
-+	case MT76_TM_TXBF_ACT_UPDATE_CH:
-+		mt7915_tm_update_channel(phy);
-+		break;
-+	case MT76_TM_TXBF_ACT_PHASE_COMP:
-+		return mt7915_tm_txbf_phase_comp(phy, val);
-+	case MT76_TM_TXBF_ACT_TX_PREP:
-+		return mt7915_tm_txbf_set_tx(phy, val);
-+	case MT76_TM_TXBF_ACT_IBF_PROF_UPDATE:
-+		return mt7915_tm_txbf_profile_update(phy, val, false);
-+	case MT76_TM_TXBF_ACT_EBF_PROF_UPDATE:
-+		return mt7915_tm_txbf_profile_update(phy, val, true);
-+	case MT76_TM_TXBF_ACT_PHASE_CAL:
-+		return mt7915_tm_txbf_phase_cal(phy, val);
-+	case MT76_TM_TXBF_ACT_PROF_UPDATE_ALL:
-+		return mt7915_tm_txbf_profile_update_all(phy, val);
-+	case MT76_TM_TXBF_ACT_E2P_UPDATE:
-+		return mt7915_tm_txbf_e2p_update(phy);
-+	default:
-+		break;
-+	};
-+
-+	return 0;
-+}
-+
- static int
- mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
--		      u16 cw_max, u16 txop)
-+		      u16 cw_max, u16 txop, u8 tx_cmd)
- {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)phy->monitor_vif->drv_priv;
--	struct mt7915_mcu_tx req = { .total = 1 };
-+	struct mt7915_mcu_tx req = {
-+		.valid = true,
-+		.mode = tx_cmd,
-+		.total = 1,
-+	};
- 	struct edca *e = &req.edca[0];
- 
- 	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
-@@ -263,7 +1037,8 @@ done:
- 
- 	return mt7915_tm_set_wmm_qid(phy,
- 				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
--				     aifsn, cw, cw, 0);
-+				     aifsn, cw, cw, 0,
-+				     mode == MT76_TM_TX_MODE_HE_MU);
- }
- 
- static int
-@@ -339,7 +1114,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
- 	bitrate = cfg80211_calculate_bitrate(&rate);
- 	tx_len = bitrate * tx_time / 10 / 8;
- 
--	ret = mt76_testmode_alloc_skb(phy->mt76, tx_len);
-+	ret = mt76_testmode_init_skb(phy->mt76, tx_len, &td->tx_skb, td->addr);
- 	if (ret)
- 		return ret;
- 
-@@ -458,64 +1233,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
- 
- 	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
- 
--	if (!en)
-+	if (!en) {
- 		mt7915_tm_set_tam_arb(phy, en, 0);
-+
-+		phy->mt76->test.aid = 0;
-+		phy->mt76->test.tx_mpdu_len = 0;
-+		phy->test.bf_en = 0;
-+		mt7915_tm_set_entry(phy);
-+	}
-+}
-+
-+static bool
-+mt7915_tm_check_skb(struct mt7915_phy *phy)
-+{
-+	struct mt76_testmode_entry_data *ed;
-+	struct mt76_wcid *wcid;
-+
-+	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
-+		struct ieee80211_tx_info *info;
-+
-+		if (!ed->tx_skb)
-+			return false;
-+
-+		info = IEEE80211_SKB_CB(ed->tx_skb);
-+		info->control.vif = phy->monitor_vif;
-+	}
-+
-+	return true;
-+}
-+
-+static int
-+mt7915_tm_set_ba(struct mt7915_phy *phy)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_wcid *wcid;
-+	struct ieee80211_vif *vif = phy->monitor_vif;
-+	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct ieee80211_ampdu_params params = { .buf_size = 256 };
-+
-+	list_for_each_entry(wcid, &td->tm_entry_list, list) {
-+		int tid, ret;
-+
-+		params.sta = wcid_to_sta(wcid);
-+		for (tid = 0; tid < 8; tid++) {
-+			params.tid = tid;
-+			ret = mt7915_mcu_add_tx_ba(phy->dev, &params, true);
-+			if (ret)
-+				return ret;
-+		}
-+	}
-+
-+	mt76_wr(dev, MT_AGG_AALCR0(mvif->mt76.band_idx, mvif->mt76.wmm_idx),
-+		0x01010101);
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_tm_set_muru_cfg(struct mt7915_phy *phy, struct mt7915_tm_muru *muru)
-+{
-+/* #define MURU_SET_MANUAL_CFG	100 */
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		__le32 cmd;
-+		struct mt7915_tm_muru muru;
-+	} __packed req = {
-+		.cmd = cpu_to_le32(MURU_SET_MANUAL_CFG),
-+	};
-+
-+	memcpy(&req.muru, muru, sizeof(struct mt7915_tm_muru));
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
-+				 sizeof(req), false);
-+}
-+
-+static int
-+mt7915_tm_set_muru_dl(struct mt7915_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt76_testmode_entry_data *ed;
-+	struct mt76_wcid *wcid;
-+	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
-+	struct ieee80211_vif *vif = phy->monitor_vif;
-+	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mt7915_tm_muru muru = {};
-+	struct mt7915_tm_muru_comm *comm = &muru.comm;
-+	struct mt7915_tm_muru_dl *dl = &muru.dl;
-+	int i;
-+
-+	comm->ppdu_format = MURU_PPDU_HE_MU;
-+	comm->band = mvif->mt76.band_idx;
-+	comm->wmm_idx = mvif->mt76.wmm_idx;
-+	comm->spe_idx = phy->test.spe_idx;
-+
-+	dl->bw = mt7915_tm_chan_bw(chandef->width);
-+	dl->gi = td->tx_rate_sgi;;
-+	dl->ltf = td->tx_ltf;
-+	dl->tx_mode = MT_PHY_TYPE_HE_MU;
-+
-+	for (i = 0; i < sizeof(dl->ru); i++)
-+		dl->ru[i] = 0x71;
-+
-+	mt76_tm_for_each_entry(phy->mt76, wcid, ed) {
-+		struct mt7915_tm_muru_dl_usr *dl_usr = &dl->usr[dl->user_num];
-+
-+		dl_usr->wlan_idx = cpu_to_le16(wcid->idx);
-+		dl_usr->ru_alloc_seg = ed->aid < 8 ? 0 : 1;
-+		dl_usr->ru_idx = ed->ru_idx;
-+		dl_usr->mcs = ed->tx_rate_idx;
-+		dl_usr->nss = ed->tx_rate_nss - 1;
-+		dl_usr->ldpc = ed->tx_rate_ldpc;
-+		dl->ru[dl->user_num] = ed->ru_alloc;
-+
-+		dl->user_num++;
-+	}
-+
-+	muru.cfg_comm = cpu_to_le32(MURU_COMM_SET);
-+	muru.cfg_dl = cpu_to_le32(MURU_DL_SET);
-+
-+	return mt7915_tm_set_muru_cfg(phy, &muru);
-+}
-+
-+static int
-+mt7915_tm_set_muru_pkt_cnt(struct mt7915_phy *phy, bool enable, u32 tx_count)
-+{
-+#define MURU_SET_TX_PKT_CNT 105
-+#define MURU_SET_TX_EN 106
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		__le32 cmd;
-+		u8 band;
-+		u8 enable;
-+		u8 _rsv[2];
-+		__le32 tx_count;
-+	} __packed req = {
-+		.band = phy->mt76->band_idx,
-+		.enable = enable,
-+		.tx_count = enable ? cpu_to_le32(tx_count) : 0,
-+	};
-+	int ret;
-+
-+	req.cmd = enable ? cpu_to_le32(MURU_SET_TX_PKT_CNT) :
-+			   cpu_to_le32(MURU_SET_TX_EN);
-+
-+	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
-+				sizeof(req), false);
-+	if (ret)
-+		return ret;
-+
-+	req.cmd = enable ? cpu_to_le32(MURU_SET_TX_EN) :
-+			   cpu_to_le32(MURU_SET_TX_PKT_CNT);
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
-+				 sizeof(req), false);
- }
- 
- static void
--mt7915_tm_update_channel(struct mt7915_phy *phy)
-+mt7915_tm_tx_frames_mu(struct mt7915_phy *phy, bool enable)
- {
--	mutex_unlock(&phy->dev->mt76.mutex);
--	mt7915_set_channel(phy);
--	mutex_lock(&phy->dev->mt76.mutex);
-+	struct mt76_testmode_data *td = &phy->mt76->test;
- 
--	mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(SET_RX_PATH));
-+	if (enable) {
-+		struct mt7915_dev *dev = phy->dev;
-+
-+		mt7915_tm_set_ba(phy);
-+		mt7915_tm_set_muru_dl(phy);
-+		mt76_rr(dev, MT_MIB_DR8(phy != &dev->phy));
-+	} else {
-+		/* set to zero for counting real tx free num */
-+		td->tx_done = 0;
-+	}
-+
-+	mt7915_tm_set_muru_pkt_cnt(phy, enable, td->tx_count);
-+	usleep_range(100000, 200000);
- }
- 
- static void
- mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- {
- 	struct mt76_testmode_data *td = &phy->mt76->test;
--	struct mt7915_dev *dev = phy->dev;
--	struct ieee80211_tx_info *info;
--	u8 duty_cycle = td->tx_duty_cycle;
--	u32 tx_time = td->tx_time;
--	u32 ipg = td->tx_ipg;
- 
- 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
--	mt7915_tm_clean_hwq(phy, dev->mt76.global_wcid.idx);
-+	mt7915_tm_set_trx(phy, TM_MAC_TX, false);
- 
- 	if (en) {
--		mt7915_tm_update_channel(phy);
-+		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
-+		u8 duty_cycle = td->tx_duty_cycle;
-+
-+		if (!phy->test.bf_en)
-+			mt7915_tm_update_channel(phy);
- 
- 		if (td->tx_spe_idx)
- 			phy->test.spe_idx = td->tx_spe_idx;
- 		else
- 			phy->test.spe_idx = mt76_connac_spe_idx(td->tx_antenna_mask);
--	}
- 
--	mt7915_tm_set_tam_arb(phy, en,
--			      td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
-+		/* if all three params are set, duty_cycle will be ignored */
-+		if (duty_cycle && tx_time && !ipg) {
-+			ipg = tx_time * 100 / duty_cycle - tx_time;
-+		} else if (duty_cycle && !tx_time && ipg) {
-+			if (duty_cycle < 100)
-+				tx_time = duty_cycle * ipg / (100 - duty_cycle);
-+		}
- 
--	/* if all three params are set, duty_cycle will be ignored */
--	if (duty_cycle && tx_time && !ipg) {
--		ipg = tx_time * 100 / duty_cycle - tx_time;
--	} else if (duty_cycle && !tx_time && ipg) {
--		if (duty_cycle < 100)
--			tx_time = duty_cycle * ipg / (100 - duty_cycle);
--	}
-+		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
-+		mt7915_tm_set_tx_len(phy, tx_time);
- 
--	mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
--	mt7915_tm_set_tx_len(phy, tx_time);
-+		if (ipg)
-+			td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
- 
--	if (ipg)
--		td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
-+		if (!mt7915_tm_check_skb(phy))
-+			return;
-+	} else {
-+		mt7915_tm_clean_hwq(phy);
-+	}
- 
--	if (!en || !td->tx_skb)
--		return;
-+	mt7915_tm_set_tam_arb(phy, en,
-+			      td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
- 
--	info = IEEE80211_SKB_CB(td->tx_skb);
--	info->control.vif = phy->monitor_vif;
-+	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
-+		mt7915_tm_tx_frames_mu(phy, en);
- 
- 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
- }
-@@ -544,10 +1482,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
- 		return ret;
- 
- 	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
--	/* pr_info("mdrdy_cnt = %d\n", le32_to_cpu(rs_band->mdrdy_cnt)); */
--	/* pr_info("fcs_err = %d\n", le16_to_cpu(rs_band->fcs_err)); */
--	/* pr_info("len_mismatch = %d\n", le16_to_cpu(rs_band->len_mismatch)); */
--	/* pr_info("fcs_ok = %d\n", le16_to_cpu(rs_band->fcs_succ)); */
- 
- 	if (!clear) {
- 		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
-@@ -562,13 +1496,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
- 	return 0;
- }
- 
-+static int
-+mt7915_tm_set_rx_user_idx(struct mt7915_phy *phy, u8 aid)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_wcid *wcid = NULL;
-+	struct mt76_testmode_entry_data *ed;
-+	struct {
-+		u8 band;
-+		u8 _rsv;
-+		__le16 wlan_idx;
-+	} __packed req = {
-+		.band = phy->mt76->band_idx,
-+	};
-+
-+	mt76_tm_for_each_entry(phy->mt76, wcid, ed)
-+		if (ed->aid == aid)
-+			break;
-+
-+	if (!wcid)
-+		return -EINVAL;
-+
-+	req.wlan_idx = cpu_to_le16(wcid->idx);
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RX_STAT_USER_CTRL),
-+				 &req, sizeof(req), false);
-+}
-+
-+static int
-+mt7915_tm_set_muru_aid(struct mt7915_phy *phy, u16 aid)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_tm_cmd req = {
-+		.testmode_en = 1,
-+		.param_idx = MCU_ATE_SET_MU_RX_AID,
-+		.param.rx_aid.band = cpu_to_le32(phy->mt76->band_idx),
-+		.param.rx_aid.aid = cpu_to_le16(aid),
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-+				 sizeof(req), false);
-+}
-+
- static void
- mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
- {
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+
-+	mt7915_tm_set_trx(phy, TM_MAC_TX, false);
- 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
- 
- 	if (en) {
--		mt7915_tm_update_channel(phy);
-+		if (!phy->test.bf_en)
-+			mt7915_tm_update_channel(phy);
-+		if (td->aid)
-+			mt7915_tm_set_rx_user_idx(phy, td->aid);
- 
- 		/* read-clear */
- 		mt7915_tm_get_rx_stats(phy, true);
-@@ -576,9 +1558,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
- 		/* clear fw count */
- 		mt7915_tm_set_phy_count(phy, 0);
- 		mt7915_tm_set_phy_count(phy, 1);
--
--		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
- 	}
-+
-+	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
-+		mt7915_tm_set_muru_aid(phy, en ? td->aid : 0xf800);
-+
-+	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
- }
- 
- static int
-@@ -617,34 +1602,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
- 	tx_cont->tx_ant = td->tx_antenna_mask;
- 	tx_cont->band = band;
- 
--	switch (chandef->width) {
--	case NL80211_CHAN_WIDTH_40:
--		tx_cont->bw = CMD_CBW_40MHZ;
--		break;
--	case NL80211_CHAN_WIDTH_80:
--		tx_cont->bw = CMD_CBW_80MHZ;
--		break;
--	case NL80211_CHAN_WIDTH_80P80:
--		tx_cont->bw = CMD_CBW_8080MHZ;
--		break;
--	case NL80211_CHAN_WIDTH_160:
--		tx_cont->bw = CMD_CBW_160MHZ;
--		break;
--	case NL80211_CHAN_WIDTH_5:
--		tx_cont->bw = CMD_CBW_5MHZ;
--		break;
--	case NL80211_CHAN_WIDTH_10:
--		tx_cont->bw = CMD_CBW_10MHZ;
--		break;
--	case NL80211_CHAN_WIDTH_20:
--		tx_cont->bw = CMD_CBW_20MHZ;
--		break;
--	case NL80211_CHAN_WIDTH_20_NOHT:
--		tx_cont->bw = CMD_CBW_20MHZ;
--		break;
--	default:
--		return -EINVAL;
--	}
-+	tx_cont->bw = mt7915_tm_chan_bw(chandef->width);
- 
- 	if (!en) {
- 		req.op.rf.param.func_data = cpu_to_le32(band);
-@@ -728,6 +1686,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
- 		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
- 	if (changed & BIT(TM_CHANGED_TXPOWER))
- 		mt7915_tm_set_tx_power(phy);
-+	if (changed & BIT(TM_CHANGED_AID))
-+		mt7915_tm_set_entry(phy);
-+	if (changed & BIT(TM_CHANGED_CFG))
-+		mt7915_tm_set_cfg(phy);
-+	if (changed & BIT(TM_CHANGED_TXBF_ACT))
-+		mt7915_tm_set_txbf(phy);
- }
- 
- static int
-@@ -807,6 +1771,7 @@ static int
- mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
- {
- 	struct mt7915_phy *phy = mphy->priv;
-+	struct mt7915_dev *dev = phy->dev;
- 	void *rx, *rssi;
- 	int i;
- 
-@@ -852,11 +1817,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
- 
- 	nla_nest_end(msg, rx);
- 
-+	if (mphy->test.tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
-+		mphy->test.tx_done += mt76_rr(dev, MT_MIB_DR8(phy != &dev->phy));
-+
- 	return mt7915_tm_get_rx_stats(phy, false);
- }
- 
-+static int
-+mt7915_tm_write_back_to_efuse(struct mt7915_dev *dev)
-+{
-+	struct mt7915_mcu_eeprom_info req = {};
-+	u8 *eeprom = dev->mt76.eeprom.data;
-+	int i, ret = -EINVAL;
-+
-+	/* prevent from damaging chip id in efuse */
-+	if (mt76_chip(&dev->mt76) != get_unaligned_le16(eeprom))
-+		goto out;
-+
-+	for (i = 0; i < mt7915_eeprom_size(dev); i += MT76_TM_EEPROM_BLOCK_SIZE) {
-+		req.addr = cpu_to_le32(i);
-+		memcpy(&req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
-+
-+		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_ACCESS),
-+					&req, sizeof(req), true);
-+		if (ret)
-+			return ret;
-+	}
-+
-+out:
-+	return ret;
-+}
-+
-+static int
-+mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
-+{
-+	struct mt7915_phy *phy = mphy->priv;
-+	struct mt7915_dev *dev = phy->dev;
-+	u8 *eeprom = dev->mt76.eeprom.data;
-+	int ret = 0;
-+
-+	if (offset >= mt7915_eeprom_size(dev))
-+		return -EINVAL;
-+
-+	switch (action) {
-+	case MT76_TM_EEPROM_ACTION_UPDATE_DATA:
-+		memcpy(eeprom + offset, val, MT76_TM_EEPROM_BLOCK_SIZE);
-+		break;
-+	case MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE:
-+		ret = mt7915_mcu_set_eeprom(dev, true);
-+		break;
-+	case MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE:
-+		ret = mt7915_tm_write_back_to_efuse(dev);
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return ret;
-+}
-+
- const struct mt76_testmode_ops mt7915_testmode_ops = {
- 	.set_state = mt7915_tm_set_state,
- 	.set_params = mt7915_tm_set_params,
- 	.dump_stats = mt7915_tm_dump_stats,
-+	.set_eeprom = mt7915_tm_set_eeprom,
- };
-diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c8..01b08e9 100644
---- a/mt7915/testmode.h
-+++ b/mt7915/testmode.h
-@@ -4,6 +4,8 @@
- #ifndef __MT7915_TESTMODE_H
- #define __MT7915_TESTMODE_H
- 
-+#include "mcu.h"
-+
- struct mt7915_tm_trx {
- 	u8 type;
- 	u8 enable;
-@@ -39,6 +41,11 @@ struct mt7915_tm_cfg {
- 	u8 _rsv[2];
- };
- 
-+struct mt7915_tm_mu_rx_aid {
-+	__le32 band;
-+	__le16 aid;
-+};
-+
- struct mt7915_tm_cmd {
- 	u8 testmode_en;
- 	u8 param_idx;
-@@ -50,6 +57,7 @@ struct mt7915_tm_cmd {
- 		struct mt7915_tm_slot_time slot;
- 		struct mt7915_tm_clean_txq clean;
- 		struct mt7915_tm_cfg cfg;
-+		struct mt7915_tm_mu_rx_aid rx_aid;
- 		u8 test[72];
- 	} param;
- } __packed;
-@@ -109,6 +117,16 @@ enum {
- 	TAM_ARB_OP_MODE_FORCE_SU = 5,
- };
- 
-+enum {
-+	TM_CBW_20MHZ,
-+	TM_CBW_40MHZ,
-+	TM_CBW_80MHZ,
-+	TM_CBW_10MHZ,
-+	TM_CBW_5MHZ,
-+	TM_CBW_160MHZ,
-+	TM_CBW_8080MHZ,
-+};
-+
- struct mt7915_tm_rx_stat_band {
- 	u8 category;
- 
-@@ -130,4 +148,264 @@ struct mt7915_tm_rx_stat_band {
- 	__le16 mdrdy_cnt_ofdm;
- };
- 
-+struct mt7915_tm_muru_comm {
-+	u8 ppdu_format;
-+	u8 sch_type;
-+	u8 band;
-+	u8 wmm_idx;
-+	u8 spe_idx;
-+	u8 proc_type;
-+};
-+
-+struct mt7915_tm_muru_dl_usr {
-+	__le16 wlan_idx;
-+	u8 ru_alloc_seg;
-+	u8 ru_idx;
-+	u8 ldpc;
-+	u8 nss;
-+	u8 mcs;
-+	u8 mu_group_idx;
-+	u8 vht_groud_id;
-+	u8 vht_up;
-+	u8 he_start_stream;
-+	u8 he_mu_spatial;
-+	u8 ack_policy;
-+	__le16 tx_power_alpha;
-+};
-+
-+struct mt7915_tm_muru_dl {
-+	u8 user_num;
-+	u8 tx_mode;
-+	u8 bw;
-+	u8 gi;
-+	u8 ltf;
-+	/* sigB */
-+	u8 mcs;
-+	u8 dcm;
-+	u8 cmprs;
-+
-+	u8 tx_power;
-+	u8 ru[8];
-+	u8 c26[2];
-+	u8 ack_policy;
-+
-+	struct mt7915_tm_muru_dl_usr usr[16];
-+};
-+
-+struct mt7915_tm_muru_ul_usr {
-+	__le16 wlan_idx;
-+	u8 ru_alloc;
-+	u8 ru_idx;
-+	u8 ldpc;
-+	u8 nss;
-+	u8 mcs;
-+	u8 target_rssi;
-+	__le32 trig_pkt_size;
-+};
-+
-+struct mt7915_tm_muru_ul {
-+	u8 user_num;
-+
-+	/* UL TX */
-+	u8 trig_type;
-+	__le16 trig_cnt;
-+	__le16 trig_intv;
-+	u8 bw;
-+	u8 gi_ltf;
-+	__le16 ul_len;
-+	u8 pad;
-+	u8 trig_ta[ETH_ALEN];
-+	u8 ru[8];
-+	u8 c26[2];
-+
-+	struct mt7915_tm_muru_ul_usr usr[16];
-+	/* HE TB RX Debug */
-+	__le32 rx_hetb_nonsf_en_bitmap;
-+	__le32 rx_hetb_cfg[2];
-+
-+	/* DL TX */
-+	u8 ba_type;
-+};
-+
-+struct mt7915_tm_muru {
-+	__le32 cfg_comm;
-+	__le32 cfg_dl;
-+	__le32 cfg_ul;
-+
-+	struct mt7915_tm_muru_comm comm;
-+	struct mt7915_tm_muru_dl dl;
-+	struct mt7915_tm_muru_ul ul;
-+};
-+
-+#define MURU_PPDU_HE_MU		BIT(3)
-+
-+/* Common Config */
-+/* #define MURU_COMM_PPDU_FMT		BIT(0) */
-+/* #define MURU_COMM_SCH_TYPE		BIT(1) */
-+/* #define MURU_COMM_BAND			BIT(2) */
-+/* #define MURU_COMM_WMM			BIT(3) */
-+/* #define MURU_COMM_SPE_IDX		BIT(4) */
-+/* #define MURU_COMM_PROC_TYPE		BIT(5) */
-+/* #define MURU_COMM_SET		(MURU_COMM_PPDU_FMT | MURU_COMM_BAND | \ */
-+/* 				 MURU_COMM_WMM | MURU_COMM_SPE_IDX) */
-+/* DL Config */
-+#define MURU_DL_BW			BIT(0)
-+#define MURU_DL_GI			BIT(1)
-+#define MURU_DL_TX_MODE			BIT(2)
-+#define MURU_DL_TONE_PLAN		BIT(3)
-+#define MURU_DL_USER_CNT		BIT(4)
-+#define MURU_DL_LTF			BIT(5)
-+#define MURU_DL_SIGB_MCS		BIT(6)
-+#define MURU_DL_SIGB_DCM		BIT(7)
-+#define MURU_DL_SIGB_CMPRS		BIT(8)
-+#define MURU_DL_ACK_POLICY		BIT(9)
-+#define MURU_DL_TXPOWER			BIT(10)
-+/* DL Per User Config */
-+#define MURU_DL_USER_WLAN_ID		BIT(16)
-+#define MURU_DL_USER_COD		BIT(17)
-+#define MURU_DL_USER_MCS		BIT(18)
-+#define MURU_DL_USER_NSS		BIT(19)
-+#define MURU_DL_USER_RU_ALLOC		BIT(20)
-+#define MURU_DL_USER_MUMIMO_GRP		BIT(21)
-+#define MURU_DL_USER_MUMIMO_VHT		BIT(22)
-+#define MURU_DL_USER_ACK_POLICY		BIT(23)
-+#define MURU_DL_USER_MUMIMO_HE		BIT(24)
-+#define MURU_DL_USER_PWR_ALPHA		BIT(25)
-+#define MURU_DL_SET		(GENMASK(7, 0) | GENMASK(20, 16) | BIT(25))
-+
-+#define MAX_PHASE_GROUP_NUM	9
-+
-+struct mt7915_tm_txbf_phase {
-+	u8 status;
-+	struct {
-+		u8 r0_uh;
-+		u8 r0_h;
-+		u8 r0_m;
-+		u8 r0_l;
-+		u8 r0_ul;
-+		u8 r1_uh;
-+		u8 r1_h;
-+		u8 r1_m;
-+		u8 r1_l;
-+		u8 r1_ul;
-+		u8 r2_uh;
-+		u8 r2_h;
-+		u8 r2_m;
-+		u8 r2_l;
-+		u8 r2_ul;
-+		u8 r3_uh;
-+		u8 r3_h;
-+		u8 r3_m;
-+		u8 r3_l;
-+		u8 r3_ul;
-+		u8 r2_uh_sx2;
-+		u8 r2_h_sx2;
-+		u8 r2_m_sx2;
-+		u8 r2_l_sx2;
-+		u8 r2_ul_sx2;
-+		u8 r3_uh_sx2;
-+		u8 r3_h_sx2;
-+		u8 r3_m_sx2;
-+		u8 r3_l_sx2;
-+		u8 r3_ul_sx2;
-+		u8 m_t0_h;
-+		u8 m_t1_h;
-+		u8 m_t2_h;
-+		u8 m_t2_h_sx2;
-+		u8 r0_reserved;
-+		u8 r1_reserved;
-+		u8 r2_reserved;
-+		u8 r3_reserved;
-+		u8 r2_sx2_reserved;
-+		u8 r3_sx2_reserved;
-+	} phase;
-+};
-+
-+struct mt7915_tm_pfmu_tag1 {
-+	__le32 pfmu_idx:10;
-+	__le32 ebf:1;
-+	__le32 data_bw:2;
-+	__le32 lm:2;
-+	__le32 is_mu:1;
-+	__le32 nr:3, nc:3;
-+	__le32 codebook:2;
-+	__le32 ngroup:2;
-+	__le32 _rsv:2;
-+	__le32 invalid_prof:1;
-+	__le32 rmsd:3;
-+
-+	__le32 col_id1:6, row_id1:10;
-+	__le32 col_id2:6, row_id2:10;
-+	__le32 col_id3:6, row_id3:10;
-+	__le32 col_id4:6, row_id4:10;
-+
-+	__le32 ru_start_id:7;
-+	__le32 _rsv1:1;
-+	__le32 ru_end_id:7;
-+	__le32 _rsv2:1;
-+	__le32 mob_cal_en:1;
-+	__le32 _rsv3:15;
-+
-+	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
-+	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
-+
-+	__le32 _rsv4;
-+} __packed;
-+
-+struct mt7915_tm_pfmu_tag2 {
-+	__le32 smart_ant:24;
-+	__le32 se_idx:5;
-+	__le32 _rsv:3;
-+
-+	__le32 _rsv1:8;
-+	__le32 rmsd_thres:3;
-+	__le32 _rsv2:5;
-+	__le32 ibf_timeout:8;
-+	__le32 _rsv3:8;
-+
-+	__le32 _rsv4:16;
-+	__le32 ibf_data_bw:2;
-+	__le32 ibf_nc:3;
-+	__le32 ibf_nr:3;
-+	__le32 ibf_ru:8;
-+
-+	__le32 mob_delta_t:8;
-+	__le32 mob_lq_result:7;
-+	__le32 _rsv5:1;
-+	__le32 _rsv6:16;
-+
-+	__le32 _rsv7;
-+} __packed;
-+
-+struct mt7915_tm_pfmu_tag {
-+	struct mt7915_tm_pfmu_tag1 t1;
-+	struct mt7915_tm_pfmu_tag2 t2;
-+};
-+
-+struct mt7915_tm_pfmu_data {
-+	__le16 subc_idx;
-+	__le16 phi11;
-+	__le16 phi21;
-+	__le16 phi31;
-+};
-+
-+struct mt7915_tm_ibf_cal_info {
-+	u8 format_id;
-+	u8 group_l_m_n;
-+	u8 group;
-+	bool sx2;
-+	u8 status;
-+	u8 cal_type;
-+	u8 _rsv[2];
-+	u8 buf[1000];
-+} __packed;
-+
-+enum {
-+	IBF_PHASE_CAL_UNSPEC,
-+	IBF_PHASE_CAL_NORMAL,
-+	IBF_PHASE_CAL_VERIFY,
-+	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
-+	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
-+};
-+
- #endif
-diff --git a/testmode.c b/testmode.c
-index 1d0d5d3..7a9ed54 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
- };
- EXPORT_SYMBOL_GPL(mt76_tm_policy);
- 
--void mt76_testmode_tx_pending(struct mt76_phy *phy)
-+static void
-+mt76_testmode_queue_tx(struct mt76_phy *phy, struct mt76_wcid *wcid,
-+		       struct sk_buff *skb, struct mt76_queue *q, int qid,
-+		       u16 limit)
- {
- 	struct mt76_testmode_data *td = &phy->test;
- 	struct mt76_dev *dev = phy->dev;
--	struct mt76_wcid *wcid = &dev->global_wcid;
--	struct sk_buff *skb = td->tx_skb;
--	struct mt76_queue *q;
--	u16 tx_queued_limit;
--	int qid;
--
--	if (!skb || !td->tx_pending)
--		return;
-+	u16 count = limit;
- 
--	qid = skb_get_queue_mapping(skb);
--	q = phy->q_tx[qid];
--
--	tx_queued_limit = td->tx_queued_limit ? td->tx_queued_limit : 1000;
--
--	spin_lock_bh(&q->lock);
--
--	while (td->tx_pending > 0 &&
--	       td->tx_queued - td->tx_done < tx_queued_limit &&
-+	while (td->tx_pending > 0 && count &&
- 	       q->queued < q->ndesc / 2) {
- 		int ret;
- 
-@@ -57,13 +45,65 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
- 		if (ret < 0)
- 			break;
- 
-+		count--;
- 		td->tx_pending--;
- 		td->tx_queued++;
-+
-+		if (td->tx_rate_mode != MT76_TM_TX_MODE_HE_MU)
-+		    if (td->tx_queued - td->tx_done >= limit)
-+			    break;
- 	}
- 
- 	dev->queue_ops->kick(dev, q);
-+}
-+
-+void mt76_testmode_tx_pending(struct mt76_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->test;
-+	struct mt76_testmode_entry_data *ed;
-+	struct mt76_queue *q;
-+	int qid;
-+	u16 tx_queued_limit;
-+	u32 remain;
-+	bool is_mu;
-+
-+	if (!td->tx_pending)
-+		return;
-+
-+	/* tx_queued_limit = td->tx_queued_limit ?: 100; */
-+	tx_queued_limit = 100;
-+
-+	if (!td->aid) {
-+		qid = skb_get_queue_mapping(td->tx_skb);
-+		q = phy->q_tx[qid];
-+		spin_lock_bh(&q->lock);
-+		mt76_testmode_queue_tx(phy, &phy->dev->global_wcid,
-+				td->tx_skb, q, qid, tx_queued_limit);
-+		spin_unlock_bh(&q->lock);
-+
-+		return;
-+	}
-+
-+	is_mu = td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU;
-+	ed = mt76_testmode_entry_data(phy, td->cur_entry);
-+	qid = skb_get_queue_mapping(ed->tx_skb);
-+	q = phy->q_tx[qid];
-+
-+	spin_lock_bh(&q->lock);
-+
-+	remain = is_mu ? 1 : (td->tx_pending % td->tx_count) ?: td->tx_count;
-+	if (remain < tx_queued_limit)
-+		tx_queued_limit = remain;
-+
-+	mt76_testmode_queue_tx(phy, td->cur_entry, ed->tx_skb, q, qid, tx_queued_limit);
-+
-+	if (td->tx_pending % td->tx_count == 0 || is_mu)
-+		td->cur_entry = list_next_entry(td->cur_entry, list);
- 
- 	spin_unlock_bh(&q->lock);
-+
-+	if (is_mu && td->tx_pending)
-+		mt76_worker_schedule(&phy->dev->tx_worker);
- }
- 
- static u32
-@@ -89,15 +129,31 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
- }
- 
- static void
--mt76_testmode_free_skb(struct mt76_phy *phy)
-+mt76_testmode_free_skb(struct sk_buff **tx_skb)
-+{
-+	if (!(*tx_skb))
-+		return;
-+
-+	dev_kfree_skb(*tx_skb);
-+	*tx_skb = NULL;
-+}
-+
-+static void
-+mt76_testmode_free_skb_all(struct mt76_phy *phy)
- {
- 	struct mt76_testmode_data *td = &phy->test;
-+	struct mt76_testmode_entry_data *ed = &td->ed;
-+	struct mt76_wcid *wcid;
-+
-+	mt76_testmode_free_skb(&ed->tx_skb);
- 
--	dev_kfree_skb(td->tx_skb);
--	td->tx_skb = NULL;
-+	mt76_tm_for_each_entry(phy, wcid, ed)
-+		mt76_testmode_free_skb(&ed->tx_skb);
- }
- 
--int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
-+static int
-+mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
-+			struct sk_buff **tx_skb, u8 (*addr)[ETH_ALEN])
- {
- #define MT_TXP_MAX_LEN	4095
- 	u16 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
-@@ -118,7 +174,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 	nfrags = len / MT_TXP_MAX_LEN;
- 	head_len = nfrags ? MT_TXP_MAX_LEN : len;
- 
--	if (len > IEEE80211_MAX_FRAME_LEN)
-+	if (len > IEEE80211_MAX_FRAME_LEN ||
-+	    td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
- 		fc |= IEEE80211_STYPE_QOS_DATA;
- 
- 	head = alloc_skb(head_len, GFP_KERNEL);
-@@ -127,9 +184,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 
- 	hdr = __skb_put_zero(head, sizeof(*hdr));
- 	hdr->frame_control = cpu_to_le16(fc);
--	memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
--	memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
--	memcpy(hdr->addr3, td->addr[2], ETH_ALEN);
-+	memcpy(hdr->addr1, addr[0], ETH_ALEN);
-+	memcpy(hdr->addr2, addr[1], ETH_ALEN);
-+	memcpy(hdr->addr3, addr[2], ETH_ALEN);
- 	skb_set_queue_mapping(head, IEEE80211_AC_BE);
- 	get_random_bytes(__skb_put(head, head_len - sizeof(*hdr)),
- 			 head_len - sizeof(*hdr));
-@@ -153,7 +210,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 
- 		frag = alloc_skb(frag_len, GFP_KERNEL);
- 		if (!frag) {
--			mt76_testmode_free_skb(phy);
-+			mt76_testmode_free_skb(tx_skb);
- 			dev_kfree_skb(head);
- 			return -ENOMEM;
- 		}
-@@ -166,15 +223,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 		frag_tail = &(*frag_tail)->next;
- 	}
- 
--	mt76_testmode_free_skb(phy);
--	td->tx_skb = head;
-+	mt76_testmode_free_skb(tx_skb);
-+	*tx_skb = head;
- 
- 	return 0;
- }
--EXPORT_SYMBOL(mt76_testmode_alloc_skb);
- 
--static int
--mt76_testmode_tx_init(struct mt76_phy *phy)
-+int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len,
-+			   struct sk_buff **tx_skb, u8 (*addr)[ETH_ALEN])
- {
- 	struct mt76_testmode_data *td = &phy->test;
- 	struct ieee80211_tx_info *info;
-@@ -182,7 +238,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
- 	u8 max_nss = hweight8(phy->antenna_mask);
- 	int ret;
- 
--	ret = mt76_testmode_alloc_skb(phy, td->tx_mpdu_len);
-+	ret = mt76_testmode_alloc_skb(phy, len, tx_skb, addr);
- 	if (ret)
- 		return ret;
- 
-@@ -192,7 +248,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
- 	if (td->tx_antenna_mask)
- 		max_nss = min_t(u8, max_nss, hweight8(td->tx_antenna_mask));
- 
--	info = IEEE80211_SKB_CB(td->tx_skb);
-+	info = IEEE80211_SKB_CB(*tx_skb);
- 	rate = &info->control.rates[0];
- 	rate->count = 1;
- 	rate->idx = td->tx_rate_idx;
-@@ -264,6 +320,25 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
- out:
- 	return 0;
- }
-+EXPORT_SYMBOL(mt76_testmode_init_skb);
-+
-+static int
-+mt76_testmode_tx_init(struct mt76_phy *phy)
-+{
-+	struct mt76_testmode_entry_data *ed;
-+	struct mt76_wcid *wcid;
-+
-+	mt76_tm_for_each_entry(phy, wcid, ed) {
-+		int ret;
-+
-+		ret = mt76_testmode_init_skb(phy, ed->tx_mpdu_len,
-+					     &ed->tx_skb, ed->addr);
-+		if (ret)
-+			return ret;
-+	}
-+
-+	return 0;
-+}
- 
- static void
- mt76_testmode_tx_start(struct mt76_phy *phy)
-@@ -274,6 +349,14 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
- 	td->tx_queued = 0;
- 	td->tx_done = 0;
- 	td->tx_pending = td->tx_count;
-+	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
-+		td->tx_pending = 1;
-+	if (td->entry_num) {
-+		td->tx_pending *= td->entry_num;
-+		td->cur_entry = list_first_entry(&td->tm_entry_list,
-+						 struct mt76_wcid, list);
-+	}
-+
- 	mt76_worker_schedule(&dev->tx_worker);
- }
- 
-@@ -292,7 +375,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
- 	wait_event_timeout(dev->tx_wait, td->tx_done == td->tx_queued,
- 			   MT76_TM_TIMEOUT * HZ);
- 
--	mt76_testmode_free_skb(phy);
-+	mt76_testmode_free_skb_all(phy);
- }
- 
- static inline void
-@@ -323,6 +406,8 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
- 	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
- 	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
- 	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
-+
-+	INIT_LIST_HEAD(&phy->test.tm_entry_list);
- }
- 
- static int
-@@ -332,8 +417,12 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
- 	struct mt76_dev *dev = phy->dev;
- 	int err;
- 
--	if (prev_state == MT76_TM_STATE_TX_FRAMES)
-+	if (prev_state == MT76_TM_STATE_TX_FRAMES) {
-+		/* MU needs to clean hwq for free done event */
-+		if (phy->test.tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
-+			dev->test_ops->set_state(phy, MT76_TM_STATE_IDLE);
- 		mt76_testmode_tx_stop(phy);
-+	}
- 
- 	if (state == MT76_TM_STATE_TX_FRAMES) {
- 		err = mt76_testmode_tx_init(phy);
-@@ -403,6 +492,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
- 	return 0;
- }
- 
-+static int
-+mt76_testmode_set_eeprom(struct mt76_phy *phy, struct nlattr **tb)
-+{
-+	struct mt76_dev *dev = phy->dev;
-+	u8 action, val[MT76_TM_EEPROM_BLOCK_SIZE];
-+	u32 offset = 0;
-+	int err = -EINVAL;
-+
-+	if (!dev->test_ops->set_eeprom)
-+		return -EOPNOTSUPP;
-+
-+	if (mt76_tm_get_u8(tb[MT76_TM_ATTR_EEPROM_ACTION], &action,
-+			   0, MT76_TM_EEPROM_ACTION_MAX))
-+		goto out;
-+
-+	if (tb[MT76_TM_ATTR_EEPROM_OFFSET]) {
-+		struct nlattr *cur;
-+		int rem, idx = 0;
-+
-+		offset = nla_get_u32(tb[MT76_TM_ATTR_EEPROM_OFFSET]);
-+		if (!!(offset % MT76_TM_EEPROM_BLOCK_SIZE) ||
-+		    !tb[MT76_TM_ATTR_EEPROM_VAL])
-+			goto out;
-+
-+		nla_for_each_nested(cur, tb[MT76_TM_ATTR_EEPROM_VAL], rem) {
-+			if (nla_len(cur) != 1 || idx >= ARRAY_SIZE(val))
-+				goto out;
-+
-+			val[idx++] = nla_get_u8(cur);
-+		}
-+	}
-+
-+	err = dev->test_ops->set_eeprom(phy, offset, val, action);
-+
-+out:
-+	return err;
-+}
-+
- int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		      void *data, int len)
- {
-@@ -426,6 +553,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 
- 	mutex_lock(&dev->mutex);
- 
-+	if (tb[MT76_TM_ATTR_EEPROM_ACTION]) {
-+		err = mt76_testmode_set_eeprom(phy, tb);
-+		goto out;
-+	}
-+
- 	if (tb[MT76_TM_ATTR_RESET]) {
- 		mt76_testmode_set_state(phy, MT76_TM_STATE_OFF);
- 		memset(td, 0, sizeof(*td));
-@@ -452,7 +584,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
- 			   &td->tx_duty_cycle, 0, 99) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
--			   &td->tx_power_control, 0, 1))
-+			   &td->tx_power_control, 0, 1) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_ALLOC], &td->ru_alloc, 0, 0xff) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68))
- 		goto out;
- 
- 	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -484,8 +619,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 
- 	if (tb[MT76_TM_ATTR_TX_POWER]) {
- 		struct nlattr *cur;
--		int idx = 0;
--		int rem;
-+		int rem, idx = 0;
- 
- 		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TX_POWER], rem) {
- 			if (nla_len(cur) != 1 ||
-@@ -505,11 +639,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			if (nla_len(cur) != ETH_ALEN || idx >= 3)
- 				goto out;
- 
--			memcpy(td->addr[idx], nla_data(cur), ETH_ALEN);
-+			memcpy(td->addr[idx++], nla_data(cur), ETH_ALEN);
-+		}
-+	}
-+
-+	if (tb[MT76_TM_ATTR_CFG]) {
-+		struct nlattr *cur;
-+		int rem, idx = 0;
-+
-+		nla_for_each_nested(cur, tb[MT76_TM_ATTR_CFG], rem) {
-+			if (nla_len(cur) != 1 || idx >= 2)
-+				goto out;
-+
-+			if (idx == 0)
-+				td->cfg.type = nla_get_u8(cur);
-+			else
-+				td->cfg.enable = nla_get_u8(cur);
- 			idx++;
- 		}
- 	}
- 
-+	if (tb[MT76_TM_ATTR_TXBF_ACT]) {
-+		struct nlattr *cur;
-+		int rem, idx = 0;
-+
-+		if (!tb[MT76_TM_ATTR_TXBF_PARAM] ||
-+		    mt76_tm_get_u8(tb[MT76_TM_ATTR_TXBF_ACT], &td->txbf_act,
-+		    0, MT76_TM_TXBF_ACT_MAX))
-+			goto out;
-+
-+		memset(td->txbf_param, 0, sizeof(td->txbf_param));
-+		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
-+			if (nla_len(cur) != 2 ||
-+			    idx >= ARRAY_SIZE(td->txbf_param))
-+				goto out;
-+
-+			td->txbf_param[idx++] = nla_get_u16(cur);
-+		}
-+	}
-+
- 	if (dev->test_ops->set_params) {
- 		err = dev->test_ops->set_params(phy, tb, state);
- 		if (err)
-@@ -574,6 +742,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 	struct mt76_phy *phy = hw->priv;
- 	struct mt76_dev *dev = phy->dev;
- 	struct mt76_testmode_data *td = &phy->test;
-+	struct mt76_testmode_entry_data *ed = &td->ed;
- 	struct nlattr *tb[NUM_MT76_TM_ATTRS] = {};
- 	int err = 0;
- 	void *a;
-@@ -606,6 +775,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 		goto out;
- 	}
- 
-+	if (tb[MT76_TM_ATTR_AID]) {
-+		struct mt76_wcid *wcid;
-+		u8 aid;
-+
-+		err = mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &aid, 1, 16);
-+		if (err)
-+			goto out;
-+
-+		mt76_tm_for_each_entry(phy, wcid, ed)
-+			if (ed->aid == aid)
-+				ed = mt76_testmode_entry_data(phy, wcid);
-+	}
-+
- 	mt76_testmode_init_defaults(phy);
- 
- 	err = -EMSGSIZE;
-@@ -618,12 +800,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 		goto out;
- 
- 	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
--	    nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, td->tx_mpdu_len) ||
- 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
--	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, td->tx_rate_nss) ||
--	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, td->tx_rate_idx) ||
- 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
--	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
- 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
- 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
- 	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
-@@ -643,6 +821,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 	     nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
- 		goto out;
- 
-+	if (nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, ed->tx_mpdu_len) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, ed->tx_rate_nss) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, ed->tx_rate_idx) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, ed->tx_rate_ldpc) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_AID, ed->aid) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_RU_ALLOC, ed->ru_alloc) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_RU_IDX, ed->ru_idx))
-+		goto out;
-+
- 	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
- 		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
- 		if (!a)
-diff --git a/testmode.h b/testmode.h
-index 8961326..57949f2 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -6,6 +6,8 @@
- #define __MT76_TESTMODE_H
- 
- #define MT76_TM_TIMEOUT	10
-+#define MT76_TM_MAX_ENTRY_NUM	16
-+#define MT76_TM_EEPROM_BLOCK_SIZE	16
- 
- /**
-  * enum mt76_testmode_attr - testmode attributes inside NL80211_ATTR_TESTDATA
-@@ -47,6 +49,15 @@
-  * @MT76_TM_ATTR_DRV_DATA: driver specific netlink attrs (nested)
-  *
-  * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
-+ *
-+ * @MT76_TM_ATTR_EEPROM_ACTION: eeprom setting actions
-+ * 	(u8, see &enum mt76_testmode_eeprom_action)
-+ * @MT76_TM_ATTR_EEPROM_OFFSET: offset of eeprom data block for writing (u32)
-+ * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
-+ * 	(nested, u8 attrs)
-+ *
-+ * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
-+ *
-  */
- enum mt76_testmode_attr {
- 	MT76_TM_ATTR_UNSPEC,
-@@ -84,6 +95,17 @@ enum mt76_testmode_attr {
- 	MT76_TM_ATTR_DRV_DATA,
- 
- 	MT76_TM_ATTR_MAC_ADDRS,
-+	MT76_TM_ATTR_AID,
-+	MT76_TM_ATTR_RU_ALLOC,
-+	MT76_TM_ATTR_RU_IDX,
-+
-+	MT76_TM_ATTR_EEPROM_ACTION,
-+	MT76_TM_ATTR_EEPROM_OFFSET,
-+	MT76_TM_ATTR_EEPROM_VAL,
-+
-+	MT76_TM_ATTR_CFG,
-+	MT76_TM_ATTR_TXBF_ACT,
-+	MT76_TM_ATTR_TXBF_PARAM,
- 
- 	/* keep last */
- 	NUM_MT76_TM_ATTRS,
-@@ -198,4 +220,57 @@ enum mt76_testmode_tx_mode {
- 
- extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
- 
-+/**
-+ * enum mt76_testmode_eeprom_action - eeprom setting actions
-+ *
-+ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
-+ * 	eeprom data block
-+ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
-+ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
-+ */
-+enum mt76_testmode_eeprom_action {
-+	MT76_TM_EEPROM_ACTION_UPDATE_DATA,
-+	MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE,
-+	MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE,
-+
-+	/* keep last */
-+	NUM_MT76_TM_EEPROM_ACTION,
-+	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
-+};
-+
-+/**
-+ * enum mt76_testmode_cfg - packet tx phy mode
-+ *
-+ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
-+ * 	eeprom data block
-+ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
-+ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
-+ */
-+enum mt76_testmode_cfg {
-+	MT76_TM_CFG_TSSI,
-+	MT76_TM_CFG_DPD,
-+	MT76_TM_CFG_RATE_POWER_OFFSET,
-+	MT76_TM_CFG_THERMAL_COMP,
-+
-+	/* keep last */
-+	NUM_MT76_TM_CFG,
-+	MT76_TM_CFG_MAX = NUM_MT76_TM_CFG - 1,
-+};
-+
-+enum mt76_testmode_txbf_act {
-+	MT76_TM_TXBF_ACT_INIT,
-+	MT76_TM_TXBF_ACT_UPDATE_CH,
-+	MT76_TM_TXBF_ACT_PHASE_COMP,
-+	MT76_TM_TXBF_ACT_TX_PREP,
-+	MT76_TM_TXBF_ACT_IBF_PROF_UPDATE,
-+	MT76_TM_TXBF_ACT_EBF_PROF_UPDATE,
-+	MT76_TM_TXBF_ACT_PHASE_CAL,
-+	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
-+	MT76_TM_TXBF_ACT_E2P_UPDATE,
-+
-+	/* keep last */
-+	NUM_MT76_TM_TXBF_ACT,
-+	MT76_TM_TXBF_ACT_MAX = NUM_MT76_TM_TXBF_ACT - 1,
-+};
-+
- #endif
-diff --git a/tools/fields.c b/tools/fields.c
-index e3f6908..6e36ab2 100644
---- a/tools/fields.c
-+++ b/tools/fields.c
-@@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
- 	[MT76_TM_STATE_IDLE] = "idle",
- 	[MT76_TM_STATE_TX_FRAMES] = "tx_frames",
- 	[MT76_TM_STATE_RX_FRAMES] = "rx_frames",
-+	[MT76_TM_STATE_TX_CONT] = "tx_cont",
- };
- 
- static const char * const testmode_tx_mode[] = {
-@@ -201,6 +202,63 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
- 	printf("%srx_per=%.02f%%\n", prefix, 100 * failed / total);
- }
- 
-+static bool parse_mac(const struct tm_field *field, int idx,
-+		      struct nl_msg *msg, const char *val)
-+{
-+#define ETH_ALEN	6
-+	bool ret = true;
-+	char *str, *cur, *ap;
-+	void *a;
-+
-+	ap = str = strdup(val);
-+
-+	a = nla_nest_start(msg, idx);
-+
-+	idx = 0;
-+	while ((cur = strsep(&ap, ",")) != NULL) {
-+		unsigned char addr[ETH_ALEN];
-+		char *val, *tmp = cur;
-+		int i = 0;
-+
-+		while ((val = strsep(&tmp, ":")) != NULL) {
-+			if (i >= ETH_ALEN)
-+				break;
-+
-+			addr[i++] = strtoul(val, NULL, 16);
-+		}
-+
-+		nla_put(msg, idx, ETH_ALEN, addr);
-+
-+		idx++;
-+	}
-+
-+	nla_nest_end(msg, a);
-+
-+	free(str);
-+
-+	return ret;
-+}
-+
-+static void print_mac(const struct tm_field *field, struct nlattr *attr)
-+{
-+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
-+#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
-+	unsigned char addr[3][6];
-+	struct nlattr *cur;
-+	int idx = 0;
-+	int rem;
-+
-+	nla_for_each_nested(cur, attr, rem) {
-+		if (nla_len(cur) != 6)
-+			continue;
-+		memcpy(addr[idx++], nla_data(cur), 6);
-+	}
-+
-+	printf("" MACSTR "," MACSTR "," MACSTR "",
-+	       MAC2STR(addr[0]), MAC2STR(addr[1]), MAC2STR(addr[2]));
-+
-+	return;
-+}
- 
- #define FIELD_GENERIC(_field, _name, ...)	\
- 	[FIELD_NAME(_field)] = {			\
-@@ -250,6 +308,13 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
- 		 ##__VA_ARGS__				\
- 	)
- 
-+#define FIELD_MAC(_field, _name)			\
-+	[FIELD_NAME(_field)] = {			\
-+		.name = _name,				\
-+		.parse = parse_mac,			\
-+		.print = print_mac			\
-+	}
-+
- #define FIELD_NAME(_field) MT76_TM_RX_ATTR_##_field
- static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
- 	FIELD_RO(s32, FREQ_OFFSET, "freq_offset"),
-@@ -300,10 +365,18 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
- 	FIELD(u8, TX_RATE_LDPC, "tx_rate_ldpc"),
- 	FIELD(u8, TX_RATE_STBC, "tx_rate_stbc"),
- 	FIELD(u8, TX_LTF, "tx_ltf"),
-+	FIELD(u8, TX_DUTY_CYCLE, "tx_duty_cycle"),
-+	FIELD(u32, TX_IPG, "tx_ipg"),
-+	FIELD(u32, TX_TIME, "tx_time"),
- 	FIELD(u8, TX_POWER_CONTROL, "tx_power_control"),
- 	FIELD_ARRAY(u8, TX_POWER, "tx_power"),
- 	FIELD(u8, TX_ANTENNA, "tx_antenna"),
-+	FIELD(u8, TX_SPE_IDX, "tx_spe_idx"),
- 	FIELD(u32, FREQ_OFFSET, "freq_offset"),
-+	FIELD(u8, AID, "aid"),
-+	FIELD(u8, RU_ALLOC, "ru_alloc"),
-+	FIELD(u8, RU_IDX, "ru_idx"),
-+	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
- 	FIELD_NESTED_RO(STATS, stats, "",
- 			.print_extra = print_extra_stats),
- };
-@@ -322,9 +395,16 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
- 	[MT76_TM_ATTR_TX_RATE_LDPC] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_RATE_STBC] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_LTF] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_TX_DUTY_CYCLE] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_TX_IPG] = { .type = NLA_U32 },
-+	[MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_TX_POWER_CONTROL] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_TX_ANTENNA] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_TX_SPE_IDX] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
-+	[MT76_TM_ATTR_AID] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_RU_ALLOC] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
- };
- 
-diff --git a/tx.c b/tx.c
-index 1f309d0..6d55566 100644
---- a/tx.c
-+++ b/tx.c
-@@ -250,8 +250,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
- 	if (mt76_is_testmode_skb(dev, skb, &hw)) {
- 		struct mt76_phy *phy = hw->priv;
- 
--		if (skb == phy->test.tx_skb)
--			phy->test.tx_done++;
-+		phy->test.tx_done++;
- 		if (phy->test.tx_queued == phy->test.tx_done)
- 			wake_up(&dev->tx_wait);
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
deleted file mode 100644
index ca0c5d5..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
+++ /dev/null
@@ -1,847 +0,0 @@
-From 027cdfa4869e252c6f2dbef992b14fa5bab4218c Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1113/1131] mt76: testmode: add pre-cal support
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
----
- eeprom.c          |   6 +-
- mt76.h            |   1 +
- mt76_connac_mcu.h |   1 +
- mt7915/eeprom.h   |  34 +++-
- mt7915/mcu.c      |  27 ++-
- mt7915/mt7915.h   |   5 +
- mt7915/testmode.c | 425 +++++++++++++++++++++++++++++++++++++++++++++-
- mt7915/testmode.h |  36 ++++
- testmode.c        |  15 +-
- testmode.h        |  17 ++
- tools/fields.c    |   8 +
- 11 files changed, 562 insertions(+), 13 deletions(-)
-
-diff --git a/eeprom.c b/eeprom.c
-index 0a88048..cb6ff17 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
- 	}
- 
- #ifdef CONFIG_NL80211_TESTMODE
--	dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
--	dev->test_mtd.offset = offset;
-+	if (len == dev->eeprom.size) {
-+		dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
-+		dev->test_mtd.offset = offset;
-+	}
- #endif
- 
- out_put_node:
-diff --git a/mt76.h b/mt76.h
-index 58258e1..89c8570 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -636,6 +636,7 @@ struct mt76_testmode_ops {
- 			  enum mt76_testmode_state new_state);
- 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
- 	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
-+	int (*dump_precal)(struct mt76_phy *phy, struct sk_buff *msg, int flag, int type);
- };
- 
- struct mt76_testmode_entry_data {
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a8ce98c..f42946e 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -990,6 +990,7 @@ enum {
- 
- /* ext event table */
- enum {
-+	MCU_EXT_EVENT_RF_TEST = 0x4,
- 	MCU_EXT_EVENT_PS_SYNC = 0x5,
- 	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
- 	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
-diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index f3e5681..88aaa16 100644
---- a/mt7915/eeprom.h
-+++ b/mt7915/eeprom.h
-@@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
- };
- 
- #define MT_EE_WIFI_CAL_GROUP			BIT(0)
--#define MT_EE_WIFI_CAL_DPD			GENMASK(2, 1)
-+#define MT_EE_WIFI_CAL_DPD_2G			BIT(2)
-+#define MT_EE_WIFI_CAL_DPD_5G			BIT(1)
-+#define MT_EE_WIFI_CAL_DPD_6G			BIT(3)
-+#define MT_EE_WIFI_CAL_DPD			GENMASK(3, 1)
- #define MT_EE_CAL_UNIT				1024
--#define MT_EE_CAL_GROUP_SIZE			(49 * MT_EE_CAL_UNIT + 16)
--#define MT_EE_CAL_DPD_SIZE			(54 * MT_EE_CAL_UNIT)
-+#define MT_EE_CAL_GROUP_SIZE_7915		(49 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7916		(54 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7975		(54 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7976		(94 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7916_6G		(94 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
-+#define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
- 
- #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
- #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
-@@ -155,6 +163,26 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
- 		return val & MT_EE_WIFI_CONF7_TSSI0_5G;
- }
- 
-+static inline u32
-+mt7915_get_cal_group_size(struct mt7915_dev *dev)
-+{
-+	u8 *eep = dev->mt76.eeprom.data;
-+	u32 val;
-+
-+	if (is_mt7915(&dev->mt76)) {
-+		return MT_EE_CAL_GROUP_SIZE_7915;
-+	} else if (is_mt7916(&dev->mt76)) {
-+		val = eep[MT_EE_WIFI_CONF + 1];
-+		val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
-+		return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
-+							 MT_EE_CAL_GROUP_SIZE_7916;
-+	} else if (mt7915_check_adie(dev, false)) {
-+		return MT_EE_CAL_GROUP_SIZE_7976;
-+	} else {
-+		return MT_EE_CAL_GROUP_SIZE_7975;
-+	}
-+}
-+
- extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
- 
- #endif
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 85450ea..8e3217b 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -387,6 +387,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
- 	case MCU_EXT_EVENT_BF_STATUS_READ:
- 		mt7915_tm_txbf_status_read(dev, skb);
- 		break;
-+	case MCU_EXT_EVENT_RF_TEST:
-+		mt7915_tm_rf_test_event(dev, skb);
-+		break;
- #endif
- 	default:
- 		break;
-@@ -2901,7 +2904,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
- 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
- 	u32 total = MT_EE_CAL_GROUP_SIZE;
- 
--	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
-+	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
- 		return 0;
- 
- 	/*
-@@ -2981,11 +2984,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
- 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
--	u16 total = 2, center_freq = chandef->center_freq1;
-+	enum nl80211_band band = chandef->chan->band;
-+	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
-+	u16 center_freq = chandef->center_freq1;
- 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
-+	u8 dpd_mask, cal_num = is_mt7915(&dev->mt76) ? 2 : 3;
- 	int idx;
- 
--	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
-+	switch (band) {
-+	case NL80211_BAND_2GHZ:
-+		dpd_mask = MT_EE_WIFI_CAL_DPD_2G;
-+		break;
-+	case NL80211_BAND_5GHZ:
-+		dpd_mask = MT_EE_WIFI_CAL_DPD_5G;
-+		break;
-+	case NL80211_BAND_6GHZ:
-+		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
-+		break;
-+	default:
-+		dpd_mask = 0;
-+		break;
-+	}
-+
-+	if (!(eep[offs] & dpd_mask))
- 		return 0;
- 
- 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4336f20..b6c9fc5 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -406,6 +406,10 @@ struct mt7915_dev {
- 	struct rchan *relay_fwlog;
- 
- 	void *cal;
-+	u32 cur_prek_offset;
-+	u8 dpd_chan_num_2g;
-+	u8 dpd_chan_num_5g;
-+	u8 dpd_chan_num_6g;
- 
- 	struct {
- 		u8 debug_wm;
-@@ -640,6 +644,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
- void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
- void mt7915_mcu_exit(struct mt7915_dev *dev);
- int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
-+void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
- 
- static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
- {
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index e0ba088..a9e57e4 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -5,6 +5,7 @@
- #include "mac.h"
- #include "mcu.h"
- #include "testmode.h"
-+#include "eeprom.h"
- 
- enum {
- 	TM_CHANGED_TXPOWER,
-@@ -1580,18 +1581,16 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
- static int
- mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
- {
--#define TX_CONT_START	0x05
--#define TX_CONT_STOP	0x06
- 	struct mt7915_dev *dev = phy->dev;
- 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
- 	int freq1 = ieee80211_frequency_to_channel(chandef->center_freq1);
- 	struct mt76_testmode_data *td = &phy->mt76->test;
--	u32 func_idx = en ? TX_CONT_START : TX_CONT_STOP;
-+	u32 func_idx = en ? RF_TEST_TX_CONT_START : RF_TEST_TX_CONT_STOP;
- 	u8 rate_idx = td->tx_rate_idx, mode;
- 	u8 band = phy->mt76->band_idx;
- 	u16 rateval;
- 	struct mt7915_tm_rf_test req = {
--		.action = 1,
-+		.action = RF_ACT_IN_RFTEST,
- 		.icap_len = 120,
- 		.op.rf.func_idx = cpu_to_le32(func_idx),
- 	};
-@@ -1676,6 +1675,316 @@ out:
- 				 sizeof(req), true);
- }
- 
-+static int
-+mt7915_tm_group_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
-+{
-+	u8 *eeprom;
-+	u32 i, group_size, dpd_size, size, offs, *pre_cal;
-+	int ret = 0;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_dev *mdev = &dev->mt76;
-+	struct mt7915_tm_rf_test req = {
-+		.action = RF_ACT_IN_RFTEST,
-+		.icap_len = 8,
-+		.op.rf.func_idx = cpu_to_le32(RF_TEST_RE_CAL),
-+	};
-+
-+	if (!dev->flash_mode && !dev->bin_file_mode) {
-+		dev_err(dev->mt76.dev, "Currently not in FLASH or BIN MODE,return!\n");
-+		return 1;
-+	}
-+
-+	eeprom = mdev->eeprom.data;
-+	dev->cur_prek_offset = 0;
-+	group_size = mt7915_get_cal_group_size(dev);
-+	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
-+	size = group_size + dpd_size;
-+	offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
-+
-+	switch (state) {
-+	case MT76_TM_STATE_GROUP_PREK:
-+		req.op.rf.param.cal_param.func_data = cpu_to_le32(RF_PRE_CAL);
-+
-+		if (!dev->cal) {
-+			dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
-+			if (!dev->cal)
-+				return -ENOMEM;
-+		}
-+
-+		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_TEST), &req,
-+					sizeof(req), true);
-+
-+		if (!ret)
-+			eeprom[offs] |= MT_EE_WIFI_CAL_GROUP;
-+		break;
-+	case MT76_TM_STATE_GROUP_PREK_DUMP:
-+		pre_cal = (u32 *)dev->cal;
-+		if (!pre_cal) {
-+			dev_info(dev->mt76.dev, "Not group pre-cal yet!\n");
-+			return ret;
-+		}
-+		dev_info(dev->mt76.dev, "Group Pre-Cal:\n");
-+		for (i = 0; i < (group_size / sizeof(u32)); i += 4) {
-+			dev_info(dev->mt76.dev, "[0x%08lx] 0x%8x 0x%8x 0x%8x 0x%8x\n",
-+				 i * sizeof(u32), pre_cal[i], pre_cal[i + 1],
-+				 pre_cal[i + 2], pre_cal[i + 3]);
-+		}
-+		break;
-+	case MT76_TM_STATE_GROUP_PREK_CLEAN:
-+		pre_cal = (u32 *)dev->cal;
-+		if (!pre_cal)
-+			return ret;
-+		memset(pre_cal, 0, group_size);
-+		eeprom[offs] &= ~MT_EE_WIFI_CAL_GROUP;
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+	return ret;
-+}
-+
-+static int
-+mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
-+{
-+#define DPD_2G_CH_BW20_BITMAP_0         0x444
-+#define DPD_5G_CH_BW20_BITMAP_0         0xffffc0ff
-+#define DPD_5G_CH_BW20_BITMAP_1         0x3
-+#define DPD_5G_CH_BW20_BITMAP_7915_0    0x7dffc0ff
-+#define DPD_6G_CH_BW20_BITMAP_0         0xffffffff
-+#define DPD_6G_CH_BW20_BITMAP_1         0x07ffffff
-+	bool is_set = false;
-+	u8 band, do_precal, *eeprom;
-+	u16 bw20_size, bw160_size;
-+	u32 i, j, *bw160_freq, bw160_5g_freq[] = {5250, 5570, 5815};
-+	u32 bw160_6g_freq[] = {6025, 6185, 6345, 6505, 6665, 6825, 6985};
-+	u32 shift, freq, group_size, dpd_size, size, offs, *pre_cal, dpd_ch_bw20_bitmap[2] = {0};
-+	__le32 func_data = 0;
-+	int ret = 0;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_dev *mdev = &dev->mt76;
-+	struct mt76_phy *mphy = phy->mt76;
-+	struct cfg80211_chan_def chandef_backup, *chandef = &mphy->chandef;
-+	struct ieee80211_channel chan_backup, chan, *bw20_ch;
-+	struct mt7915_tm_rf_test req = {
-+		.action = RF_ACT_IN_RFTEST,
-+		.icap_len = 8,
-+		.op.rf.func_idx = cpu_to_le32(RF_TEST_RE_CAL),
-+	};
-+
-+	if (!dev->flash_mode && !dev->bin_file_mode) {
-+		dev_err(dev->mt76.dev, "Currently not in FLASH or BIN MODE,return!\n");
-+		return -EOPNOTSUPP;
-+	}
-+
-+	eeprom = mdev->eeprom.data;
-+	dev->cur_prek_offset = 0;
-+	group_size = mt7915_get_cal_group_size(dev);
-+	dev->dpd_chan_num_2g = hweight32(DPD_2G_CH_BW20_BITMAP_0);
-+	if (is_mt7915(&dev->mt76)) {
-+		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_7915_0);
-+		dev->dpd_chan_num_6g = 0;
-+		dpd_size = MT_EE_CAL_DPD_SIZE_V1;
-+		offs = MT_EE_DO_PRE_CAL;
-+	} else {
-+		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_0) +
-+				       hweight32(DPD_5G_CH_BW20_BITMAP_1) +
-+				       ARRAY_SIZE(bw160_5g_freq);
-+		dev->dpd_chan_num_6g = hweight32(DPD_6G_CH_BW20_BITMAP_0) +
-+				       hweight32(DPD_6G_CH_BW20_BITMAP_1) +
-+				       ARRAY_SIZE(bw160_6g_freq);
-+		dpd_size = MT_EE_CAL_DPD_SIZE_V2;
-+		offs = MT_EE_DO_PRE_CAL_V2;
-+	}
-+	size = group_size + dpd_size;
-+
-+	switch (state) {
-+	case MT76_TM_STATE_DPD_2G:
-+		if (!is_set) {
-+			func_data = cpu_to_le32(RF_DPD_FLAT_CAL);
-+			dpd_ch_bw20_bitmap[0] = DPD_2G_CH_BW20_BITMAP_0;
-+			bw20_ch = mphy->sband_2g.sband.channels;
-+			bw160_freq = NULL;
-+			bw160_size = 0;
-+			band = NL80211_BAND_2GHZ;
-+			do_precal = MT_EE_WIFI_CAL_DPD_2G;
-+			is_set = true;
-+		}
-+		fallthrough;
-+	case MT76_TM_STATE_DPD_5G:
-+		if (!is_set) {
-+			if (is_mt7915(&dev->mt76)) {
-+				func_data = cpu_to_le32(RF_DPD_FLAT_CAL);
-+				dpd_ch_bw20_bitmap[0] = DPD_5G_CH_BW20_BITMAP_7915_0;
-+				bw160_size = 0;
-+				dev->cur_prek_offset -= dev->dpd_chan_num_5g * MT_EE_CAL_UNIT * 2;
-+			} else {
-+				func_data = cpu_to_le32(RF_DPD_FLAT_5G_CAL);
-+				dpd_ch_bw20_bitmap[0] = DPD_5G_CH_BW20_BITMAP_0;
-+				dpd_ch_bw20_bitmap[1] = DPD_5G_CH_BW20_BITMAP_1;
-+				bw160_size = ARRAY_SIZE(bw160_5g_freq);
-+			}
-+			bw20_ch = mphy->sband_5g.sband.channels;
-+			bw160_freq = bw160_5g_freq;
-+			band = NL80211_BAND_5GHZ;
-+			do_precal = MT_EE_WIFI_CAL_DPD_5G;
-+			is_set = true;
-+		}
-+		fallthrough;
-+	case MT76_TM_STATE_DPD_6G:
-+		if (!is_set) {
-+			func_data = cpu_to_le32(RF_DPD_FLAT_6G_CAL);
-+			dpd_ch_bw20_bitmap[0] = DPD_6G_CH_BW20_BITMAP_0;
-+			dpd_ch_bw20_bitmap[1] = DPD_6G_CH_BW20_BITMAP_1;
-+			bw20_ch = mphy->sband_6g.sband.channels;
-+			bw160_freq = bw160_6g_freq;
-+			bw160_size = ARRAY_SIZE(bw160_6g_freq);
-+			band = NL80211_BAND_6GHZ;
-+			do_precal = MT_EE_WIFI_CAL_DPD_6G;
-+			is_set = true;
-+		}
-+
-+		if (!bw20_ch)
-+			return -EOPNOTSUPP;
-+		if (!dev->cal) {
-+			dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
-+			if (!dev->cal)
-+				return -ENOMEM;
-+		}
-+
-+		req.op.rf.param.cal_param.func_data = func_data;
-+		req.op.rf.param.cal_param.band_idx = phy->mt76->band_idx;
-+
-+		memcpy(&chan_backup, chandef->chan, sizeof(struct ieee80211_channel));
-+		memcpy(&chandef_backup, chandef, sizeof(struct cfg80211_chan_def));
-+
-+		bw20_size = hweight32(dpd_ch_bw20_bitmap[0]) + hweight32(dpd_ch_bw20_bitmap[1]);
-+		for (i = 0, j = 0; i < bw20_size + bw160_size; i++) {
-+			if (i < bw20_size) {
-+				freq = dpd_ch_bw20_bitmap[0] ? 0 : 1;
-+				shift = ffs(dpd_ch_bw20_bitmap[freq]);
-+				j += shift;
-+				memcpy(&chan, &bw20_ch[j - 1], sizeof(struct ieee80211_channel));
-+				chandef->width = NL80211_CHAN_WIDTH_20;
-+				dpd_ch_bw20_bitmap[0] >>= shift;
-+			} else {
-+				freq = bw160_freq[i - bw20_size];
-+				chan.center_freq = freq;
-+				chan.hw_value = ieee80211_frequency_to_channel(freq);
-+				chan.band = band;
-+				chandef->width = NL80211_CHAN_WIDTH_160;
-+			}
-+
-+			memcpy(chandef->chan, &chan, sizeof(struct ieee80211_channel));
-+			if (is_mt7915(&dev->mt76))
-+				mphy->hw->conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
-+			else
-+				mphy->hw->conf.flags |= IEEE80211_CONF_OFFCHANNEL;
-+
-+			mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(CHANNEL_SWITCH));
-+
-+			ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RF_TEST), &req,
-+						sizeof(req), true);
-+			if (ret) {
-+				dev_err(dev->mt76.dev, "DPD Pre-cal: mcu send msg failed!\n");
-+				break;
-+			}
-+		}
-+		memcpy(chandef, &chandef_backup, sizeof(struct cfg80211_chan_def));
-+		memcpy(chandef->chan, &chan_backup, sizeof(struct ieee80211_channel));
-+		mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(CHANNEL_SWITCH));
-+
-+		if (!ret)
-+			eeprom[offs] |= do_precal;
-+
-+		break;
-+	case MT76_TM_STATE_DPD_DUMP:
-+		pre_cal = (u32 *)dev->cal;
-+		if (!dev->cal) {
-+			dev_info(dev->mt76.dev, "Not DPD pre-cal yet!\n");
-+			return ret;
-+		}
-+		dev_info(dev->mt76.dev, "DPD Pre-Cal:\n");
-+		for (i = 0; i < dpd_size / sizeof(u32); i += 4) {
-+			j = i + (group_size / sizeof(u32));
-+			dev_info(dev->mt76.dev, "[0x%08lx] 0x%8x 0x%8x 0x%8x 0x%8x\n",
-+				 j * sizeof(u32), pre_cal[j], pre_cal[j + 1],
-+				 pre_cal[j + 2], pre_cal[j + 3]);
-+		}
-+		break;
-+	case MT76_TM_STATE_DPD_CLEAN:
-+		pre_cal = (u32 *)dev->cal;
-+		if (!pre_cal)
-+			return ret;
-+		memset(pre_cal + (group_size / sizeof(u32)), 0, dpd_size);
-+		do_precal = MT_EE_WIFI_CAL_DPD;
-+		eeprom[offs] &= ~do_precal;
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+	return ret;
-+}
-+
-+void mt7915_tm_re_cal_event(struct mt7915_dev *dev, struct mt7915_tm_rf_test_result *result,
-+			    struct mt7915_tm_rf_test_data *data)
-+{
-+#define DPD_PER_CHAN_SIZE_7915	2
-+#define DPD_PER_CHAN_SIZE_7986	3
-+	u32 base, dpd_offest_2g, dpd_offest_5g, cal_idx = 0, cal_type = 0, len = 0;
-+	u8 *pre_cal;
-+
-+	pre_cal = dev->cal;
-+	dpd_offest_5g = dev->dpd_chan_num_6g * DPD_PER_CHAN_SIZE_7986 * MT_EE_CAL_UNIT;
-+	dpd_offest_2g = dpd_offest_5g + dev->dpd_chan_num_5g * MT_EE_CAL_UNIT *
-+			(is_mt7915(&dev->mt76) ? DPD_PER_CHAN_SIZE_7915 : DPD_PER_CHAN_SIZE_7986);
-+	cal_idx = le32_to_cpu(data->cal_idx);
-+	cal_type = le32_to_cpu(data->cal_type);
-+	len = le32_to_cpu(result->payload_len);
-+	len = len - sizeof(struct mt7915_tm_rf_test_data);
-+
-+	switch (cal_type) {
-+	case RF_PRE_CAL:
-+		base = 0;
-+		break;
-+	case RF_DPD_FLAT_CAL:
-+		base = mt7915_get_cal_group_size(dev) + dpd_offest_2g;
-+		break;
-+	case RF_DPD_FLAT_5G_CAL:
-+		base = mt7915_get_cal_group_size(dev) + dpd_offest_5g;
-+		break;
-+	case RF_DPD_FLAT_6G_CAL:
-+		base = mt7915_get_cal_group_size(dev);
-+		break;
-+	default:
-+		dev_info(dev->mt76.dev, "Unknown calibration type!\n");
-+		return;
-+	}
-+	pre_cal += (base + dev->cur_prek_offset);
-+
-+	memcpy(pre_cal, data->data, len);
-+	dev->cur_prek_offset += len;
-+}
-+
-+void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb)
-+{
-+	struct mt7915_tm_rf_test_result *result;
-+	struct mt7915_tm_rf_test_data *data;
-+	static u32 event_type;
-+
-+	result = (struct mt7915_tm_rf_test_result *)skb->data;
-+	data = (struct mt7915_tm_rf_test_data *)result->event;
-+
-+	event_type = le32_to_cpu(result->func_idx);
-+
-+	switch (event_type) {
-+	case RF_TEST_RE_CAL:
-+		mt7915_tm_re_cal_event(dev, result, data);
-+		break;
-+	default:
-+		break;
-+	}
-+}
-+
- static void
- mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
- {
-@@ -1715,6 +2024,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
- 	else if (prev_state == MT76_TM_STATE_OFF ||
- 		 state == MT76_TM_STATE_OFF)
- 		mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
-+	else if (state >= MT76_TM_STATE_GROUP_PREK && state <= MT76_TM_STATE_GROUP_PREK_CLEAN)
-+		return mt7915_tm_group_prek(phy, state);
-+	else if (state >= MT76_TM_STATE_DPD_2G && state <= MT76_TM_STATE_DPD_CLEAN)
-+		return mt7915_tm_dpd_prek(phy, state);
- 
- 	if ((state == MT76_TM_STATE_IDLE &&
- 	     prev_state == MT76_TM_STATE_OFF) ||
-@@ -1876,9 +2189,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
- 	return ret;
- }
- 
-+static int
-+mt7915_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int type)
-+{
-+#define DPD_PER_CHAN_SIZE_MASK		GENMASK(31, 24)
-+#define DPD_CHAN_NUM_2G_MASK		GENMASK(23, 16)
-+#define DPD_CHAN_NUM_5G_MASK		GENMASK(15, 8)
-+#define DPD_CHAN_NUM_6G_MASK		GENMASK(7, 0)
-+	struct mt7915_phy *phy = mphy->priv;
-+	struct mt7915_dev *dev = phy->dev;
-+	u32 i, group_size, dpd_size, total_size, dpd_per_chan_size, dpd_info = 0;
-+	u32 base, size, total_chan_num, offs, transmit_size = 1000;
-+	u8 *pre_cal, *eeprom;
-+	void *precal;
-+	enum prek_ops {
-+		PREK_GET_INFO,
-+		PREK_SYNC_ALL,
-+		PREK_SYNC_GROUP,
-+		PREK_SYNC_DPD_2G,
-+		PREK_SYNC_DPD_5G,
-+		PREK_SYNC_DPD_6G,
-+		PREK_CLEAN_GROUP,
-+		PREK_CLEAN_DPD,
-+	};
-+
-+	if (!dev->cal) {
-+		dev_info(dev->mt76.dev, "Not pre-cal yet!\n");
-+		return 0;
-+	}
-+
-+	group_size = mt7915_get_cal_group_size(dev);
-+	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
-+	dpd_per_chan_size = is_mt7915(&dev->mt76) ? 2 : 3;
-+	total_size = group_size + dpd_size;
-+	pre_cal = dev->cal;
-+	eeprom = dev->mt76.eeprom.data;
-+	offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
-+
-+	total_chan_num = dev->dpd_chan_num_2g + dev->dpd_chan_num_5g + dev->dpd_chan_num_6g;
-+
-+	switch (type) {
-+	case PREK_SYNC_ALL:
-+		base = 0;
-+		size = total_size;
-+		break;
-+	case PREK_SYNC_GROUP:
-+		base = 0;
-+		size = group_size;
-+		break;
-+	case PREK_SYNC_DPD_6G:
-+		base = group_size;
-+		size = dpd_size * dev->dpd_chan_num_6g / total_chan_num;
-+		break;
-+	case PREK_SYNC_DPD_5G:
-+		base = group_size + dev->dpd_chan_num_6g * dpd_per_chan_size * MT_EE_CAL_UNIT;
-+		size = dpd_size * dev->dpd_chan_num_5g / total_chan_num;
-+		break;
-+	case PREK_SYNC_DPD_2G:
-+		base = group_size + (dev->dpd_chan_num_6g + dev->dpd_chan_num_5g) *
-+			   dpd_per_chan_size * MT_EE_CAL_UNIT;
-+		size = dpd_size * dev->dpd_chan_num_2g / total_chan_num;
-+		break;
-+	case PREK_GET_INFO:
-+		break;
-+	default:
-+		return 0;
-+	}
-+
-+	if (!flag) {
-+		if (eeprom[offs] & MT_EE_WIFI_CAL_DPD) {
-+			dpd_info |= u32_encode_bits(dpd_per_chan_size, DPD_PER_CHAN_SIZE_MASK) |
-+				    u32_encode_bits(dev->dpd_chan_num_2g, DPD_CHAN_NUM_2G_MASK) |
-+				    u32_encode_bits(dev->dpd_chan_num_5g, DPD_CHAN_NUM_5G_MASK) |
-+				    u32_encode_bits(dev->dpd_chan_num_6g, DPD_CHAN_NUM_6G_MASK);
-+		}
-+		dev->cur_prek_offset = 0;
-+		precal = nla_nest_start(msg, MT76_TM_ATTR_PRECAL_INFO);
-+		if (!precal)
-+			return -ENOMEM;
-+		nla_put_u32(msg, 0, group_size);
-+		nla_put_u32(msg, 1, dpd_size);
-+		nla_put_u32(msg, 2, dpd_info);
-+		nla_put_u32(msg, 3, transmit_size);
-+		nla_put_u32(msg, 4, eeprom[offs]);
-+		nla_nest_end(msg, precal);
-+	} else {
-+		precal = nla_nest_start(msg, MT76_TM_ATTR_PRECAL);
-+		if (!precal)
-+			return -ENOMEM;
-+
-+		transmit_size = (dev->cur_prek_offset + transmit_size < size) ?
-+				transmit_size : (size - dev->cur_prek_offset);
-+		for (i = 0; i < transmit_size; i++) {
-+			if (nla_put_u8(msg, i, pre_cal[base + dev->cur_prek_offset + i]))
-+				return -ENOMEM;
-+		}
-+		dev->cur_prek_offset += transmit_size;
-+
-+		nla_nest_end(msg, precal);
-+	}
-+
-+	return 0;
-+}
-+
- const struct mt76_testmode_ops mt7915_testmode_ops = {
- 	.set_state = mt7915_tm_set_state,
- 	.set_params = mt7915_tm_set_params,
- 	.dump_stats = mt7915_tm_dump_stats,
- 	.set_eeprom = mt7915_tm_set_eeprom,
-+	.dump_precal = mt7915_tm_dump_precal,
- };
-diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9..d500987 100644
---- a/mt7915/testmode.h
-+++ b/mt7915/testmode.h
-@@ -81,6 +81,11 @@ struct tm_tx_cont {
- 	u8 txfd_mode;
- };
- 
-+struct tm_cal_param {
-+	__le32 func_data;
-+	u8 band_idx;
-+};
-+
- struct mt7915_tm_rf_test {
- 	u8 action;
- 	u8 icap_len;
-@@ -96,6 +101,7 @@ struct mt7915_tm_rf_test {
- 				__le32 cal_dump;
- 
- 				struct tm_tx_cont tx_cont;
-+				struct tm_cal_param cal_param;
- 
- 				u8 _pad[80];
- 			} param;
-@@ -103,6 +109,20 @@ struct mt7915_tm_rf_test {
- 	} op;
- } __packed;
- 
-+struct mt7915_tm_rf_test_result {
-+	struct mt76_connac2_mcu_rxd rxd;
-+
-+	u32 func_idx;
-+	u32 payload_len;
-+	u8 event[0];
-+} __packed;
-+
-+struct mt7915_tm_rf_test_data {
-+	u32 cal_idx;
-+	u32 cal_type;
-+	u8 data[0];
-+} __packed;
-+
- enum {
- 	RF_OPER_NORMAL,
- 	RF_OPER_RF_TEST,
-@@ -111,6 +131,22 @@ enum {
- 	RF_OPER_WIFI_SPECTRUM,
- };
- 
-+enum {
-+	RF_ACT_SWITCH_MODE,
-+	RF_ACT_IN_RFTEST,
-+};
-+
-+enum {
-+	RF_TEST_RE_CAL = 0x01,
-+	RF_TEST_TX_CONT_START = 0x05,
-+	RF_TEST_TX_CONT_STOP = 0x06,
-+};
-+
-+#define RF_DPD_FLAT_CAL		BIT(28)
-+#define RF_PRE_CAL		BIT(29)
-+#define RF_DPD_FLAT_5G_CAL	GENMASK(29, 28)
-+#define RF_DPD_FLAT_6G_CAL	(BIT(30) | BIT(28))
-+
- enum {
- 	TAM_ARB_OP_MODE_NORMAL = 1,
- 	TAM_ARB_OP_MODE_TEST,
-diff --git a/testmode.c b/testmode.c
-index 7a9ed54..82b8e98 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 
- 	mutex_lock(&dev->mutex);
- 
-+	if (tb[MT76_TM_ATTR_PRECAL] || tb[MT76_TM_ATTR_PRECAL_INFO]) {
-+		int flag, type;
-+
-+		err = -EINVAL;
-+		flag = tb[MT76_TM_ATTR_PRECAL] ? 1 : 0;
-+		type = flag ? nla_get_u8(tb[MT76_TM_ATTR_PRECAL_INFO]) : 0;
-+		if (dev->test_ops->dump_precal)
-+			err = dev->test_ops->dump_precal(phy, msg, flag, type);
-+
-+		goto out;
-+	}
-+
- 	if (tb[MT76_TM_ATTR_STATS]) {
- 		err = -EINVAL;
- 
-@@ -796,7 +808,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 
- 	if (dev->test_mtd.name &&
- 	    (nla_put_string(msg, MT76_TM_ATTR_MTD_PART, dev->test_mtd.name) ||
--	     nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset)))
-+	     nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset) ||
-+	     nla_put_u8(msg, MT76_TM_ATTR_IS_MAIN_PHY, phy == &dev->phy)))
- 		goto out;
- 
- 	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
-diff --git a/testmode.h b/testmode.h
-index 57949f2..e2190e7 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -19,6 +19,7 @@
-  *
-  * @MT76_TM_ATTR_MTD_PART: mtd partition used for eeprom data (string)
-  * @MT76_TM_ATTR_MTD_OFFSET: offset of eeprom data within the partition (u32)
-+ * @MT76_TM_ATTR_IS_MAIN_PHY: Is current phy index the main phy or the ext phy (u8)
-  *
-  * @MT76_TM_ATTR_TX_COUNT: configured number of frames to send when setting
-  *	state to MT76_TM_STATE_TX_FRAMES (u32)
-@@ -40,6 +41,11 @@
-  *
-  * @MT76_TM_ATTR_STATS: statistics (nested, see &enum mt76_testmode_stats_attr)
-  *
-+ * @MT76_TM_ATTR_PRECAL: Pre-cal data (u8)
-+ * @MT76_TM_ATTR_PRECAL_INFO: group size, dpd size, dpd_info, transmit size,
-+ *                            eeprom cal indicator (u32),
-+ *                            dpd_info = [dpd_per_chan_size, chan_num_2g,
-+ *                                        chan_num_5g, chan_num_6g]
-  * @MT76_TM_ATTR_TX_SPE_IDX: tx spatial extension index (u8)
-  *
-  * @MT76_TM_ATTR_TX_DUTY_CYCLE: packet tx duty cycle (u8)
-@@ -67,6 +73,7 @@ enum mt76_testmode_attr {
- 
- 	MT76_TM_ATTR_MTD_PART,
- 	MT76_TM_ATTR_MTD_OFFSET,
-+	MT76_TM_ATTR_IS_MAIN_PHY,
- 
- 	MT76_TM_ATTR_TX_COUNT,
- 	MT76_TM_ATTR_TX_LENGTH,
-@@ -85,6 +92,8 @@ enum mt76_testmode_attr {
- 	MT76_TM_ATTR_FREQ_OFFSET,
- 
- 	MT76_TM_ATTR_STATS,
-+	MT76_TM_ATTR_PRECAL,
-+	MT76_TM_ATTR_PRECAL_INFO,
- 
- 	MT76_TM_ATTR_TX_SPE_IDX,
- 
-@@ -184,6 +193,14 @@ enum mt76_testmode_state {
- 	MT76_TM_STATE_TX_FRAMES,
- 	MT76_TM_STATE_RX_FRAMES,
- 	MT76_TM_STATE_TX_CONT,
-+	MT76_TM_STATE_GROUP_PREK,
-+	MT76_TM_STATE_GROUP_PREK_DUMP,
-+	MT76_TM_STATE_GROUP_PREK_CLEAN,
-+	MT76_TM_STATE_DPD_2G,
-+	MT76_TM_STATE_DPD_5G,
-+	MT76_TM_STATE_DPD_6G,
-+	MT76_TM_STATE_DPD_DUMP,
-+	MT76_TM_STATE_DPD_CLEAN,
- 	MT76_TM_STATE_ON,
- 
- 	/* keep last */
-diff --git a/tools/fields.c b/tools/fields.c
-index 6e36ab2..1be1ffd 100644
---- a/tools/fields.c
-+++ b/tools/fields.c
-@@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
- 	[MT76_TM_STATE_TX_FRAMES] = "tx_frames",
- 	[MT76_TM_STATE_RX_FRAMES] = "rx_frames",
- 	[MT76_TM_STATE_TX_CONT] = "tx_cont",
-+	[MT76_TM_STATE_GROUP_PREK] = "group_prek",
-+	[MT76_TM_STATE_GROUP_PREK_DUMP] = "group_prek_dump",
-+	[MT76_TM_STATE_GROUP_PREK_CLEAN] = "group_prek_clean",
-+	[MT76_TM_STATE_DPD_2G] = "dpd_2g",
-+	[MT76_TM_STATE_DPD_5G] = "dpd_5g",
-+	[MT76_TM_STATE_DPD_6G] = "dpd_6g",
-+	[MT76_TM_STATE_DPD_DUMP] = "dpd_dump",
-+	[MT76_TM_STATE_DPD_CLEAN] = "dpd_clean",
- };
- 
- static const char * const testmode_tx_mode[] = {
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
deleted file mode 100644
index 5f69e9e..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
+++ /dev/null
@@ -1,243 +0,0 @@
-From 66bc9f6b11a2d1bb5da592400984337bb0d077b9 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1114/1131] mt76: testmode: add iBF command mode support
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
----
- mt7915/testmode.c | 21 ++++++++++++++-------
- testmode.c        | 41 +++++++++++++++++++++++++++++++++++++++++
- testmode.h        |  2 ++
- tools/fields.c    | 28 ++++++++++++++++++++++++++++
- 4 files changed, 85 insertions(+), 7 deletions(-)
-
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index a9e57e4..99582d9 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
- 	struct ieee80211_vif *vif = phy->monitor_vif;
- 	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
- 	u8 pfmu_idx = val[0], nc = val[2], nr;
-+	bool is_atenl = val[6];
- 	int ret;
- 
- 	if (td->tx_antenna_mask == 3)
-@@ -748,7 +749,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
- 	if (ret)
- 		return ret;
- 
--	if (!ebf)
-+	if (!ebf && is_atenl)
- 		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
- 
- 	return 0;
-@@ -775,7 +776,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
- 		.group_l_m_n = val[1],
- 		.sx2 = val[2],
- 		.cal_type = val[3],
--		.lna_gain_level = 0, /* for test purpose */
-+		.lna_gain_level = val[4],
- 	};
- 	struct mt7915_tm_txbf_phase *phase =
- 		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
-@@ -814,6 +815,8 @@ int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
- 			phase = &phase[cal->group];
- 			memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
- 			phase->status = cal->status;
-+			/* for passing iTest script */
-+			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
- 			break;
- 		case IBF_PHASE_CAL_VERIFY:
- 		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
-@@ -865,7 +868,6 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
- 	pfmu_data->phi11 = cpu_to_le16(phi11);
- 	pfmu_data->phi21 = cpu_to_le16(phi21);
- 	pfmu_data->phi31 = cpu_to_le16(phi31);
--
- 	if (subc_id == 63) {
- 		struct mt7915_dev *dev = phy->dev;
- 		struct {
-@@ -923,8 +925,8 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
- 	struct mt76_testmode_data *td = &phy->mt76->test;
- 	u16 *val = td->txbf_param;
- 
--	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u\n",
--		td->txbf_act, val[0], val[1], val[2], val[3], val[4]);
-+	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
-+		td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5]);
- 
- 	switch (td->txbf_act) {
- 	case MT76_TM_TXBF_ACT_INIT:
-@@ -942,10 +944,17 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
- 		return mt7915_tm_txbf_profile_update(phy, val, true);
- 	case MT76_TM_TXBF_ACT_PHASE_CAL:
- 		return mt7915_tm_txbf_phase_cal(phy, val);
-+	case MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD:
- 	case MT76_TM_TXBF_ACT_PROF_UPDATE_ALL:
- 		return mt7915_tm_txbf_profile_update_all(phy, val);
- 	case MT76_TM_TXBF_ACT_E2P_UPDATE:
- 		return mt7915_tm_txbf_e2p_update(phy);
-+	case MT76_TM_TXBF_ACT_APPLY_TX: {
-+		u16 wlan_idx = val[0];
-+		bool ebf = !!val[1], ibf = !!val[2], phase_cal = !!val[4];
-+
-+		return mt7915_tm_txbf_apply_tx(phy, wlan_idx, ebf, ibf, phase_cal);
-+	}
- 	default:
- 		break;
- 	};
-@@ -1072,7 +1081,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
- 		rate.legacy = sband->bitrates[rate.mcs].bitrate;
- 		break;
- 	case MT76_TM_TX_MODE_HT:
--		rate.mcs += rate.nss * 8;
- 		flags |= RATE_INFO_FLAGS_MCS;
- 
- 		if (td->tx_rate_sgi)
-@@ -1437,7 +1445,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 			if (duty_cycle < 100)
- 				tx_time = duty_cycle * ipg / (100 - duty_cycle);
- 		}
--
- 		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
- 		mt7915_tm_set_tx_len(phy, tx_time);
- 
-diff --git a/testmode.c b/testmode.c
-index 82b8e98..aa874a8 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -530,6 +530,42 @@ out:
- 	return err;
- }
- 
-+static int
-+mt76_testmode_txbf_profile_update_all_cmd(struct mt76_phy *phy, struct nlattr **tb, u32 state)
-+{
-+#define PARAM_UNIT	5
-+	static u8 pfmu_idx;
-+	struct mt76_testmode_data *td = &phy->test;
-+	struct mt76_dev *dev = phy->dev;
-+	struct nlattr *cur;
-+	u16 tmp_val[PARAM_UNIT], *val = td->txbf_param;
-+	int idx, rem, ret, i = 0;
-+
-+	memset(td->txbf_param, 0, sizeof(td->txbf_param));
-+	nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
-+		if (nla_len(cur) != 2)
-+			return -EINVAL;
-+		idx = i % PARAM_UNIT;
-+		tmp_val[idx] = nla_get_u16(cur);
-+		if (idx == 1 && (tmp_val[idx] == 0xf0 || tmp_val[idx] == 0xff)) {
-+			pfmu_idx = tmp_val[0];
-+			return 0;
-+		}
-+		if (idx == PARAM_UNIT - 1) {
-+			val[0] = pfmu_idx;
-+			memcpy(val + 1, tmp_val, sizeof(tmp_val));
-+			if (dev->test_ops->set_params) {
-+				ret = dev->test_ops->set_params(phy, tb, state);
-+				if (ret)
-+					return ret;
-+			}
-+		}
-+		i++;
-+	}
-+
-+	return 0;
-+}
-+
- int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		      void *data, int len)
- {
-@@ -668,6 +704,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		    0, MT76_TM_TXBF_ACT_MAX))
- 			goto out;
- 
-+		if (td->txbf_act == MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD) {
-+			err = mt76_testmode_txbf_profile_update_all_cmd(phy, tb, state);
-+			goto out;
-+		}
-+
- 		memset(td->txbf_param, 0, sizeof(td->txbf_param));
- 		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
- 			if (nla_len(cur) != 2 ||
-diff --git a/testmode.h b/testmode.h
-index e2190e7..5d1fe79 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
- 	MT76_TM_TXBF_ACT_TX_PREP,
- 	MT76_TM_TXBF_ACT_IBF_PROF_UPDATE,
- 	MT76_TM_TXBF_ACT_EBF_PROF_UPDATE,
-+	MT76_TM_TXBF_ACT_APPLY_TX,
- 	MT76_TM_TXBF_ACT_PHASE_CAL,
- 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
-+	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
- 	MT76_TM_TXBF_ACT_E2P_UPDATE,
- 
- 	/* keep last */
-diff --git a/tools/fields.c b/tools/fields.c
-index 1be1ffd..47fc69f 100644
---- a/tools/fields.c
-+++ b/tools/fields.c
-@@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
- 	[MT76_TM_TX_MODE_HE_MU] = "he_mu",
- };
- 
-+static const char * const testmode_txbf_act[] = {
-+	[MT76_TM_TXBF_ACT_INIT] = "init",
-+	[MT76_TM_TXBF_ACT_UPDATE_CH] = "update_ch",
-+	[MT76_TM_TXBF_ACT_PHASE_COMP] = "phase_comp",
-+	[MT76_TM_TXBF_ACT_TX_PREP] = "tx_prep",
-+	[MT76_TM_TXBF_ACT_IBF_PROF_UPDATE] = "ibf_prof_update",
-+	[MT76_TM_TXBF_ACT_EBF_PROF_UPDATE] = "ebf_prof_update",
-+	[MT76_TM_TXBF_ACT_APPLY_TX] = "apply_tx",
-+	[MT76_TM_TXBF_ACT_PHASE_CAL] = "phase_cal",
-+	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL] = "prof_update",
-+	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD] = "prof_update_all",
-+	[MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
-+};
-+
- static void print_enum(const struct tm_field *field, struct nlattr *attr)
- {
- 	unsigned int i = nla_get_u8(attr);
-@@ -82,6 +96,17 @@ static void print_s8(const struct tm_field *field, struct nlattr *attr)
- 	printf("%d", (int8_t)nla_get_u8(attr));
- }
- 
-+static bool parse_u16_hex(const struct tm_field *field, int idx,
-+			  struct nl_msg *msg, const char *val)
-+{
-+	return !nla_put_u16(msg, idx, strtoul(val, NULL, 16));
-+}
-+
-+static void print_u16_hex(const struct tm_field *field, struct nlattr *attr)
-+{
-+	printf("%d", nla_get_u16(attr));
-+}
-+
- static bool parse_u32(const struct tm_field *field, int idx,
- 		      struct nl_msg *msg, const char *val)
- {
-@@ -384,6 +409,8 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
- 	FIELD(u8, AID, "aid"),
- 	FIELD(u8, RU_ALLOC, "ru_alloc"),
- 	FIELD(u8, RU_IDX, "ru_idx"),
-+	FIELD_ENUM(TXBF_ACT, "txbf_act", testmode_txbf_act),
-+	FIELD_ARRAY(u16_hex, TXBF_PARAM, "txbf_param"),
- 	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
- 	FIELD_NESTED_RO(STATS, stats, "",
- 			.print_extra = print_extra_stats),
-@@ -414,6 +441,7 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
- 	[MT76_TM_ATTR_RU_ALLOC] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
-+	[MT76_TM_ATTR_TXBF_ACT] = { .type = NLA_U8 },
- };
- 
- const struct tm_field msg_field = {
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
deleted file mode 100644
index 1fb13e1..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ /dev/null
@@ -1,686 +0,0 @@
-From fbce4b7e9c52454e930544224e586002fb77eb67 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1115/1131] mt76: testmode: add ZWDFS test mode support
-
-Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt76.h            |   9 ++
- mt76_connac_mcu.h |   2 +
- mt7915/mcu.c      |  66 +++++++++++++
- mt7915/mcu.h      |  46 +++++++++
- mt7915/mt7915.h   |   4 +
- mt7915/regs.h     |   2 +
- mt7915/testmode.c | 232 ++++++++++++++++++++++++++++++++++++++++++++++
- testmode.c        |  25 ++++-
- testmode.h        |  45 +++++++++
- tools/fields.c    |  22 +++++
- 10 files changed, 452 insertions(+), 1 deletion(-)
-
-diff --git a/mt76.h b/mt76.h
-index 89c8570..2bacc1b 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -719,6 +719,15 @@ struct mt76_testmode_data {
- 		u64 fcs_error[__MT_RXQ_MAX];
- 		u64 len_mismatch;
- 	} rx_stats;
-+
-+	u8 offchan_ch;
-+	u8 offchan_center_ch;
-+	u8 offchan_bw;
-+
-+	u8 ipi_threshold;
-+	u32 ipi_period;
-+	u8 ipi_antenna_idx;
-+	u8 ipi_reset;
- };
- 
- struct mt76_vif {
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f42946e..7853e07 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1190,6 +1190,7 @@ enum {
- 	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
- 	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
- 	MCU_EXT_CMD_MURU_CTRL = 0x9f,
-+	MCU_EXT_CMD_IPI_HIST_CTRL = 0xa3,
- 	MCU_EXT_CMD_RX_STAT = 0xa4,
- 	MCU_EXT_CMD_SET_SPR = 0xa8,
- 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
-@@ -1200,6 +1201,7 @@ enum {
- 	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
- 	MCU_EXT_CMD_CERT_CFG = 0xb7,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
-+	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
- };
- 
- enum {
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8e3217b..b8243e1 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2636,6 +2636,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
- 		req.monitor_chan = chandef->chan->hw_value;
- 		req.monitor_central_chan =
- 			ieee80211_frequency_to_channel(chandef->center_freq1);
-+		req.monitor_bw = mt76_connac_chan_bw(chandef);
- 		req.band_idx = phy->mt76->band_idx;
- 		req.scan_mode = 2;
- 		break;
-@@ -4474,3 +4475,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
- }
- #endif
-+
-+int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct sk_buff *skb;
-+	int ret;
-+	struct {
-+		u8 ipi_hist_idx;
-+		u8 band_idx;
-+		u8 set_val;
-+		u8 rsv;
-+		int idle_power_th;
-+		u32 idle_power_max_cnt;
-+		u32 idle_power_duration;
-+		u32 idle_power_cmd_type;
-+	} __packed req = {
-+		.ipi_hist_idx = cmd,
-+		.band_idx = phy->mt76->band_idx,
-+	};
-+
-+	if (!wait_resp)
-+		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(IPI_HIST_CTRL),
-+					 &req, sizeof(req), true);
-+
-+	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(IPI_HIST_CTRL),
-+					&req, sizeof(req), wait_resp, &skb);
-+
-+	if (ret)
-+		return ret;
-+
-+	memcpy(data, skb->data, sizeof(struct mt7915_mcu_rdd_ipi_ctrl));
-+	dev_kfree_skb(skb);
-+
-+	return 0;
-+}
-+
-+int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct sk_buff *skb;
-+	int ret;
-+	struct rdd_ipi_hist_scan {
-+		u8 mode;
-+		u8 pd_setting;
-+		u8 band_idx;
-+		u8 rsv;
-+	} __packed req = {
-+		.mode = mode,
-+		.pd_setting = 1,
-+		.band_idx = phy->mt76->band_idx,
-+	};
-+
-+	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(IPI_HIST_SCAN),
-+					&req, sizeof(req), wait_resp, &skb);
-+	if (ret)
-+		return ret;
-+
-+	if (!wait_resp)
-+		return 0;
-+
-+	memcpy(data, skb->data, sizeof(struct mt7915_mcu_rdd_ipi_scan));
-+	dev_kfree_skb(skb);
-+
-+	return 0;
-+}
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 4d86c7f..9a48524 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -628,6 +628,52 @@ struct csi_data {
- };
- #endif
- 
-+enum {
-+	RDD_SET_IPI_CR_INIT,		/* CR initialization */
-+	RDD_SET_IPI_HIST_RESET,		/* Reset IPI histogram counter */
-+	RDD_SET_IDLE_POWER,		/* Idle power info */
-+	RDD_SET_IPI_HIST_NUM
-+};
-+
-+enum {
-+	RDD_IPI_HIST_0,			/* IPI count for power <= -92 (dBm) */
-+	RDD_IPI_HIST_1,			/* IPI count for -92 < power <= -89 (dBm) */
-+	RDD_IPI_HIST_2,			/* IPI count for -89 < power <= -86 (dBm) */
-+	RDD_IPI_HIST_3,			/* IPI count for -86 < power <= -83 (dBm) */
-+	RDD_IPI_HIST_4,			/* IPI count for -83 < power <= -80 (dBm) */
-+	RDD_IPI_HIST_5,			/* IPI count for -80 < power <= -75 (dBm) */
-+	RDD_IPI_HIST_6,			/* IPI count for -75 < power <= -70 (dBm) */
-+	RDD_IPI_HIST_7,			/* IPI count for -70 < power <= -65 (dBm) */
-+	RDD_IPI_HIST_8,			/* IPI count for -65 < power <= -60 (dBm) */
-+	RDD_IPI_HIST_9,			/* IPI count for -60 < power <= -55 (dBm) */
-+	RDD_IPI_HIST_10,		/* IPI count for -55 < power        (dBm) */
-+	RDD_IPI_FREE_RUN_CNT,		/* IPI count for counter++ per 8 us */
-+	RDD_IPI_HIST_ALL_CNT,		/* Get all IPI */
-+	RDD_IPI_HIST_0_TO_10_CNT,	/* Get IPI histogram 0 to 10 */
-+	RDD_IPI_HIST_2_TO_10_CNT,	/* Get IPI histogram 2 to 10 */
-+	RDD_TX_ASSERT_TIME,		/* Get band 1 TX assert time */
-+	RDD_IPI_HIST_NUM
-+};
-+
-+#define RDM_NF_MAX_WF_IDX		8
-+#define POWER_INDICATE_HIST_MAX		RDD_IPI_FREE_RUN_CNT
-+#define IPI_HIST_TYPE_NUM		(POWER_INDICATE_HIST_MAX + 1)
-+
-+struct mt7915_mcu_rdd_ipi_ctrl {
-+	u8 ipi_hist_idx;
-+	u8 band_idx;
-+	u8 rsv[2];
-+	u32 ipi_hist_val[IPI_HIST_TYPE_NUM];
-+	u32 tx_assert_time;						/* unit: us */
-+} __packed;
-+
-+struct mt7915_mcu_rdd_ipi_scan {
-+	u32 ipi_hist_val[RDM_NF_MAX_WF_IDX][POWER_INDICATE_HIST_MAX];
-+	u8 band_idx;
-+	u8 rsv[2];
-+	u8 tx_assert_time;						/* unit: us */
-+} __packed;
-+
- /* MURU */
- #define OFDMA_DL                       BIT(0)
- #define OFDMA_UL                       BIT(1)
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b6c9fc5..d845206 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -308,6 +308,7 @@ struct mt7915_phy {
- 
- 	struct mib_stats mib;
- 	struct mt76_channel_state state_ts;
-+	struct delayed_work ipi_work;
- 
- #ifdef CONFIG_NL80211_TESTMODE
- 	struct {
-@@ -758,6 +759,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
- 				  struct ieee80211_sta *sta);
- #endif
- 
-+int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
-+int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
-+
- #ifdef MTK_DEBUG
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
- int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e876848..f4b5709 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -1194,6 +1194,8 @@ enum offs_rev {
- #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
- #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
- 
-+#define MT_WF_IPI_RESET			0x831a3008
-+
- /* PHY */
- #define MT_WF_PHY_BASE			0x83080000
- #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 99582d9..2ae6c07 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -13,6 +13,12 @@ enum {
- 	TM_CHANGED_AID,
- 	TM_CHANGED_CFG,
- 	TM_CHANGED_TXBF_ACT,
-+	TM_CHANGED_OFF_CHAN_CH,
-+	TM_CHANGED_OFF_CHAN_CENTER_CH,
-+	TM_CHANGED_OFF_CHAN_BW,
-+	TM_CHANGED_IPI_THRESHOLD,
-+	TM_CHANGED_IPI_PERIOD,
-+	TM_CHANGED_IPI_RESET,
- 
- 	/* must be last */
- 	NUM_TM_CHANGED
-@@ -24,6 +30,12 @@ static const u8 tm_change_map[] = {
- 	[TM_CHANGED_AID] = MT76_TM_ATTR_AID,
- 	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
- 	[TM_CHANGED_TXBF_ACT] = MT76_TM_ATTR_TXBF_ACT,
-+	[TM_CHANGED_OFF_CHAN_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CH,
-+	[TM_CHANGED_OFF_CHAN_CENTER_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
-+	[TM_CHANGED_OFF_CHAN_BW] = MT76_TM_ATTR_OFF_CH_SCAN_BW,
-+	[TM_CHANGED_IPI_THRESHOLD] = MT76_TM_ATTR_IPI_THRESHOLD,
-+	[TM_CHANGED_IPI_PERIOD] = MT76_TM_ATTR_IPI_PERIOD,
-+	[TM_CHANGED_IPI_RESET] = MT76_TM_ATTR_IPI_RESET,
- };
- 
- struct reg_band {
-@@ -962,6 +974,216 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
- 	return 0;
- }
- 
-+static int
-+mt7915_tm_set_offchan(struct mt7915_phy *phy)
-+{
-+	struct mt76_phy *mphy = phy->mt76;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct ieee80211_hw *hw = mphy->hw;
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct cfg80211_chan_def chandef = {};
-+	struct ieee80211_channel *chan;
-+	int ret, freq = ieee80211_channel_to_frequency(td->offchan_ch, NL80211_BAND_5GHZ);
-+	int width_mhz;
-+	const int bw_to_mhz[] = {
-+		[NL80211_CHAN_WIDTH_20_NOHT] = 20,
-+		[NL80211_CHAN_WIDTH_20] = 20,
-+		[NL80211_CHAN_WIDTH_40] = 40,
-+		[NL80211_CHAN_WIDTH_80] = 80,
-+		[NL80211_CHAN_WIDTH_80P80] = 80,
-+		[NL80211_CHAN_WIDTH_160] = 160,
-+	};
-+
-+	if (!mphy->cap.has_5ghz || !freq) {
-+		ret = -EINVAL;
-+		dev_info(dev->mt76.dev, "Failed to set offchan (invalid band or channel)!\n");
-+		goto out;
-+	}
-+
-+	chandef.width = td->offchan_bw;
-+	width_mhz = bw_to_mhz[chandef.width];
-+	chandef.center_freq1 = freq;
-+	chan = ieee80211_get_channel(hw->wiphy, freq);
-+	chandef.chan = chan;
-+
-+	memset(&dev->rdd2_chandef, 0, sizeof(struct cfg80211_chan_def));
-+
-+	ret = mt7915_mcu_rdd_background_enable(phy, &chandef);
-+
-+	if (ret)
-+		goto out;
-+
-+	dev->rdd2_phy = phy;
-+	dev->rdd2_chandef = chandef;
-+
-+	return ret;
-+
-+out:
-+	td->offchan_ch = 0;
-+	td->offchan_bw = 0;
-+
-+	return ret;
-+}
-+
-+static void
-+mt7915_tm_dump_ipi(struct mt7915_phy *phy, void *data, u8 antenna_num,
-+		   u8 start_antenna_idx, bool is_scan)
-+{
-+#define PRECISION	100
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt7915_mcu_rdd_ipi_scan *scan_data;
-+	struct mt7915_mcu_rdd_ipi_ctrl *ctrl_data;
-+	u32 ipi_idx, ipi_free_count, ipi_percentage, ipi_hist_count_th, ipi_hist_total_count;
-+	u32 self_idle_ratio, ipi_idle_ratio, channel_load, tx_assert_time;
-+	u8 i, antenna_idx = start_antenna_idx;
-+	u32 *ipi_hist_data;
-+	const char *power_lower_bound, *power_upper_bound;
-+	static const char * const ipi_idx_to_power_bound[] = {
-+		[RDD_IPI_HIST_0] = "-92",
-+		[RDD_IPI_HIST_1] = "-89",
-+		[RDD_IPI_HIST_2] = "-86",
-+		[RDD_IPI_HIST_3] = "-83",
-+		[RDD_IPI_HIST_4] = "-80",
-+		[RDD_IPI_HIST_5] = "-75",
-+		[RDD_IPI_HIST_6] = "-70",
-+		[RDD_IPI_HIST_7] = "-65",
-+		[RDD_IPI_HIST_8] = "-60",
-+		[RDD_IPI_HIST_9] = "-55",
-+		[RDD_IPI_HIST_10] = "inf",
-+	};
-+
-+	if (is_scan) {
-+		scan_data = (struct mt7915_mcu_rdd_ipi_scan *)data;
-+		tx_assert_time = scan_data->tx_assert_time;
-+	} else {
-+		ctrl_data = (struct mt7915_mcu_rdd_ipi_ctrl *)data;
-+		tx_assert_time = ctrl_data->tx_assert_time;
-+	}
-+
-+	for (i = 0; i < antenna_num; i++) {
-+		ipi_free_count = 0;
-+		ipi_hist_count_th = 0;
-+		ipi_hist_total_count = 0;
-+		ipi_hist_data = is_scan ? scan_data->ipi_hist_val[antenna_idx] :
-+					  ctrl_data->ipi_hist_val;
-+
-+		dev_info(dev->mt76.dev, "Antenna index: %d\n", antenna_idx);
-+		for (ipi_idx = 0; ipi_idx < POWER_INDICATE_HIST_MAX; ipi_idx++) {
-+			power_lower_bound = ipi_idx ? ipi_idx_to_power_bound[ipi_idx - 1] :
-+						      "-inf";
-+			power_upper_bound = ipi_idx_to_power_bound[ipi_idx];
-+
-+			dev_info(dev->mt76.dev,
-+				 "IPI %d (power range: (%s, %s] dBm): ipi count = %d\n",
-+				 ipi_idx, power_lower_bound,
-+				 power_upper_bound, ipi_hist_data[ipi_idx]);
-+
-+			if (td->ipi_threshold <= ipi_idx && ipi_idx <= RDD_IPI_HIST_10)
-+				ipi_hist_count_th += ipi_hist_data[ipi_idx];
-+
-+			ipi_hist_total_count += ipi_hist_data[ipi_idx];
-+		}
-+		ipi_free_count = is_scan ? ipi_hist_total_count :
-+					   ipi_hist_data[RDD_IPI_FREE_RUN_CNT];
-+
-+		dev_info(dev->mt76.dev,
-+			 "IPI threshold %d: ipi_hist_count_th = %d, ipi_free_count = %d\n",
-+			 td->ipi_threshold, ipi_hist_count_th, ipi_free_count);
-+		dev_info(dev->mt76.dev, "TX assert time =  %d [ms]\n",
-+			 tx_assert_time / 1000);
-+
-+		// Calculate channel load = (self idle ratio - idle ratio) / self idle ratio
-+		if (ipi_hist_count_th >= UINT_MAX / (100 * PRECISION))
-+			ipi_percentage = 100 * PRECISION *
-+					(ipi_hist_count_th / (100 * PRECISION)) /
-+					(ipi_free_count / (100 * PRECISION));
-+		else
-+			ipi_percentage = PRECISION * 100 * ipi_hist_count_th / ipi_free_count;
-+
-+		ipi_idle_ratio = ((100 * PRECISION) - ipi_percentage) / PRECISION;
-+
-+		self_idle_ratio = PRECISION * 100 *
-+				  (td->ipi_period - (tx_assert_time / 1000)) /
-+				  td->ipi_period / PRECISION;
-+
-+		if (self_idle_ratio < ipi_idle_ratio)
-+			channel_load = 0;
-+		else
-+			channel_load = self_idle_ratio - ipi_idle_ratio;
-+
-+		if (self_idle_ratio <= td->ipi_threshold) {
-+			dev_info(dev->mt76.dev,
-+				 "band[%d]: self idle ratio = %d%%, idle ratio = %d%%\n",
-+				 phy->mt76->band_idx, self_idle_ratio, ipi_idle_ratio);
-+			return;
-+		}
-+
-+		channel_load = (100 * channel_load) / self_idle_ratio;
-+		dev_info(dev->mt76.dev,
-+			 "band[%d]: chan load = %d%%, self idle ratio = %d%%, idle ratio = %d%%\n",
-+			 phy->mt76->band_idx, channel_load, self_idle_ratio, ipi_idle_ratio);
-+		antenna_idx++;
-+	}
-+}
-+
-+static void
-+mt7915_tm_ipi_work(struct work_struct *work)
-+{
-+	struct mt7915_phy *phy = container_of(work, struct mt7915_phy, ipi_work.work);
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	u8 start_antenna_idx = 0, antenna_num = 1;
-+
-+	if (!is_mt7915(&dev->mt76)) {
-+		struct mt7915_mcu_rdd_ipi_scan data;
-+
-+		if (phy->mt76->band_idx)
-+			start_antenna_idx = 4;
-+
-+		/* Use all antenna */
-+		if (td->ipi_antenna_idx == MT76_TM_IPI_ANTENNA_ALL)
-+			antenna_num = 4;
-+		else
-+			start_antenna_idx += td->ipi_antenna_idx;
-+
-+		mt7915_mcu_ipi_hist_scan(phy, &data, 0, true);
-+		mt7915_tm_dump_ipi(phy, &data, antenna_num, start_antenna_idx, true);
-+	} else {
-+		struct mt7915_mcu_rdd_ipi_ctrl data;
-+
-+		start_antenna_idx = 4;
-+		mt7915_mcu_ipi_hist_ctrl(phy, &data, RDD_IPI_HIST_ALL_CNT, true);
-+		mt7915_tm_dump_ipi(phy, &data, antenna_num, start_antenna_idx, false);
-+	}
-+}
-+
-+static inline void
-+mt7915_tm_reset_ipi(struct mt7915_phy *phy)
-+{
-+#define IPI_RESET_BIT	BIT(2)
-+	struct mt7915_dev *dev = phy->dev;
-+
-+	if (is_mt7915(&dev->mt76))
-+		mt7915_mcu_ipi_hist_ctrl(phy, NULL, RDD_SET_IPI_HIST_RESET, false);
-+	else
-+		mt76_set(dev, MT_WF_IPI_RESET, IPI_RESET_BIT);
-+}
-+
-+static int
-+mt7915_tm_set_ipi(struct mt7915_phy *phy)
-+{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+
-+	mt7915_tm_reset_ipi(phy);
-+
-+	cancel_delayed_work(&phy->ipi_work);
-+	ieee80211_queue_delayed_work(phy->mt76->hw, &phy->ipi_work,
-+				     msecs_to_jiffies(td->ipi_period));
-+
-+	return 0;
-+}
-+
- static int
- mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
- 		      u16 cw_max, u16 txop, u8 tx_cmd)
-@@ -1249,6 +1471,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
- 		phy->mt76->test.tx_mpdu_len = 0;
- 		phy->test.bf_en = 0;
- 		mt7915_tm_set_entry(phy);
-+	} else {
-+		INIT_DELAYED_WORK(&phy->ipi_work, mt7915_tm_ipi_work);
- 	}
- }
- 
-@@ -2008,6 +2232,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
- 		mt7915_tm_set_cfg(phy);
- 	if (changed & BIT(TM_CHANGED_TXBF_ACT))
- 		mt7915_tm_set_txbf(phy);
-+	if ((changed & BIT(TM_CHANGED_OFF_CHAN_CH)) &&
-+	    (changed & BIT(TM_CHANGED_OFF_CHAN_BW)))
-+		mt7915_tm_set_offchan(phy);
-+	if ((changed & BIT(TM_CHANGED_IPI_THRESHOLD)) &&
-+	    (changed & BIT(TM_CHANGED_IPI_PERIOD)))
-+		mt7915_tm_set_ipi(phy);
-+	if (changed & BIT(TM_CHANGED_IPI_RESET))
-+		mt7915_tm_reset_ipi(phy);
- }
- 
- static int
-diff --git a/testmode.c b/testmode.c
-index aa874a8..b19b872 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -24,6 +24,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
- 	[MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
- 	[MT76_TM_ATTR_DRV_DATA] = { .type = NLA_NESTED },
-+	[MT76_TM_ATTR_OFF_CH_SCAN_CH] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_OFF_CH_SCAN_PATH] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_IPI_THRESHOLD] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_IPI_PERIOD] = { .type = NLA_U32 },
-+	[MT76_TM_ATTR_IPI_ANTENNA_INDEX] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_IPI_RESET] = { .type = NLA_U8 },
- };
- EXPORT_SYMBOL_GPL(mt76_tm_policy);
- 
-@@ -402,6 +409,7 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
- 	td->tx_count = 1;
- 	td->tx_rate_mode = MT76_TM_TX_MODE_OFDM;
- 	td->tx_rate_nss = 1;
-+	td->ipi_antenna_idx = MT76_TM_IPI_ANTENNA_ALL;
- 
- 	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
- 	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
-@@ -607,6 +615,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	if (tb[MT76_TM_ATTR_TX_RATE_IDX])
- 		td->tx_rate_idx = nla_get_u8(tb[MT76_TM_ATTR_TX_RATE_IDX]);
- 
-+	if (tb[MT76_TM_ATTR_IPI_PERIOD])
-+		td->ipi_period = nla_get_u32(tb[MT76_TM_ATTR_IPI_PERIOD]);
-+
- 	if (mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_MODE], &td->tx_rate_mode,
- 			   0, MT76_TM_TX_MODE_MAX) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_NSS], &td->tx_rate_nss,
-@@ -623,7 +634,16 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			   &td->tx_power_control, 0, 1) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_ALLOC], &td->ru_alloc, 0, 0xff) ||
--	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68))
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CH], &td->offchan_ch, 36, 196) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH], &td->offchan_center_ch,
-+			   36, 196) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_BW],
-+			   &td->offchan_bw, NL80211_CHAN_WIDTH_20_NOHT, NL80211_CHAN_WIDTH_160) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_IPI_THRESHOLD], &td->ipi_threshold, 0, 10) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_IPI_ANTENNA_INDEX], &td->ipi_antenna_idx,
-+			   MT76_TM_IPI_ANTENNA_0, MT76_TM_IPI_ANTENNA_ALL) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_IPI_RESET], &td->ipi_reset, 0, 1))
- 		goto out;
- 
- 	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -857,6 +877,9 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
- 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
- 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_CH, td->offchan_ch) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH, td->offchan_center_ch) ||
-+	    nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_BW, td->offchan_bw) ||
- 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
- 	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
- 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
-diff --git a/testmode.h b/testmode.h
-index 5d1fe79..27a0095 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -63,6 +63,20 @@
-  * 	(nested, u8 attrs)
-  *
-  * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
-+ * @MT76_TM_ATTR_TXBF_ACT: txbf setting actions (u8)
-+ * @MT76_TM_ATTR_TXBF_PARAM: txbf parameters (nested)
-+ *
-+ * @MT76_TM_ATTR_OFF_CH_SCAN_CH: config the channel of background chain (ZWDFS) (u8)
-+ * @MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH: config the center channel of background chain (ZWDFS) (u8)
-+ * @MT76_TM_ATTR_OFF_CH_SCAN_BW: config the bandwidth of background chain (ZWDFS) (u8)
-+ * @MT76_TM_ATTR_OFF_CH_SCAN_PATH: config the tx path of background chain (ZWDFS) (u8)
-+ *
-+ * @MT76_TM_ATTR_IPI_THRESHOLD: config the IPI index you want to read (u8)
-+ * @MT76_TM_ATTR_IPI_PERIOD: config the time period for reading
-+ *			     the histogram of specific IPI index (u8)
-+ * @MT76_TM_ATTR_IPI_ANTENNA_INDEX: config the antenna index for reading
-+ *				    the histogram of specific IPI index (u8)
-+ * @MT76_TM_ATTR_IPI_RESET: Reset the IPI counter
-  *
-  */
- enum mt76_testmode_attr {
-@@ -116,6 +130,16 @@ enum mt76_testmode_attr {
- 	MT76_TM_ATTR_TXBF_ACT,
- 	MT76_TM_ATTR_TXBF_PARAM,
- 
-+	MT76_TM_ATTR_OFF_CH_SCAN_CH,
-+	MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
-+	MT76_TM_ATTR_OFF_CH_SCAN_BW,
-+	MT76_TM_ATTR_OFF_CH_SCAN_PATH,
-+
-+	MT76_TM_ATTR_IPI_THRESHOLD,
-+	MT76_TM_ATTR_IPI_PERIOD,
-+	MT76_TM_ATTR_IPI_ANTENNA_INDEX,
-+	MT76_TM_ATTR_IPI_RESET,
-+
- 	/* keep last */
- 	NUM_MT76_TM_ATTRS,
- 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
-@@ -292,4 +316,25 @@ enum mt76_testmode_txbf_act {
- 	MT76_TM_TXBF_ACT_MAX = NUM_MT76_TM_TXBF_ACT - 1,
- };
- 
-+/**
-+ * enum mt76_testmode_ipi_antenna - specify antenna index for ipi count
-+ *
-+ * @MT76_TM_IPI_ANTENNA_0: use antenna 0
-+ * @MT76_TM_IPI_ANTENNA_1: use antenna 1
-+ * @MT76_TM_IPI_ANTENNA_2: use antenna 2
-+ * @MT76_TM_IPI_ANTENNA_3: use antenna 3
-+ * @MT76_TM_IPI_ANTENNA_ALL: use all antenna
-+ */
-+enum mt76_testmode_ipi_antenna {
-+	MT76_TM_IPI_ANTENNA_0,
-+	MT76_TM_IPI_ANTENNA_1,
-+	MT76_TM_IPI_ANTENNA_2,
-+	MT76_TM_IPI_ANTENNA_3,
-+	MT76_TM_IPI_ANTENNA_ALL,
-+
-+	/* keep last */
-+	NUM_MT76_TM_IPI_ANTENNA,
-+	MT76_TM_IPI_ANTENNA_MAX = NUM_MT76_TM_IPI_ANTENNA - 1,
-+};
-+
- #endif
-diff --git a/tools/fields.c b/tools/fields.c
-index 47fc69f..6f07eed 100644
---- a/tools/fields.c
-+++ b/tools/fields.c
-@@ -46,6 +46,14 @@ static const char * const testmode_txbf_act[] = {
- 	[MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
- };
- 
-+static const char * const testmode_offchan_bw[] = {
-+	[NL80211_CHAN_WIDTH_20_NOHT] = "NOHT",
-+	[NL80211_CHAN_WIDTH_20] = "20",
-+	[NL80211_CHAN_WIDTH_40] = "40",
-+	[NL80211_CHAN_WIDTH_80] = "80",
-+	[NL80211_CHAN_WIDTH_160] = "160",
-+};
-+
- static void print_enum(const struct tm_field *field, struct nlattr *attr)
- {
- 	unsigned int i = nla_get_u8(attr);
-@@ -411,6 +419,13 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
- 	FIELD(u8, RU_IDX, "ru_idx"),
- 	FIELD_ENUM(TXBF_ACT, "txbf_act", testmode_txbf_act),
- 	FIELD_ARRAY(u16_hex, TXBF_PARAM, "txbf_param"),
-+	FIELD(u8, OFF_CH_SCAN_CH, "offchan_ch"),
-+	FIELD(u8, OFF_CH_SCAN_CENTER_CH, "offchan_center_ch"),
-+	FIELD_ENUM(OFF_CH_SCAN_BW, "offchan_bw", testmode_offchan_bw),
-+	FIELD(u8, IPI_THRESHOLD, "ipi_threshold"),
-+	FIELD(u32, IPI_PERIOD, "ipi_period"),
-+	FIELD(u8, IPI_ANTENNA_INDEX, "ipi_antenna_idx"),
-+	FIELD(u8, IPI_RESET, "ipi_reset"),
- 	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
- 	FIELD_NESTED_RO(STATS, stats, "",
- 			.print_extra = print_extra_stats),
-@@ -442,6 +457,13 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
- 	[MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
- 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
- 	[MT76_TM_ATTR_TXBF_ACT] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_OFF_CH_SCAN_CH] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_OFF_CH_SCAN_BW] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_IPI_THRESHOLD] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_IPI_PERIOD] = { .type = NLA_U32 },
-+	[MT76_TM_ATTR_IPI_ANTENNA_INDEX] = { .type = NLA_U8 },
-+	[MT76_TM_ATTR_IPI_RESET] = { .type = NLA_U8 },
- };
- 
- const struct tm_field msg_field = {
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
deleted file mode 100644
index 264bb50..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
+++ /dev/null
@@ -1,1916 +0,0 @@
-From acc136bc397c9417ca42de7642ede1c35745dae3 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH] mt76: testmode: add iBF/eBF cal and cert commands with golden
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt76.h               |   4 +
- mt76_connac_mcu.c    |   3 +
- mt7915/mac.c         |   4 +-
- mt7915/main.c        |  54 ++---
- mt7915/mcu.c         |  29 ++-
- mt7915/mcu.h         | 172 ++++++++++++++++
- mt7915/mmio.c        |   2 +
- mt7915/mt7915.h      |  14 +-
- mt7915/mtk_debugfs.c |  35 ++++
- mt7915/mtk_mcu.c     | 246 ++++++++++++++++++++++-
- mt7915/regs.h        |   4 +
- mt7915/testmode.c    | 460 ++++++++++++++++++++++++++++---------------
- mt7915/testmode.h    | 134 +------------
- testmode.c           |   1 +
- testmode.h           |   9 +
- tools/fields.c       |   9 +
- 16 files changed, 856 insertions(+), 324 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index 2bacc1b..c6aefbf 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -681,6 +681,7 @@ struct mt76_testmode_data {
- 
- 	struct list_head tm_entry_list;
- 	struct mt76_wcid *cur_entry;
-+	struct ieee80211_vif *second_vif;
- 	u8 entry_num;
- 	union {
- 		struct mt76_testmode_entry_data ed;
-@@ -709,6 +710,9 @@ struct mt76_testmode_data {
- 
- 	u8 txbf_act;
- 	u16 txbf_param[8];
-+	bool is_txbf_dut;
-+	bool bf_en;
-+	bool ebf;
- 
- 	u32 tx_pending;
- 	u32 tx_queued;
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 291a7c1..14ce09e 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -2756,6 +2756,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
- 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
- 	struct bss_info_basic *bss;
- 	struct tlv *tlv;
-+	struct mt76_testmode_data *td = &phy->test;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
- 	bss = (struct bss_info_basic *)tlv;
-@@ -2815,6 +2816,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
- 		bss->dtim_period = vif->bss_conf.dtim_period;
- 		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
- 							 chandef->chan->band, NULL);
-+	} else if (td->bf_en) {
-+		memcpy(bss->bssid, vif->addr, ETH_ALEN);
- 	} else {
- 		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
- 	}
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0746e4b..013dfbd 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -753,8 +753,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
- 		val |= MT_TXD6_LDPC;
- 
- 	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
--	if (phy->test.bf_en)
-+	if (td->bf_en && !td->ebf)
- 		val |= MT_TXD6_TX_IBF | MT_TXD6_TX_EBF;
-+	else if (td->bf_en && td->ebf)
-+		val |= MT_TXD6_TX_EBF;
- 
- 	txwi[6] |= cpu_to_le32(val);
- #endif
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 4c3d822..a347e77 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
- 	}
- }
- 
--static int mt7915_add_interface(struct ieee80211_hw *hw,
--				struct ieee80211_vif *vif)
-+int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en)
- {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
--	struct mt7915_dev *dev = mt7915_hw_dev(hw);
--	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
- 	struct mt76_txq *mtxq;
- 	bool ext_phy = phy != &dev->phy;
- 	int idx, ret = 0;
- 
--	mutex_lock(&dev->mt76.mutex);
--
--	mt76_testmode_reset(phy->mt76, true);
--
--	if (vif->type == NL80211_IFTYPE_MONITOR &&
--	    is_zero_ether_addr(vif->addr))
--		phy->monitor_vif = vif;
-+	/* To differentiate the mac address of TXD and TXCMD interface */
-+	vif->addr[0] |= bf_en;
- 
- 	mvif->mt76.idx = __ffs64(~dev->mt76.vif_mask);
--	if (mvif->mt76.idx >= (MT7915_MAX_INTERFACES << dev->dbdc_support)) {
--		ret = -ENOSPC;
--		goto out;
--	}
-+	if (mvif->mt76.idx >= (MT7915_MAX_INTERFACES << dev->dbdc_support))
-+		return -ENOSPC;
- 
- 	idx = get_omac_idx(vif->type, phy->omac_mask);
--	if (idx < 0) {
--		ret = -ENOSPC;
--		goto out;
--	}
-+	if (idx < 0)
-+		return -ENOSPC;
-+
- 	mvif->mt76.omac_idx = idx;
- 	mvif->phy = phy;
- 	mvif->mt76.band_idx = phy->mt76->band_idx;
- 
--	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP && vif->type != NL80211_IFTYPE_MONITOR);
-+	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP &&
-+			      vif->type != NL80211_IFTYPE_MONITOR) || bf_en;
- 	if (ext_phy)
- 		mvif->mt76.wmm_idx += 2;
- 
- 	ret = mt7915_mcu_add_dev_info(phy, vif, true);
- 	if (ret)
--		goto out;
-+		return ret;
- 
- 	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
- 	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
-@@ -279,7 +270,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
- 	mt7915_mcu_add_sta(dev, vif, NULL, true);
- 	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
- 
--out:
-+	return ret;
-+}
-+
-+static int mt7915_add_interface(struct ieee80211_hw *hw,
-+				struct ieee80211_vif *vif)
-+{
-+	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	int ret = 0;
-+
-+	mutex_lock(&dev->mt76.mutex);
-+
-+	mt76_testmode_reset(phy->mt76, true);
-+
-+	if (vif->type == NL80211_IFTYPE_MONITOR &&
-+	    is_zero_ether_addr(vif->addr))
-+		phy->monitor_vif = vif;
-+
-+	ret = mt7915_init_vif(phy, vif, false);
-+
- 	mutex_unlock(&dev->mt76.mutex);
- 
- 	return ret;
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b8243e1..5d41ebf 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -193,6 +193,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
- 	int ret;
- 
- 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
-+
- 	if (ret)
- 		return ret;
- 
-@@ -383,10 +384,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
- 	case MCU_EXT_EVENT_BCC_NOTIFY:
- 		mt7915_mcu_rx_bcc_notify(dev, skb);
- 		break;
--#ifdef CONFIG_NL80211_TESTMODE
-+#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
- 	case MCU_EXT_EVENT_BF_STATUS_READ:
--		mt7915_tm_txbf_status_read(dev, skb);
-+		mt7915_mcu_txbf_status_read(dev, skb);
- 		break;
-+#endif
-+#ifdef CONFIG_NL80211_TESTMODE
- 	case MCU_EXT_EVENT_RF_TEST:
- 		mt7915_tm_rf_test_event(dev, skb);
- 		break;
-@@ -673,11 +676,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
- 	if (enable)
- 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
- 
--	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
--				      mvif->sta.wcid.idx, enable);
-+	if (vif->type == NL80211_IFTYPE_MONITOR) {
-+		struct mt76_testmode_data *td = &phy->mt76->test;
-+		struct mt76_wcid *wcid;
-+
-+		if (!td->aid || list_empty(&td->tm_entry_list))
-+			wcid = &mvif->sta.wcid;
-+		else
-+			wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
- 
--	if (vif->type == NL80211_IFTYPE_MONITOR)
-+		mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
-+					      wcid->idx, enable);
- 		goto out;
-+	}
-+
-+	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
-+				      mvif->sta.wcid.idx, enable);
- 
- 	if (enable) {
- 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
-@@ -3403,6 +3417,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
- 
- int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
- {
-+#define MT_BF_PROCESSING	4
- 	struct {
- 		u8 action;
- 		union {
-@@ -3429,7 +3444,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
- 		.action = action,
- 	};
- 
--#define MT_BF_PROCESSING	4
- 	switch (action) {
- 	case MT_BF_SOUNDING_ON:
- 		req.snd.snd_mode = MT_BF_PROCESSING;
-@@ -4347,6 +4361,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
- 		req.he_opt = v2;
- 		req.glo_opt = v3;
- 		break;
-+	case BF_SND_CFG_INF:
-+		req.inf = v1;
-+		break;
- 	default:
- 		return -EINVAL;
- 	}
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9a48524..a30f52d 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -475,10 +475,12 @@ enum {
- };
- 
- enum {
-+	MT_BF_SOUNDING_OFF = 0,
- 	MT_BF_SOUNDING_ON = 1,
- 	MT_BF_DATA_PACKET_APPLY = 2,
- 	MT_BF_PFMU_TAG_READ = 5,
- 	MT_BF_PFMU_TAG_WRITE = 6,
-+	MT_BF_STA_REC_READ = 13,
- 	MT_BF_PHASE_CAL = 14,
- 	MT_BF_IBF_PHASE_COMP = 15,
- 	MT_BF_PROFILE_WRITE_ALL = 17,
-@@ -486,6 +488,176 @@ enum {
- 	MT_BF_MODULE_UPDATE = 25
- };
- 
-+#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
-+struct mt7915_pfmu_tag1 {
-+	__le32 pfmu_idx:10;
-+	__le32 ebf:1;
-+	__le32 data_bw:2;
-+	__le32 lm:2;
-+	__le32 is_mu:1;
-+	__le32 nr:3, nc:3;
-+	__le32 codebook:2;
-+	__le32 ngroup:2;
-+	__le32 _rsv:2;
-+	__le32 invalid_prof:1;
-+	__le32 rmsd:3;
-+
-+	__le32 col_id1:6, row_id1:10;
-+	__le32 col_id2:6, row_id2:10;
-+	__le32 col_id3:6, row_id3:10;
-+	__le32 col_id4:6, row_id4:10;
-+
-+	__le32 ru_start_id:7;
-+	__le32 _rsv1:1;
-+	__le32 ru_end_id:7;
-+	__le32 _rsv2:1;
-+	__le32 mob_cal_en:1;
-+	__le32 _rsv3:15;
-+
-+	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
-+	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
-+
-+	__le32 _rsv4;
-+} __packed;
-+
-+struct mt7915_pfmu_tag2 {
-+	__le32 smart_ant:24;
-+	__le32 se_idx:5;
-+	__le32 _rsv:3;
-+
-+	__le32 _rsv1:8;
-+	__le32 rmsd_thres:3;
-+	__le32 _rsv2:5;
-+	__le32 ibf_timeout:8;
-+	__le32 _rsv3:8;
-+
-+	__le32 _rsv4:16;
-+	__le32 ibf_data_bw:2;
-+	__le32 ibf_nc:3;
-+	__le32 ibf_nr:3;
-+	__le32 ibf_ru:8;
-+
-+	__le32 mob_delta_t:8;
-+	__le32 mob_lq_result:7;
-+	__le32 _rsv5:1;
-+	__le32 _rsv6:16;
-+
-+	__le32 _rsv7;
-+} __packed;
-+
-+struct mt7915_pfmu_tag {
-+	struct mt7915_pfmu_tag1 t1;
-+	struct mt7915_pfmu_tag2 t2;
-+};
-+
-+struct mt7915_bf_status_hdr {
-+	u8 format_id;
-+	u8 bw;
-+	u16 subcarrier_idx;
-+	bool bfer;
-+	u8 rsv[3];
-+} __packed;
-+
-+struct mt7915_bf_status {
-+	struct mt7915_bf_status_hdr hdr;
-+	u8 buf[1000];
-+} __packed;
-+
-+struct mt7915_txbf_phase_out {
-+	u8 c0_l;
-+	u8 c1_l;
-+	u8 c2_l;
-+	u8 c3_l;
-+	u8 c0_m;
-+	u8 c1_m;
-+	u8 c2_m;
-+	u8 c3_m;
-+	u8 c0_h;
-+	u8 c1_h;
-+	u8 c2_h;
-+	u8 c3_h;
-+	u8 c0_uh;
-+	u8 c1_uh;
-+	u8 c2_uh;
-+	u8 c3_uh;
-+};
-+
-+struct mt7915_txbf_phase {
-+	u8 status;
-+	struct {
-+		u8 r0_uh;
-+		u8 r0_h;
-+		u8 r0_m;
-+		u8 r0_l;
-+		u8 r0_ul;
-+		u8 r1_uh;
-+		u8 r1_h;
-+		u8 r1_m;
-+		u8 r1_l;
-+		u8 r1_ul;
-+		u8 r2_uh;
-+		u8 r2_h;
-+		u8 r2_m;
-+		u8 r2_l;
-+		u8 r2_ul;
-+		u8 r3_uh;
-+		u8 r3_h;
-+		u8 r3_m;
-+		u8 r3_l;
-+		u8 r3_ul;
-+		u8 r2_uh_sx2;
-+		u8 r2_h_sx2;
-+		u8 r2_m_sx2;
-+		u8 r2_l_sx2;
-+		u8 r2_ul_sx2;
-+		u8 r3_uh_sx2;
-+		u8 r3_h_sx2;
-+		u8 r3_m_sx2;
-+		u8 r3_l_sx2;
-+		u8 r3_ul_sx2;
-+		u8 m_t0_h;
-+		u8 m_t1_h;
-+		u8 m_t2_h;
-+		u8 m_t2_h_sx2;
-+		u8 r0_reserved;
-+		u8 r1_reserved;
-+		u8 r2_reserved;
-+		u8 r3_reserved;
-+		u8 r2_sx2_reserved;
-+		u8 r3_sx2_reserved;
-+	} phase;
-+};
-+
-+struct mt7915_pfmu_data {
-+	__le16 subc_idx;
-+	__le16 phi11;
-+	__le16 phi21;
-+	__le16 phi31;
-+};
-+
-+struct mt7915_ibf_cal_info {
-+	u8 format_id;
-+	u8 group_l_m_n;
-+	u8 group;
-+	bool sx2;
-+	u8 status;
-+	u8 cal_type;
-+	u8 _rsv[2];
-+	u8 buf[1000];
-+} __packed;
-+
-+enum {
-+	IBF_PHASE_CAL_UNSPEC,
-+	IBF_PHASE_CAL_NORMAL,
-+	IBF_PHASE_CAL_VERIFY,
-+	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
-+	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
-+};
-+
-+#define MT7915_TXBF_SUBCAR_NUM	64
-+
-+#endif
-+
- enum {
- 	MURU_SET_ARB_OP_MODE = 14,
- 	MURU_SET_PLATFORM_TYPE = 25,
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 26881fd..c1b421d 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -131,6 +131,7 @@ static const u32 mt7915_offs[] = {
- 	[MDP_BNRCFR1]		= 0x074,
- 	[ARB_DRNGR0]		= 0x194,
- 	[ARB_SCR]		= 0x080,
-+	[ARB_TQSAXM0]		= 0x030,
- 	[RMAC_MIB_AIRTIME14]	= 0x3b8,
- 	[AGG_AALCR0]		= 0x048,
- 	[AGG_AWSCR0]		= 0x05c,
-@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
- 	[MDP_BNRCFR1]		= 0x094,
- 	[ARB_DRNGR0]		= 0x1e0,
- 	[ARB_SCR]		= 0x000,
-+	[ARB_TQSAXM0]		= 0x180,
- 	[RMAC_MIB_AIRTIME14]	= 0x0398,
- 	[AGG_AALCR0]		= 0x028,
- 	[AGG_AWSCR0]		= 0x030,
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d845206..ab1efe6 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -322,7 +322,6 @@ struct mt7915_phy {
- 
- 		u8 spe_idx;
- 
--		bool bf_en;
- 		bool bf_ever_en;
- 	} test;
- #endif
-@@ -427,7 +426,7 @@ struct mt7915_dev {
- 	void __iomem *dcm;
- 	void __iomem *sku;
- 
--#ifdef CONFIG_NL80211_TESTMODE
-+#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
- 	struct {
- 		void *txbf_phase_cal;
- 		void *txbf_pfmu_data;
-@@ -566,6 +565,7 @@ void mt7915_dma_prefetch(struct mt7915_dev *dev);
- void mt7915_dma_cleanup(struct mt7915_dev *dev);
- int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
- int mt7915_txbf_init(struct mt7915_dev *dev);
-+int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en);
- void mt7915_init_txpower(struct mt7915_dev *dev,
- 			 struct ieee80211_supported_band *sband);
- void mt7915_reset(struct mt7915_dev *dev);
-@@ -644,8 +644,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
- int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
- void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
- void mt7915_mcu_exit(struct mt7915_dev *dev);
--int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
-+
-+#ifdef CONFIG_NL80211_TESTMODE
- void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
-+#endif
- 
- static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
- {
-@@ -782,4 +784,10 @@ enum {
- 
- #endif
- 
-+#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
-+int mt7915_mcu_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
-+int mt7915_mcu_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx, bool bfer);
-+int mt7915_mcu_txbf_sta_rec_read(struct mt7915_dev *dev, u16 wlan_idx);
-+#endif
-+
- #endif
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 583bc19..a2ceb6f 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -2831,6 +2831,36 @@ mt7915_txpower_level_set(void *data, u64 val)
- DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
- 			 mt7915_txpower_level_set, "%lld\n");
- 
-+static int
-+mt7915_txbf_pfmu_tag_read(void *data, u64 val)
-+{
-+	struct mt7915_phy *phy = data;
-+	u8 pfmu_idx = (u8)val;
-+
-+	pr_info("%s: %d pfmu_tag cmd sent out ---\n", __func__, __LINE__);
-+	mt7915_mcu_txbf_profile_tag_read(phy, pfmu_idx, true);
-+
-+	return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_txbf_pfmu_tag_idx, NULL,
-+			 mt7915_txbf_pfmu_tag_read, "%llx\n");
-+
-+static int
-+mt7915_txbf_sta_rec_read(void *data, u64 val)
-+{
-+	struct mt7915_dev *dev = data;
-+	u16 wlan_idx = (u16)val;
-+
-+	pr_info("%s: %d sta_rec cmd sent out ---\n", __func__, __LINE__);
-+	mt7915_mcu_txbf_sta_rec_read(dev, wlan_idx);
-+
-+	return 0;
-+}
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_txbf_sta_rec, NULL,
-+			 mt7915_txbf_sta_rec_read, "%llx\n");
-+
- /* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
- static int
- mt7915_wa_set(void *data, u64 val)
-@@ -2969,6 +2999,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- 	debugfs_create_file("txpower_level", 0400, dir, dev,
- 			    &fops_txpower_level);
- 
-+	debugfs_create_file("txbf_pfmu_tag_idx", 0600, dir, phy,
-+			    &fops_txbf_pfmu_tag_idx);
-+	debugfs_create_file("txbf_sta_rec", 0600, dir, dev,
-+			    &fops_txbf_sta_rec);
-+
- 	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
- 
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
-diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
-index 143dae2..906c872 100644
---- a/mt7915/mtk_mcu.c
-+++ b/mt7915/mtk_mcu.c
-@@ -1,9 +1,10 @@
- #include <linux/firmware.h>
- #include <linux/fs.h>
--#include<linux/inet.h>
-+#include <linux/inet.h>
- #include "mt7915.h"
- #include "mcu.h"
- #include "mac.h"
-+#include "testmode.h"
- 
- int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
- {
-@@ -49,3 +50,246 @@ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
- 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
- 				 sizeof(req), true);
- }
-+
-+#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
-+static void mt7915_txbf_dump_pfmu_tag(struct mt7915_dev *dev, struct mt7915_pfmu_tag *tag)
-+{
-+	u32 *raw_t1 = (u32 *)&tag->t1;
-+	u32 *raw_t2 = (u32 *)&tag->t2;
-+
-+	dev_info(dev->mt76.dev, "=================== TXBf Profile Tag1 Info ==================\n");
-+	dev_info(dev->mt76.dev,
-+		 "DW0 = 0x%08x, DW1 = 0x%08x, DW2 = 0x%08x\n",
-+		 raw_t1[0], raw_t1[1], raw_t1[2]);
-+	dev_info(dev->mt76.dev,
-+		 "DW4 = 0x%08x, DW5 = 0x%08x, DW6 = 0x%08x\n\n",
-+		 raw_t1[3], raw_t1[4], raw_t1[5]);
-+	dev_info(dev->mt76.dev, "PFMU ID = %d              Invalid status = %d\n",
-+		 tag->t1.pfmu_idx, tag->t1.invalid_prof);
-+	dev_info(dev->mt76.dev, "iBf/eBf = %d\n\n", tag->t1.ebf);
-+	dev_info(dev->mt76.dev, "DBW   = %d\n", tag->t1.data_bw);
-+	dev_info(dev->mt76.dev, "SU/MU = %d\n", tag->t1.is_mu);
-+	dev_info(dev->mt76.dev, "RMSD  = %d\n", tag->t1.rmsd);
-+	dev_info(dev->mt76.dev,
-+		 "nrow = %d, ncol = %d, ng = %d, LM = %d, CodeBook = %d MobCalEn = %d\n",
-+		 tag->t1.nr, tag->t1.nc, tag->t1.ngroup, tag->t1.lm, tag->t1.codebook,
-+		 tag->t1.mob_cal_en);
-+	dev_info(dev->mt76.dev, "RU start = %d, RU end = %d\n",
-+		 tag->t1.ru_start_id, tag->t1.ru_end_id);
-+	dev_info(dev->mt76.dev, "Mem Col1 = %d, Mem Row1 = %d, Mem Col2 = %d, Mem Row2 = %d\n",
-+		 tag->t1.col_id1, tag->t1.row_id1, tag->t1.col_id2, tag->t1.row_id2);
-+	dev_info(dev->mt76.dev, "Mem Col3 = %d, Mem Row3 = %d, Mem Col4 = %d, Mem Row4 = %d\n\n",
-+		 tag->t1.col_id3, tag->t1.row_id3, tag->t1.col_id4, tag->t1.row_id4);
-+	dev_info(dev->mt76.dev,
-+		 "STS0_SNR = 0x%02x, STS1_SNR = 0x%02x, STS2_SNR = 0x%02x, STS3_SNR = 0x%02x\n",
-+		 tag->t1.snr_sts0, tag->t1.snr_sts1, tag->t1.snr_sts2, tag->t1.snr_sts3);
-+	dev_info(dev->mt76.dev,
-+		 "STS4_SNR = 0x%02x, STS5_SNR = 0x%02x, STS6_SNR = 0x%02x, STS7_SNR = 0x%02x\n",
-+		 tag->t1.snr_sts4, tag->t1.snr_sts5, tag->t1.snr_sts6, tag->t1.snr_sts7);
-+	dev_info(dev->mt76.dev, "=============================================================\n");
-+
-+	dev_info(dev->mt76.dev, "=================== TXBf Profile Tag2 Info ==================\n");
-+	dev_info(dev->mt76.dev,
-+		 "DW0 = 0x%08x, DW1 = 0x%08x, DW2 = 0x%08x\n",
-+		 raw_t2[0], raw_t2[1], raw_t2[2]);
-+	dev_info(dev->mt76.dev,
-+		 "DW3 = 0x%08x, DW4 = 0x%08x, DW5 = 0x%08x\n\n",
-+		 raw_t2[3], raw_t2[4], raw_t2[5]);
-+	dev_info(dev->mt76.dev, "Smart antenna ID = 0x%x,  SE index = %d\n",
-+		 tag->t2.smart_ant, tag->t2.se_idx);
-+	dev_info(dev->mt76.dev, "RMSD threshold = %d\n", tag->t2.rmsd_thres);
-+	dev_info(dev->mt76.dev, "Timeout = 0x%x\n", tag->t2.ibf_timeout);
-+	dev_info(dev->mt76.dev, "Desired BW = %d, Desired Ncol = %d, Desired Nrow = %d\n",
-+		 tag->t2.ibf_data_bw, tag->t2.ibf_nc, tag->t2.ibf_nr);
-+	dev_info(dev->mt76.dev, "Desired RU Allocation = %d\n", tag->t2.ibf_ru);
-+	dev_info(dev->mt76.dev, "Mobility DeltaT = %d, Mobility LQ = %d\n",
-+		 tag->t2.mob_delta_t, tag->t2.mob_lq_result);
-+	dev_info(dev->mt76.dev, "=============================================================\n");
-+}
-+
-+static void mt7915_txbf_dump_sta_rec(struct mt7915_dev *dev, struct sta_rec_bf *sta_info)
-+{
-+	dev_info(dev->mt76.dev, "===================== BF Station Record =====================\n");
-+	dev_info(dev->mt76.dev, "pfmu           = %d\n", sta_info->pfmu);
-+	dev_info(dev->mt76.dev, "su_mu          = %d\n", sta_info->su_mu);
-+	dev_info(dev->mt76.dev, "bf_cap         = %d\n", sta_info->bf_cap);
-+	dev_info(dev->mt76.dev, "sounding_phy   = %d\n", sta_info->sounding_phy);
-+	dev_info(dev->mt76.dev, "ndpa_rate      = %d\n", sta_info->ndpa_rate);
-+	dev_info(dev->mt76.dev, "ndp_rate       = %d\n", sta_info->ndp_rate);
-+	dev_info(dev->mt76.dev, "rept_poll_rate = %d\n", sta_info->rept_poll_rate);
-+	dev_info(dev->mt76.dev, "tx_mode        = %d\n", sta_info->tx_mode);
-+	dev_info(dev->mt76.dev, "ncol           = %d\n", sta_info->ncol);
-+	dev_info(dev->mt76.dev, "nrow           = %d\n", sta_info->nrow);
-+	dev_info(dev->mt76.dev, "bw             = %d\n", sta_info->bw);
-+	dev_info(dev->mt76.dev, "mem_total      = %d\n", sta_info->mem_total);
-+	dev_info(dev->mt76.dev, "mem_20m        = %d\n", sta_info->mem_20m);
-+	dev_info(dev->mt76.dev, "mem_row0       = %d\n", sta_info->mem[0].row);
-+	dev_info(dev->mt76.dev, "mem_col0       = %d\n", sta_info->mem[0].col);
-+	dev_info(dev->mt76.dev, "mem_row1       = %d\n", sta_info->mem[1].row);
-+	dev_info(dev->mt76.dev, "mem_col1       = %d\n", sta_info->mem[1].col);
-+	dev_info(dev->mt76.dev, "mem_row2       = %d\n", sta_info->mem[2].row);
-+	dev_info(dev->mt76.dev, "mem_col2       = %d\n", sta_info->mem[2].col);
-+	dev_info(dev->mt76.dev, "mem_row3       = %d\n", sta_info->mem[3].row);
-+	dev_info(dev->mt76.dev, "mem_col3       = %d\n", sta_info->mem[3].col);
-+	dev_info(dev->mt76.dev, "smart_ant      = 0x%x\n", sta_info->smart_ant);
-+	dev_info(dev->mt76.dev, "se_idx         = %d\n", sta_info->se_idx);
-+	dev_info(dev->mt76.dev, "auto_sounding  = %d\n", sta_info->auto_sounding);
-+	dev_info(dev->mt76.dev, "ibf_timeout    = 0x%x\n", sta_info->ibf_timeout);
-+	dev_info(dev->mt76.dev, "ibf_dbw        = %d\n", sta_info->ibf_dbw);
-+	dev_info(dev->mt76.dev, "ibf_ncol       = %d\n", sta_info->ibf_ncol);
-+	dev_info(dev->mt76.dev, "ibf_nrow       = %d\n", sta_info->ibf_nrow);
-+	dev_info(dev->mt76.dev, "nrow_gt_bw80   = %d\n", sta_info->nrow_gt_bw80);
-+	dev_info(dev->mt76.dev, "ncol_gt_bw80   = %d\n", sta_info->ncol_gt_bw80);
-+	dev_info(dev->mt76.dev, "ru_start_idx   = %d\n", sta_info->ru_start_idx);
-+	dev_info(dev->mt76.dev, "trigger_su     = %d\n", sta_info->trigger_su);
-+	dev_info(dev->mt76.dev, "trigger_mu     = %d\n", sta_info->trigger_mu);
-+	dev_info(dev->mt76.dev, "ng16_su        = %d\n", sta_info->ng16_su);
-+	dev_info(dev->mt76.dev, "ng16_mu        = %d\n", sta_info->ng16_mu);
-+	dev_info(dev->mt76.dev, "codebook42_su  = %d\n", sta_info->codebook42_su);
-+	dev_info(dev->mt76.dev, "codebook75_mu  = %d\n", sta_info->codebook75_mu);
-+	dev_info(dev->mt76.dev, "he_ltf         = %d\n", sta_info->he_ltf);
-+	dev_info(dev->mt76.dev, "=============================================================\n");
-+}
-+
-+static void mt7915_txbf_dump_cal_phase(struct mt7915_dev *dev,
-+				       struct mt7915_txbf_phase *phase, int group)
-+{
-+	dev_info(dev->mt76.dev, "Group %d and Group M\n", group);
-+	dev_info(dev->mt76.dev, "m_t0_h = %d\n", phase->phase.m_t0_h);
-+	dev_info(dev->mt76.dev, "m_t1_h = %d\n", phase->phase.m_t1_h);
-+	dev_info(dev->mt76.dev, "m_t2_h = %d\n", phase->phase.m_t2_h);
-+
-+	dev_info(dev->mt76.dev, "r0_uh = %d\n", phase->phase.r0_uh);
-+	dev_info(dev->mt76.dev, "r0_h = %d\n", phase->phase.r0_h);
-+	dev_info(dev->mt76.dev, "r0_m = %d\n", phase->phase.r0_m);
-+	dev_info(dev->mt76.dev, "r0_l = %d\n", phase->phase.r0_l);
-+
-+	dev_info(dev->mt76.dev, "r1_uh = %d\n", phase->phase.r1_uh);
-+	dev_info(dev->mt76.dev, "r1_h = %d\n", phase->phase.r1_h);
-+	dev_info(dev->mt76.dev, "r1_m = %d\n", phase->phase.r1_m);
-+	dev_info(dev->mt76.dev, "r1_l = %d\n", phase->phase.r1_l);
-+
-+	dev_info(dev->mt76.dev, "r2_uh = %d\n", phase->phase.r2_uh);
-+	dev_info(dev->mt76.dev, "r2_h = %d\n", phase->phase.r2_h);
-+	dev_info(dev->mt76.dev, "r2_m = %d\n", phase->phase.r2_m);
-+	dev_info(dev->mt76.dev, "r2_l = %d\n", phase->phase.r2_l);
-+
-+	dev_info(dev->mt76.dev, "r3_uh = %d\n", phase->phase.r3_uh);
-+	dev_info(dev->mt76.dev, "r3_h = %d\n", phase->phase.r3_h);
-+	dev_info(dev->mt76.dev, "r3_m = %d\n", phase->phase.r3_m);
-+	dev_info(dev->mt76.dev, "r3_l = %d\n", phase->phase.r3_l);
-+	dev_info(dev->mt76.dev, "r3_ul = %d\n", phase->phase.r3_ul);
-+}
-+
-+int mt7915_mcu_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
-+{
-+#define BF_PFMU_TAG	16
-+#define BF_STA_REC	20
-+#define BF_CAL_PHASE	21
-+#define GROUP_M		1
-+	u8 format_id;
-+
-+	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
-+	format_id = *(u8 *)skb->data;
-+
-+	if (format_id == BF_PFMU_TAG) {
-+		struct mt7915_pfmu_tag *pfmu_tag;
-+
-+		skb_pull(skb, 8);
-+		pfmu_tag = (struct mt7915_pfmu_tag *)skb->data;
-+		mt7915_txbf_dump_pfmu_tag(dev, pfmu_tag);
-+		if (dev->test.txbf_pfmu_tag)
-+			memcpy(dev->test.txbf_pfmu_tag, pfmu_tag, sizeof(struct mt7915_pfmu_tag));
-+	} else if (format_id == BF_STA_REC) {
-+		struct sta_rec_bf *sta_rec;
-+
-+		skb_pull(skb, sizeof(struct mt7915_bf_status_hdr));
-+		/* padding 4 byte since bf_status->buf does not contain tag & len */
-+		skb_push(skb, 4);
-+		sta_rec = (struct sta_rec_bf *)skb->data;
-+
-+		mt7915_txbf_dump_sta_rec(dev, sta_rec);
-+	} else if (format_id == BF_CAL_PHASE) {
-+		u8 phase_out_len = sizeof(struct mt7915_txbf_phase_out);
-+		struct mt7915_ibf_cal_info *cal;
-+		struct mt7915_txbf_phase_out phase_out;
-+		struct mt7915_txbf_phase *phase =
-+			(struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
-+
-+		cal = (struct mt7915_ibf_cal_info *)skb->data;
-+		memcpy(&phase_out, cal->buf, phase_out_len);
-+		switch (cal->cal_type) {
-+		case IBF_PHASE_CAL_NORMAL:
-+		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
-+			/* Only calibrate group M */
-+			if (cal->group_l_m_n != GROUP_M)
-+				break;
-+			phase = &phase[cal->group];
-+			memcpy(&phase->phase, cal->buf + phase_out_len, sizeof(phase->phase));
-+			phase->status = cal->status;
-+
-+			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
-+			mt7915_txbf_dump_cal_phase(dev, phase, cal->group);
-+			break;
-+		case IBF_PHASE_CAL_VERIFY:
-+		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
-+			dev_info(dev->mt76.dev, "Verification result = %d\n", cal->status);
-+			break;
-+		default:
-+			break;
-+		}
-+
-+		dev_info(dev->mt76.dev, "c0_h = %d, c1_h = %d, c2_h = %d\n",
-+			 phase_out.c0_h, phase_out.c1_h, phase_out.c2_h);
-+		dev_info(dev->mt76.dev, "c0_m = %d, c1_m = %d, c2_m = %d\n",
-+			 phase_out.c0_m, phase_out.c1_m, phase_out.c2_m);
-+		dev_info(dev->mt76.dev, "c0_l = %d, c1_l = %d, c2_l = %d\n",
-+			 phase_out.c0_l, phase_out.c1_l, phase_out.c2_l);
-+		dev_info(dev->mt76.dev, "c3_m = %d, c3_h = %d\n", phase_out.c3_m, phase_out.c3_h);
-+	}
-+
-+	wake_up(&dev->mt76.tx_wait);
-+
-+	return 0;
-+}
-+
-+int mt7915_mcu_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx, bool bfer)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 format_id;
-+		u8 pfmu_idx;
-+		bool bfer;
-+		u8 dbdc_idx;
-+	} __packed req = {
-+		.format_id = MT_BF_PFMU_TAG_READ,
-+		.pfmu_idx = pfmu_idx,
-+		.bfer = bfer,
-+		.dbdc_idx = phy->mt76->band_idx,
-+	};
-+	struct mt7915_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
-+
-+	/* Reset to 0 for mt7915_tm_txbf_profile_tag_write wait_event */
-+	tag->t1.pfmu_idx = 0;
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
-+				 sizeof(req), true);
-+}
-+
-+int mt7915_mcu_txbf_sta_rec_read(struct mt7915_dev *dev, u16 wlan_idx)
-+{
-+	struct {
-+		u8 action;
-+		u8 wlan_idx_lo;
-+		u8 wlan_idx_hi;
-+		u8 rsv[5];
-+	} __packed req = {
-+		.action = MT_BF_STA_REC_READ,
-+		.wlan_idx_lo = to_wcid_lo(wlan_idx),
-+		.wlan_idx_hi = to_wcid_hi(wlan_idx),
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
-+				 sizeof(req), true);
-+}
-+#endif
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index f4b5709..007fd4d 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -61,6 +61,7 @@ enum offs_rev {
- 	MDP_BNRCFR1,
- 	ARB_DRNGR0,
- 	ARB_SCR,
-+	ARB_TQSAXM0,
- 	RMAC_MIB_AIRTIME14,
- 	AGG_AALCR0,
- 	AGG_AWSCR0,
-@@ -530,6 +531,9 @@ enum offs_rev {
- #define MT_ARB_DRNGR0(_band, _n)	MT_WF_ARB(_band, (__OFFS(ARB_DRNGR0) +	\
- 							  (_n) * 4))
- 
-+#define MT_ARB_TQSAXM0(_band)		MT_WF_ARB(_band, __OFFS(ARB_TQSAXM0))
-+#define MT_ARB_TQSAXM_ALTX_START_MASK	GENMASK(12, 8)
-+
- /* RMAC: band 0(0x820e5000), band 1(0x820f5000) */
- #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
- #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 2ae6c07..e4af5e1 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -53,6 +53,8 @@ struct reg_band {
- static struct reg_band reg_backup_list[TM_REG_MAX_ID];
- 
- static void mt7915_tm_update_entry(struct mt7915_phy *phy);
-+static int mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode, bool bf_sounding);
-+static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy, struct mt76_wcid *wcid);
- 
- static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
- {
-@@ -73,6 +75,25 @@ static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
- 	return width_to_bw[width];
- }
- 
-+static u8 mt7915_tm_rate_to_phy(u8 tx_rate_mode)
-+{
-+	static const u8 rate_to_phy[] = {
-+		[MT76_TM_TX_MODE_CCK] = MT_PHY_TYPE_CCK,
-+		[MT76_TM_TX_MODE_OFDM] = MT_PHY_TYPE_OFDM,
-+		[MT76_TM_TX_MODE_HT] = MT_PHY_TYPE_HT,
-+		[MT76_TM_TX_MODE_VHT] = MT_PHY_TYPE_VHT,
-+		[MT76_TM_TX_MODE_HE_SU] = MT_PHY_TYPE_HE_SU,
-+		[MT76_TM_TX_MODE_HE_EXT_SU] = MT_PHY_TYPE_HE_EXT_SU,
-+		[MT76_TM_TX_MODE_HE_TB] = MT_PHY_TYPE_HE_TB,
-+		[MT76_TM_TX_MODE_HE_MU] = MT_PHY_TYPE_HE_MU,
-+	};
-+
-+	if (tx_rate_mode > MT76_TM_TX_MODE_MAX)
-+		return -EINVAL;
-+
-+	return rate_to_phy[tx_rate_mode];
-+}
-+
- static void
- mt7915_tm_update_channel(struct mt7915_phy *phy)
- {
-@@ -273,17 +294,33 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
- 	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_testmode_data *td = &phy->mt76->test;
- 	struct sk_buff *skb;
- 	struct sta_rec_bf *bf;
- 	struct tlv *tlv;
--	u8 ndp_rate;
-+	u8 ndp_rate, ndpa_rate, rept_poll_rate, bf_bw;
-+
-+	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_SU) {
-+		rept_poll_rate = 0x49;
-+		ndpa_rate = 0x49;
-+		ndp_rate = 0;
-+	} else if (td->tx_rate_mode == MT76_TM_TX_MODE_VHT) {
-+		rept_poll_rate = 0x9;
-+		ndpa_rate = 0x9;
-+		ndp_rate = 0;
-+	} else {
-+		rept_poll_rate = 0;
-+		ndpa_rate = 0;
-+		if (nr == 1)
-+			ndp_rate = 8;
-+		else if (nr == 2)
-+			ndp_rate = 16;
-+		else
-+			ndp_rate = 24;
-+	}
- 
--	if (nr == 1)
--		ndp_rate = 8;
--	else if (nr == 2)
--		ndp_rate = 16;
--	else
--		ndp_rate = 24;
-+	/* BF use CMD_CBW instead of TM_CBW */
-+	bf_bw = mt76_connac_chan_bw(&phy->mt76->chandef);
- 
- 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
- 					    &msta->wcid);
-@@ -299,8 +336,11 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 	bf->ncol = nc;
- 	bf->nrow = nr;
- 	bf->ndp_rate = ndp_rate;
-+	bf->ndpa_rate = ndpa_rate;
-+	bf->rept_poll_rate = rept_poll_rate;
-+	bf->bw = bf_bw;
- 	bf->ibf_timeout = 0xff;
--	bf->tx_mode = MT_PHY_TYPE_HT;
-+	bf->tx_mode = mt7915_tm_rate_to_phy(td->tx_rate_mode);
- 
- 	if (ebf) {
- 		bf->mem[0].row = 0;
-@@ -353,11 +393,8 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
- 	}
- 
- 	memcpy(sta->addr, ed->addr[0], ETH_ALEN);
--	if (phy->test.bf_en) {
--		u8 addr[ETH_ALEN] = {0x00, 0x11, 0x11, 0x11, 0x11, 0x11};
--
--		memcpy(sta->addr, addr, ETH_ALEN);
--	}
-+	if (td->bf_en)
-+		memcpy(sta->addr, td->addr[0], ETH_ALEN);
- 
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
- 		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
-@@ -382,6 +419,14 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
- 	list_add_tail(&msta->wcid.list, &td->tm_entry_list);
- 	td->entry_num++;
- 
-+	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, true);
-+
-+	if (td->bf_en) {
-+		mt7915_tm_set_ipg_params(phy, td->tx_ipg, td->tx_rate_mode, true);
-+		mt7915_tm_set_tam_arb(phy, td->bf_en, 0);
-+		mt7915_tm_txbf_set_rate(phy, &msta->wcid);
-+	}
-+
- 	return 0;
- }
- 
-@@ -451,7 +496,7 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
- 	struct mt76_testmode_entry_data *ed, tmp;
- 	struct mt76_wcid *wcid, *last;
- 
--	if (!td->aid || phy->test.bf_en)
-+	if (!td->aid || td->bf_en)
- 		return;
- 
- 	memcpy(&tmp, &td->ed, sizeof(tmp));
-@@ -472,20 +517,30 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
- static int
- mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
- {
-+#define EBF_BBP_RX_OFFSET	0x10280
-+#define EBF_BBP_RX_ENABLE	(BIT(0) | BIT(15))
-+#define WF1			1
-+#define WF2			2
- 	struct mt76_testmode_data *td = &phy->mt76->test;
- 	struct mt7915_dev *dev = phy->dev;
-+	struct mt76_phy *mphy = phy->mt76;
- 	bool enable = val[0];
- 	void *phase_cal, *pfmu_data, *pfmu_tag;
--	u8 addr[ETH_ALEN] = {0x00, 0x22, 0x22, 0x22, 0x22, 0x22};
-+	u8 sub_addr = td->is_txbf_dut ? TXBF_DUT_MAC_SUBADDR : TXBF_GOLDEN_MAC_SUBADDR;
-+	u8 peer_addr = td->is_txbf_dut ? TXBF_GOLDEN_MAC_SUBADDR : TXBF_DUT_MAC_SUBADDR;
-+	u8 bss_addr = TXBF_DUT_MAC_SUBADDR;
-+	u8 addr[ETH_ALEN] = {0x00, sub_addr, sub_addr, sub_addr, sub_addr, sub_addr};
-+	u8 bssid[ETH_ALEN] = {0x00, bss_addr, bss_addr, bss_addr, bss_addr, bss_addr};
-+	u8 peer_addrs[ETH_ALEN] = {0x00, peer_addr, peer_addr, peer_addr, peer_addr, peer_addr};
- 
- 	if (!enable) {
--		phy->test.bf_en = 0;
-+		td->bf_en = 0;
- 		return 0;
- 	}
- 
- 	if (!dev->test.txbf_phase_cal) {
- 		phase_cal = devm_kzalloc(dev->mt76.dev,
--					 sizeof(struct mt7915_tm_txbf_phase) *
-+					 sizeof(struct mt7915_txbf_phase) *
- 					 MAX_PHASE_GROUP_NUM,
- 					 GFP_KERNEL);
- 		if (!phase_cal)
-@@ -495,7 +550,10 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
- 	}
- 
- 	if (!dev->test.txbf_pfmu_data) {
--		pfmu_data = devm_kzalloc(dev->mt76.dev, 512, GFP_KERNEL);
-+		pfmu_data = devm_kzalloc(dev->mt76.dev,
-+					 sizeof(struct mt7915_pfmu_data) *
-+					 MT7915_TXBF_SUBCAR_NUM,
-+					 GFP_KERNEL);
- 		if (!pfmu_data)
- 			return -ENOMEM;
- 
-@@ -504,21 +562,77 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
- 
- 	if (!dev->test.txbf_pfmu_tag) {
- 		pfmu_tag = devm_kzalloc(dev->mt76.dev,
--					sizeof(struct mt7915_tm_pfmu_tag), GFP_KERNEL);
-+					sizeof(struct mt7915_pfmu_tag), GFP_KERNEL);
- 		if (!pfmu_tag)
- 			return -ENOMEM;
- 
- 		dev->test.txbf_pfmu_tag = pfmu_tag;
- 	}
- 
-+	td->bf_en = 1;
-+	memcpy(td->addr[0], peer_addrs, ETH_ALEN);
-+	memcpy(td->addr[1], addr, ETH_ALEN);
-+	memcpy(td->addr[2], bssid, ETH_ALEN);
- 	memcpy(phy->monitor_vif->addr, addr, ETH_ALEN);
- 	mt7915_mcu_add_dev_info(phy, phy->monitor_vif, true);
- 
--	td->tx_rate_mode = MT76_TM_TX_MODE_HT;
--	td->tx_mpdu_len = 1024;
--	td->tx_rate_sgi = 0;
--	td->tx_ipg = 100;
--	phy->test.bf_en = 1;
-+	/* Add second interface in wtbl for using TXCMD to transmit sounding */
-+	td->second_vif = kzalloc(sizeof(*td->second_vif) + sizeof(struct mt7915_vif), GFP_KERNEL);
-+	memcpy(td->second_vif, phy->monitor_vif, sizeof(*td->second_vif));
-+	mt7915_init_vif(phy, td->second_vif, td->bf_en);
-+
-+	if (td->ebf && !td->is_txbf_dut) {
-+		u8 is_160hz = val[1];
-+
-+		/* Turn On BBP CR for RX */
-+		mt76_set(dev, EBF_BBP_RX_OFFSET, EBF_BBP_RX_ENABLE);
-+		dev_info(dev->mt76.dev, "Set BBP RX CR = %x\n", mt76_rr(dev, EBF_BBP_RX_OFFSET));
-+
-+		/* Set TX antenna mask of golden: default use WF0 only */
-+		td->tx_antenna_mask = 1;
-+		if (is_mt7915(&dev->mt76)) {
-+			/* Add WF1/WF2 for dbdc/single band in BW 160 */
-+			td->tx_antenna_mask |= is_160hz << (dev->dbdc_support ? WF1 : WF2);
-+			/* Shift to WF2/WF3 for dbdc band 1 */
-+			td->tx_antenna_mask <<= 2 * phy->mt76->band_idx;
-+		}
-+	} else if (td->ebf && td->is_txbf_dut) {
-+		/* Enable ETxBF Capability */
-+		dev->ibf = false;
-+		mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
-+		/* Set TX antenna mask of DUT */
-+		td->tx_antenna_mask = mphy->chainmask >> (dev->chainshift * phy->mt76->band_idx);
-+		td->tx_spe_idx = phy->mt76->band_idx ? 25 : 24;
-+		/* Shift to WF2/WF3 for dbdc band 1, Nss = 2 */
-+		if ((hweight8(td->tx_antenna_mask) == 2) && phy->mt76->band_idx)
-+			td->tx_antenna_mask <<= 2;
-+	} else {
-+		if (td->is_txbf_dut) {
-+			int nss;
-+
-+			/* Enable ITxBF Capability */
-+			dev->ibf = true;
-+			mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
-+			td->tx_antenna_mask = mphy->chainmask >> (dev->chainshift *
-+								  phy->mt76->band_idx);
-+			nss = hweight8(td->tx_antenna_mask);
-+			if (nss > 1 && nss <= 4)
-+				td->tx_rate_idx = 15 + 8 * (nss - 2);
-+			else
-+				td->tx_rate_idx = 31;
-+		} else {
-+			td->tx_antenna_mask  = 1;
-+			mt76_set(dev, EBF_BBP_RX_OFFSET, EBF_BBP_RX_ENABLE);
-+			dev_info(dev->mt76.dev, "Set BBP RX CR = %x\n",
-+				 mt76_rr(dev, EBF_BBP_RX_OFFSET));
-+		}
-+		td->tx_rate_mode = MT76_TM_TX_MODE_HT;
-+		td->tx_mpdu_len = 1024;
-+		td->tx_rate_sgi = 0;
-+		td->tx_ipg = 100;
-+	}
-+
-+	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, true);
- 
- 	return mt7915_tm_set_trx(phy, TM_MAC_TX, true);
- }
-@@ -545,8 +659,7 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
- 		.read_from_e2p = val[3],
- 		.disable = val[4],
- 	};
--	struct mt7915_tm_txbf_phase *phase =
--		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
-+	struct mt7915_txbf_phase *phase = (struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
- 
- 	wait_event_timeout(dev->mt76.tx_wait, phase[val[2]].status != 0, HZ);
- 	memcpy(req.buf, &phase[val[2]].phase, sizeof(req.buf));
-@@ -559,32 +672,9 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
- 				 sizeof(req), true);
- }
- 
--static int
--mt7915_tm_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx)
--{
--	struct mt7915_dev *dev = phy->dev;
--	struct {
--		u8 format_id;
--		u8 pfmu_idx;
--		bool bfer;
--		u8 dbdc_idx;
--	} __packed req = {
--		.format_id = MT_BF_PFMU_TAG_READ,
--		.pfmu_idx = pfmu_idx,
--		.bfer = 1,
--		.dbdc_idx = phy != &dev->phy,
--	};
--	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
--
--	tag->t1.pfmu_idx = 0;
--
--	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
--				 sizeof(req), true);
--}
--
- static int
- mt7915_tm_txbf_profile_tag_write(struct mt7915_phy *phy, u8 pfmu_idx,
--				 struct mt7915_tm_pfmu_tag *tag)
-+				 struct mt7915_pfmu_tag *tag)
- {
- 	struct mt7915_dev *dev = phy->dev;
- 	struct {
-@@ -611,8 +701,6 @@ static int
- mt7915_tm_txbf_apply_tx(struct mt7915_phy *phy, u16 wlan_idx, bool ebf,
- 			bool ibf, bool phase_cal)
- {
--#define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
--#define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
- 	struct mt7915_dev *dev = phy->dev;
- 	struct {
- 		u8 category;
-@@ -641,14 +729,15 @@ static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
- {
- 	struct mt7915_dev *dev = phy->dev;
- 	struct mt76_testmode_entry_data *ed = mt76_testmode_entry_data(phy->mt76, wcid);
-+	struct mt76_testmode_data *td = &phy->mt76->test;
- 	struct ieee80211_sta *sta = wcid_to_sta(wcid);
- 	struct sta_phy rate = {};
- 
- 	if (!sta)
- 		return 0;
- 
--	rate.type = MT_PHY_TYPE_HT;
--	rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
-+	rate.type = mt7915_tm_rate_to_phy(td->tx_rate_mode);
-+	rate.bw = mt76_connac_chan_bw(&phy->mt76->chandef);
- 	rate.nss = ed->tx_rate_nss;
- 	rate.mcs = ed->tx_rate_idx;
- 	rate.ldpc = (rate.bw || ed->tx_rate_ldpc) * GENMASK(2, 0);
-@@ -662,13 +751,14 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
- {
- 	bool bf_on = val[0], update = val[3];
- 	/* u16 wlan_idx = val[2]; */
--	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
- 	struct mt76_testmode_data *td = &phy->mt76->test;
- 	struct mt76_wcid *wcid;
- 
- 	if (bf_on) {
- 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
--		mt7915_tm_txbf_profile_tag_read(phy, 2);
-+		mt7915_mcu_txbf_profile_tag_read(phy, 2, true);
- 		tag->t1.invalid_prof = false;
- 		mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
- 
-@@ -683,7 +773,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
- 		} else {
- 			phy->test.bf_ever_en = false;
- 
--			mt7915_tm_txbf_profile_tag_read(phy, 2);
-+			mt7915_mcu_txbf_profile_tag_read(phy, 2, true);
- 			tag->t1.invalid_prof = true;
- 			mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
- 		}
-@@ -698,6 +788,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
- static int
- mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
- {
-+#define MT_ARB_IBF_ENABLE	(BIT(0) | GENMASK(9, 8))
- 	static const u8 mode_to_lm[] = {
- 		[MT76_TM_TX_MODE_CCK] = 0,
- 		[MT76_TM_TX_MODE_OFDM] = 0,
-@@ -711,7 +802,8 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
- 	struct mt76_testmode_data *td = &phy->mt76->test;
- 	struct mt76_wcid *wcid;
- 	struct ieee80211_vif *vif = phy->monitor_vif;
--	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
- 	u8 pfmu_idx = val[0], nc = val[2], nr;
- 	bool is_atenl = val[6];
- 	int ret;
-@@ -729,18 +821,22 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
- 	tag->t1.nr = nr;
- 	tag->t1.nc = nc;
- 	tag->t1.invalid_prof = true;
--
--	tag->t1.snr_sts4 = 0xc0;
--	tag->t1.snr_sts5 = 0xff;
--	tag->t1.snr_sts6 = 0xff;
--	tag->t1.snr_sts7 = 0xff;
-+	tag->t1.data_bw = mt76_connac_chan_bw(&phy->mt76->chandef);
-+	tag->t2.se_idx = td->tx_spe_idx;
-+
-+	if (is_atenl) {
-+		tag->t1.snr_sts4 = 0xc0;
-+		tag->t1.snr_sts5 = 0xff;
-+		tag->t1.snr_sts6 = 0xff;
-+		tag->t1.snr_sts7 = 0xff;
-+	}
- 
- 	if (ebf) {
- 		tag->t1.row_id1 = 0;
- 		tag->t1.row_id2 = 1;
- 		tag->t1.row_id3 = 2;
- 		tag->t1.row_id4 = 3;
--		tag->t1.lm = mode_to_lm[MT76_TM_TX_MODE_HT];
-+		tag->t1.lm = mode_to_lm[td->tx_rate_mode];
- 	} else {
- 		tag->t1.row_id1 = 4;
- 		tag->t1.row_id2 = 5;
-@@ -761,6 +857,19 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
- 	if (ret)
- 		return ret;
- 
-+	if (td->ebf) {
-+		mt76_set(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx), MT_ARB_TQSAXM_ALTX_START_MASK);
-+		dev_info(dev->mt76.dev, "Set TX queue start CR for AX management (0x%x) = 0x%x\n",
-+			 MT_ARB_TQSAXM0(phy->mt76->band_idx),
-+			 mt76_rr(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx)));
-+	} else if (!td->ebf && ebf) {
-+		/* iBF's ebf profile update */
-+		mt76_set(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx), MT_ARB_IBF_ENABLE);
-+		dev_info(dev->mt76.dev, "Set TX queue start CR for AX management (0x%x) = 0x%x\n",
-+			 MT_ARB_TQSAXM0(phy->mt76->band_idx),
-+			 mt76_rr(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx)));
-+	}
-+
- 	if (!ebf && is_atenl)
- 		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
- 
-@@ -778,7 +887,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
- 		u8 category;
- 		u8 group_l_m_n;
- 		u8 group;
--		bool sx2;
-+		bool dbdc_idx;
- 		u8 cal_type;
- 		u8 lna_gain_level;
- 		u8 _rsv[2];
-@@ -786,12 +895,12 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
- 		.category = MT_BF_PHASE_CAL,
- 		.group = val[0],
- 		.group_l_m_n = val[1],
--		.sx2 = val[2],
-+		.dbdc_idx = phy->mt76->band_idx,
- 		.cal_type = val[3],
- 		.lna_gain_level = val[4],
- 	};
--	struct mt7915_tm_txbf_phase *phase =
--		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
-+	struct mt7915_txbf_phase *phase =
-+		(struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
- 
- 	phase[req.group].status = 0;
- 
-@@ -799,53 +908,10 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
- 				 sizeof(req), true);
- }
- 
--int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
--{
--#define BF_PFMU_TAG	16
--#define BF_CAL_PHASE	21
--	u8 format_id;
--
--	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
--	format_id = *(u8 *)skb->data;
--
--	if (format_id == BF_PFMU_TAG) {
--		struct mt7915_tm_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
--
--		skb_pull(skb, 8);
--		memcpy(tag, skb->data, sizeof(struct mt7915_tm_pfmu_tag));
--	} else if (format_id == BF_CAL_PHASE) {
--		struct mt7915_tm_ibf_cal_info *cal;
--		struct mt7915_tm_txbf_phase *phase =
--			(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
--
--		cal = (struct mt7915_tm_ibf_cal_info *)skb->data;
--		switch (cal->cal_type) {
--		case IBF_PHASE_CAL_NORMAL:
--		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
--			if (cal->group_l_m_n != GROUP_M)
--				break;
--			phase = &phase[cal->group];
--			memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
--			phase->status = cal->status;
--			/* for passing iTest script */
--			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
--			break;
--		case IBF_PHASE_CAL_VERIFY:
--		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
--			break;
--		default:
--			break;
--		}
--	}
--
--	wake_up(&dev->mt76.tx_wait);
--
--	return 0;
--}
--
- static int
- mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
- {
-+#define MT7915_TXBF_PFMU_DATA_LEN	(MT7915_TXBF_SUBCAR_NUM * sizeof(struct mt7915_pfmu_data))
- 	struct mt76_testmode_data *td = &phy->mt76->test;
- 	u16 pfmu_idx = val[0];
- 	u16 subc_id = val[1];
-@@ -854,9 +920,9 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
- 	u16 angle31 = val[4];
- 	u16 angle41 = val[5];
- 	s16 phi11 = 0, phi21 = 0, phi31 = 0;
--	struct mt7915_tm_pfmu_data *pfmu_data;
-+	struct mt7915_pfmu_data *pfmu_data;
- 
--	if (subc_id > 63)
-+	if (subc_id > MT7915_TXBF_SUBCAR_NUM - 1)
- 		return -EINVAL;
- 
- 	if (td->tx_antenna_mask == 2) {
-@@ -870,7 +936,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
- 		phi31 = (s16)(angle41 - angle31);
- 	}
- 
--	pfmu_data = (struct mt7915_tm_pfmu_data *)phy->dev->test.txbf_pfmu_data;
-+	pfmu_data = (struct mt7915_pfmu_data *)phy->dev->test.txbf_pfmu_data;
- 	pfmu_data = &pfmu_data[subc_id];
- 
- 	if (subc_id < 32)
-@@ -880,21 +946,21 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
- 	pfmu_data->phi11 = cpu_to_le16(phi11);
- 	pfmu_data->phi21 = cpu_to_le16(phi21);
- 	pfmu_data->phi31 = cpu_to_le16(phi31);
--	if (subc_id == 63) {
-+	if (subc_id == MT7915_TXBF_SUBCAR_NUM - 1) {
- 		struct mt7915_dev *dev = phy->dev;
- 		struct {
- 			u8 format_id;
- 			u8 pfmu_idx;
- 			u8 dbdc_idx;
- 			u8 _rsv;
--			u8 buf[512];
-+			u8 buf[MT7915_TXBF_PFMU_DATA_LEN];
- 		} __packed req = {
- 			.format_id = MT_BF_PROFILE_WRITE_ALL,
- 			.pfmu_idx = pfmu_idx,
- 			.dbdc_idx = phy != &dev->phy,
- 		};
- 
--		memcpy(req.buf, dev->test.txbf_pfmu_data, 512);
-+		memcpy(req.buf, dev->test.txbf_pfmu_data, MT7915_TXBF_PFMU_DATA_LEN);
- 
- 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
- 					 &req, sizeof(req), true);
-@@ -906,7 +972,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
- static int
- mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
- {
--	struct mt7915_tm_txbf_phase *phase, *p;
-+	struct mt7915_txbf_phase *phase, *p;
- 	struct mt7915_dev *dev = phy->dev;
- 	u8 *eeprom = dev->mt76.eeprom.data;
- 	u16 offset;
-@@ -916,7 +982,7 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
- 	is_7976 = mt7915_check_adie(dev, false) || is_mt7916(&dev->mt76);
- 	offset = is_7976 ? 0x60a : 0x651;
- 
--	phase = (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
-+	phase = (struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
- 	for (i = 0; i < MAX_PHASE_GROUP_NUM; i++) {
- 		p = &phase[i];
- 
-@@ -931,17 +997,75 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
- 	return 0;
- }
- 
-+static int
-+mt7915_tm_trigger_sounding(struct mt7915_phy *phy, u16 *val, bool en)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	u8 sounding_mode = val[0];
-+	u8 MU_num = val[1];
-+	u32 sounding_interval = (u32)val[2] << 2;	/* input unit: 4ms */
-+	enum sounding_mode {
-+		SU_SOUNDING,
-+		MU_SOUNDING,
-+		SU_PERIODIC_SOUNDING,
-+		MU_PERIODIC_SOUNDING,
-+		BF_PROCESSING,
-+		TXCMD_NONTB_SU_SOUNDING,
-+		TXCMD_VHT_MU_SOUNDING,
-+		TXCMD_TB_PER_BRP_SOUNDING,
-+		TXCMD_TB_SOUNDING,
-+
-+		/* keep last */
-+		NUM_SOUNDING_MODE,
-+		SOUNDING_MODE_MAX = NUM_SOUNDING_MODE - 1,
-+	};
-+	struct {
-+		u8 cmd_category_id;
-+		u8 sounding_mode;
-+		u8 MU_num;
-+		u8 rsv;
-+		u8 wlan_idx[4];
-+		u32 sounding_interval;		/* unit: ms */
-+	} __packed req = {
-+		.cmd_category_id = en ? MT_BF_SOUNDING_ON : MT_BF_SOUNDING_OFF,
-+		.sounding_mode = sounding_mode,
-+		.MU_num = MU_num,
-+		.sounding_interval = cpu_to_le32(sounding_interval),
-+		.wlan_idx[0] = val[3],
-+		.wlan_idx[1] = val[4],
-+		.wlan_idx[2] = val[5],
-+		.wlan_idx[3] = val[6],
-+	};
-+
-+	if (sounding_mode > SOUNDING_MODE_MAX)
-+		return -EINVAL;
-+
-+	/* Enable Tx MAC HW before trigger sounding */
-+	if (en)
-+		mt7915_tm_set_trx(phy, TM_MAC_TX, true);
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
-+				 &req, sizeof(req), true);
-+}
-+
- static int
- mt7915_tm_set_txbf(struct mt7915_phy *phy)
- {
-+#define TXBF_IS_DUT_MASK	BIT(0)
-+#define TXBF_EBF_MASK		BIT(1)
- 	struct mt76_testmode_data *td = &phy->mt76->test;
- 	u16 *val = td->txbf_param;
- 
--	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
--		td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5]);
-+	dev_info(phy->dev->mt76.dev, "ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
-+		 td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5], val[6]);
- 
- 	switch (td->txbf_act) {
-+	case MT76_TM_TXBF_ACT_GOLDEN_INIT:
- 	case MT76_TM_TXBF_ACT_INIT:
-+	case MT76_TM_TX_EBF_ACT_GOLDEN_INIT:
-+	case MT76_TM_TX_EBF_ACT_INIT:
-+		td->ebf = !!u32_get_bits(td->txbf_act, TXBF_EBF_MASK);
-+		td->is_txbf_dut = !!u32_get_bits(td->txbf_act, TXBF_IS_DUT_MASK);
- 		return mt7915_tm_txbf_init(phy, val);
- 	case MT76_TM_TXBF_ACT_UPDATE_CH:
- 		mt7915_tm_update_channel(phy);
-@@ -967,6 +1091,36 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
- 
- 		return mt7915_tm_txbf_apply_tx(phy, wlan_idx, ebf, ibf, phase_cal);
- 	}
-+	case MT76_TM_TXBF_ACT_TRIGGER_SOUNDING:
-+		return mt7915_tm_trigger_sounding(phy, val, true);
-+	case MT76_TM_TXBF_ACT_STOP_SOUNDING:
-+		memset(val, 0, sizeof(td->txbf_param));
-+		return mt7915_tm_trigger_sounding(phy, val, false);
-+	case MT76_TM_TXBF_ACT_PROFILE_TAG_READ:
-+	case MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE:
-+	case MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID: {
-+		u8 pfmu_idx = val[0];
-+		bool bfer = !!val[1];
-+		struct mt7915_dev *dev = phy->dev;
-+		struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
-+
-+		if (!tag) {
-+			dev_err(dev->mt76.dev,
-+				"pfmu tag is not initialized!\n");
-+			return 0;
-+		}
-+
-+		if (td->txbf_act == MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE)
-+			return mt7915_tm_txbf_profile_tag_write(phy, pfmu_idx, tag);
-+		else if (td->txbf_act == MT76_TM_TXBF_ACT_PROFILE_TAG_READ)
-+			return mt7915_mcu_txbf_profile_tag_read(phy, pfmu_idx, bfer);
-+
-+		tag->t1.invalid_prof = !!val[0];
-+
-+		return 0;
-+	}
-+	case MT76_TM_TXBF_ACT_STA_REC_READ:
-+		return mt7915_mcu_txbf_sta_rec_read(phy->dev, val[0]);
- 	default:
- 		break;
- 	};
-@@ -1186,9 +1340,10 @@ mt7915_tm_set_ipi(struct mt7915_phy *phy)
- 
- static int
- mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
--		      u16 cw_max, u16 txop, u8 tx_cmd)
-+		      u16 cw_max, u16 txop, u8 tx_cmd, bool bf_sounding)
- {
--	struct mt7915_vif *mvif = (struct mt7915_vif *)phy->monitor_vif->drv_priv;
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt7915_vif *mvif;
- 	struct mt7915_mcu_tx req = {
- 		.valid = true,
- 		.mode = tx_cmd,
-@@ -1196,6 +1351,9 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
- 	};
- 	struct edca *e = &req.edca[0];
- 
-+	mvif = bf_sounding ? (struct mt7915_vif *)td->second_vif->drv_priv :
-+			     (struct mt7915_vif *)phy->monitor_vif->drv_priv;
-+
- 	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
- 	e->set = WMM_PARAM_SET;
- 
-@@ -1208,17 +1366,19 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
- }
- 
- static int
--mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
-+mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode, bool bf_sounding)
- {
- #define TM_DEFAULT_SIFS	10
- #define TM_MAX_SIFS	127
- #define TM_MAX_AIFSN	0xf
- #define TM_MIN_AIFSN	0x1
- #define BBP_PROC_TIME	1500
-+#define TM_DEFAULT_CW	1
- 	struct mt7915_dev *dev = phy->dev;
- 	u8 sig_ext = (mode == MT76_TM_TX_MODE_CCK) ? 0 : 6;
- 	u8 slot_time = 9, sifs = TM_DEFAULT_SIFS;
- 	u8 aifsn = TM_MIN_AIFSN;
-+	bool tx_cmd;
- 	u8 band = phy->mt76->band_idx;
- 	u32 i2t_time, tr2t_time, txv_time;
- 	u16 cw = 0;
-@@ -1232,6 +1392,7 @@ mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
- 	ipg -= sig_ext;
- 
- 	if (ipg <= (TM_MAX_SIFS + slot_time)) {
-+		cw = TM_DEFAULT_CW;
- 		sifs = ipg - slot_time;
- 	} else {
- 		u32 val = (ipg + slot_time) / slot_time;
-@@ -1267,10 +1428,12 @@ done:
- 
- 	mt7915_tm_set_slot_time(phy, slot_time, sifs);
- 
-+	/* HE MU data and iBF/eBF sounding packet use TXCMD */
-+	tx_cmd = (mode == MT76_TM_TX_MODE_HE_MU) || bf_sounding;
-+
- 	return mt7915_tm_set_wmm_qid(phy,
- 				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
--				     aifsn, cw, cw, 0,
--				     mode == MT76_TM_TX_MODE_HE_MU);
-+				     aifsn, cw, cw, 0, tx_cmd, bf_sounding);
- }
- 
- static int
-@@ -1469,7 +1632,7 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
- 
- 		phy->mt76->test.aid = 0;
- 		phy->mt76->test.tx_mpdu_len = 0;
--		phy->test.bf_en = 0;
-+		phy->mt76->test.bf_en = 0;
- 		mt7915_tm_set_entry(phy);
- 	} else {
- 		INIT_DELAYED_WORK(&phy->ipi_work, mt7915_tm_ipi_work);
-@@ -1654,7 +1817,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
- 		u8 duty_cycle = td->tx_duty_cycle;
- 
--		if (!phy->test.bf_en)
-+		if (!td->bf_en)
- 			mt7915_tm_update_channel(phy);
- 
- 		if (td->tx_spe_idx)
-@@ -1669,7 +1832,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 			if (duty_cycle < 100)
- 				tx_time = duty_cycle * ipg / (100 - duty_cycle);
- 		}
--		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
-+		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode, false);
- 		mt7915_tm_set_tx_len(phy, tx_time);
- 
- 		if (ipg)
-@@ -1688,6 +1851,9 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 		mt7915_tm_tx_frames_mu(phy, en);
- 
- 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
-+
-+	if (td->bf_en)
-+		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
- }
- 
- static int
-@@ -1779,7 +1945,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
- 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
- 
- 	if (en) {
--		if (!phy->test.bf_en)
-+		if (!td->bf_en || !td->is_txbf_dut)
- 			mt7915_tm_update_channel(phy);
- 		if (td->aid)
- 			mt7915_tm_set_rx_user_idx(phy, td->aid);
-@@ -1796,6 +1962,9 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
- 		mt7915_tm_set_muru_aid(phy, en ? td->aid : 0xf800);
- 
- 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
-+
-+	if (td->bf_en)
-+		mt7915_tm_set_trx(phy, TM_MAC_TX, en);
- }
- 
- static int
-@@ -1855,34 +2024,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
- 		rate_idx = sband->bitrates[idx].hw_value & 0xff;
- 	}
- 
--	switch (td->tx_rate_mode) {
--	case MT76_TM_TX_MODE_CCK:
--		mode = MT_PHY_TYPE_CCK;
--		break;
--	case MT76_TM_TX_MODE_OFDM:
--		mode = MT_PHY_TYPE_OFDM;
--		break;
--	case MT76_TM_TX_MODE_HT:
--		mode = MT_PHY_TYPE_HT;
--		break;
--	case MT76_TM_TX_MODE_VHT:
--		mode = MT_PHY_TYPE_VHT;
--		break;
--	case MT76_TM_TX_MODE_HE_SU:
--		mode = MT_PHY_TYPE_HE_SU;
--		break;
--	case MT76_TM_TX_MODE_HE_EXT_SU:
--		mode = MT_PHY_TYPE_HE_EXT_SU;
--		break;
--	case MT76_TM_TX_MODE_HE_TB:
--		mode = MT_PHY_TYPE_HE_TB;
--		break;
--	case MT76_TM_TX_MODE_HE_MU:
--		mode = MT_PHY_TYPE_HE_MU;
--		break;
--	default:
--		return -EINVAL;
--	}
-+	mode = mt7915_tm_rate_to_phy(td->tx_rate_mode);
- 
- 	rateval =  mode << 6 | rate_idx;
- 	tx_cont->rateval = cpu_to_le16(rateval);
-diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index d500987..1982369 100644
---- a/mt7915/testmode.h
-+++ b/mt7915/testmode.h
-@@ -311,137 +311,7 @@ struct mt7915_tm_muru {
- 
- #define MAX_PHASE_GROUP_NUM	9
- 
--struct mt7915_tm_txbf_phase {
--	u8 status;
--	struct {
--		u8 r0_uh;
--		u8 r0_h;
--		u8 r0_m;
--		u8 r0_l;
--		u8 r0_ul;
--		u8 r1_uh;
--		u8 r1_h;
--		u8 r1_m;
--		u8 r1_l;
--		u8 r1_ul;
--		u8 r2_uh;
--		u8 r2_h;
--		u8 r2_m;
--		u8 r2_l;
--		u8 r2_ul;
--		u8 r3_uh;
--		u8 r3_h;
--		u8 r3_m;
--		u8 r3_l;
--		u8 r3_ul;
--		u8 r2_uh_sx2;
--		u8 r2_h_sx2;
--		u8 r2_m_sx2;
--		u8 r2_l_sx2;
--		u8 r2_ul_sx2;
--		u8 r3_uh_sx2;
--		u8 r3_h_sx2;
--		u8 r3_m_sx2;
--		u8 r3_l_sx2;
--		u8 r3_ul_sx2;
--		u8 m_t0_h;
--		u8 m_t1_h;
--		u8 m_t2_h;
--		u8 m_t2_h_sx2;
--		u8 r0_reserved;
--		u8 r1_reserved;
--		u8 r2_reserved;
--		u8 r3_reserved;
--		u8 r2_sx2_reserved;
--		u8 r3_sx2_reserved;
--	} phase;
--};
--
--struct mt7915_tm_pfmu_tag1 {
--	__le32 pfmu_idx:10;
--	__le32 ebf:1;
--	__le32 data_bw:2;
--	__le32 lm:2;
--	__le32 is_mu:1;
--	__le32 nr:3, nc:3;
--	__le32 codebook:2;
--	__le32 ngroup:2;
--	__le32 _rsv:2;
--	__le32 invalid_prof:1;
--	__le32 rmsd:3;
--
--	__le32 col_id1:6, row_id1:10;
--	__le32 col_id2:6, row_id2:10;
--	__le32 col_id3:6, row_id3:10;
--	__le32 col_id4:6, row_id4:10;
--
--	__le32 ru_start_id:7;
--	__le32 _rsv1:1;
--	__le32 ru_end_id:7;
--	__le32 _rsv2:1;
--	__le32 mob_cal_en:1;
--	__le32 _rsv3:15;
--
--	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
--	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
--
--	__le32 _rsv4;
--} __packed;
--
--struct mt7915_tm_pfmu_tag2 {
--	__le32 smart_ant:24;
--	__le32 se_idx:5;
--	__le32 _rsv:3;
--
--	__le32 _rsv1:8;
--	__le32 rmsd_thres:3;
--	__le32 _rsv2:5;
--	__le32 ibf_timeout:8;
--	__le32 _rsv3:8;
--
--	__le32 _rsv4:16;
--	__le32 ibf_data_bw:2;
--	__le32 ibf_nc:3;
--	__le32 ibf_nr:3;
--	__le32 ibf_ru:8;
--
--	__le32 mob_delta_t:8;
--	__le32 mob_lq_result:7;
--	__le32 _rsv5:1;
--	__le32 _rsv6:16;
--
--	__le32 _rsv7;
--} __packed;
--
--struct mt7915_tm_pfmu_tag {
--	struct mt7915_tm_pfmu_tag1 t1;
--	struct mt7915_tm_pfmu_tag2 t2;
--};
--
--struct mt7915_tm_pfmu_data {
--	__le16 subc_idx;
--	__le16 phi11;
--	__le16 phi21;
--	__le16 phi31;
--};
--
--struct mt7915_tm_ibf_cal_info {
--	u8 format_id;
--	u8 group_l_m_n;
--	u8 group;
--	bool sx2;
--	u8 status;
--	u8 cal_type;
--	u8 _rsv[2];
--	u8 buf[1000];
--} __packed;
--
--enum {
--	IBF_PHASE_CAL_UNSPEC,
--	IBF_PHASE_CAL_NORMAL,
--	IBF_PHASE_CAL_VERIFY,
--	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
--	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
--};
-+#define TXBF_DUT_MAC_SUBADDR		0x22
-+#define TXBF_GOLDEN_MAC_SUBADDR		0x11
- 
- #endif
-diff --git a/testmode.c b/testmode.c
-index b19b872..ed5ceee 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -191,6 +191,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
- 
- 	hdr = __skb_put_zero(head, sizeof(*hdr));
- 	hdr->frame_control = cpu_to_le16(fc);
-+
- 	memcpy(hdr->addr1, addr[0], ETH_ALEN);
- 	memcpy(hdr->addr2, addr[1], ETH_ALEN);
- 	memcpy(hdr->addr3, addr[2], ETH_ALEN);
-diff --git a/testmode.h b/testmode.h
-index 27a0095..e1ebbd5 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -299,7 +299,10 @@ enum mt76_testmode_cfg {
- };
- 
- enum mt76_testmode_txbf_act {
-+	MT76_TM_TXBF_ACT_GOLDEN_INIT,
- 	MT76_TM_TXBF_ACT_INIT,
-+	MT76_TM_TX_EBF_ACT_GOLDEN_INIT,
-+	MT76_TM_TX_EBF_ACT_INIT,
- 	MT76_TM_TXBF_ACT_UPDATE_CH,
- 	MT76_TM_TXBF_ACT_PHASE_COMP,
- 	MT76_TM_TXBF_ACT_TX_PREP,
-@@ -310,6 +313,12 @@ enum mt76_testmode_txbf_act {
- 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
- 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
- 	MT76_TM_TXBF_ACT_E2P_UPDATE,
-+	MT76_TM_TXBF_ACT_TRIGGER_SOUNDING,
-+	MT76_TM_TXBF_ACT_STOP_SOUNDING,
-+	MT76_TM_TXBF_ACT_PROFILE_TAG_READ,
-+	MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE,
-+	MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID,
-+	MT76_TM_TXBF_ACT_STA_REC_READ,
- 
- 	/* keep last */
- 	NUM_MT76_TM_TXBF_ACT,
-diff --git a/tools/fields.c b/tools/fields.c
-index 6f07eed..7211ec5 100644
---- a/tools/fields.c
-+++ b/tools/fields.c
-@@ -33,7 +33,10 @@ static const char * const testmode_tx_mode[] = {
- };
- 
- static const char * const testmode_txbf_act[] = {
-+	[MT76_TM_TXBF_ACT_GOLDEN_INIT] = "golden_init",
- 	[MT76_TM_TXBF_ACT_INIT] = "init",
-+	[MT76_TM_TX_EBF_ACT_GOLDEN_INIT] = "ebf_golden_init",
-+	[MT76_TM_TX_EBF_ACT_INIT] = "ebf_init",
- 	[MT76_TM_TXBF_ACT_UPDATE_CH] = "update_ch",
- 	[MT76_TM_TXBF_ACT_PHASE_COMP] = "phase_comp",
- 	[MT76_TM_TXBF_ACT_TX_PREP] = "tx_prep",
-@@ -44,6 +47,12 @@ static const char * const testmode_txbf_act[] = {
- 	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL] = "prof_update",
- 	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD] = "prof_update_all",
- 	[MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
-+	[MT76_TM_TXBF_ACT_TRIGGER_SOUNDING] = "trigger_sounding",
-+	[MT76_TM_TXBF_ACT_STOP_SOUNDING] = "stop_sounding",
-+	[MT76_TM_TXBF_ACT_PROFILE_TAG_READ] = "pfmu_tag_read",
-+	[MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE] = "pfmu_tag_write",
-+	[MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID] = "set_invalid_prof",
-+	[MT76_TM_TXBF_ACT_STA_REC_READ] = "sta_rec_read",
- };
- 
- static const char * const testmode_offchan_bw[] = {
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
deleted file mode 100644
index 5fc9548..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From c7815914fe507bf9781b064efb6ba7ca33b6f5d1 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1117/1131] mt76: mt7915: init rssi in WTBL when add station
-
----
- mt7915/main.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/mt7915/main.c b/mt7915/main.c
-index a347e77..eae1377 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -692,6 +692,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7915_phy *phy;
- #endif
- 	int ret, idx;
-+	u32 addr;
- 
- 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
- 	if (idx < 0)
-@@ -715,6 +716,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	if (ret)
- 		return ret;
- 
-+	addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 30);
-+	mt76_rmw_field(dev, addr, GENMASK(7, 0), 0xa0);
-+
- #ifdef CONFIG_MTK_VENDOR
- 	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
- #endif
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
deleted file mode 100644
index be60246..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 4da9061216a9790e27d85358abcfbb7a8b0ae279 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1118/1131] mt76: mt7915: reduce TWT SP sent to FW for cert
-
-Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/mcu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5d41ebf..2d363c4 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3811,7 +3811,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
- 		.own_mac_idx = mvif->mt76.omac_idx,
- 		.flowid = flow->id,
- 		.peer_id = cpu_to_le16(flow->wcid),
--		.duration = flow->duration,
-+		.duration = (flow->duration * 7) >> 3,
- 		.bss_idx = mvif->mt76.idx,
- 		.start_tsf = cpu_to_le64(flow->tsf),
- 		.mantissa = flow->mantissa,
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
deleted file mode 100644
index 9e83ecf..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 6aa3a1fd535b382c7b5af1b811d0ead0d4b74509 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1119/1131] mt76: connac: airtime fairness feature off in
- mac80211
-
----
- mac80211.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/mac80211.c b/mac80211.c
-index 2e0e011..de9ef23 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -435,7 +435,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
- 			WIPHY_FLAG_AP_UAPSD;
- 
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
--	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_AIRTIME_FAIRNESS);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_AQL);
- 
- 	wiphy->available_antennas_tx = phy->antenna_mask;
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
deleted file mode 100644
index 7184f67..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ /dev/null
@@ -1,202 +0,0 @@
-From e57722d4c3513b72957e6bb61bb67a4feb70c80f Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1120/1131] mt76: mt7915: add mt7986 and mt7916 pre-calibration
-
-Add pre-calibration for mt7986 and mt7916. It has different data size
-with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
-respectively. DPD cal needs 300k.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/eeprom.c | 15 +++++------
- mt7915/eeprom.h |  1 +
- mt7915/mcu.c    | 72 ++++++++++++++++++++++++++++++++++++-------------
- 3 files changed, 62 insertions(+), 26 deletions(-)
-
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index a796289..55ba90a 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
- {
- 	struct mt76_dev *mdev = &dev->mt76;
- 	u8 *eeprom = mdev->eeprom.data;
--	u32 val = eeprom[MT_EE_DO_PRE_CAL];
--	u32 offs;
-+	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
-+	u32 size, val = eeprom[offs];
- 
--	if (!dev->flash_mode)
-+	if (!dev->flash_mode || !val)
- 		return 0;
- 
--	if (val != (MT_EE_WIFI_CAL_DPD | MT_EE_WIFI_CAL_GROUP))
--		return 0;
-+	size = mt7915_get_cal_group_size(dev) +
-+	       (is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2);
- 
--	val = MT_EE_CAL_GROUP_SIZE + MT_EE_CAL_DPD_SIZE;
--	dev->cal = devm_kzalloc(mdev->dev, val, GFP_KERNEL);
-+	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
- 	if (!dev->cal)
- 		return -ENOMEM;
- 
- 	offs = is_mt7915(&dev->mt76) ? MT_EE_PRECAL : MT_EE_PRECAL_V2;
- 
--	return mt76_get_of_eeprom(mdev, dev->cal, offs, val);
-+	return mt76_get_of_eeprom(mdev, dev->cal, offs, size);
- }
- 
- static int mt7915_check_eeprom(struct mt7915_dev *dev)
-diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 88aaa16..fdae347 100644
---- a/mt7915/eeprom.h
-+++ b/mt7915/eeprom.h
-@@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
- 	MT_EE_DDIE_FT_VERSION =	0x050,
- 	MT_EE_DO_PRE_CAL =	0x062,
- 	MT_EE_WIFI_CONF =	0x190,
-+	MT_EE_DO_PRE_CAL_V2 =	0x19a,
- 	MT_EE_RATE_DELTA_2G =	0x252,
- 	MT_EE_RATE_DELTA_5G =	0x29d,
- 	MT_EE_TX0_POWER_2G =	0x2fc,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2d363c4..4c64655 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2917,7 +2917,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
- int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
- {
- 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
--	u32 total = MT_EE_CAL_GROUP_SIZE;
-+	u32 total = mt7915_get_cal_group_size(dev);
-+	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
- 
- 	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
- 		return 0;
-@@ -2955,9 +2956,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
- 	return -1;
- }
- 
--static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
-+static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
- {
--	static const u16 freq_list[] = {
-+	const u16 freq_list_v1[] = {
- 		5180, 5200, 5220, 5240,
- 		5260, 5280, 5300, 5320,
- 		5500, 5520, 5540, 5560,
-@@ -2965,34 +2966,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
- 		5660, 5680, 5700, 5745,
- 		5765, 5785, 5805, 5825
- 	};
--	int offset_2g = ARRAY_SIZE(freq_list);
-+	const u16 freq_list_v2[] = {
-+		/* 6G BW20*/
-+		5955, 5975, 5995, 6015,
-+		6035, 6055, 6075, 6095,
-+		6115, 6135, 6155, 6175,
-+		6195, 6215, 6235, 6255,
-+		6275, 6295, 6315, 6335,
-+		6355, 6375, 6395, 6415,
-+		6435, 6455, 6475, 6495,
-+		6515, 6535, 6555, 6575,
-+		6595, 6615, 6635, 6655,
-+		6675, 6695, 6715, 6735,
-+		6755, 6775, 6795, 6815,
-+		6835, 6855, 6875, 6895,
-+		6915, 6935, 6955, 6975,
-+		6995, 7015, 7035, 7055,
-+		7075, 7095, 7115,
-+		/* 6G BW160 */
-+		6025, 6185, 6345, 6505,
-+		6665, 6825, 6985,
-+		/* 5G BW20 */
-+		5180, 5200, 5220, 5240,
-+		5260, 5280, 5300, 5320,
-+		5500, 5520, 5540, 5560,
-+		5580, 5600, 5620, 5640,
-+		5660, 5680, 5700, 5720,
-+		5745, 5765, 5785, 5805,
-+		5825, 5845, 5865, 5885,
-+		/* 5G BW160 */
-+		5250, 5570, 5815
-+	};
-+	const u16 *freq_list = freq_list_v1;
-+	int n_freqs = ARRAY_SIZE(freq_list_v1);
- 	int idx;
- 
-+	if (!is_mt7915(&dev->mt76)) {
-+		freq_list = freq_list_v2;
-+		n_freqs = ARRAY_SIZE(freq_list_v2);
-+	}
-+
- 	if (freq < 4000) {
- 		if (freq < 2432)
--			return offset_2g;
-+			return n_freqs;
- 		if (freq < 2457)
--			return offset_2g + 1;
-+			return n_freqs + 1;
- 
--		return offset_2g + 2;
-+		return n_freqs + 2;
- 	}
- 
--	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
-+	if (bw == NL80211_CHAN_WIDTH_80P80)
- 		return -1;
- 
- 	if (bw != NL80211_CHAN_WIDTH_20) {
--		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
--					   freq + 10);
-+		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq + 10);
- 		if (idx >= 0)
- 			return idx;
- 
--		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
--					   freq - 10);
-+		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq - 10);
- 		if (idx >= 0)
- 			return idx;
- 	}
- 
--	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
-+	return mt7915_find_freq_idx(freq_list, n_freqs, freq);
- }
- 
- int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3024,24 +3060,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
- 	if (!(eep[offs] & dpd_mask))
- 		return 0;
- 
--	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
-+	idx = mt7915_dpd_freq_idx(dev, center_freq, chandef->width);
- 	if (idx < 0)
- 		return -EINVAL;
- 
- 	/* Items: Tx DPD, Tx Flatness */
--	idx = idx * 2;
--	cal += MT_EE_CAL_GROUP_SIZE;
-+	idx = idx * cal_num;
-+	cal += mt7915_get_cal_group_size(dev) + (idx * MT_EE_CAL_UNIT);
- 
--	while (total--) {
-+	while (cal_num--) {
- 		int ret;
- 
--		cal += (idx * MT_EE_CAL_UNIT);
- 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
- 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
- 		if (ret)
- 			return ret;
- 
- 		idx++;
-+		cal += MT_EE_CAL_UNIT;
- 	}
- 
- 	return 0;
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
deleted file mode 100644
index 46f6a3e..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From e7f4f1cdee8c63f7e43a81e4ee538aada45c3b9b Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
-Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1121/1131] mt76: mt7915: add phy capability vendor command
-
----
- mt7915/mt7915.h |  1 +
- mt7915/vendor.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h | 25 ++++++++++++++++++++++++
- 3 files changed, 78 insertions(+)
-
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ab1efe6..e977e5c 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -11,6 +11,7 @@
- 
- #define MTK_DEBUG 1
- #define MT7915_MAX_INTERFACES		19
-+#define MT7915_MAX_BSS			16
- #define MT7915_WTBL_SIZE		288
- #define MT7916_WTBL_SIZE		544
- #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c755184..77d71e4 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
- 	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF] = { .type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+phy_capa_ctrl_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_CTRL] = {
-+	[MTK_VENDOR_ATTR_PHY_CAPA_CTRL_SET] = { .type = NLA_NESTED },
-+	[MTK_VENDOR_ATTR_PHY_CAPA_CTRL_DUMP] = { .type = NLA_NESTED },
-+};
-+
-+static const struct nla_policy
-+phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
-+	[MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_BSS] = { .type = NLA_U16 },
-+	[MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA] = { .type = NLA_U16 },
-+};
-+
- struct csi_null_tone {
- 	u8 start;
- 	u8 end;
-@@ -974,6 +986,35 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
- 	return 0;
- }
- 
-+static int
-+mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	void *a;
-+	int len = 0;
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	a = nla_nest_start(skb, MTK_VENDOR_ATTR_PHY_CAPA_CTRL_DUMP);
-+
-+	if (nla_put_u16(skb,
-+	    MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_BSS, MT7915_MAX_BSS) ||
-+	    nla_put_u16(skb,
-+	    MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA, MT7915_WTBL_STA))
-+		return -ENOMEM;
-+	len += 2;
-+
-+	nla_nest_end(skb, a);
-+
-+	return len;
-+}
-+
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -1031,6 +1072,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.doit = mt7915_vendor_hemu_ctrl,
- 		.policy = hemu_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.dumpit = mt7915_vendor_phy_capa_ctrl_dump,
-+		.policy = phy_capa_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf..719b851 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
- 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
-+	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
- };
- 
- enum mtk_capi_control_changed {
-@@ -149,4 +150,28 @@ enum mtk_vendor_attr_mnt_dump {
- 		NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
- };
- 
-+enum mtk_vendor_attr_phy_capa_ctrl {
-+	MTK_VENDOR_ATTR_PHY_CAPA_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_PHY_CAPA_CTRL_SET,
-+	MTK_VENDOR_ATTR_PHY_CAPA_CTRL_DUMP,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_PHY_CAPA_CTRL,
-+	MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_PHY_CAPA_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_phy_capa_dump {
-+	MTK_VENDOR_ATTR_PHY_CAPA_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_BSS,
-+	MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP,
-+	MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP - 1
-+};
-+
- #endif
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
deleted file mode 100644
index ef77644..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ /dev/null
@@ -1,380 +0,0 @@
-From 470a35f89bc43925f3ff9113a6541dcad2a6863e Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1122/1131] mt76: mt7915: add vendor subcmd EDCCA ctrl
- enable/threshold/compensation
-
-Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
----
- mt76_connac_mcu.h |   1 +
- mt7915/main.c     |   3 ++
- mt7915/mcu.c      |  72 +++++++++++++++++++++++++
- mt7915/mcu.h      |  21 ++++++++
- mt7915/mt7915.h   |   3 +-
- mt7915/vendor.c   | 132 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h   |  33 ++++++++++++
- 7 files changed, 264 insertions(+), 1 deletion(-)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 7853e07..88bfd09 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1200,6 +1200,7 @@ enum {
- 	MCU_EXT_CMD_SMESH_CTRL = 0xae,
- 	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
- 	MCU_EXT_CMD_CERT_CFG = 0xb7,
-+	MCU_EXT_CMD_EDCCA = 0xba,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- 	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
- };
-diff --git a/mt7915/main.c b/mt7915/main.c
-index eae1377..09cf35c 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -479,6 +479,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
- 			mutex_unlock(&dev->mt76.mutex);
- 		}
- #endif
-+		ret = mt7915_mcu_set_edcca(phy, EDCCA_CTRL_SET_EN, NULL, 0);
-+		if (ret)
-+			return ret;
- 		ieee80211_stop_queues(hw);
- 		ret = mt7915_set_channel(phy);
- 		if (ret)
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 4c64655..dddab7d 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -4593,3 +4593,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
- 
- 	return 0;
- }
-+
-+int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation)
-+{
-+	static const u8 ch_band[] = {
-+		[NL80211_BAND_2GHZ] = 0,
-+		[NL80211_BAND_5GHZ] = 1,
-+		[NL80211_BAND_6GHZ] = 2,
-+	};
-+	struct mt7915_dev *dev = phy->dev;
-+	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
-+	struct {
-+		u8 band_idx;
-+		u8 cmd_idx;
-+		u8 setting[3];
-+		bool record_in_fw;
-+		u8 region;
-+		s8 thres_compensation;
-+	} __packed req = {
-+		.band_idx = phy->mt76->band_idx,
-+		.cmd_idx = mode,
-+		.record_in_fw = false,
-+		.thres_compensation = compensation,
-+	};
-+
-+	if (ch_band[chandef->chan->band] == 2 && dev->mt76.region == NL80211_DFS_FCC)
-+		req.region = dev->mt76.region;
-+
-+	if (mode == EDCCA_CTRL_SET_EN) {
-+		req.setting[0] = (!value)? EDCCA_MODE_AUTO: value[0];
-+	} else if (mode == EDCCA_CTRL_SET_THERS) {
-+		req.setting[0] = value[0];
-+		req.setting[1] = value[1];
-+		req.setting[2] = value[2];
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
-+}
-+
-+
-+int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 band_idx;
-+		u8 cmd_idx;
-+		u8 setting[3];
-+		bool record_in_fw;
-+		u8 region;
-+		s8 thres_compensation;
-+	} __packed req = {
-+		.band_idx = phy->mt76->band_idx,
-+		.cmd_idx = mode,
-+		.record_in_fw = false,
-+	};
-+	struct sk_buff *skb;
-+	int ret;
-+	struct mt7915_mcu_edcca_info *res;
-+
-+	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req),
-+				        true, &skb);
-+	if (ret)
-+		return ret;
-+
-+	res = (struct mt7915_mcu_edcca_info *)skb->data;
-+	*value++ = res->info[0];
-+	*value++ = res->info[1];
-+	*value = res->info[2];
-+
-+	return 0;
-+}
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a30f52d..391aed9 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -1057,6 +1057,27 @@ enum {
-    MURU_DL_INIT,
-    MURU_UL_INIT,
- };
-+
-+enum {
-+   EDCCA_CTRL_SET_EN = 0,
-+   EDCCA_CTRL_SET_THERS,
-+   EDCCA_CTRL_GET_EN,
-+   EDCCA_CTRL_GET_THERS,
-+   EDCCA_CTRL_NUM,
-+};
-+
-+enum {
-+   EDCCA_MODE_FORCE_DISABLE,
-+   EDCCA_MODE_AUTO,
-+};
-+
-+struct mt7915_mcu_edcca_info {
-+	u8 cmd_idx;
-+	u8 band_idx;
-+	u8 info[3];
-+	u8 fginit;
-+	u8 rsv[2];
-+};
- #endif
- 
- #endif
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e977e5c..4c370bb 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -761,7 +761,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
- int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
- 				  struct ieee80211_sta *sta);
- #endif
--
-+int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
-+int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
- int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
- int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
- 
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e4..2484e25 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
- 	[MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA] = { .type = NLA_U16 },
- };
- 
-+static const struct nla_policy
-+edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_S8 },
-+};
-+
-+static const struct nla_policy
-+edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
-+       [MTK_VENDOR_ATTR_EDCCA_DUMP_MODE] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
-+};
-+
- struct csi_null_tone {
- 	u8 start;
- 	u8 end;
-@@ -1015,6 +1033,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
- 	return len;
- }
- 
-+static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
-+				  struct wireless_dev *wdev,
-+				  const void *data,
-+				  int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
-+	int err;
-+	u8 edcca_mode;
-+	s8 edcca_compensation;
-+	u8 edcca_value[EDCCA_THRES_NUM] = {0};
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_EDCCA_CTRL_MAX, data, data_len,
-+			edcca_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE])
-+		return -EINVAL;
-+
-+	edcca_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE]);
-+	if (edcca_mode == EDCCA_CTRL_SET_EN) {
-+		if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] ||
-+			!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE]) {
-+			return -EINVAL;
-+		}
-+		edcca_value[0] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL]);
-+		edcca_compensation =
-+			nla_get_s8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE]);
-+
-+		err = mt7915_mcu_set_edcca(phy, edcca_mode, edcca_value,
-+					   edcca_compensation);
-+		if (err)
-+			return err;
-+	} else if (edcca_mode == EDCCA_CTRL_SET_THERS) {
-+		if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] ||
-+		    !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] ||
-+		    !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL]) {
-+			return -EINVAL;
-+		}
-+		edcca_value[0] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL]);
-+		edcca_value[1] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL]);
-+		edcca_value[2] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL]);
-+		err = mt7915_mcu_set_edcca(phy, edcca_mode, edcca_value,
-+					   edcca_compensation);
-+		if (err)
-+			return err;
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
-+	int len = EDCCA_THRES_NUM;
-+	int err;
-+	u8 edcca_mode;
-+	s8 value[EDCCA_THRES_NUM];
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_EDCCA_CTRL_MAX, data, data_len,
-+			edcca_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE])
-+		return -EINVAL;
-+
-+	edcca_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE]);
-+	if (edcca_mode ==  EDCCA_CTRL_GET_EN || edcca_mode == EDCCA_CTRL_GET_THERS) {
-+		err = mt7915_mcu_get_edcca(phy, edcca_mode, value);
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	if (err)
-+		return err;
-+
-+	if (nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL, value[0]) ||
-+	    nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL, value[1]) ||
-+	    nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL, value[2]))
-+		return -ENOMEM;
-+
-+	return len;
-+}
-+
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -1083,6 +1203,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.dumpit = mt7915_vendor_phy_capa_ctrl_dump,
- 		.policy = phy_capa_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_edcca_ctrl,
-+		.dumpit = mt7915_vendor_edcca_ctrl_dump,
-+		.policy = edcca_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851..7231971 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -2,6 +2,7 @@
- #define __MT7915_VENDOR_H
- 
- #define MTK_NL80211_VENDOR_ID	0x0ce7
-+#define EDCCA_THRES_NUM 3
- 
- enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
-@@ -10,6 +11,38 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
- 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
-+	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
-+};
-+
-+
-+enum mtk_vendor_attr_edcca_ctrl {
-+        MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
-+
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
-+
-+        /* keep last */
-+        NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
-+                NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_edcca_dump {
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
-+
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
-+
-+        /* keep last */
-+        NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
-+                NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
- };
- 
- enum mtk_capi_control_changed {
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-implement-bin-file-mode.patch
deleted file mode 100644
index 3ba1ab7..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-implement-bin-file-mode.patch
+++ /dev/null
@@ -1,273 +0,0 @@
-From 57fecb7bb0f51f52b23727811f4d2a0612435911 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1123/1131] mt76: mt7915: implement bin file mode
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- eeprom.c             | 20 ++++++++++++++++++++
- mt76.h               |  3 +++
- mt7915/eeprom.c      | 36 +++++++++++++++++++++++++++++++++---
- mt7915/eeprom.h      |  7 +++++++
- mt7915/mt7915.h      |  9 ++++++---
- mt7915/mtk_debugfs.c | 41 +++++++++++++++++++++++++++++++++++++++++
- 6 files changed, 110 insertions(+), 6 deletions(-)
-
-diff --git a/eeprom.c b/eeprom.c
-index cb6ff17..05b6dfa 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -104,6 +104,26 @@ out_put_node:
- }
- EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
- 
-+bool mt76_check_bin_file_mode(struct mt76_dev *dev)
-+{
-+	struct device_node *np = dev->dev->of_node;
-+	const char *bin_file_name = NULL;
-+
-+	if (!np)
-+		return false;
-+
-+	of_property_read_string(np, "bin_file_name", &bin_file_name);
-+
-+	dev->bin_file_name = bin_file_name;
-+	if (dev->bin_file_name)
-+		dev_info(dev->dev, "Using bin file %s\n", dev->bin_file_name);
-+
-+	of_node_put(np);
-+
-+	return dev->bin_file_name ? true : false;
-+}
-+EXPORT_SYMBOL_GPL(mt76_check_bin_file_mode);
-+
- void
- mt76_eeprom_override(struct mt76_phy *phy)
- {
-diff --git a/mt76.h b/mt76.h
-index c6aefbf..9b6e806 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -894,9 +894,11 @@ struct mt76_dev {
- 		struct mt76_sdio sdio;
- 	};
- 
-+	/* for mtk internal */
- 	struct mt76_connac2_patch_hdr *patch_hdr;
- 	struct mt76_connac2_fw_trailer *wm_hdr;
- 	struct mt76_connac2_fw_trailer *wa_hdr;
-+	const char *bin_file_name;
- };
- 
- struct mt76_power_limits {
-@@ -1033,6 +1035,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
- int mt76_eeprom_init(struct mt76_dev *dev, int len);
- void mt76_eeprom_override(struct mt76_phy *phy);
- int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
-+bool mt76_check_bin_file_mode(struct mt76_dev *dev);
- 
- struct mt76_queue *
- mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 55ba90a..54803e8 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -45,8 +45,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
- 	}
- }
- 
--static char *mt7915_eeprom_name(struct mt7915_dev *dev)
-+const char *mt7915_eeprom_name(struct mt7915_dev *dev)
- {
-+	if (dev->bin_file_mode)
-+		return dev->mt76.bin_file_name;
-+
- 	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7915:
- 		return dev->dbdc_support ?
-@@ -84,7 +87,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
- 		return ret;
- 
- 	if (!fw || !fw->data) {
--		dev_err(dev->mt76.dev, "Invalid default bin\n");
-+		if (dev->bin_file_mode)
-+			dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
-+		else
-+			dev_err(dev->mt76.dev, "Invalid default bin\n");
- 		ret = -EINVAL;
- 		goto out;
- 	}
-@@ -109,6 +115,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 
- 	if (ret) {
- 		dev->flash_mode = true;
-+		dev->eeprom_mode = FLASH_MODE;
- 	} else {
- 		u8 free_block_num;
- 		u32 block_num, i;
-@@ -129,6 +136,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 			if (ret < 0)
- 				return ret;
- 		}
-+
-+		dev->eeprom_mode = EFUSE_MODE;
- 	}
- 
- 	return mt7915_check_eeprom(dev);
-@@ -234,12 +243,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
- {
- 	int ret;
- 
--	ret = mt7915_eeprom_load(dev);
-+	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
-+	if (dev->bin_file_mode) {
-+		dev->mt76.eeprom.size = mt7915_eeprom_size(dev);
-+		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
-+						     GFP_KERNEL);
-+		if (!dev->mt76.eeprom.data)
-+			return -ENOMEM;
-+		ret = mt7915_eeprom_load_default(dev);
-+		if (ret)
-+			return ret;
-+
-+		ret = mt7915_check_eeprom(dev);
-+		if (ret)
-+			return ret;
-+		dev->eeprom_mode = BIN_FILE_MODE;
-+	} else {
-+		ret = mt7915_eeprom_load(dev);
-+	}
-+
- 	if (ret < 0) {
- 		if (ret != -EINVAL)
- 			return ret;
- 
- 		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
-+		dev->bin_file_mode = false;
-+		dev->eeprom_mode = DEFAULT_BIN_MODE;
-+
- 		ret = mt7915_eeprom_load_default(dev);
- 		if (ret)
- 			return ret;
-diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index fdae347..9056d78 100644
---- a/mt7915/eeprom.h
-+++ b/mt7915/eeprom.h
-@@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
- 	MAX_SKU_RATE_GROUP_NUM,
- };
- 
-+enum mt7915_eeprom_mode {
-+	DEFAULT_BIN_MODE,
-+	EFUSE_MODE,
-+	FLASH_MODE,
-+	BIN_FILE_MODE,
-+};
-+
- static inline int
- mt7915_get_channel_group_5g(int channel, bool is_7976)
- {
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4c370bb..e5cfc77 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -42,9 +42,9 @@
- #define MT7986_ROM_PATCH		"mediatek/mt7986_rom_patch.bin"
- #define MT7986_ROM_PATCH_MT7975		"mediatek/mt7986_rom_patch_mt7975.bin"
- 
--#define MT7915_EEPROM_DEFAULT		"mediatek/mt7915_eeprom.bin"
--#define MT7915_EEPROM_DEFAULT_DBDC	"mediatek/mt7915_eeprom_dbdc.bin"
--#define MT7916_EEPROM_DEFAULT		"mediatek/mt7916_eeprom.bin"
-+#define MT7915_EEPROM_DEFAULT			"mediatek/mt7915_eeprom.bin"
-+#define MT7915_EEPROM_DEFAULT_DBDC		"mediatek/mt7915_eeprom_dbdc.bin"
-+#define MT7916_EEPROM_DEFAULT			"mediatek/mt7916_eeprom.bin"
- #define MT7986_EEPROM_MT7975_DEFAULT		"mediatek/mt7986_eeprom_mt7975.bin"
- #define MT7986_EEPROM_MT7975_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7975_dual.bin"
- #define MT7986_EEPROM_MT7976_DEFAULT		"mediatek/mt7986_eeprom_mt7976.bin"
-@@ -400,6 +400,8 @@ struct mt7915_dev {
- 
- 	bool dbdc_support;
- 	bool flash_mode;
-+	bool bin_file_mode;
-+	u8 eeprom_mode;
- 	bool muru_debug;
- 	bool ibf;
- 
-@@ -774,6 +776,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
- int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
- void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
- int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
-+const char *mt7915_eeprom_name(struct mt7915_dev *dev);
- 
- #define PKT_BIN_DEBUG_MAGIC	0xc8763123
- enum {
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index a2ceb6f..7567666 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -3,6 +3,7 @@
- #include "mt7915_debug.h"
- #include "mac.h"
- #include "mcu.h"
-+#include "eeprom.h"
- 
- #ifdef MTK_DEBUG
- #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
-@@ -2924,6 +2925,44 @@ mt7915_wa_debug(void *data, u64 val)
- DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
- 			 "0x%llx\n");
- 
-+static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	struct mt76_dev *mdev = &dev->mt76;
-+#ifdef CONFIG_NL80211_TESTMODE
-+	const char *mtd_name = mdev->test_mtd.name;
-+	u32 mtd_offset = mdev->test_mtd.offset;
-+#else
-+	const char *mtd_name = NULL;
-+	u32 mtd_offset;
-+#endif
-+
-+	seq_printf(s, "Current eeprom mode:\n");
-+
-+	switch (dev->eeprom_mode) {
-+	case DEFAULT_BIN_MODE:
-+		seq_printf(s, "   default bin mode\n   filename = %s\n", mt7915_eeprom_name(dev));
-+		break;
-+	case EFUSE_MODE:
-+		seq_printf(s, "   efuse mode\n");
-+		break;
-+	case FLASH_MODE:
-+		if (mtd_name)
-+			seq_printf(s, "   flash mode\n   mtd name = %s\n   flash offset = 0x%x\n",
-+				   mtd_name, mtd_offset);
-+		else
-+			seq_printf(s, "   flash mode\n");
-+		break;
-+	case BIN_FILE_MODE:
-+		seq_printf(s, "   bin file mode\n   filename = %s\n", mt7915_eeprom_name(dev));
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- {
- 	struct mt7915_dev *dev = phy->dev;
-@@ -3009,6 +3048,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
- 				    mt7915_dump_version);
- 
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
-+				    mt7915_show_eeprom_mode);
- 	return 0;
- }
- #endif
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-initialize-wcid.patch
deleted file mode 100644
index 2001d10..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-initialize-wcid.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 380d2c824b4cd4792a33c9fff30f5f7a55fbce43 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1124/1131] mt76: mt7915: initialize wcid
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- mt7915/mac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 013dfbd..9d4cfa1 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -1032,7 +1032,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
- 		info = le32_to_cpu(*cur_info);
- 		if (info & MT_TX_FREE_PAIR) {
- 			struct mt7915_sta *msta;
--			struct mt76_wcid *wcid;
-+			struct mt76_wcid *wcid = NULL;
- 			u16 idx;
- 
- 			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-Add-hemu-dump-support.patch
deleted file mode 100644
index 11d6764..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-Add-hemu-dump-support.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 5b7b1ad75275431f2a3981445ecb122296e6033c Mon Sep 17 00:00:00 2001
-From: TomLiu <tomml.liu@mediatek.com>
-Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1125/1131] mt76: mt7915: Add hemu dump support
-
-Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
----
- mt7915/vendor.c | 25 +++++++++++++++++++++++++
- mt7915/vendor.h |  1 +
- 2 files changed, 26 insertions(+)
-
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 2484e25..f7becce 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
- static const struct nla_policy
- hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
- 	[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
- };
- 
- static const struct nla_policy
-@@ -1004,6 +1005,29 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
- 	return 0;
- }
- 
-+
-+static int
-+mt7915_vendor_hemu_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	int len = 0;
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	if (nla_put_u8(skb, MTK_VENDOR_ATTR_HEMU_CTRL_DUMP, dev->dbg.muru_onoff))
-+		return -ENOMEM;
-+	len += 1;
-+
-+	return len;
-+}
-+
-+
- static int
- mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
- 			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1190,6 +1214,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
- 			WIPHY_VENDOR_CMD_NEED_RUNNING,
- 		.doit = mt7915_vendor_hemu_ctrl,
-+		.dumpit = mt7915_vendor_hemu_ctrl_dump,
- 		.policy = hemu_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
- 	},
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 7231971..c19ffe7 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
- 	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
- 
- 	MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
-+	MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
- 
- 	/* keep last */
- 	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
deleted file mode 100644
index 2a83b0d..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ /dev/null
@@ -1,272 +0,0 @@
-From da5f1ee9d19099b72b349a259e553db74954db59 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1126/1131] mt76: mt7915: add vendor subcmd three wire (PTA)
- ctrl
-
-Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt76_connac_mcu.h |  2 +-
- mt7915/mcu.c      | 50 ++++++++++++++++++++++-------------------------
- mt7915/mcu.h      | 29 +++++++++++++++++++++++++++
- mt7915/mt7915.h   |  1 +
- mt7915/vendor.c   | 44 ++++++++++++++++++++++++++++++++++++++++-
- mt7915/vendor.h   | 14 +++++++++++++
- 6 files changed, 111 insertions(+), 29 deletions(-)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 88bfd09..5cff1a4 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1199,7 +1199,7 @@ enum {
- 	/* for vendor csi and air monitor */
- 	MCU_EXT_CMD_SMESH_CTRL = 0xae,
- 	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
--	MCU_EXT_CMD_CERT_CFG = 0xb7,
-+	MCU_EXT_CMD_SET_CFG = 0xb7,
- 	MCU_EXT_CMD_EDCCA = 0xba,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- 	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index dddab7d..36a33f6 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -4272,37 +4272,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
- 			&req, sizeof(req), false);
- }
- 
--void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type)
-+int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
- {
--#define CFGINFO_CERT_CFG 4
- 	struct mt7915_dev *dev = phy->dev;
--	struct {
--		struct basic_info{
--			u8 dbdc_idx;
--			u8 rsv[3];
--			__le32 tlv_num;
--			u8 tlv_buf[0];
--		} hdr;
--		struct cert_cfg{
--			__le16 tag;
--			__le16 length;
--			u8 cert_program;
--			u8 rsv[3];
--		} tlv;
--	} req = {
--		.hdr = {
--			.dbdc_idx = phy != &dev->phy,
--			.tlv_num = cpu_to_le32(1),
--		},
--		.tlv = {
--			.tag = cpu_to_le16(CFGINFO_CERT_CFG),
--			.length = cpu_to_le16(sizeof(struct cert_cfg)),
--			.cert_program = type, /* 1: CAPI Enable */
--		}
-+	struct cfg_basic_info req = {
-+		.dbdc_idx = phy != &dev->phy,
-+		.tlv_num = cpu_to_le32(1),
- 	};
-+	int tlv_len;
-+
-+	switch (cfg_info) {
-+	case CFGINFO_CERT_CFG:
-+		tlv_len = sizeof(struct cert_cfg);
-+		req.cert.tag = cpu_to_le16(cfg_info);
-+		req.cert.length = cpu_to_le16(tlv_len);
-+		req.cert.cert_program = type;
-+		break;
-+	case CFGINFO_3WIRE_EN_CFG:
-+		tlv_len = sizeof(struct three_wire_cfg);
-+		req.three_wire.tag = cpu_to_le16(cfg_info);
-+		req.three_wire.length = cpu_to_le16(tlv_len);
-+		req.three_wire.three_wire_en = type;
-+		break;
-+	default:
-+		return -EOPNOTSUPP;
-+	}
- 
--	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CERT_CFG),
--			  &req, sizeof(req), false);
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_CFG), &req, sizeof(req), false);
- }
- 
- void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 391aed9..025a03b 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -846,6 +846,35 @@ struct mt7915_mcu_rdd_ipi_scan {
- 	u8 tx_assert_time;						/* unit: us */
- } __packed;
- 
-+struct cert_cfg {
-+	__le16 tag;
-+	__le16 length;
-+	u8 cert_program;
-+	u8 rsv[3];
-+} __packed;
-+
-+struct three_wire_cfg {
-+	__le16 tag;
-+	__le16 length;
-+	u8 three_wire_en;
-+	u8 rsv[3];
-+} __packed;
-+
-+struct cfg_basic_info {
-+	u8 dbdc_idx;
-+	u8 rsv[3];
-+	__le32 tlv_num;
-+	union {
-+		struct cert_cfg cert;
-+		struct three_wire_cfg three_wire;
-+	};
-+} __packed;
-+
-+enum {
-+	CFGINFO_CERT_CFG = 4,
-+	CFGINFO_3WIRE_EN_CFG = 10,
-+};
-+
- /* MURU */
- #define OFDMA_DL                       BIT(0)
- #define OFDMA_UL                       BIT(1)
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e5cfc77..b9b86b8 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -755,6 +755,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
- void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
- int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
- void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
-+int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type);
- void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val);
- void mt7915_vendor_register(struct mt7915_phy *phy);
- int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index f7becce..fb760e1 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
- 	[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
-+	[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
-+};
-+
- static const struct nla_policy
- rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
- 	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
-@@ -971,7 +976,7 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
- 			mt7915_set_wireless_vif, &val32);
- 	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]) {
- 		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
--		mt7915_mcu_set_cert(phy, val8); /* Cert Enable for OMI */
-+		mt7915_mcu_set_cfg(phy, CFGINFO_CERT_CFG, val8); /* Cert Enable for OMI */
- 		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
- 	}
- 
-@@ -1116,6 +1121,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
- 	return 0;
- }
- 
-+
- static int
- mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
- 			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1159,6 +1165,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
- 	return len;
- }
- 
-+static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
-+				    struct wireless_dev *wdev,
-+				    const void *data,
-+				    int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL];
-+	int err;
-+	u8 three_wire_mode;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_3WIRE_CTRL_MAX, data, data_len,
-+			three_wire_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE])
-+		return -EINVAL;
-+
-+	three_wire_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE]);
-+
-+	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
-+}
-+
-+
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -1240,6 +1271,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.dumpit = mt7915_vendor_edcca_ctrl_dump,
- 		.policy = edcca_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_3wire_ctrl,
-+		.policy = three_wire_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index c19ffe7..d96e5c2 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -12,6 +12,7 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
- 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
- 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
-+	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
- };
- 
- 
-@@ -31,6 +32,7 @@ enum mtk_vendor_attr_edcca_ctrl {
-                 NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
- };
- 
-+
- enum mtk_vendor_attr_edcca_dump {
-         MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
- 
-@@ -45,6 +47,18 @@ enum mtk_vendor_attr_edcca_dump {
-                 NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
- };
- 
-+enum mtk_vendor_attr_3wire_ctrl {
-+	MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
-+	MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
-+};
-+
-+
- enum mtk_capi_control_changed {
- 	CAPI_RFEATURE_CHANGED		= BIT(16),
- 	CAPI_WIRELESS_CHANGED		= BIT(17),
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
deleted file mode 100644
index f5a487e..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 1c77eafd5da4591caf20235cf716734e2319cd1c Mon Sep 17 00:00:00 2001
-From: mtk27835 <shurong.wen@mediatek.com>
-Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1127/1131] mt76: mt7915: add ibf control vendor cmd
-
-Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
----
- mt7915/vendor.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h | 25 ++++++++++++++++++-
- 2 files changed, 89 insertions(+), 1 deletion(-)
-
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index fb760e1..22af66d 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
-        [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
-+	[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
-+};
-+
- struct csi_null_tone {
- 	u8 start;
- 	u8 end;
-@@ -1189,6 +1194,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
- 	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
- }
- 
-+static int mt7915_vendor_ibf_ctrl(struct wiphy *wiphy,
-+				  struct wireless_dev *wdev,
-+				  const void *data,
-+				  int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_IBF_CTRL];
-+	int err;
-+	u8 val;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_IBF_CTRL_MAX, data, data_len,
-+			ibf_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (tb[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE]) {
-+		val = nla_get_u8(tb[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE]);
-+
-+		dev->ibf = !!val;
-+
-+		err = mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
-+		if (err)
-+			return err;
-+	}
-+	return 0;
-+}
-+
-+static int
-+mt7915_vendor_ibf_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	if (nla_put_u8(skb, MTK_VENDOR_ATTR_IBF_DUMP_ENABLE, dev->ibf))
-+		return -ENOMEM;
-+
-+	return 1;
-+}
-+
- 
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
-@@ -1282,6 +1335,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.doit = mt7915_vendor_3wire_ctrl,
- 		.policy = three_wire_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_ibf_ctrl,
-+		.dumpit = mt7915_vendor_ibf_ctrl_dump,
-+		.policy = ibf_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_IBF_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index d96e5c2..949c885 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -12,7 +12,8 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
- 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
- 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
--	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
-+	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
-+	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
- };
- 
- 
-@@ -222,4 +223,26 @@ enum mtk_vendor_attr_phy_capa_dump {
- 		NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP - 1
- };
- 
-+enum mtk_vendor_attr_ibf_ctrl {
-+	MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
-+	MTK_VENDOR_ATTR_IBF_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_ibf_dump {
-+	MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
-+	MTK_VENDOR_ATTR_IBF_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
-+};
-+
- #endif
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
deleted file mode 100644
index b5c2d81..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From e7ed3dabb5b29e6a8d8d244d2fb9bd4a7a36a562 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1128/1131] mt76: mt7915: add E3 re-bonding for low yield rate
- issue
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7915/eeprom.c | 27 ++++++++++++++++++++++++++-
- mt7915/mcu.c    | 13 ++++++++++---
- mt7915/mt7915.h |  3 ++-
- 3 files changed, 38 insertions(+), 5 deletions(-)
-
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 54803e8..849275e 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -132,7 +132,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 		/* read eeprom data from efuse */
- 		block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
- 		for (i = 0; i < block_num; i++) {
--			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size);
-+			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size, NULL);
- 			if (ret < 0)
- 				return ret;
- 		}
-@@ -239,6 +239,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
- 	dev->chainshift = hweight8(dev->mphy.chainmask);
- }
- 
-+void mt7915_eeprom_rebonding(struct mt7915_dev *dev)
-+{
-+#define MT7976_ADIE_MASK			BIT(1)
-+#define MT7986_ADIE1_EFFUSE_OFFSET		0x1000
-+#define MT7986_ADIE1_MT7976C_OFFSET		0x270
-+#define MT7986_ADIE1_E3_OFFSET			0x271
-+	u32 adie_offset, sku = mt7915_check_adie(dev, true);
-+	u8 read_buf, *eeprom = dev->mt76.eeprom.data;
-+
-+	if (!(sku & MT7976_ADIE_MASK))
-+		return;
-+
-+	adie_offset = (sku == MT7976_DUAL_ADIE) ? MT7986_ADIE1_EFFUSE_OFFSET : 0;
-+
-+	/* 7976 A-Die, To identify MT7976C */
-+	mt7915_mcu_get_eeprom(dev, MT7986_ADIE1_MT7976C_OFFSET + adie_offset, &read_buf);
-+	eeprom[MT7986_ADIE1_MT7976C_OFFSET] = read_buf;
-+
-+	/* E3 re-binding */
-+	mt7915_mcu_get_eeprom(dev, MT7986_ADIE1_E3_OFFSET + adie_offset, &read_buf);
-+	eeprom[MT7986_ADIE1_E3_OFFSET] = read_buf;
-+}
-+
- int mt7915_eeprom_init(struct mt7915_dev *dev)
- {
- 	int ret;
-@@ -275,6 +298,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
- 			return ret;
- 	}
- 
-+	mt7915_eeprom_rebonding(dev);
-+
- 	ret = mt7915_eeprom_load_precal(dev);
- 	if (ret)
- 		return ret;
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 36a33f6..cb47ae6 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2836,7 +2836,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
- 				 &req, sizeof(req), true);
- }
- 
--int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
-+int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
- {
- 	struct mt7915_mcu_eeprom_info req = {
- 		.addr = cpu_to_le32(round_down(offset,
-@@ -2854,8 +2854,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
- 		return ret;
- 
- 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
--	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
--	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
-+
-+	if (read_buf) {
-+		u32 offs = offset % MT7915_EEPROM_BLOCK_SIZE;
-+		*read_buf = res->data[offs];
-+	} else {
-+		buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
-+		memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
-+	}
-+
- 	dev_kfree_skb(skb);
- 
- 	return 0;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b9b86b8..ab81d41 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -556,6 +556,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
- 
- int mt7915_register_device(struct mt7915_dev *dev);
- void mt7915_unregister_device(struct mt7915_dev *dev);
-+void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
- int mt7915_eeprom_init(struct mt7915_dev *dev);
- void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
- 				struct mt7915_phy *phy);
-@@ -610,7 +611,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
- 				   struct ieee80211_sta *sta,
- 				   void *data, u32 field);
- int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
--int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
-+int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf);
- int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
- int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
- 		       bool hdr_trans);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
deleted file mode 100644
index 6128624..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 413d06c543e77b9d0acf7e75819a62a068a5359e Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1129/1131] mt76: mt7915: support on off SW ACI through debugfs
-
-Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
----
- mt76_connac_mcu.h    |  1 +
- mt7915/mtk_debugfs.c | 21 +++++++++++++++++++++
- 2 files changed, 22 insertions(+)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5cff1a4..98b0074 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1201,6 +1201,7 @@ enum {
- 	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
- 	MCU_EXT_CMD_SET_CFG = 0xb7,
- 	MCU_EXT_CMD_EDCCA = 0xba,
-+	MCU_EXT_CMD_SWLNA_ACI_CTRL = 0xc0,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- 	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
- };
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 7567666..19cc8cb 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -2963,6 +2963,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
- 	return 0;
- }
- 
-+static int
-+mt7915_sw_aci_set(void *data, u64 val)
-+{
-+#define SWLNA_ENABLE 6
-+	struct mt7915_dev *dev = data;
-+	struct {
-+		u32 subcmd;
-+		u8 enable;
-+	} req = {
-+		.subcmd = SWLNA_ENABLE,
-+		.enable = (u8) val,
-+	};
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SWLNA_ACI_CTRL), &req, sizeof(req), NULL);
-+}
-+
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_sw_aci, NULL,
-+			 mt7915_sw_aci_set, "%llx\n");
-+
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- {
- 	struct mt7915_dev *dev = phy->dev;
-@@ -3050,6 +3069,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- 
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
- 				    mt7915_show_eeprom_mode);
-+	debugfs_create_file("sw_aci", 0600, dir, dev,
-+			    &fops_sw_aci);
- 	return 0;
- }
- #endif
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
deleted file mode 100644
index 2b7daf1..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ /dev/null
@@ -1,425 +0,0 @@
-From cc6ed7205f43ca7da22cf2dba1697f4cae0780b1 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1130/1131] mt76: mt7915: add bf backoff limit table support
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- eeprom.c         |  25 +++++++++-
- mt76.h           |   8 +++
- mt7915/debugfs.c |  73 ++++++++++++++++++++++++++--
- mt7915/mcu.c     | 124 +++++++++++++++++++++++++++++++++++------------
- mt7915/mcu.h     |   6 +++
- mt7915/mt7915.h  |   4 +-
- 6 files changed, 203 insertions(+), 37 deletions(-)
-
-diff --git a/eeprom.c b/eeprom.c
-index 05b6dfa..d161264 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -310,7 +310,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
- 	if (!mcs_rates)
- 		mcs_rates = 10;
- 
--	memset(dest, target_power, sizeof(*dest));
-+	memset(dest, target_power, sizeof(*dest) - sizeof(dest->path));
-+	memset(&dest->path, 0, sizeof(dest->path));
- 
- 	if (!IS_ENABLED(CONFIG_OF))
- 		return target_power;
-@@ -363,6 +364,28 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
- 				     ARRAY_SIZE(dest->ru), val, len,
- 				     target_power, txs_delta, &max_power);
- 
-+	val = mt76_get_of_array(np, "paths-cck", &len, ARRAY_SIZE(dest->path.cck));
-+	mt76_apply_array_limit(dest->path.cck, ARRAY_SIZE(dest->path.cck), val,
-+			       target_power, txs_delta, &max_power);
-+
-+	val = mt76_get_of_array(np, "paths-ofdm", &len, ARRAY_SIZE(dest->path.ofdm));
-+	mt76_apply_array_limit(dest->path.ofdm, ARRAY_SIZE(dest->path.ofdm), val,
-+			       target_power, txs_delta, &max_power);
-+
-+	val = mt76_get_of_array(np, "paths-ofdm-bf", &len, ARRAY_SIZE(dest->path.ofdm_bf));
-+	mt76_apply_array_limit(dest->path.ofdm_bf, ARRAY_SIZE(dest->path.ofdm_bf), val,
-+			       target_power, txs_delta, &max_power);
-+
-+	val = mt76_get_of_array(np, "paths-ru", &len, ARRAY_SIZE(dest->path.ru[0]) + 1);
-+	mt76_apply_multi_array_limit(dest->path.ru[0], ARRAY_SIZE(dest->path.ru[0]),
-+				     ARRAY_SIZE(dest->path.ru), val, len,
-+				     target_power, txs_delta, &max_power);
-+
-+	val = mt76_get_of_array(np, "paths-ru-bf", &len, ARRAY_SIZE(dest->path.ru_bf[0]) + 1);
-+	mt76_apply_multi_array_limit(dest->path.ru_bf[0], ARRAY_SIZE(dest->path.ru_bf[0]),
-+				     ARRAY_SIZE(dest->path.ru_bf), val, len,
-+				     target_power, txs_delta, &max_power);
-+
- 	return max_power;
- }
- EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
-diff --git a/mt76.h b/mt76.h
-index 9b6e806..c81ece0 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -906,6 +906,14 @@ struct mt76_power_limits {
- 	s8 ofdm[8];
- 	s8 mcs[4][10];
- 	s8 ru[7][12];
-+
-+	struct {
-+		s8 cck[4];
-+		s8 ofdm[4];
-+		s8 ofdm_bf[4];
-+		s8 ru[7][10];
-+		s8 ru_bf[7][10];
-+	} path;
- };
- 
- struct mt76_ethtool_worker_info {
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f1f3f2f..3ef2148 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -1024,7 +1024,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
- 	if (!buf)
- 		return -ENOMEM;
- 
--	ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr));
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr), TX_POWER_INFO_RATE);
- 	if (ret)
- 		goto out;
- 
-@@ -1134,7 +1134,7 @@ mt7915_rate_txpower_set(struct file *file, const char __user *user_buf,
- 
- 	mutex_lock(&dev->mt76.mutex);
- 	ret = mt7915_mcu_get_txpower_sku(phy, req.txpower_sku,
--					 sizeof(req.txpower_sku));
-+					 sizeof(req.txpower_sku), TX_POWER_INFO_RATE);
- 	if (ret)
- 		goto out;
- 
-@@ -1176,7 +1176,7 @@ out:
- 	return ret ? ret : count;
- }
- 
--static const struct file_operations mt7915_rate_txpower_fops = {
-+static const struct file_operations mt7915_txpower_fops = {
- 	.write = mt7915_rate_txpower_set,
- 	.read = mt7915_rate_txpower_get,
- 	.open = simple_open,
-@@ -1184,6 +1184,69 @@ static const struct file_operations mt7915_rate_txpower_fops = {
- 	.llseek = default_llseek,
- };
- 
-+static int
-+mt7915_path_txpower_show(struct seq_file *file)
-+{
-+	struct mt7915_phy *phy = file->private;
-+	s8 txpower[MT7915_SKU_PATH_NUM], *buf = txpower;
-+	int ret;
-+
-+#define PATH_POWER_SHOW(_name, _len, _skip) do {				\
-+		if (_skip) {						\
-+			buf -= 1;					\
-+			*buf = 0;					\
-+		}							\
-+		mt76_seq_puts_array(file, _name, buf, _len);		\
-+		buf += _len;						\
-+	} while(0)
-+
-+	seq_printf(file, "\n%*c", 11, ' ');
-+	seq_printf(file, "1T1S/2T1S/3T1S/4T1S/2T2S/3T2S/4T2S/3T3S/4T3S/4T4S\n");
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower),
-+					 TX_POWER_INFO_PATH);
-+	if (ret)
-+		return ret;
-+
-+	PATH_POWER_SHOW("CCK", 4, 0);
-+	PATH_POWER_SHOW("OFDM", 4, 0);
-+	PATH_POWER_SHOW("BF-OFDM", 4, 1);
-+
-+	PATH_POWER_SHOW("HT20", 10, 0);
-+	PATH_POWER_SHOW("BF-HT20", 10, 1);
-+	PATH_POWER_SHOW("HT40", 10, 0);
-+	PATH_POWER_SHOW("BF-HT40", 10, 1);
-+
-+	PATH_POWER_SHOW("RU242", 10, 0);
-+	PATH_POWER_SHOW("BF-RU242", 10, 1);
-+	PATH_POWER_SHOW("RU484", 10, 0);
-+	PATH_POWER_SHOW("BF-RU484", 10, 1);
-+	PATH_POWER_SHOW("RU996", 10, 0);
-+	PATH_POWER_SHOW("BF-RU996", 10, 1);
-+	PATH_POWER_SHOW("RU2x996", 10, 0);
-+	PATH_POWER_SHOW("BF-RU2x996", 10, 1);
-+	PATH_POWER_SHOW("RU26", 10, 0);
-+	PATH_POWER_SHOW("BF-RU26", 10, 0);
-+	PATH_POWER_SHOW("RU52", 10, 0);
-+	PATH_POWER_SHOW("BF-RU52", 10, 0);
-+	PATH_POWER_SHOW("RU106", 10, 0);
-+	PATH_POWER_SHOW("BF-RU106", 10, 0);
-+#undef PATH_POWER_SHOW
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_txpower_path_show(struct seq_file *file, void *data)
-+{
-+	struct mt7915_phy *phy = file->private;
-+
-+	seq_printf(file, "\nBand %d\n", phy != &phy->dev->phy);
-+
-+	return mt7915_path_txpower_show(file);
-+}
-+
-+DEFINE_SHOW_ATTRIBUTE(mt7915_txpower_path);
-+
- static int
- mt7915_twt_stats(struct seq_file *s, void *data)
- {
-@@ -1270,7 +1333,9 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
- 	debugfs_create_file("implicit_txbf", 0600, dir, dev,
- 			    &fops_implicit_txbf);
- 	debugfs_create_file("txpower_sku", 0400, dir, phy,
--			    &mt7915_rate_txpower_fops);
-+			    &mt7915_txpower_fops);
-+	debugfs_create_file("txpower_path", 0400, dir, phy,
-+			    &mt7915_txpower_path_fops);
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
- 				    mt7915_twt_stats);
- 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index cb47ae6..d380811 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3281,7 +3281,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
- 	int ret;
- 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
- 
--	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku),
-+					 TX_POWER_INFO_RATE);
- 	if (ret)
- 		return ret;
- 
-@@ -3323,51 +3324,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
- 
- int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
- {
-+#define TX_POWER_LIMIT_TABLE_RATE	0
-+#define TX_POWER_LIMIT_TABLE_PATH	1
- 	struct mt7915_dev *dev = phy->dev;
- 	struct mt76_phy *mphy = phy->mt76;
- 	struct ieee80211_hw *hw = mphy->hw;
--	struct mt7915_mcu_txpower_sku req = {
-+	struct mt7915_sku_val {
-+		u8 format_id;
-+		u8 limit_type;
-+		u8 band_idx;
-+	} __packed hdr = {
- 		.format_id = TX_POWER_LIMIT_TABLE,
-+		.limit_type = TX_POWER_LIMIT_TABLE_RATE,
- 		.band_idx = phy->mt76->band_idx,
- 	};
--	struct mt76_power_limits limits_array;
--	s8 *la = (s8 *)&limits_array;
--	int i, idx;
--	int tx_power;
-+	int i, ret, tx_power;
-+	const u8 *len = mt7915_sku_group_len;
-+	struct mt76_power_limits la = {};
-+	struct sk_buff *skb;
- 
- 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
- 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
--					      &limits_array, tx_power);
-+					      &la, tx_power);
- 	mphy->txpower_cur = tx_power;
- 
--	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
--		u8 mcs_num, len = mt7915_sku_group_len[i];
--		int j;
-+	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
-+				 sizeof(hdr) + MT7915_SKU_RATE_NUM);
-+	if (!skb)
-+		return -ENOMEM;
- 
--		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
--			mcs_num = 10;
-+	skb_put_data(skb, &hdr, sizeof(hdr));
-+	skb_put_data(skb, &la.cck, len[SKU_CCK] + len[SKU_OFDM]);
-+	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
-+	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
- 
--			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
--				la = (s8 *)&limits_array + 12;
--		} else {
--			mcs_num = len;
--		}
-+	/* vht */
-+	for (i = 0; i < 4; i++) {
-+		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
-+		skb_put_zero(skb, 2);  /* padding */
-+	}
- 
--		for (j = 0; j < min_t(u8, mcs_num, len); j++)
--			req.txpower_sku[idx + j] = la[j];
-+	/* he */
-+	skb_put_data(skb, &la.ru[0], sizeof(la.ru));
- 
--		la += mcs_num;
--		idx += len;
-+	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
-+				    MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
-+	if (ret)
-+		return ret;
-+
-+	/* only set per-path power table when it's configured */
-+	if (!la.path.ofdm[0])
-+		return 0;
-+
-+	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
-+				 sizeof(hdr) + MT7915_SKU_PATH_NUM);
-+	if (!skb)
-+		return -ENOMEM;
-+
-+	hdr.limit_type = TX_POWER_LIMIT_TABLE_PATH;
-+	skb_put_data(skb, &hdr, sizeof(hdr));
-+	skb_put_data(skb, &la.path.cck, sizeof(la.path.cck));
-+	skb_put_data(skb, &la.path.ofdm, sizeof(la.path.ofdm));
-+	skb_put_data(skb, &la.path.ofdm_bf[1], sizeof(la.path.ofdm_bf) - 1);
-+
-+	/* HT20 and HT40 */
-+	skb_put_data(skb, &la.path.ru[0], sizeof(la.path.ru[0]));
-+	skb_put_data(skb, &la.path.ru_bf[0][1], sizeof(la.path.ru_bf[0]) - 1);
-+	skb_put_data(skb, &la.path.ru[1], sizeof(la.path.ru[1]));
-+	skb_put_data(skb, &la.path.ru_bf[1][1], sizeof(la.path.ru_bf[1]) - 1);
-+
-+	/* start from non-bf and bf fields of
-+	 * BW20/RU242, BW40/RU484, BW80/RU996, BW160/RU2x996,
-+	 * RU26, RU52, and RU106
-+	 */
-+	for (i = 7; i < 21; i++) {
-+		bool bf = !(i % 2);
-+		u8 idx = (i - 7) / 2;
-+		s8 *buf = bf ? la.path.ru_bf[idx] : la.path.ru[idx];
-+
-+		/* The non-bf fields of RU26 to RU106 are special cases */
-+		if (bf && i < 15)
-+			skb_put_data(skb, buf + 1, 9);
-+		else
-+			skb_put_data(skb, buf, 10);
- 	}
- 
--	return mt76_mcu_send_msg(&dev->mt76,
--				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
--				 sizeof(req), true);
-+	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
-+				     MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
- }
- 
--int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
-+int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
-+			       u8 category)
- {
--#define RATE_POWER_INFO	2
- 	struct mt7915_dev *dev = phy->dev;
- 	struct {
- 		u8 format_id;
-@@ -3376,10 +3424,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
- 		u8 _rsv;
- 	} __packed req = {
- 		.format_id = TX_POWER_LIMIT_INFO,
--		.category = RATE_POWER_INFO,
-+		.category = category,
- 		.band_idx = phy->mt76->band_idx,
- 	};
--	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
- 	struct sk_buff *skb;
- 	int ret, i;
- 
-@@ -3389,9 +3436,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
- 	if (ret)
- 		return ret;
- 
--	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
--	for (i = 0; i < len; i++)
--		txpower[i] = txpower_sku[i][req.band_idx];
-+	if (category == TX_POWER_INFO_RATE) {
-+		s8 res[MT7915_SKU_RATE_NUM][2];
-+
-+		memcpy(res, skb->data + 4, sizeof(res));
-+		for (i = 0; i < len; i++)
-+			txpower[i] = res[i][req.band_idx];
-+	} else if (category == TX_POWER_INFO_PATH) {
-+		memcpy(txpower, skb->data + 4, len);
-+	}
- 
- 	dev_kfree_skb(skb);
- 
-@@ -3433,9 +3486,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
- 		.band_idx = phy->mt76->band_idx,
- 		.sku_enable = enable,
- 	};
-+	int ret;
-+
-+	ret = mt76_mcu_send_msg(&dev->mt76,
-+				MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
-+				sizeof(req), true);
-+	if (ret)
-+		return ret;
- 
- 	pr_info("%s: enable = %d\n", __func__, enable);
- 
-+	req.format_id = TX_POWER_LIMIT_PATH_ENABLE;
-+
- 	return mt76_mcu_send_msg(&dev->mt76,
- 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
- 				 sizeof(req), true);
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 025a03b..b33e671 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -446,12 +446,18 @@ enum {
- 
- enum {
- 	TX_POWER_LIMIT_ENABLE,
-+	TX_POWER_LIMIT_PATH_ENABLE = 0x3,
- 	TX_POWER_LIMIT_TABLE = 0x4,
- 	TX_POWER_LIMIT_INFO = 0x7,
- 	TX_POWER_LIMIT_FRAME = 0x11,
- 	TX_POWER_LIMIT_FRAME_MIN = 0x12,
- };
- 
-+enum {
-+	TX_POWER_INFO_PATH = 1,
-+	TX_POWER_INFO_RATE,
-+};
-+
- enum {
- 	SPR_ENABLE = 0x1,
- 	SPR_ENABLE_SD = 0x3,
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ab81d41..f5ac92e 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -64,6 +64,7 @@
- #define MT7915_CDEV_THROTTLE_MAX	99
- 
- #define MT7915_SKU_RATE_NUM		161
-+#define MT7915_SKU_PATH_NUM		185
- 
- #define MT7915_MAX_TWT_AGRT		16
- #define MT7915_MAX_STA_TWT_AGRT		8
-@@ -620,7 +621,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
- int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
- int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
- int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
--int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
-+int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
-+			       u8 category);
- int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower);
- int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
- 				 struct ieee80211_vif *vif,
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1131-mt76-mt7915-amsdu-set-and-get-control.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1131-mt76-mt7915-amsdu-set-and-get-control.patch
deleted file mode 100644
index a430000..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1131-mt76-mt7915-amsdu-set-and-get-control.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From 5d409ad69898ac9ca36176b2289b6fe7f61af618 Mon Sep 17 00:00:00 2001
-From: TomLiu <tomml.liu@mediatek.com>
-Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH 1131/1131] mt76: mt7915: amsdu set and get control
-
----
- mt7915/mac.c    | 10 ++++++++++
- mt7915/mt7915.h |  1 +
- mt7915/vendor.c | 31 +++++++++++++++++++++++++++++++
- mt7915/vendor.h | 12 ++++++++++++
- 4 files changed, 54 insertions(+)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9d4cfa1..a0df785 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -2053,6 +2053,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
- 	phy->trb_ts = trb;
- }
- 
-+void mt7915_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en) {
-+	struct mt76_phy *mphy = hw->priv;
-+	struct mt76_dev *mdev = mphy->dev;
-+
-+	if (en)
-+		ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
-+	else
-+		ieee80211_hw_clear(hw, SUPPORTS_AMSDU_IN_AMPDU);
-+}
-+
- #ifdef CONFIG_MTK_VENDOR
- void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
- {
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f5ac92e..5cc1924 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -746,6 +746,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 			 bool pci, int *irq);
- 
- #ifdef CONFIG_MTK_VENDOR
-+void mt7915_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
- void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta);
- void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
- void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 22af66d..a1f526c 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -30,10 +30,16 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA] = {.type = NLA_U8 },
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO] = {.type = NLA_U8 },
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE] = {.type = NLA_U16 },
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU] = {.type = NLA_U8 },
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA] = {.type = NLA_U8 },
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
-+	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
-+};
-+
- static const struct nla_policy
- hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
- 	[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
-@@ -983,11 +989,35 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
- 		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
- 		mt7915_mcu_set_cfg(phy, CFGINFO_CERT_CFG, val8); /* Cert Enable for OMI */
- 		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
-+	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]) {
-+		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]);
-+		mt7915_set_wireless_amsdu(hw, val8);
- 	}
- 
- 	return 0;
- }
- 
-+static int
-+mt7915_vendor_wireless_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	int len = 0;
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	if (nla_put_u8(skb,
-+	    MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU, ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU)))
-+		return -ENOMEM;
-+	len += 2;
-+
-+	return len;
-+}
-+
- static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
- 				  struct wireless_dev *wdev,
- 				  const void *data,
-@@ -1287,6 +1317,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
- 			WIPHY_VENDOR_CMD_NEED_RUNNING,
- 		.doit = mt7915_vendor_wireless_ctrl,
-+		.dumpit = mt7915_vendor_wireless_ctrl_dump,
- 		.policy = wireless_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
- 	},
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 949c885..cbff910 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -74,6 +74,7 @@ enum mtk_vendor_attr_wireless_ctrl {
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT = 9,
- 
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA, /* reserve */
-@@ -83,6 +84,17 @@ enum mtk_vendor_attr_wireless_ctrl {
- 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
- };
- 
-+enum mtk_vendor_attr_wireless_dump {
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
-+};
-+
- enum mtk_vendor_attr_hemu_ctrl {
- 	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
deleted file mode 100644
index 9f2bfc8..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From 0f99f68ae5aaabbb8a3c8a6b2f70114fe685267a Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 3001/3013] mt76: mt7915: wed: add wed tx support
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- mt76_connac.h |  1 +
- mt7915/mac.c  | 11 +++++++----
- mt7915/main.c |  4 ++--
- mt7915/mmio.c |  5 +++--
- 4 files changed, 13 insertions(+), 8 deletions(-)
-
-diff --git a/mt76_connac.h b/mt76_connac.h
-index 8ba883b..f70987d 100644
---- a/mt76_connac.h
-+++ b/mt76_connac.h
-@@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
- };
- 
- #define MT_TXP_MAX_BUF_NUM		6
-+#define MT_TXD_TXP_BUF_SIZE		128
- 
- struct mt76_connac_fw_txp {
- 	__le16 flags;
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a0df785..0984357 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -891,9 +891,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
- 
- 	txp->token = cpu_to_le16(token_id);
- 	txp->nbuf = 1;
--	txp->buf[0] = cpu_to_le32(phys + MT_TXD_SIZE + sizeof(*txp));
-+	txp->buf[0] = cpu_to_le32(phys + MT_TXD_TXP_BUF_SIZE);
- 
--	return MT_TXD_SIZE + sizeof(*txp);
-+	return MT_TXD_TXP_BUF_SIZE;
- }
- 
- static void
-@@ -1009,6 +1009,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
- 	LIST_HEAD(free_list);
- 	void *end = data + len;
- 	bool v3, wake = false;
-+	bool with_txwi = true;
- 	u16 total, count = 0;
- 	u32 txd = le32_to_cpu(free->txd);
- 	__le32 *cur_info;
-@@ -1064,12 +1065,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
- 			txwi = mt76_token_release(mdev, msdu, &wake);
- 			if (!txwi)
- 				continue;
-+			else
-+				with_txwi = false;
- 
- 			mt7915_txwi_free(dev, txwi, sta, &free_list);
- 		}
- 	}
--
--	mt7915_mac_tx_free_done(dev, &free_list, wake);
-+	if (!with_txwi)
-+		mt7915_mac_tx_free_done(dev, &free_list, wake);
- }
- 
- static void
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 09cf35c..2dd78ca 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -1533,14 +1533,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
- 	if (!mtk_wed_device_active(wed))
- 		return -ENODEV;
- 
--	if (msta->wcid.idx > 0xff)
-+	if (msta->wcid.idx > MT7915_WTBL_STA)
- 		return -EIO;
- 
- 	path->type = DEV_PATH_MTK_WDMA;
- 	path->dev = ctx->dev;
- 	path->mtk_wdma.wdma_idx = wed->wdma_idx;
- 	path->mtk_wdma.bss = mvif->mt76.idx;
--	path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? msta->wcid.idx : 0x3ff;
-+	path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
- 	path->mtk_wdma.queue = phy != &dev->phy;
- 
- 	ctx->dev = NULL;
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c1b421d..04411e7 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -11,7 +11,7 @@
- #include "../trace.h"
- #include "../dma.h"
- 
--static bool wed_enable;
-+static bool wed_enable = true;
- module_param(wed_enable, bool, 0644);
- MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
- 
-@@ -582,7 +582,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
- 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
- 
- 	spin_lock_bh(&dev->mt76.token_lock);
--	dev->mt76.token_size = MT7915_TOKEN_SIZE;
-+	dev->mt76.token_size = wed->wlan.token_start;//MT7915_TOKEN_SIZE
- 	spin_unlock_bh(&dev->mt76.token_lock);
- 
- 	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-@@ -792,6 +792,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 
- 	*irq = wed->irq;
- 	dev->mt76.dma_dev = wed->dev;
-+	dev->mt76.token_size = wed->wlan.token_start;
- 
- 	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
- 	if (ret)
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
deleted file mode 100644
index 87102c4..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
+++ /dev/null
@@ -1,207 +0,0 @@
-From f53aeef70b53d51114ef0ffd7c05a3fca29fe57d Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Tue, 13 Dec 2022 17:51:26 +0800
-Subject: [PATCH 3002/3013] mt76: mt7915: wed: add wds support when wed is
- enabled
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- mt76.h        |  6 ++++++
- mt7915/main.c | 22 ++++++++++++++++++++--
- mt7915/mcu.c  | 13 +++++++++++--
- mt7915/mcu.h  |  1 +
- util.c        | 40 +++++++++++++++++++++++++++++++++++++---
- util.h        |  7 ++++++-
- 6 files changed, 81 insertions(+), 8 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index c81ece0..cba11f6 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -60,6 +60,12 @@ enum mt76_wed_type {
- 	MT76_WED_Q_RX,
- };
- 
-+enum mt76_wed_state {
-+	MT76_WED_DEFAULT,
-+	MT76_WED_ACTIVE,
-+	MT76_WED_WDS_ACTIVE,
-+};
-+
- struct mt76_bus_ops {
- 	u32 (*rr)(struct mt76_dev *dev, u32 offset);
- 	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 2dd78ca..eef4c3b 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -696,8 +696,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- #endif
- 	int ret, idx;
- 	u32 addr;
-+	u8 flags = MT76_WED_DEFAULT;
- 
--	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
-+	    !is_mt7915(&dev->mt76)) {
-+		flags = test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags) ?
-+			MT76_WED_WDS_ACTIVE : MT76_WED_ACTIVE;
-+	}
-+
-+	idx = __mt76_wcid_alloc(mdev->wcid_mask, MT7915_WTBL_STA, flags);
- 	if (idx < 0)
- 		return -ENOSPC;
- 
-@@ -1169,6 +1176,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
- 	else
- 		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
- 
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
-+	    !is_mt7915(&dev->mt76)) {
-+		mt7915_sta_remove(hw, vif, sta);
-+		mt76_sta_pre_rcu_remove(hw, vif, sta);
-+		mt7915_sta_add(hw, vif, sta);
-+	}
-+
- 	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
- }
- 
-@@ -1540,8 +1554,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
- 	path->dev = ctx->dev;
- 	path->mtk_wdma.wdma_idx = wed->wdma_idx;
- 	path->mtk_wdma.bss = mvif->mt76.idx;
--	path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
- 	path->mtk_wdma.queue = phy != &dev->phy;
-+	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags) ||
-+	    is_mt7915(&dev->mt76))
-+		path->mtk_wdma.wcid = msta->wcid.idx;
-+	else
-+		path->mtk_wdma.wcid = 0x3ff;
- 
- 	ctx->dev = NULL;
- 
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d380811..f494d9f 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2364,8 +2364,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
- 	if (ret)
- 		return ret;
- 
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(&dev->mt76))
--		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+		if (is_mt7915(&dev->mt76))
-+			ret = mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY),
-+						0, 0, 0);
-+		else
-+			ret = mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
-+						MCU_WA_PARAM_WED_VERSION,
-+						dev->mt76.mmio.wed.rev_id, 0);
-+		if (ret)
-+			return ret;
-+	}
- 
- 	ret = mt7915_mcu_set_mwds(dev, 1);
- 	if (ret)
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b33e671..f2f88cc 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -284,6 +284,7 @@ enum {
- 	MCU_WA_PARAM_PDMA_RX = 0x04,
- 	MCU_WA_PARAM_CPU_UTIL = 0x0b,
- 	MCU_WA_PARAM_RED = 0x0e,
-+	MCU_WA_PARAM_WED_VERSION = 0x32,
- #ifdef MTK_DEBUG
- 	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
- 	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
-diff --git a/util.c b/util.c
-index 5819644..5cd5ede 100644
---- a/util.c
-+++ b/util.c
-@@ -42,9 +42,14 @@ bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
- }
- EXPORT_SYMBOL_GPL(__mt76_poll_msec);
- 
--int mt76_wcid_alloc(u32 *mask, int size)
-+int __mt76_wcid_alloc(u32 *mask, int size, u8 flag)
- {
-+#define MT76_WED_WDS_MIN    256
-+#define MT76_WED_WDS_CNT    16
-+
- 	int i, idx = 0, cur;
-+	int min = MT76_WED_WDS_MIN;
-+	int max = min + MT76_WED_WDS_CNT;
- 
- 	for (i = 0; i < DIV_ROUND_UP(size, 32); i++) {
- 		idx = ffs(~mask[i]);
-@@ -53,16 +58,45 @@ int mt76_wcid_alloc(u32 *mask, int size)
- 
- 		idx--;
- 		cur = i * 32 + idx;
--		if (cur >= size)
-+
-+		switch (flag) {
-+		case MT76_WED_ACTIVE:
-+			if (cur >= min && cur < max)
-+				continue;
-+
-+			if (cur >= size) {
-+				u32 end = MT76_WED_WDS_CNT - 1;
-+
-+				i = min / 32;
-+				idx = ffs(~mask[i] & GENMASK(end, 0));
-+				if (!idx)
-+					goto error;
-+				idx--;
-+				cur = min + idx;
-+			}
-+
- 			break;
-+		case MT76_WED_WDS_ACTIVE:
-+			if (cur < min)
-+				continue;
-+			if (cur >= max)
-+				goto error;
-+
-+			break;
-+		default:
-+			if (cur >= size)
-+				goto error;
-+			break;
-+		}
- 
- 		mask[i] |= BIT(idx);
- 		return cur;
- 	}
- 
-+error:
- 	return -1;
- }
--EXPORT_SYMBOL_GPL(mt76_wcid_alloc);
-+EXPORT_SYMBOL_GPL(__mt76_wcid_alloc);
- 
- int mt76_get_min_avg_rssi(struct mt76_dev *dev, bool ext_phy)
- {
-diff --git a/util.h b/util.h
-index 260965d..99b7263 100644
---- a/util.h
-+++ b/util.h
-@@ -27,7 +27,12 @@ enum {
- #define MT76_INCR(_var, _size) \
- 	(_var = (((_var) + 1) % (_size)))
- 
--int mt76_wcid_alloc(u32 *mask, int size);
-+int __mt76_wcid_alloc(u32 *mask, int size, u8 flags);
-+
-+static inline int mt76_wcid_alloc(u32 *mask, int size)
-+{
-+	return __mt76_wcid_alloc(mask, size, 0);
-+}
- 
- static inline void
- mt76_wcid_mask_set(u32 *mask, int idx)
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
deleted file mode 100644
index 3d0585f..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From b6c09473c12f564b96821267e66d4fc92819f83a Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 25 Nov 2022 12:05:06 +0800
-Subject: [PATCH 3003/3013] mt76: connac: wed: add wed rx copy skb
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- dma.c | 23 ++++++++++++++++++-----
- 1 file changed, 18 insertions(+), 5 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index dc8d888..53c7528 100644
---- a/dma.c
-+++ b/dma.c
-@@ -386,9 +386,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 				 SKB_WITH_OVERHEAD(q->buf_size),
- 				 DMA_FROM_DEVICE);
- 
--		buf = t->ptr;
-+		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+		if (!buf)
-+			return NULL;
-+
-+		memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
- 		t->dma_addr = 0;
--		t->ptr = NULL;
- 
- 		mt76_put_rxwi(dev, t);
- 
-@@ -568,6 +571,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	while (q->queued < q->ndesc - 1) {
- 		struct mt76_txwi_cache *t = NULL;
- 		struct mt76_queue_buf qbuf;
-+		bool skip_alloc = false;
- 		void *buf = NULL;
- 
- 		if ((q->flags & MT_QFLAG_WED) &&
-@@ -575,11 +579,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 			t = mt76_get_rxwi(dev);
- 			if (!t)
- 				break;
-+
-+			if (t->ptr) {
-+				skip_alloc = true;
-+				buf = t->ptr;
-+			}
- 		}
- 
--		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
--		if (!buf)
--			break;
-+		if (!skip_alloc) {
-+			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+			if (!buf)
-+				break;
-+		}
- 
- 		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
- 		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
-@@ -949,5 +960,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
- 
- 	if (mtk_wed_device_active(&dev->mmio.wed))
- 		mtk_wed_device_detach(&dev->mmio.wed);
-+
-+	mt76_free_pending_rxwi(dev);
- }
- EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
deleted file mode 100644
index a0921cd..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 0e8afd49ef8b1b488e3808b7135703c58896bcdb Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3013] mt76: mt7915: wed: add fill receive path to report
- wed idx
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- mt7915/main.c | 19 +++++++++++++++++++
- 1 file changed, 19 insertions(+)
-
-diff --git a/mt7915/main.c b/mt7915/main.c
-index eef4c3b..7dd3973 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -1565,6 +1565,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
- 
- 	return 0;
- }
-+
-+static int
-+mt7915_net_fill_receive_path(struct ieee80211_hw *hw,
-+			     struct net_device_path_ctx *ctx,
-+			     struct net_device_path *path)
-+{
-+	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
-+
-+	if (!mtk_wed_device_active(wed))
-+		return -ENODEV;
-+
-+	path->dev = ctx->dev;
-+	path->mtk_wdma.wdma_idx = wed->wdma_idx;
-+
-+	return 0;
-+}
-+
- #endif
- 
- const struct ieee80211_ops mt7915_ops = {
-@@ -1617,5 +1635,6 @@ const struct ieee80211_ops mt7915_ops = {
- 	.set_radar_background = mt7915_set_radar_background,
- #ifdef CONFIG_NET_MEDIATEK_SOC_WED
- 	.net_fill_forward_path = mt7915_net_fill_forward_path,
-+	.net_fill_receive_path = mt7915_net_fill_receive_path,
- #endif
- };
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
deleted file mode 100644
index 0fad4b4..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ /dev/null
@@ -1,284 +0,0 @@
-From 5fbbc3d3c0923c92f6b99a6f6a84c85acd4c6f1a Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 25 Nov 2022 14:07:46 +0800
-Subject: [PATCH 3005/3013] mt76: mt7915: wed: add ser support when wed on
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- dma.c           | 29 ++++++++++++++++++++---------
- dma.h           |  1 +
- mt76.h          |  1 +
- mt7915/dma.c    | 37 ++++++++++++++++++++++++++++++++-----
- mt7915/mac.c    | 18 ++++++++++++++++++
- mt7915/mmio.c   |  3 +++
- mt7915/mt7915.h |  1 +
- 7 files changed, 76 insertions(+), 14 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 53c7528..35beec7 100644
---- a/dma.c
-+++ b/dma.c
-@@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
- 	local_bh_enable();
- }
- 
--static void
-+void
- mt76_free_pending_rxwi(struct mt76_dev *dev)
- {
- 	struct mt76_txwi_cache *t;
-@@ -178,6 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
- 	}
- 	local_bh_enable();
- }
-+EXPORT_SYMBOL_GPL(mt76_free_pending_rxwi);
- 
- static void
- mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
-@@ -618,14 +619,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	return frames;
- }
- 
--static int
--mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
-+int
-+mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
- {
- #ifdef CONFIG_NET_MEDIATEK_SOC_WED
- 	struct mtk_wed_device *wed = &dev->mmio.wed;
- 	int ret, type, ring;
--	u8 flags = q->flags;
-+	u8 flags;
- 
-+	if (!q || !q->ndesc)
-+		return -EINVAL;
-+
-+	flags = q->flags;
- 	if (!mtk_wed_device_active(wed))
- 		q->flags &= ~MT_QFLAG_WED;
- 
-@@ -637,7 +642,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 
- 	switch (type) {
- 	case MT76_WED_Q_TX:
--		ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs);
-+		ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs, reset);
- 		if (!ret)
- 			q->wed_regs = wed->tx_ring[ring].reg_base;
- 		break;
-@@ -653,7 +658,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 			q->wed_regs = wed->txfree_ring.reg_base;
- 		break;
- 	case MT76_WED_Q_RX:
--		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
-+		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs, reset);
- 		if (!ret)
- 			q->wed_regs = wed->rx_ring[ring].reg_base;
- 		break;
-@@ -666,6 +671,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
- 	return 0;
- #endif
- }
-+EXPORT_SYMBOL_GPL(mt76_dma_wed_setup);
- 
- static int
- mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
-@@ -692,7 +698,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
- 	if (!q->entry)
- 		return -ENOMEM;
- 
--	ret = mt76_dma_wed_setup(dev, q);
-+	ret = mt76_dma_wed_setup(dev, q, false);
- 	if (ret)
- 		return ret;
- 
-@@ -743,8 +749,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
- 		q->desc[i].ctrl = cpu_to_le32(MT_DMA_CTL_DMA_DONE);
- 
- 	mt76_dma_rx_cleanup(dev, q);
--	mt76_dma_sync_idx(dev, q);
--	mt76_dma_rx_fill(dev, q);
-+
-+	mt76_dma_wed_setup(dev, q, true);
-+
-+	if (q->flags != MT_WED_Q_TXFREE) {
-+		mt76_dma_sync_idx(dev, q);
-+		mt76_dma_rx_fill(dev, q);
-+	}
- 
- 	if (!q->rx_head)
- 		return;
-diff --git a/dma.h b/dma.h
-index 53c6ce2..4b9bc7f 100644
---- a/dma.h
-+++ b/dma.h
-@@ -56,5 +56,6 @@ enum mt76_mcu_evt_type {
- int mt76_dma_rx_poll(struct napi_struct *napi, int budget);
- void mt76_dma_attach(struct mt76_dev *dev);
- void mt76_dma_cleanup(struct mt76_dev *dev);
-+int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
- 
- #endif
-diff --git a/mt76.h b/mt76.h
-index cba11f6..369e1e4 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -1401,6 +1401,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
- void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
- void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
- struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
-+void mt76_free_pending_rxwi(struct mt76_dev *dev);
- void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
- 		      struct napi_struct *napi);
- void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index e3fa064..1ae6c33 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -4,6 +4,7 @@
- #include "mt7915.h"
- #include "../dma.h"
- #include "mac.h"
-+#include <linux/rtnetlink.h>
- 
- static int
- mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc, int ring_base)
-@@ -562,6 +563,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
- {
- 	struct mt76_phy *mphy_ext = dev->mt76.phys[MT_BAND1];
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
- 	int i;
- 
- 	/* clean up hw queues */
-@@ -581,28 +583,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
- 	if (force)
- 		mt7915_wfsys_reset(dev);
- 
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
-+		mtk_wed_device_dma_reset(&dev->mt76.mmio.wed);
- 	mt7915_dma_disable(dev, force);
- 
-+	/* set wifi reset done, wait FE reset */
-+	if (mtk_wed_device_active(wed) && atomic_read(&wed->fe_reset)) {
-+		atomic_set(&wed->fe_reset, 0);
-+		rtnl_lock();
-+		complete(&wed->wlan_reset_done);
-+		rtnl_unlock();
-+		wait_for_completion(&wed->fe_reset_done);
-+	}
-+
- 	/* reset hw queues */
- 	for (i = 0; i < __MT_TXQ_MAX; i++) {
- 		mt76_queue_reset(dev, dev->mphy.q_tx[i]);
--		if (mphy_ext)
-+		if (mphy_ext) {
- 			mt76_queue_reset(dev, mphy_ext->q_tx[i]);
-+			if (mtk_wed_device_active(wed))
-+				mt76_dma_wed_setup(&dev->mt76,
-+						   mphy_ext->q_tx[i],
-+						   true);
-+		}
-+		if (mtk_wed_device_active(wed))
-+			mt76_dma_wed_setup(&dev->mt76, dev->mphy.q_tx[i],
-+					   true);
- 	}
- 
- 	for (i = 0; i < __MT_MCUQ_MAX; i++)
- 		mt76_queue_reset(dev, dev->mt76.q_mcu[i]);
- 
--	mt76_for_each_q_rx(&dev->mt76, i)
--		mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
-+	mt76_for_each_q_rx(&dev->mt76, i) {
-+		if (dev->mt76.q_rx[i].flags != MT_WED_Q_TXFREE)
-+			mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
-+	}
- 
- 	mt76_tx_status_check(&dev->mt76, true);
- 
--	mt7915_dma_enable(dev);
--
- 	mt76_for_each_q_rx(&dev->mt76, i)
- 		mt76_queue_rx_reset(dev, i);
- 
-+	if(mtk_wed_device_active(wed) && is_mt7915(&dev->mt76))
-+		mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
-+			 MT_WFDMA0_EXT0_RXWB_KEEP);
-+
-+	mt7915_dma_enable(dev);
-+
- 	return 0;
- }
- 
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0984357..0d0ae7a 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -896,6 +896,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
- 	return MT_TXD_TXP_BUF_SIZE;
- }
- 
-+void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
-+{
-+	struct mt7915_dev *dev;
-+	u8 band_idx;
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	band_idx = dev->phy.mt76->band_idx;
-+
-+	mt7915_mcu_set_ser(dev, SER_RECOVER, 1, band_idx);
-+
-+	return;
-+}
-+
- static void
- mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
- {
-@@ -1635,6 +1647,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
- 	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
- 		return;
- 
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+		mtk_wed_device_stop(&dev->mt76.mmio.wed, true);
-+		if (!is_mt7986(&dev->mt76))
-+			mt76_wr(dev, MT_INT_WED_MASK_CSR, 0);
-+	}
-+
- 	ieee80211_stop_queues(mt76_hw(dev));
- 	if (ext_phy)
- 		ieee80211_stop_queues(ext_phy->hw);
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 04411e7..e0761e8 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -619,6 +619,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- 		mt76_put_rxwi(&dev->mt76, t);
- 	}
- 
-+	mt76_free_pending_rxwi(&dev->mt76);
-+
- 	if (!wed->rx_buf_ring.rx_page.va)
- 		return;
- 
-@@ -784,6 +786,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	wed->wlan.init_rx_buf = mt7915_mmio_wed_init_rx_buf;
- 	wed->wlan.release_rx_buf = mt7915_mmio_wed_release_rx_buf;
- 	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
-+	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
- 
- 	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
- 
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5cc1924..89c13db 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -554,6 +554,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
- irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
- u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
- u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
-+void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
- 
- int mt7915_register_device(struct mt7915_dev *dev);
- void mt7915_unregister_device(struct mt7915_dev *dev);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
deleted file mode 100644
index 5eed16f..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ /dev/null
@@ -1,171 +0,0 @@
-From f7a5428387ab23b9c9de3a67ad1ffc5921f89b72 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3006/3013] mt76: mt7915: wed: enable red per-band token drop
- for HW Path
-
-Limit the number of token used by each band. If a band uses too many token,
-it may hurt the throughput of the other band. The SW path can solve this
-problem by AQL.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/mcu.c    | 56 ++++++++++++++++++++++++++++++++++++++++---------
- mt7915/mcu.h    |  1 +
- mt7915/mmio.c   |  2 +-
- mt7915/mt7915.h |  4 +++-
- 4 files changed, 51 insertions(+), 12 deletions(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f494d9f..5b2ae77 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2374,8 +2374,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
- 						dev->mt76.mmio.wed.rev_id, 0);
- 		if (ret)
- 			return ret;
-+
-+		ret = mt7915_mcu_set_red(dev, true);
-+		if (ret)
-+			return ret;
-+	} else {
-+		mt7915_mcu_set_red(dev, false);
-+		if (ret)
-+			return ret;
- 	}
- 
-+
- 	ret = mt7915_mcu_set_mwds(dev, 1);
- 	if (ret)
- 		return ret;
-@@ -2385,12 +2394,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
- 	if (ret)
- 		return ret;
- 
--	ret = mt7915_mcu_init_rx_airtime(dev);
--	if (ret)
--		return ret;
--
--	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
--				 MCU_WA_PARAM_RED, 0, 0);
-+	return mt7915_mcu_init_rx_airtime(dev);
- }
- 
- int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4533,6 +4537,34 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
- 
- 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
- }
-+#endif
-+
-+static int mt7915_red_set_watermark(struct mt7915_dev *dev)
-+{
-+#define RED_GLOBAL_TOKEN_WATERMARK 2
-+	struct {
-+		__le32 args[3];
-+
-+		u8 cmd;
-+		u8 version;
-+		u8 __rsv1[4];
-+		u16 len;
-+
-+		__le16 high_mark;
-+		__le16 low_mark;
-+		u8 __rsv2[12];
-+	} req = {
-+		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
-+		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
-+		.len = cpu_to_le16(sizeof(req) - 12),
-+
-+		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
-+		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
-+				 sizeof(req), false);
-+}
- 
- int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
- {
-@@ -4543,17 +4575,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
- 	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
- 	__le32 req = cpu_to_le32(red_type);
- 
-+	if (enabled) {
-+		ret = mt7915_red_set_watermark(dev);
-+		if (ret < 0)
-+			return ret;
-+	}
-+
- 	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
- 				 sizeof(req), false);
- 	if (ret < 0)
- 		return ret;
- 
--	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
--			  MCU_WA_PARAM_RED, enabled, 0, true);
-+	return mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
-+				 MCU_WA_PARAM_RED, enabled, 0);
- 
--	return 0;
- }
--#endif
- 
- int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
- {
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f2f88cc..572cc16 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -285,6 +285,7 @@ enum {
- 	MCU_WA_PARAM_CPU_UTIL = 0x0b,
- 	MCU_WA_PARAM_RED = 0x0e,
- 	MCU_WA_PARAM_WED_VERSION = 0x32,
-+	MCU_WA_PARAM_RED_SETTING = 0x40,
- #ifdef MTK_DEBUG
- 	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
- 	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index e0761e8..b29fe7a 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -759,7 +759,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
- 		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
- 	}
--	wed->wlan.nbuf = 4096;
-+	wed->wlan.nbuf = MT7915_HW_TOKEN_SIZE;
- 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
- 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
- 	wed->wlan.txfree_tbit = is_mt7986(&dev->mt76) ? 2 : 1;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 89c13db..2335f78 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -56,6 +56,7 @@
- 
- #define MT7915_EEPROM_BLOCK_SIZE	16
- #define MT7915_TOKEN_SIZE		8192
-+#define MT7915_HW_TOKEN_SIZE		7168
- 
- #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
- #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
-@@ -771,13 +772,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
- #endif
- int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
- int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
-+int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
-+
- int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
- int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
- 
- #ifdef MTK_DEBUG
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
- int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
--int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
- void mt7915_dump_tmac_info(u8 *tmac_info);
- int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
- void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
deleted file mode 100644
index 5d1f911..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From e2237042eb0282b5f3a82f2b34f4a302f408cc73 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH 3007/3013] mt76: mt7915: wed: update mt7916 trinfo when hw
- path enable
-
----
- mt7915/mt7915_debug.h | 10 ++++++++++
- mt7915/mtk_debugfs.c  | 16 +++++++++++++---
- 2 files changed, 23 insertions(+), 3 deletions(-)
-
-diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-index ecdc02a..0a1ee80 100644
---- a/mt7915/mt7915_debug.h
-+++ b/mt7915/mt7915_debug.h
-@@ -133,6 +133,8 @@ enum dbg_reg_rev {
- 	DBG_MIB_M0ARNG0,
- 	DBG_MIB_M0DR2,
- 	DBG_MIB_M0DR13,
-+	DBG_WFDMA_WED_TX_CTRL,
-+	DBG_WFDMA_WED_RX_CTRL,
- 	__MT_DBG_REG_REV_MAX,
- };
- 
-@@ -177,6 +179,8 @@ static const u32 mt7986_dbg_base[] = {
- 
- /* mt7915 regs with different base and offset */
- static const struct __dbg_reg mt7915_dbg_reg[] = {
-+	[DBG_WFDMA_WED_TX_CTRL]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x300 },
-+	[DBG_WFDMA_WED_RX_CTRL]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x400 },
- 	[DBG_INT_SOURCE_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x10 },
- 	[DBG_INT_MASK_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x14 },
- 	[DBG_INT1_SOURCE_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x88 },
-@@ -281,6 +285,8 @@ static const struct __dbg_reg mt7915_dbg_reg[] = {
- 
- /* mt7986/mt7916 regs with different base and offset */
- static const struct __dbg_reg mt7916_dbg_reg[] = {
-+	[DBG_WFDMA_WED_TX_CTRL]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x300 },
-+	[DBG_WFDMA_WED_RX_CTRL]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x400 },
- 	[DBG_INT_SOURCE_CSR]		= { MT_DBG_WFDMA0_BASE, 0x200 },
- 	[DBG_INT_MASK_CSR]		= { MT_DBG_WFDMA0_BASE, 0x204 },
- 	[DBG_INT1_SOURCE_CSR]		= { MT_DBG_WFDMA0_PCIE1_BASE, 0x200 },
-@@ -450,11 +456,15 @@ struct bin_debug_hdr {
- #define MT_DBG_RX_EVENT_RING_BASE		__DBG_REG(dev, DBG_RX_EVENT_RING_BASE)
- #define MT_DBG_RX_STS_RING_BASE			__DBG_REG(dev, DBG_RX_STS_RING_BASE)
- #define MT_DBG_RX_DATA_RING_BASE		__DBG_REG(dev, DBG_RX_DATA_RING_BASE)
-+#define MT_DBG_WFDMA_WED_TX_CTRL_BASE		__DBG_REG(dev, DBG_WFDMA_WED_TX_CTRL)
-+#define MT_DBG_WFDMA_WED_RX_CTRL_BASE		__DBG_REG(dev, DBG_WFDMA_WED_RX_CTRL)
- 
- #define MT_DBG_TX_RING_CTRL(n)			(MT_DBG_TX_RING_BASE + (0x10 * (n)))
- #define MT_DBG_RX_DATA_RING_CTRL(n)		(MT_DBG_RX_DATA_RING_BASE + (0x10 * (n)))
- #define MT_DBG_RX_EVENT_RING_CTRL(n)		(MT_DBG_RX_EVENT_RING_BASE + (0x10 * (n)))
- 
-+#define MT_DBG_WFDMA_WED_TX_CTRL(n)		(MT_DBG_WFDMA_WED_TX_CTRL_BASE + (0x10 * (n)))
-+#define MT_DBG_WFDMA_WED_RX_CTRL(n)		(MT_DBG_WFDMA_WED_RX_CTRL_BASE + (0x10 * (n)))
- /* WFDMA COMMON */
- #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
- #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 19cc8cb..919cae4 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -856,12 +856,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
- 		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
- 	dump_dma_tx_ring_info(s, dev, "T16:FWDL", MT_DBG_TX_RING_CTRL(0));
- 	dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)",	MT_DBG_TX_RING_CTRL(1));
--	dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)",  MT_DBG_TX_RING_CTRL(2));
--	dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)",  MT_DBG_TX_RING_CTRL(3));
-+
-+	if (is_mt7916(&dev->mt76) && mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+		dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)",  MT_DBG_WFDMA_WED_TX_CTRL(0));
-+		dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)",  MT_DBG_WFDMA_WED_TX_CTRL(1));
-+	} else {
-+		dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)",  MT_DBG_TX_RING_CTRL(2));
-+		dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)",  MT_DBG_TX_RING_CTRL(3));
-+	}
-+
- 	dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)",	MT_DBG_TX_RING_CTRL(4));
- 	dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", MT_DBG_RX_DATA_RING_CTRL(0));
- 	dump_dma_rx_ring_info(s, dev, "R1:Event(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(1));
--	dump_dma_rx_ring_info(s, dev, "R2:TxDone(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
-+	if (is_mt7916(&dev->mt76) && mtk_wed_device_active(&dev->mt76.mmio.wed))
-+		dump_dma_rx_ring_info(s, dev, "R2:TxDone(WA2H)", MT_DBG_WFDMA_WED_RX_CTRL(1));
-+	else
-+		dump_dma_rx_ring_info(s, dev, "R2:TxDone(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
- 	dump_dma_rx_ring_info(s, dev, "R3:TxDone1(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(3));
- 	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
- 	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
deleted file mode 100644
index 41ecf07..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 0c5b82da3de9a903de87814a8fd70956c2280c47 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 3008/3013] mt76: mt7915: wed: find rx token by physical
- address
-
-The token id in RxDMAD may be incorrect when it is not the last frame due to
-WED HW bug. Lookup correct token id by physical address in sdp0.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- dma.c | 21 ++++++++++++++++++++-
- 1 file changed, 20 insertions(+), 1 deletion(-)
-
-diff --git a/dma.c b/dma.c
-index 35beec7..327ed3b 100644
---- a/dma.c
-+++ b/dma.c
-@@ -376,10 +376,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 
- 	if ((q->flags & MT_QFLAG_WED) &&
- 	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
-+		u32 id, find = 0;
- 		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
- 				      le32_to_cpu(desc->buf1));
--		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
-+		struct mt76_txwi_cache *t;
-+
-+		if (*more) {
-+			spin_lock_bh(&dev->rx_token_lock);
-+
-+			idr_for_each_entry(&dev->rx_token, t, id) {
-+				if (t->dma_addr == le32_to_cpu(desc->buf0)) {
-+					find = 1;
-+					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
-+					token = id;
-+					break;
-+				}
-+			}
-+
-+			spin_unlock_bh(&dev->rx_token_lock);
-+			if (!find)
-+				return NULL;
-+		}
- 
-+		t = mt76_rx_token_release(dev, token);
- 		if (!t)
- 			return NULL;
- 
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
deleted file mode 100644
index 0f96e92..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From d8cd3a2ce0a0544d130c5ec12c4d297aae8e84b7 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 25 Nov 2022 14:37:58 +0800
-Subject: [PATCH 3009/3013] mt76: mt7915: wed: drop scatter and gather frame
-
-The scatter and gather frame may be incorrect because WED and WO may
-send frames to host driver interleaved.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- dma.c  | 9 +++++++++
- dma.h  | 1 +
- mt76.h | 1 +
- 3 files changed, 11 insertions(+)
-
-diff --git a/dma.c b/dma.c
-index 327ed3b..0914266 100644
---- a/dma.c
-+++ b/dma.c
-@@ -420,6 +420,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 
- 			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
- 					   MT_DMA_CTL_DROP));
-+
-+			if (*more || (q->flags & MT_QFLAG_WED_FRAG)) {
-+				*drop = true;
-+
-+				if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
-+					q->flags &= ~MT_QFLAG_WED_FRAG;
-+				else
-+					q->flags |= MT_QFLAG_WED_FRAG;
-+			}
- 		}
- 	} else {
- 		buf = e->buf;
-diff --git a/dma.h b/dma.h
-index 4b9bc7f..ce8ac42 100644
---- a/dma.h
-+++ b/dma.h
-@@ -19,6 +19,7 @@
- #define MT_DMA_CTL_TO_HOST_A		BIT(12)
- #define MT_DMA_CTL_DROP			BIT(14)
- #define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
-+#define MT_DMA_CTL_WO			BIT(8)
- 
- #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
- #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
-diff --git a/mt76.h b/mt76.h
-index 369e1e4..b10a16f 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -30,6 +30,7 @@
- #define MT_QFLAG_WED_RING	GENMASK(1, 0)
- #define MT_QFLAG_WED_TYPE	GENMASK(3, 2)
- #define MT_QFLAG_WED		BIT(4)
-+#define MT_QFLAG_WED_FRAG	BIT(5)
- 
- #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
- 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
deleted file mode 100644
index d9691d7..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ /dev/null
@@ -1,1014 +0,0 @@
-From 1ee66cbba1ce67edfba21bde3c9f9ae794634ab4 Mon Sep 17 00:00:00 2001
-From: Lian Chen <lian.chen@mediatek.com>
-Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3010/3013] mt76: mt7915: wed: HW ATF support for mt7986
-
-Signed-off-by: Lian Chen <lian.chen@mediatek.com>
----
- mt76_connac_mcu.h    |   2 +
- mt7915/debugfs.c     | 405 +++++++++++++++++++++++++++++++++++++++++++
- mt7915/init.c        |  39 +++++
- mt7915/main.c        |  15 ++
- mt7915/mcu.c         | 165 ++++++++++++++++++
- mt7915/mt7915.h      |  68 ++++++++
- mt7915/mtk_debugfs.c | 133 +++++++++++++-
- 7 files changed, 826 insertions(+), 1 deletion(-)
- mode change 100644 => 100755 mt7915/init.c
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 98b0074..239643b 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1159,6 +1159,7 @@ enum {
- 	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
- 	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
- 	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
-+	MCU_EXT_CMD_SET_FEATURE_CTRL = 0x38,
- 	MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
- 	MCU_EXT_CMD_ATE_CTRL = 0x3d,
- 	MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
-@@ -1168,6 +1169,7 @@ enum {
- 	MCU_EXT_CMD_MUAR_UPDATE = 0x48,
- 	MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
- 	MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
-+	MCU_EXT_CMD_AT_PROC_MODULE = 0x4b,
- 	MCU_EXT_CMD_SET_RX_PATH = 0x4e,
- 	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
- 	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 3ef2148..b178036 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -12,6 +12,10 @@
- #define FW_BIN_LOG_MAGIC_V2	0x44d9c99a
- #endif
- 
-+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
-+#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
-+
-+
- /** global debugfs **/
- 
- struct hw_queue_map {
-@@ -211,6 +215,406 @@ static const struct file_operations mt7915_sys_recovery_ops = {
- 	.llseek = default_llseek,
- };
- 
-+static ssize_t mt7915_vow_get(struct file *file, char __user *user_buf,
-+                              size_t count, loff_t *ppos)
-+{
-+	char *buff;
-+	int desc = 0;
-+	ssize_t ret;
-+	static const size_t bufsz = 1000;
-+
-+	buff = kmalloc(bufsz, GFP_KERNEL);
-+	if (!buff)
-+		return -ENOMEM;
-+
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "======== Control =============\n"
-+			  "vow_atf_en=<0/1> 0:disable, 1:enable\n"
-+			  "vow_watf_en=<0/1> 0:disable, 1:enable\n"
-+			  "vow_watf_quantum=<level>-<quantum> unit 256us\n"
-+			  "======== Station table =============\n"
-+			  "vow_sta_dwrr_quantum_id=<wlanidx>-<WMM AC>-<Qid>\n"
-+			  "vow_dwrr_max_wait_time=<time> 256us\n"
-+			  "======== Debug =============\n"
-+			  "vow_show_en=<0/1> 0:dieable, 1:enable\n"
-+			  "vow_show_sta=<STA num>\n"
-+			  "show_vow_info\n"
-+			  "show_vow_sta_conf=<STA num> 0:all\n");
-+	ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
-+	kfree(buff);
-+	return ret;
-+}
-+
-+static int mt7915_set_vow_sta_dwrr_quantum_id(struct mt7915_dev *dev,
-+                                              u32 wcid_id,
-+                                              u32 ac, u32 val)
-+{
-+	struct mt7915_sta *msta;
-+	struct mt76_wcid *wcid;
-+	int ret;
-+
-+	wcid = rcu_dereference(dev->mt76.wcid[wcid_id]);
-+	if ((!wcid) || (!wcid->sta)) {
-+		dev_err(dev->mt76.dev, "%s: error station.\n", __func__);
-+		return 0;
-+	}
-+
-+	msta = container_of(wcid, struct mt7915_sta, wcid);
-+
-+	msta->vow_sta_cfg.dwrr_quantum[ac] = val;
-+
-+	ret = mt7915_mcu_set_vow_drr_ctrl(dev, msta, VOW_DRR_STA_AC0_QUA_ID + ac);
-+	dev_info(dev->mt76.dev, "%s: set sta %d, ac %d, quantum id %u.\n",
-+                 __func__, wcid_id, ac, val);
-+
-+	return ret;
-+}
-+
-+static int mt7915_set_vow_atf_en(struct mt7915_dev *dev, u32 val)
-+{
-+	int ret;
-+
-+	dev->vow_cfg.vow_atf_en = !!val;
-+	dev->vow_cfg.sta_max_wait_time = val ? 0x40 : 0x1;
-+	ret = mt7915_mcu_set_vow_feature_ctrl(dev);
-+        dev_info(dev->mt76.dev, "%s: set vow_atf_en %u.\n",
-+                 __func__, val);
-+
-+	ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
-+                                          VOW_DRR_AIRTIME_DEFICIT_BOUND);
-+	dev_info(dev->mt76.dev, "%s: set vow_dwrr_max_wait_time %u.\n",
-+                 __func__, dev->vow_cfg.sta_max_wait_time);
-+
-+	return ret;
-+}
-+
-+static int mt7915_set_vow_dwrr_max_wait_time(struct mt7915_dev *dev,
-+                                             u32 val)
-+{
-+	int ret;
-+
-+	dev->vow_cfg.sta_max_wait_time = val;
-+	ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
-+		                          VOW_DRR_AIRTIME_DEFICIT_BOUND);
-+	dev_info(dev->mt76.dev, "%s: set vow_dwrr_max_wait_time %u.\n",
-+		 __func__, val);
-+
-+	return ret;
-+}
-+
-+static int mt7915_set_vow_watf_en(struct mt7915_dev *dev, u32 val)
-+{
-+	int ret;
-+
-+	dev->vow_cfg.vow_watf_en = !!val;
-+	ret = mt7915_mcu_set_vow_feature_ctrl(dev);
-+	dev_info(dev->mt76.dev, "%s: set vow_watf_en %u.\n", __func__, val);
-+
-+	return ret;
-+}
-+
-+static int mt7915_set_vow_watf_quantum(struct mt7915_dev *dev,
-+                                       u32 id, u32 val)
-+{
-+	int ret;
-+
-+	dev->vow_cfg.vow_sta_dwrr_quantum[id] = val;
-+	ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
-+				          VOW_DRR_AIRTIME_QUANTUM_L0 + id);
-+	dev_info(dev->mt76.dev, "%s: set quantum id %u, val %d.\n",
-+                 __func__, id, val);
-+
-+	return ret;
-+}
-+
-+extern int mt7915_vow_pleinfo_read(struct mt7915_dev *dev);
-+static void mt7915_show_station_tx_airtime(struct work_struct *work){
-+	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
-+					      vow_work.work);
-+	static u32 vow_last_tx_time[MT7916_WTBL_SIZE];
-+	struct ieee80211_sta *ieee80211_sta;
-+	struct mt7915_sta *msta;
-+	struct mt76_wcid *wcid;
-+	int idx = 0;
-+	int i = 0;
-+	u32 addr;
-+	int tx_airtime_sum = 0;
-+	int tx_add_airtime = 0;
-+
-+	if (!dev->vow_cfg.vow_show_en)
-+		return;
-+
-+	rcu_read_lock();
-+	for (idx = 1; (idx < dev->vow_cfg.vow_show_sta) &&
-+	     (idx < MT7915_WTBL_STA); idx++) {
-+		if (idx >= ARRAY_SIZE(dev->mt76.wcid))
-+			return;
-+
-+		wcid = rcu_dereference(dev->mt76.wcid[idx]);
-+		if (!wcid || !wcid->sta)
-+			continue;
-+
-+		msta = container_of(wcid, struct mt7915_sta, wcid);
-+		addr = mt7915_mac_wtbl_lmac_addr(dev, idx, 20);
-+		tx_airtime_sum = 0;
-+
-+		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
-+			tx_airtime_sum += mt76_rr(dev, addr);
-+			addr += 8;
-+		}
-+		tx_add_airtime = tx_airtime_sum - vow_last_tx_time[idx];
-+		vow_last_tx_time[idx] = tx_airtime_sum;
-+
-+		ieee80211_sta = container_of((void *)msta, struct ieee80211_sta,
-+					     drv_priv);
-+
-+		dev_info(dev->mt76.dev, "sta%u:" MACSTR " tx -> %u)\n",
-+                         idx, MAC2STR(ieee80211_sta->addr), tx_add_airtime);
-+	}
-+	mt7915_vow_pleinfo_read(dev);
-+	ieee80211_queue_delayed_work(mt76_hw(dev), &dev->vow_work, 1 * HZ);
-+	rcu_read_unlock();
-+	return;
-+}
-+
-+
-+static int mt7915_set_vow_show_en(struct mt7915_dev *dev, u32 val)
-+{
-+	if (!!dev->vow_cfg.vow_show_en == !!val)
-+		return 0;
-+	dev->vow_cfg.vow_show_en = val;
-+	mt7915_mcu_set_vow_feature_ctrl(dev);
-+	if (dev->vow_cfg.vow_show_en) {
-+		INIT_DELAYED_WORK(&dev->vow_work, mt7915_show_station_tx_airtime);
-+		ieee80211_queue_delayed_work(mt76_hw(dev), &dev->vow_work, 1 * HZ);
-+	}
-+	else {
-+		cancel_delayed_work_sync(&dev->vow_work);
-+	}
-+	return 0;
-+}
-+
-+static int mt7915_set_vow_show_sta(struct mt7915_dev *dev, u32 val)
-+{
-+	dev->vow_cfg.vow_show_sta = val;
-+	dev_info(dev->mt76.dev, "%s: show station up to %d.\n",
-+		 __func__, dev->vow_cfg.vow_show_sta);
-+	return 0;
-+}
-+static int mt7915_set_show_vow_info(struct mt7915_dev *dev)
-+{
-+	dev_info(dev->mt76.dev, "====== VOW Control Information ======\n");
-+	dev_info(dev->mt76.dev, "ATF Enbale: %d\n",
-+                 dev->vow_cfg.vow_atf_en);
-+	dev_info(dev->mt76.dev, "WATF Enable: %d\n",
-+                 dev->vow_cfg.vow_watf_en);
-+	dev_info(dev->mt76.dev, "refill_period: %d\n",
-+                 dev->vow_cfg.refill_period);
-+	dev_info(dev->mt76.dev, "===== VOW Max Deficit Information =====\n");
-+	dev_info(dev->mt76.dev, "VOW Max Deficit(unit 256us): %d\n",
-+                 dev->vow_cfg.sta_max_wait_time);
-+	dev_info(dev->mt76.dev, "===== VOW Quantum Information =====\n");
-+	dev_info(dev->mt76.dev, "Quantum ID 0 value(unit 256us): %d\n",
-+                 dev->vow_cfg.vow_sta_dwrr_quantum[0]);
-+	dev_info(dev->mt76.dev, "Quantum ID 1 value(unit 256us): %d\n",
-+                 dev->vow_cfg.vow_sta_dwrr_quantum[1]);
-+	dev_info(dev->mt76.dev, "Quantum ID 2 value(unit 256us): %d\n",
-+                 dev->vow_cfg.vow_sta_dwrr_quantum[2]);
-+	dev_info(dev->mt76.dev, "Quantum ID 3 value(unit 256us): %d\n",
-+                 dev->vow_cfg.vow_sta_dwrr_quantum[3]);
-+	return 0;
-+}
-+
-+static int mt7915_show_vow_sta_conf(struct mt7915_dev *dev, u32 val)
-+{
-+	struct ieee80211_sta *ieee80211_sta;
-+	struct mt7915_sta *msta;
-+	struct mt76_wcid *wcid;
-+	u32 i;
-+	u8 q;
-+
-+	if (val > 0 && val < MT7915_WTBL_STA) {
-+		wcid = rcu_dereference(dev->mt76.wcid[val]);
-+		if (!wcid || !wcid->sta)
-+			return 0;
-+		msta = container_of(wcid, struct mt7915_sta, wcid);
-+		ieee80211_sta = container_of((void *)msta, struct ieee80211_sta,
-+					     drv_priv);
-+		dev_info(dev->mt76.dev, "%s: ****** sta%d: "MACSTR"******\n",
-+			 __func__, val, MAC2STR(ieee80211_sta->addr));
-+		q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO];
-+		dev_info(dev->mt76.dev, "Ac0 --> %uus(%u)\n",
-+			 (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
-+		q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI];
-+		dev_info(dev->mt76.dev, "Ac1 --> %uus(%u)\n",
-+			 (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
-+		q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE];
-+		dev_info(dev->mt76.dev, "Ac2 --> %uus(%u)\n",
-+			 (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
-+		q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK];
-+		dev_info(dev->mt76.dev, "Ac3 --> %uus(%u)\n",
-+			 (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
-+	}
-+	else{
-+		for (i = 1; i < MT7915_WTBL_STA; i++) {
-+			wcid = rcu_dereference(dev->mt76.wcid[i]);
-+			if (!wcid || !wcid->sta)
-+				continue;
-+			msta = container_of(wcid, struct mt7915_sta, wcid);
-+			ieee80211_sta = container_of((void *)msta, struct ieee80211_sta,
-+						     drv_priv);
-+			dev_info(dev->mt76.dev, "%s: ****** sta%d: "MACSTR"******\n",
-+				 __func__, i, MAC2STR(ieee80211_sta->addr));
-+			q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO];
-+			dev_info(dev->mt76.dev, "Ac0 --> %uus(%u)\n",
-+				 (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
-+			q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI];
-+			dev_info(dev->mt76.dev, "Ac1 --> %uus(%u)\n",
-+				 (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
-+			q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE];
-+			dev_info(dev->mt76.dev, "Ac2 --> %uus(%u)\n",
-+				 (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
-+			q = msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK];
-+			dev_info(dev->mt76.dev, "Ac3 --> %uus(%u)\n",
-+				 (dev->vow_cfg.vow_sta_dwrr_quantum[q] << 8), q);
-+		}
-+	}
-+	return 0;
-+}
-+
-+static ssize_t
-+mt7915_vow_set(struct file *file, const char __user *user_buf,
-+		  size_t count, loff_t *ppos)
-+{
-+	struct mt7915_phy *phy = file->private_data;
-+	struct mt7915_dev *dev = phy->dev;
-+	u32 rv, param1, param2, param3;
-+	char buf[128];
-+	int ret = 0;
-+
-+	if (count >= sizeof(buf))
-+		return -EINVAL;
-+
-+	if (copy_from_user(buf, user_buf, count))
-+		return -EFAULT;
-+
-+	if (count && buf[count - 1] == '\n')
-+		buf[count - 1] = '\0';
-+	else
-+		buf[count] = '\0';
-+
-+	if (!strncmp(buf, "vow_sta_dwrr_quantum_id",
-+		strlen("vow_sta_dwrr_quantum_id")))
-+	{
-+		rv = sscanf(buf, "vow_sta_dwrr_quantum_id=%d-%d-%d",
-+			    &param1, &param2, &param3);
-+		if ((rv > 2) && (param2 < IEEE80211_NUM_ACS) &&
-+                    (param3 < VOW_WATF_LEVEL_NUM)) {
-+			ret = mt7915_set_vow_sta_dwrr_quantum_id(dev, param1,
-+								 param2, param3);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_atf_en", strlen("vow_atf_en")))
-+	{
-+		rv = sscanf(buf, "vow_atf_en=%d", &param1);
-+		if (rv > 0) {
-+			ret = mt7915_set_vow_atf_en(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_dwrr_max_wait_time",
-+		 strlen("vow_dwrr_max_wait_time")))
-+	{
-+		rv = sscanf(buf, "vow_dwrr_max_wait_time=%d", &param1);
-+		if (rv > 0) {
-+			ret = mt7915_set_vow_dwrr_max_wait_time(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_watf_en", strlen("vow_watf_en")))
-+	{
-+		rv = sscanf(buf, "vow_watf_en=%d", &param1);
-+		if (rv > 0) {
-+			ret = mt7915_set_vow_watf_en(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_watf_quantum",
-+		 strlen("vow_watf_quantum")))
-+	{
-+		rv = sscanf(buf, "vow_watf_quantum=%d-%d",
-+			    &param1, &param2);
-+		if ((dev->vow_cfg.vow_watf_en) && (rv > 1) &&
-+                    (param1 < VOW_WATF_LEVEL_NUM)) {
-+			ret = mt7915_set_vow_watf_quantum(dev, param1, param2);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_show_en", strlen("vow_show_en")))
-+	{
-+		rv = sscanf(buf, "vow_show_en=%d", &param1);
-+		if (rv > 0) {
-+			ret = mt7915_set_vow_show_en(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "vow_show_sta", strlen("vow_show_sta")))
-+	{
-+		rv = sscanf(buf, "vow_show_sta=%d", &param1);
-+		if ((rv > 0)&& (param1 < MT7915_WTBL_STA)) {
-+			ret = mt7915_set_vow_show_sta(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "show_vow_info", strlen("show_vow_info")))
-+	{
-+		if (rv == 0) {
-+			ret = mt7915_set_show_vow_info(dev);
-+		}
-+		else {
-+			dev_err(dev->mt76.dev, "show_vow_info\n");
-+			goto out;
-+		}
-+	}
-+	else if (!strncmp(buf, "show_vow_sta_conf", strlen("show_vow_sta_conf")))
-+	{
-+		rv = sscanf(buf, "show_vow_sta_conf=%d", &param1);
-+		if ((rv > 0) && (param1 < MT7915_WTBL_STA)) {
-+			ret = mt7915_show_vow_sta_conf(dev, param1);
-+		}
-+		else {
-+			goto out;
-+		}
-+	}
-+
-+	if (ret)
-+		return ret;
-+out:
-+	return count;
-+}
-+
-+static const struct file_operations mt7915_vow_ops = {
-+	.write = mt7915_vow_set,
-+	.read = mt7915_vow_get,
-+	.open = simple_open,
-+	.llseek = default_llseek,
-+};
-+
- static int
- mt7915_radar_trigger(void *data, u64 val)
- {
-@@ -1339,6 +1743,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
- 				    mt7915_twt_stats);
- 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
-+	debugfs_create_file("vow", 0600, dir, phy, &mt7915_vow_ops);
- 
- 	if (!dev->dbdc_support || phy->mt76->band_idx) {
- 		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
-diff --git a/mt7915/init.c b/mt7915/init.c
-old mode 100644
-new mode 100755
-index e044f50..ef752e1
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -563,10 +563,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
- 	}
- }
- 
-+void mt7915_vow_init(struct mt7915_dev *dev)
-+{
-+	struct mt7915_vow_cfg *vow_cfg = &dev->vow_cfg;
-+	bool ret;
-+	int i;
-+
-+	if (!(is_mt7915(&dev->mt76)))
-+		vow_cfg->vow_feature |= VOW_FEATURE_BWCG;
-+
-+	vow_cfg->vow_atf_en = 0x1;
-+	vow_cfg->sta_max_wait_time = 0x40;
-+	vow_cfg->refill_period = 0x5;
-+
-+	vow_cfg->vow_sta_dwrr_quantum[0] = 0x06;
-+	vow_cfg->vow_sta_dwrr_quantum[1] = 0x0c;
-+	vow_cfg->vow_sta_dwrr_quantum[2] = 0x10;
-+	vow_cfg->vow_sta_dwrr_quantum[3] = 0x14;
-+	vow_cfg->vow_sta_dwrr_quantum[4] = 0x18;
-+	vow_cfg->vow_sta_dwrr_quantum[5] = 0x1c;
-+	vow_cfg->vow_sta_dwrr_quantum[6] = 0x20;
-+	vow_cfg->vow_sta_dwrr_quantum[7] = 0x24;
-+
-+	ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
-+					  VOW_DRR_AIRTIME_DEFICIT_BOUND);
-+	ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
-+					  VOW_DRR_AIRTIME_QUANTUM_ALL);
-+
-+	for(i = 0; i < 4; i++)
-+		ret = mt7915_mcu_set_vow_drr_ctrl(dev, NULL,
-+						  VOW_DRR_AIRTIME_QUANTUM_L0 + i);
-+
-+	ret = mt7915_mcu_set_vow_feature_ctrl(dev);
-+	return;
-+}
-+
- void mt7915_mac_init(struct mt7915_dev *dev)
- {
- 	int i;
- 	u32 rx_len = is_mt7915(&dev->mt76) ? 0x400 : 0x680;
-+	struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
- 
- 	/* config pse qid6 wfdma port selection */
- 	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -588,6 +624,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
- 		mt7915_mac_init_band(dev, i);
- 
- 	mt7915_init_led_mux(dev);
-+
-+	if (mt7915_is_atf_default_on(wiphy, dev))
-+		mt7915_vow_init(dev);
- }
- 
- int mt7915_txbf_init(struct mt7915_dev *dev)
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 7dd3973..c87f04b 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -209,6 +209,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
- {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	struct mt7915_dev *dev = phy->dev;
-+	struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
- 	struct mt76_txq *mtxq;
- 	bool ext_phy = phy != &dev->phy;
- 	int idx, ret = 0;
-@@ -270,6 +271,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
- 	mt7915_mcu_add_sta(dev, vif, NULL, true);
- 	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
- 
-+	if (mt7915_is_atf_default_on(wiphy, dev))
-+		mt7915_mcu_set_vow_band(dev, mvif);
-+
- 	return ret;
- }
- 
-@@ -691,6 +695,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	bool ext_phy = mvif->phy != &dev->phy;
-+	struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
- #ifdef CONFIG_MTK_VENDOR
- 	struct mt7915_phy *phy;
- #endif
-@@ -742,6 +747,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 		mt7915_mcu_set_mimo(phy, 0);
- 	}
- #endif
-+	if (mt7915_is_atf_default_on(wiphy, dev)) {
-+		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO] = 2;
-+		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI] = 2;
-+		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE] = 1;
-+		msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK] = 0;
-+		mt7915_mcu_set_vow_drr_ctrl(dev, msta, VOW_DRR_STA_BSS_GROUP);
-+		mt7915_mcu_set_vow_drr_ctrl(dev, msta, VOW_DRR_STA_PAUSE_SETTING);
-+		mt7915_mcu_set_vow_drr_ctrl(dev, msta, VOW_DRR_STA_ALL);
-+	}
-+
- 	return 0;
- }
- 
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5b2ae77..029d7e3 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3533,6 +3533,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
- 				 &req, sizeof(req), false);
- }
- 
-+int mt7915_mcu_set_vow_drr_ctrl(struct mt7915_dev *dev,
-+                                struct mt7915_sta *msta,
-+                                u32 subcmd)
-+{
-+	u32 setting = 0;
-+	u32 i;
-+
-+	struct {
-+		__le32 action;
-+		u8 wlan_idx_lo;
-+		u8 status;
-+		u8 wlan_idx_hi;
-+		u8 rsv0[5];
-+		union {
-+			__le32 com_value;
-+			struct {
-+				u8 air_time_quantum[VOW_MAX_STA_DWRR_NUM];
-+			}air_time_quantum_all;
-+		}air_time_ctrl;
-+	} __packed req = {
-+		.action = cpu_to_le32(subcmd),
-+		.wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : to_wcid_lo(0x0),
-+		.wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : to_wcid_hi(0x0),
-+	};
-+
-+	switch (subcmd) {
-+		case VOW_DRR_STA_ALL:{
-+			setting |= 0x00;
-+			setting |= msta->vif->mt76.idx;
-+			setting |= msta->vow_sta_cfg.ac_change_rule << 4;
-+			setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO] << 8);
-+			setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI] << 12);
-+			setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE] << 16);
-+			setting |= (msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK] << 20);
-+			if (dev->vow_cfg.vow_feature & VOW_FEATURE_BWCG)
-+                                setting |= ((UMAC_BWC_GROUP_MIN) << 24);
-+			req.air_time_ctrl.com_value = cpu_to_le32(setting);
-+			break;
-+		}
-+
-+		case VOW_DRR_STA_BSS_GROUP:
-+			req.air_time_ctrl.com_value = cpu_to_le32(0x0);
-+			break;
-+
-+		case VOW_DRR_STA_PAUSE_SETTING:
-+			req.air_time_ctrl.com_value = cpu_to_le32(msta->vow_sta_cfg.paused);
-+			break;
-+
-+		case VOW_DRR_STA_AC0_QUA_ID:
-+			req.air_time_ctrl.com_value =
-+				cpu_to_le32(msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VO]);
-+			break;
-+
-+		case VOW_DRR_STA_AC1_QUA_ID:
-+			req.air_time_ctrl.com_value =
-+				cpu_to_le32(msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_VI]);
-+			break;
-+
-+		case VOW_DRR_STA_AC2_QUA_ID:
-+			req.air_time_ctrl.com_value =
-+				cpu_to_le32(msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BE]);
-+			break;
-+
-+		case VOW_DRR_STA_AC3_QUA_ID:
-+			req.air_time_ctrl.com_value =
-+				cpu_to_le32(msta->vow_sta_cfg.dwrr_quantum[IEEE80211_AC_BK]);
-+			break;
-+
-+		case VOW_DRR_AIRTIME_DEFICIT_BOUND:
-+			req.air_time_ctrl.com_value =
-+				cpu_to_le32(dev->vow_cfg.sta_max_wait_time);
-+			break;
-+
-+		case VOW_DRR_AIRTIME_QUANTUM_L0:
-+		case VOW_DRR_AIRTIME_QUANTUM_L1:
-+		case VOW_DRR_AIRTIME_QUANTUM_L2:
-+		case VOW_DRR_AIRTIME_QUANTUM_L3:
-+		case VOW_DRR_AIRTIME_QUANTUM_L4:
-+		case VOW_DRR_AIRTIME_QUANTUM_L5:
-+		case VOW_DRR_AIRTIME_QUANTUM_L6:
-+		case VOW_DRR_AIRTIME_QUANTUM_L7:
-+			req.air_time_ctrl.com_value =
-+				cpu_to_le32(dev->vow_cfg.vow_sta_dwrr_quantum[subcmd -
-+				            VOW_DRR_AIRTIME_QUANTUM_L0]);
-+			break;
-+
-+		case VOW_DRR_AIRTIME_QUANTUM_ALL: {
-+			for (i = 0; i < VOW_MAX_STA_DWRR_NUM; i++) {
-+				req.air_time_ctrl.air_time_quantum_all.air_time_quantum[i] =
-+					dev->vow_cfg.vow_sta_dwrr_quantum[i];
-+			}
-+			break;
-+		}
-+
-+		default:
-+			break;
-+	}
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_DRR_CTRL),
-+				 &req, sizeof(req), false);
-+}
-+
-+int mt7915_mcu_set_vow_feature_ctrl(struct mt7915_dev *dev)
-+{
-+	u16 value = 0;
-+	u32 sch_value = 0;
-+
-+	struct vow_feature_ctrl {
-+		__le16 bss_flag;
-+		__le16 vow_ctrl_flag;
-+		__le16 bss_value[9];
-+		__le16 vow_ctrl_val;
-+		__le16 time_token_value[2];
-+                __le16 length_token_value[2];
-+		__le32 tx_ctrl;
-+		__le32 sch_ctrl;
-+	} __packed req = {
-+		.bss_flag = cpu_to_le16(0xffff),
-+		.vow_ctrl_flag = cpu_to_le16(0xf231),
-+		.bss_value[0] = cpu_to_le16(0xffff),
-+		.bss_value[2] = cpu_to_le16(0xffff),
-+		.bss_value[8] = cpu_to_le16(0xffff),
-+		.time_token_value[0] = cpu_to_le16(0xffff),
-+	};
-+
-+	value |= dev->vow_cfg.refill_period;
-+	value |= 1 << 4;
-+	value |= 1 << 5;
-+	value |= dev->vow_cfg.vow_watf_en << 9;
-+	value |= 1 << 12;
-+	value |= dev->vow_cfg.vow_atf_en << 13;
-+	value |= 1 << 14;
-+	req.vow_ctrl_val = value;
-+	if (dev->vow_cfg.vow_atf_en)
-+		req.tx_ctrl = cpu_to_le32(0x6bf69e1f);
-+	sch_value |= 1 << 6;
-+	sch_value |= (((dev->vow_cfg.vow_show_en == 0) ? 0 :
-+                      (dev->vow_cfg.vow_show_en - 1 )) << 4);
-+	req.sch_ctrl = sch_value;
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_FEATURE_CTRL),
-+							 &req, sizeof(req), false);
-+}
-+
-+int mt7915_mcu_set_vow_band(struct mt7915_dev *dev, struct mt7915_vif *mvif)
-+{
-+	struct module_ctrl {
-+		__le16 action;
-+		__le16 sub_action;
-+		__le32 rsv1[5];
-+		u8 rsv2[72];
-+		u8 group_idx;
-+		u8 band_idx;
-+		u8 rsv3[2];
-+	} __packed req = {
-+		.action = cpu_to_le16(0x1),
-+		.sub_action = cpu_to_le16(0x4),
-+		.group_idx = mvif->mt76.band_idx * 4 + mvif->mt76.omac_idx % 4,
-+		.band_idx = mvif->mt76.band_idx,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(AT_PROC_MODULE),
-+				 &req, sizeof(req), false);
-+}
-+
- int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
- {
- #define MT_BF_PROCESSING	4
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2335f78..c3a0b32 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -127,6 +127,58 @@ struct mt7915_twt_flow {
- 
- DECLARE_EWMA(avg_signal, 10, 8)
- 
-+#define VOW_MAX_STA_DWRR_NUM    8
-+#define VOW_WATF_LEVEL_NUM      4
-+#define VOW_FEATURE_BWCG        BIT(3)
-+#define UMAC_BWC_GROUP_MIN      40
-+
-+
-+enum ext_cmd_vow_drr_ctrl {
-+	/* Type 1 */
-+	VOW_DRR_STA_ALL             	= 0x00,
-+	VOW_DRR_STA_BSS_GROUP           = 0x01,
-+	VOW_DRR_STA_AC0_QUA_ID      	= 0x03,
-+	VOW_DRR_STA_AC1_QUA_ID      	= 0x04,
-+	VOW_DRR_STA_AC2_QUA_ID      	= 0x05,
-+	VOW_DRR_STA_AC3_QUA_ID      	= 0x06,
-+
-+	/* Type 2 */
-+	VOW_DRR_AIRTIME_DEFICIT_BOUND   = 0x10,
-+
-+	/* Type 3 */
-+	VOW_DRR_AIRTIME_QUANTUM_L0  	= 0x20,
-+	VOW_DRR_AIRTIME_QUANTUM_L1  	= 0x21,
-+	VOW_DRR_AIRTIME_QUANTUM_L2  	= 0x22,
-+	VOW_DRR_AIRTIME_QUANTUM_L3  	= 0x23,
-+	VOW_DRR_AIRTIME_QUANTUM_L4  	= 0x24,
-+	VOW_DRR_AIRTIME_QUANTUM_L5  	= 0x25,
-+	VOW_DRR_AIRTIME_QUANTUM_L6  	= 0x26,
-+	VOW_DRR_AIRTIME_QUANTUM_L7  	= 0x27,
-+	VOW_DRR_AIRTIME_QUANTUM_ALL 	= 0x28,
-+	VOW_DRR_STA_PAUSE_SETTING       = 0x30,
-+};
-+
-+struct mt7915_vow_sta_cfg{
-+	u8 dwrr_quantum[IEEE80211_NUM_ACS];
-+	u8 ac_change_rule;
-+	bool paused;
-+};
-+
-+struct mt7915_vow_cfg{
-+	/*ATF setting */
-+	u32  vow_feature;
-+	bool vow_atf_en;
-+	u8   refill_period;
-+	u8   sta_max_wait_time;
-+	u8   vow_sta_dwrr_quantum[VOW_MAX_STA_DWRR_NUM];
-+	u8   vow_show_en;
-+	u32  vow_show_sta;
-+
-+	/*WATF setting */
-+	bool	vow_watf_en;
-+};
-+
-+
- struct mt7915_sta {
- 	struct mt76_wcid wcid; /* must be first */
- 
-@@ -148,6 +200,7 @@ struct mt7915_sta {
- 		u8 flowid_mask;
- 		struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
- 	} twt;
-+	struct mt7915_vow_sta_cfg vow_sta_cfg;
- };
- 
- struct mt7915_vif_cap {
-@@ -461,6 +514,8 @@ struct mt7915_dev {
- 	} dbg;
- 	const struct mt7915_dbg_reg_desc *dbg_reg;
- #endif
-+	struct delayed_work vow_work;
-+	struct mt7915_vow_cfg vow_cfg;
- };
- 
- enum {
-@@ -493,6 +548,15 @@ enum mt7915_rdd_cmd {
- 	RDD_IRQ_OFF,
- };
- 
-+static inline bool
-+mt7915_is_atf_default_on(struct wiphy *wiphy, struct mt7915_dev *dev)
-+{
-+	return ((!wiphy_ext_feature_isset(wiphy,
-+                NL80211_EXT_FEATURE_AIRTIME_FAIRNESS)) ||
-+                mtk_wed_device_active(&dev->mt76.mmio.wed));
-+}
-+
-+
- static inline struct mt7915_phy *
- mt7915_hw_phy(struct ieee80211_hw *hw)
- {
-@@ -621,6 +685,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
- int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
- 			      u8 en);
- int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
-+int mt7915_mcu_set_vow_drr_ctrl(struct mt7915_dev *dev, struct mt7915_sta *msta,
-+                                u32 subcmd);
-+int mt7915_mcu_set_vow_feature_ctrl(struct mt7915_dev *dev);
-+int mt7915_mcu_set_vow_band(struct mt7915_dev *dev, struct mt7915_vif *mvif);
- int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
- int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
- int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 919cae4..c8df2d0 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -1301,7 +1301,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
- };
- 
- 
--
- static char* sta_ctrl_reg[] = {"ENABLE", "DISABLE", "PAUSE"};
- static u32 chip_show_sta_acq_info(struct seq_file *s, struct mt7915_dev *dev, u32 *ple_stat,
- 				  u32 *sta_pause, u32 *dis_sta_map,
-@@ -1455,6 +1454,138 @@ static void chip_get_sta_pause(struct mt7915_dev *dev, u32 *sta_pause)
- 	}
- }
- 
-+u32 vow_chip_show_sta_acq_info(struct mt7915_dev *dev, u32 *ple_stat,
-+			       u32 *sta_pause, u32 *dis_sta_map,
-+			       u32 dumptxd)
-+{
-+	int i, j;
-+	u32 total_nonempty_cnt = 0;
-+	u32 ac_num = 9, all_ac_num;
-+	static char* sta_ctrl_reg[] = {"ENABLE", "DISABLE", "PAUSE"};
-+	if (!is_mt7915(&dev->mt76))
-+		ac_num = 17;
-+
-+	all_ac_num = ac_num * 4;
-+
-+	for (j = 0; j < all_ac_num; j++) { /* show AC Q info */
-+		for (i = 0; i < 32; i++) {
-+			if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
-+				u32 hfid, tfid, pktcnt, ac_n = j / ac_num, ctrl = 0;
-+				u32 sta_num = i + (j % ac_num) * 32, fl_que_ctrl[3] = {0};
-+				u32 wmmidx = 0;
-+				struct mt7915_sta *msta;
-+				struct mt76_wcid *wcid;
-+				struct ieee80211_sta *sta = NULL;
-+
-+				wcid = rcu_dereference(dev->mt76.wcid[sta_num]);
-+				sta = wcid_to_sta(wcid);
-+				if (!sta) {
-+					printk("ERROR!! no found STA wcid=%d\n", sta_num);
-+					continue;
-+				}
-+				msta = container_of(wcid, struct mt7915_sta, wcid);
-+				wmmidx = msta->vif->mt76.wmm_idx;
-+
-+				dev_info(dev->mt76.dev, "\tSTA%d AC%d: ", sta_num, ac_n);
-+
-+				fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
-+				fl_que_ctrl[0] |= (ENUM_UMAC_LMAC_PORT_2 <<
-+						   MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
-+				fl_que_ctrl[0] |= (ac_n << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
-+				fl_que_ctrl[0] |= sta_num;
-+				mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
-+				fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
-+				fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
-+				hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK,
-+						 fl_que_ctrl[1]);
-+				tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK,
-+						 fl_que_ctrl[1]);
-+				pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK,
-+						   fl_que_ctrl[2]);
-+				dev_info(dev->mt76.dev, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x",
-+					 tfid, hfid, pktcnt);
-+
-+				if (((sta_pause[j % 6] & 0x1 << i) >> i) == 1)
-+					ctrl = 2;
-+
-+				if (((dis_sta_map[j % 6] & 0x1 << i) >> i) == 1)
-+					ctrl = 1;
-+
-+				dev_info(dev->mt76.dev, " ctrl = %s", sta_ctrl_reg[ctrl]);
-+				dev_info(dev->mt76.dev, " (wmmidx=%d)\n", wmmidx);
-+
-+				total_nonempty_cnt++;
-+			}
-+		}
-+	}
-+
-+	return total_nonempty_cnt;
-+}
-+
-+int mt7915_vow_pleinfo_read(struct mt7915_dev *dev)
-+{
-+	u32 ple_stat[70] = {0}, pg_flow_ctrl[8] = {0};
-+	u32 ple_txcmd_stat;
-+	u32 sta_pause[CR_NUM_OF_AC] = {0}, dis_sta_map[CR_NUM_OF_AC] = {0};
-+	int i;
-+
-+	chip_get_ple_acq_stat(dev, ple_stat);
-+	ple_txcmd_stat = mt76_rr(dev, MT_DBG_PLE_TXCMD_Q_EMPTY);
-+	pg_flow_ctrl[0] = mt76_rr(dev, MT_DBG_PLE_FREEPG_CNT);
-+	pg_flow_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FREEPG_HEAD_TAIL);
-+	pg_flow_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_GROUP);
-+	pg_flow_ctrl[3] = mt76_rr(dev, MT_DBG_PLE_HIF_PG_INFO);
-+	pg_flow_ctrl[4] = mt76_rr(dev, MT_DBG_PLE_PG_CPU_GROUP);
-+	pg_flow_ctrl[5] = mt76_rr(dev, MT_DBG_PLE_CPU_PG_INFO);
-+	pg_flow_ctrl[6] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_TXCMD_GROUP);
-+	pg_flow_ctrl[7] = mt76_rr(dev, MT_DBG_PLE_HIF_TXCMD_PG_INFO);
-+	chip_get_dis_sta_map(dev, dis_sta_map);
-+	chip_get_sta_pause(dev, sta_pause);
-+
-+	dev_info(dev->mt76.dev, "PLE Configuration Info:\n");
-+
-+	for (i = 0; i < 32; i++) {
-+		if (((ple_stat[0] & (0x1 << i)) >> i) == 0) {
-+			u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
-+
-+			if (ple_queue_empty_info[i].QueueName != NULL) {
-+				fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
-+				fl_que_ctrl[0] |= (ple_queue_empty_info[i].Portid <<
-+						   MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
-+				fl_que_ctrl[0] |= (ple_queue_empty_info[i].Queueid <<
-+						   MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
-+			} else
-+				continue;
-+
-+			if (ple_queue_empty_info[i].Queueid >=
-+			    ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0 &&
-+		            ple_queue_empty_info[i].Queueid <=
-+			    ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0)
-+			    /* band0 set TGID 0, bit31 = 0 */
-+			    mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x0);
-+			else if (ple_queue_empty_info[i].Queueid >=
-+				 ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1 &&
-+				 ple_queue_empty_info[i].Queueid <=
-+				 ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1)
-+				/* band1 set TGID 1, bit31 = 1 */
-+				mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x80000000);
-+
-+			mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
-+			fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
-+			fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
-+			hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK,
-+					 fl_que_ctrl[1]);
-+			tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK,
-+					 fl_que_ctrl[1]);
-+			pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK,
-+					   fl_que_ctrl[2]);
-+		}
-+	}
-+
-+	vow_chip_show_sta_acq_info(dev, ple_stat, sta_pause, dis_sta_map, 0);
-+
-+	return 0;
-+}
- static int mt7915_pleinfo_read(struct seq_file *s, void *data)
- {
- 	struct mt7915_dev *dev = dev_get_drvdata(s->private);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
deleted file mode 100644
index 2e0fb38..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 7457368e57931875b9cf7e40014b2aad294ef4d1 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 2 Dec 2022 17:17:06 +0800
-Subject: [PATCH 3011/3013] mt76: mt7915: wed: add mt7916 2 pcie support when
- wed on
-
-It should use bit 23 in interrupt mask for wfdma band1 data
-for 2 pcie mt7916, and use bit 19 for  band1 data for 1 pcie.
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- mt7915/dma.c  |  8 ++++++--
- mt7915/mcu.c  |  3 ++-
- mt7915/mmio.c | 10 +++++-----
- 3 files changed, 13 insertions(+), 8 deletions(-)
-
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 1ae6c33..3626008 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -88,8 +88,12 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
- 				   MT7916_RXQ_BAND0);
- 			RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MT7916,
- 				   MT7916_RXQ_MCU_WA);
--			RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_WED_RX_DONE_BAND1_MT7916,
--				   MT7916_RXQ_BAND1);
-+			if (dev->hif2)
-+				RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1_MT7916,
-+					   MT7916_RXQ_BAND1);
-+			else
-+				RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_WED_RX_DONE_BAND1_MT7916,
-+					   MT7916_RXQ_BAND1);
- 			RXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MAIN_MT7916,
- 				   MT7916_RXQ_MCU_WA_MAIN);
- 			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 029d7e3..387967d 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2365,7 +2365,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
- 		return ret;
- 
- 	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
--		if (is_mt7915(&dev->mt76))
-+		if (is_mt7915(&dev->mt76) ||
-+		    !mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
- 			ret = mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY),
- 						0, 0, 0);
- 		else
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b29fe7a..4bc8e8c 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -966,13 +966,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
- 	struct mt7915_dev *dev = dev_instance;
- 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
- 
--	if (mtk_wed_device_active(wed)) {
-+	if (mtk_wed_device_active(wed))
- 		mtk_wed_device_irq_set_mask(wed, 0);
--	} else {
-+	else
- 		mt76_wr(dev, MT_INT_MASK_CSR, 0);
--		if (dev->hif2)
--			mt76_wr(dev, MT_INT1_MASK_CSR, 0);
--	}
-+
-+	if (dev->hif2)
-+		mt76_wr(dev, MT_INT1_MASK_CSR, 0);
- 
- 	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
- 		return IRQ_NONE;
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
deleted file mode 100644
index 0b3383a..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
+++ /dev/null
@@ -1,499 +0,0 @@
-From 4ea9663e3a1dbfef0ab30ea37a749c58b7c71e2e Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Wed, 21 Dec 2022 09:47:01 +0800
-Subject: [PATCH 3012/3013] mt76: mt7915: wed: add rxwi for further in chip rro
- development
-
----
- dma.c           | 98 +++++++++++++++++++++++++------------------------
- mac80211.c      |  2 +-
- mt76.h          | 24 +++++++-----
- mt7915/dma.c    |  2 -
- mt7915/mmio.c   | 21 ++++++-----
- mt7915/mt7915.h |  1 +
- tx.c            | 16 ++++----
- 7 files changed, 86 insertions(+), 78 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 0914266..7ef272e 100644
---- a/dma.c
-+++ b/dma.c
-@@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
- 	return t;
- }
- 
--static struct mt76_txwi_cache *
-+static struct mt76_rxwi_cache *
- mt76_alloc_rxwi(struct mt76_dev *dev)
- {
--	struct mt76_txwi_cache *t;
-+	struct mt76_rxwi_cache *r;
- 
--	t = kzalloc(L1_CACHE_ALIGN(sizeof(*t)), GFP_ATOMIC);
--	if (!t)
-+	r = kzalloc(L1_CACHE_ALIGN(sizeof(*r)), GFP_ATOMIC);
-+	if (!r)
- 		return NULL;
- 
--	t->ptr = NULL;
--	return t;
-+	r->ptr = NULL;
-+	return r;
- }
- 
- static struct mt76_txwi_cache *
-@@ -88,20 +88,20 @@ __mt76_get_txwi(struct mt76_dev *dev)
- 	return t;
- }
- 
--static struct mt76_txwi_cache *
-+static struct mt76_rxwi_cache *
- __mt76_get_rxwi(struct mt76_dev *dev)
- {
--	struct mt76_txwi_cache *t = NULL;
-+	struct mt76_rxwi_cache *r = NULL;
- 
--	spin_lock(&dev->wed_lock);
-+	spin_lock(&dev->lock);
- 	if (!list_empty(&dev->rxwi_cache)) {
--		t = list_first_entry(&dev->rxwi_cache, struct mt76_txwi_cache,
-+		r = list_first_entry(&dev->rxwi_cache, struct mt76_rxwi_cache,
- 				     list);
--		list_del(&t->list);
-+		list_del(&r->list);
- 	}
--	spin_unlock(&dev->wed_lock);
-+	spin_unlock(&dev->lock);
- 
--	return t;
-+	return r;
- }
- 
- static struct mt76_txwi_cache *
-@@ -115,13 +115,13 @@ mt76_get_txwi(struct mt76_dev *dev)
- 	return mt76_alloc_txwi(dev);
- }
- 
--struct mt76_txwi_cache *
-+struct mt76_rxwi_cache *
- mt76_get_rxwi(struct mt76_dev *dev)
- {
--	struct mt76_txwi_cache *t = __mt76_get_rxwi(dev);
-+	struct mt76_rxwi_cache *r = __mt76_get_rxwi(dev);
- 
--	if (t)
--		return t;
-+	if (r)
-+		return r;
- 
- 	return mt76_alloc_rxwi(dev);
- }
-@@ -140,14 +140,14 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
- EXPORT_SYMBOL_GPL(mt76_put_txwi);
- 
- void
--mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
-+mt76_put_rxwi(struct mt76_dev *dev, struct mt76_rxwi_cache *r)
- {
--	if (!t)
-+	if (!r)
- 		return;
- 
--	spin_lock(&dev->wed_lock);
--	list_add(&t->list, &dev->rxwi_cache);
--	spin_unlock(&dev->wed_lock);
-+	spin_lock(&dev->lock);
-+	list_add(&r->list, &dev->rxwi_cache);
-+	spin_unlock(&dev->lock);
- }
- EXPORT_SYMBOL_GPL(mt76_put_rxwi);
- 
-@@ -168,13 +168,13 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
- void
- mt76_free_pending_rxwi(struct mt76_dev *dev)
- {
--	struct mt76_txwi_cache *t;
-+	struct mt76_rxwi_cache *r;
- 
- 	local_bh_disable();
--	while ((t = __mt76_get_rxwi(dev)) != NULL) {
--		if (t->ptr)
--			skb_free_frag(t->ptr);
--		kfree(t);
-+	while ((r = __mt76_get_rxwi(dev)) != NULL) {
-+		if (r->ptr)
-+			skb_free_frag(r->ptr);
-+		kfree(r);
- 	}
- 	local_bh_enable();
- }
-@@ -209,7 +209,7 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
- static int
- mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 		 struct mt76_queue_buf *buf, int nbufs, u32 info,
--		 struct sk_buff *skb, void *txwi)
-+		 struct sk_buff *skb, void *txwi, void *rxwi)
- {
- 	struct mt76_queue_entry *entry;
- 	struct mt76_desc *desc;
-@@ -227,13 +227,13 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 
- 		if ((q->flags & MT_QFLAG_WED) &&
- 		    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
--			struct mt76_txwi_cache *t = txwi;
-+			struct mt76_rxwi_cache *r = rxwi;
- 			int rx_token;
- 
--			if (!t)
-+			if (!r)
- 				return -ENOMEM;
- 
--			rx_token = mt76_rx_token_consume(dev, (void *)skb, t,
-+			rx_token = mt76_rx_token_consume(dev, (void *)skb, r,
- 							 buf[0].addr);
- 			if (rx_token < 0)
- 				return -ENOMEM;
-@@ -280,6 +280,7 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 	}
- 
- 	q->entry[idx].txwi = txwi;
-+	q->entry[idx].rxwi = rxwi;
- 	q->entry[idx].skb = skb;
- 	q->entry[idx].wcid = 0xffff;
- 
-@@ -379,13 +380,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 		u32 id, find = 0;
- 		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
- 				      le32_to_cpu(desc->buf1));
--		struct mt76_txwi_cache *t;
-+		struct mt76_rxwi_cache *r;
- 
- 		if (*more) {
- 			spin_lock_bh(&dev->rx_token_lock);
- 
--			idr_for_each_entry(&dev->rx_token, t, id) {
--				if (t->dma_addr == le32_to_cpu(desc->buf0)) {
-+			idr_for_each_entry(&dev->rx_token, r, id) {
-+				if (r->dma_addr == le32_to_cpu(desc->buf0)) {
- 					find = 1;
- 					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
- 					token = id;
-@@ -398,11 +399,11 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 				return NULL;
- 		}
- 
--		t = mt76_rx_token_release(dev, token);
--		if (!t)
-+		r = mt76_rx_token_release(dev, token);
-+		if (!r)
- 			return NULL;
- 
--		dma_unmap_single(dev->dma_dev, t->dma_addr,
-+		dma_unmap_single(dev->dma_dev, r->dma_addr,
- 				 SKB_WITH_OVERHEAD(q->buf_size),
- 				 DMA_FROM_DEVICE);
- 
-@@ -410,10 +411,10 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 		if (!buf)
- 			return NULL;
- 
--		memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
--		t->dma_addr = 0;
-+		memcpy(buf, r->ptr, SKB_WITH_OVERHEAD(q->buf_size));
-+		r->dma_addr = 0;
- 
--		mt76_put_rxwi(dev, t);
-+		mt76_put_rxwi(dev, r);
- 
- 		if (drop) {
- 			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-@@ -481,7 +482,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
- 	buf.len = skb->len;
- 
- 	spin_lock_bh(&q->lock);
--	mt76_dma_add_buf(dev, q, &buf, 1, tx_info, skb, NULL);
-+	mt76_dma_add_buf(dev, q, &buf, 1, tx_info, skb, NULL, NULL);
- 	mt76_dma_kick_queue(dev, q);
- 	spin_unlock_bh(&q->lock);
- 
-@@ -558,7 +559,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
- 		goto unmap;
- 
- 	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
--				tx_info.info, tx_info.skb, t);
-+				tx_info.info, tx_info.skb, t, NULL);
- 
- unmap:
- 	for (n--; n > 0; n--)
-@@ -598,20 +599,21 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	spin_lock_bh(&q->lock);
- 
- 	while (q->queued < q->ndesc - 1) {
--		struct mt76_txwi_cache *t = NULL;
-+		struct mt76_rxwi_cache *r = NULL;
- 		struct mt76_queue_buf qbuf;
- 		bool skip_alloc = false;
- 		void *buf = NULL;
- 
- 		if ((q->flags & MT_QFLAG_WED) &&
- 		    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
--			t = mt76_get_rxwi(dev);
--			if (!t)
-+			r = mt76_get_rxwi(dev);
-+			if (!r)
- 				break;
- 
--			if (t->ptr) {
-+			/* reuse skb buf for wed rx copy*/
-+			if (r->ptr) {
- 				skip_alloc = true;
--				buf = t->ptr;
-+				buf = r->ptr;
- 			}
- 		}
- 
-@@ -630,7 +632,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		qbuf.addr = addr + offset;
- 		qbuf.len = len - offset;
- 		qbuf.skip_unmap = false;
--		if (mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, t) < 0) {
-+		if (mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL, r) < 0) {
- 			dma_unmap_single(dev->dma_dev, addr, len,
- 					 DMA_FROM_DEVICE);
- 			skb_free_frag(buf);
-diff --git a/mac80211.c b/mac80211.c
-index de9ef23..818f4f0 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -597,7 +597,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
- 	spin_lock_init(&dev->lock);
- 	spin_lock_init(&dev->cc_lock);
- 	spin_lock_init(&dev->status_lock);
--	spin_lock_init(&dev->wed_lock);
- 	mutex_init(&dev->mutex);
- 	init_waitqueue_head(&dev->tx_wait);
- 
-@@ -628,6 +627,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
- 	INIT_LIST_HEAD(&dev->txwi_cache);
- 	INIT_LIST_HEAD(&dev->rxwi_cache);
- 	dev->token_size = dev->drv->token_size;
-+	dev->rx_token_size = dev->drv->rx_token_size;
- 
- 	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
- 		skb_queue_head_init(&dev->rx_skb[i]);
-diff --git a/mt76.h b/mt76.h
-index b10a16f..631c4cc 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -166,6 +166,7 @@ struct mt76_queue_entry {
- 	};
- 	union {
- 		struct mt76_txwi_cache *txwi;
-+		struct mt76_rxwi_cache *rxwi;
- 		struct urb *urb;
- 		int buf_sz;
- 	};
-@@ -354,10 +355,15 @@ struct mt76_txwi_cache {
- 	struct list_head list;
- 	dma_addr_t dma_addr;
- 
--	union {
--		struct sk_buff *skb;
--		void *ptr;
--	};
-+	struct sk_buff *skb;
-+};
-+
-+struct mt76_rxwi_cache {
-+	struct list_head list;
-+	dma_addr_t dma_addr;
-+
-+	void *ptr;
-+	u32 token;
- };
- 
- struct mt76_rx_tid {
-@@ -441,6 +447,7 @@ struct mt76_driver_ops {
- 	u16 txwi_size;
- 	u16 token_size;
- 	u8 mcs_rates;
-+	u16 rx_token_size;
- 
- 	void (*update_survey)(struct mt76_phy *phy);
- 
-@@ -809,7 +816,6 @@ struct mt76_dev {
- 
- 	struct ieee80211_hw *hw;
- 
--	spinlock_t wed_lock;
- 	spinlock_t lock;
- 	spinlock_t cc_lock;
- 
-@@ -1400,8 +1406,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
- }
- 
- void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
--void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
--struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
-+void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_rxwi_cache *r);
-+struct mt76_rxwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
- void mt76_free_pending_rxwi(struct mt76_dev *dev);
- void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
- 		      struct napi_struct *napi);
-@@ -1547,9 +1553,9 @@ struct mt76_txwi_cache *
- mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
- int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
- void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
--struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
-+struct mt76_rxwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
- int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
--			  struct mt76_txwi_cache *r, dma_addr_t phys);
-+			  struct mt76_rxwi_cache *r, dma_addr_t phys);
- 
- static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
- {
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 3626008..9cbd362 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -492,7 +492,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
- 			dev->mt76.q_rx[MT_RXQ_MAIN].flags =
- 				MT_WED_Q_RX(MT7915_RXQ_BAND0);
--			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
- 		}
- 
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
-@@ -529,7 +528,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 		    mtk_wed_get_rx_capa(&mdev->mmio.wed)) {
- 			dev->mt76.q_rx[MT_RXQ_BAND1].flags =
- 				MT_WED_Q_RX(MT7915_RXQ_BAND1);
--			dev->mt76.rx_token_size += MT7915_RX_RING_SIZE;
- 		}
- 
- 		/* rx data queue for band1 */
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 4bc8e8c..09b3973 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -605,18 +605,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- 
- 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
- 	for (i = 0; i < dev->mt76.rx_token_size; i++) {
--		struct mt76_txwi_cache *t;
-+		struct mt76_rxwi_cache *r;
- 
--		t = mt76_rx_token_release(&dev->mt76, i);
--		if (!t || !t->ptr)
-+		r = mt76_rx_token_release(&dev->mt76, i);
-+		if (!r || !r->ptr)
- 			continue;
- 
--		dma_unmap_single(dev->mt76.dma_dev, t->dma_addr,
-+		dma_unmap_single(dev->mt76.dma_dev, r->dma_addr,
- 				 wed->wlan.rx_size, DMA_FROM_DEVICE);
--		skb_free_frag(t->ptr);
--		t->ptr = NULL;
-+		skb_free_frag(r->ptr);
-+		r->ptr = NULL;
- 
--		mt76_put_rxwi(&dev->mt76, t);
-+		mt76_put_rxwi(&dev->mt76, r);
- 	}
- 
- 	mt76_free_pending_rxwi(&dev->mt76);
-@@ -641,7 +641,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 				sizeof(struct skb_shared_info));
- 
- 	for (i = 0; i < size; i++) {
--		struct mt76_txwi_cache *t = mt76_get_rxwi(&dev->mt76);
-+		struct mt76_rxwi_cache *r = mt76_get_rxwi(&dev->mt76);
- 		dma_addr_t phy_addr;
- 		int token;
- 		void *ptr;
-@@ -660,7 +660,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- 		}
- 
- 		desc->buf0 = cpu_to_le32(phy_addr);
--		token = mt76_rx_token_consume(&dev->mt76, ptr, t, phy_addr);
-+		token = mt76_rx_token_consume(&dev->mt76, ptr, r, phy_addr);
- 		if (token < 0) {
- 			dma_unmap_single(dev->mt76.dma_dev, phy_addr,
- 					 wed->wlan.rx_size, DMA_TO_DEVICE);
-@@ -788,7 +788,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
- 	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
- 
--	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
-+	dev->mt76.rx_token_size += wed->wlan.rx_npkt;
- 
- 	if (mtk_wed_device_attach(wed))
- 		return 0;
-@@ -994,6 +994,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
- 				SURVEY_INFO_TIME_RX |
- 				SURVEY_INFO_TIME_BSS_RX,
- 		.token_size = MT7915_TOKEN_SIZE,
-+		.rx_token_size = MT7915_RX_TOKEN_SIZE,
- 		.tx_prepare_skb = mt7915_tx_prepare_skb,
- 		.tx_complete_skb = mt76_connac_tx_complete_skb,
- 		.rx_skb = mt7915_queue_rx_skb,
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c3a0b32..91b98ed 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -57,6 +57,7 @@
- #define MT7915_EEPROM_BLOCK_SIZE	16
- #define MT7915_TOKEN_SIZE		8192
- #define MT7915_HW_TOKEN_SIZE		7168
-+#define MT7915_RX_TOKEN_SIZE		4096
- 
- #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
- #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
-diff --git a/tx.c b/tx.c
-index 6d55566..a72b777 100644
---- a/tx.c
-+++ b/tx.c
-@@ -756,16 +756,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
- EXPORT_SYMBOL_GPL(mt76_token_consume);
- 
- int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
--			  struct mt76_txwi_cache *t, dma_addr_t phys)
-+			  struct mt76_rxwi_cache *r, dma_addr_t phys)
- {
- 	int token;
- 
- 	spin_lock_bh(&dev->rx_token_lock);
--	token = idr_alloc(&dev->rx_token, t, 0, dev->rx_token_size,
-+	token = idr_alloc(&dev->rx_token, r, 0, dev->rx_token_size,
- 			  GFP_ATOMIC);
- 	if (token >= 0) {
--		t->ptr = ptr;
--		t->dma_addr = phys;
-+		r->ptr = ptr;
-+		r->dma_addr = phys;
- 	}
- 	spin_unlock_bh(&dev->rx_token_lock);
- 
-@@ -802,15 +802,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
- }
- EXPORT_SYMBOL_GPL(mt76_token_release);
- 
--struct mt76_txwi_cache *
-+struct mt76_rxwi_cache *
- mt76_rx_token_release(struct mt76_dev *dev, int token)
- {
--	struct mt76_txwi_cache *t;
-+	struct mt76_rxwi_cache *r;
- 
- 	spin_lock_bh(&dev->rx_token_lock);
--	t = idr_remove(&dev->rx_token, token);
-+	r = idr_remove(&dev->rx_token, token);
- 	spin_unlock_bh(&dev->rx_token_lock);
- 
--	return t;
-+	return r;
- }
- EXPORT_SYMBOL_GPL(mt76_rx_token_release);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch
deleted file mode 100644
index e7e1ce6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From e8340bcdb520bd5b5ddf860de81402359ad556b9 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 16 Dec 2022 12:16:40 +0800
-Subject: [PATCH 3013/3013] mt76: mt7915: wed: fix potential memory leakage
-
-release rx queue pages in mt7915_mmio_wed_release_rx_buf.
-recycle rxwi when mt76_dma_add_buf() call fails.
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- dma.c         | 16 ++++++++++------
- mt7915/mmio.c | 15 +++++++++++++++
- 2 files changed, 25 insertions(+), 6 deletions(-)
-
-diff --git a/dma.c b/dma.c
-index 7ef272e..0925daf 100644
---- a/dma.c
-+++ b/dma.c
-@@ -633,9 +633,11 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		qbuf.len = len - offset;
- 		qbuf.skip_unmap = false;
- 		if (mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL, r) < 0) {
-+			mt76_put_rxwi(dev, r);
- 			dma_unmap_single(dev->dma_dev, addr, len,
- 					 DMA_FROM_DEVICE);
--			skb_free_frag(buf);
-+			if (!skip_alloc)
-+				skb_free_frag(buf);
- 			break;
- 		}
- 		frames++;
-@@ -758,12 +760,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
- 	} while (1);
- 	spin_unlock_bh(&q->lock);
- 
--	if (!q->rx_page.va)
--		return;
-+	if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) != MT76_WED_Q_RX) {
-+		if (!q->rx_page.va)
-+			return;
- 
--	page = virt_to_page(q->rx_page.va);
--	__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
--	memset(&q->rx_page, 0, sizeof(q->rx_page));
-+		page = virt_to_page(q->rx_page.va);
-+		__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
-+		memset(&q->rx_page, 0, sizeof(q->rx_page));
-+	}
- }
- 
- static void
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 09b3973..419338c 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -621,12 +621,27 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
- 
- 	mt76_free_pending_rxwi(&dev->mt76);
- 
-+	mt76_for_each_q_rx(&dev->mt76, i) {
-+		if (FIELD_GET(MT_QFLAG_WED_TYPE,
-+			      dev->mt76.q_rx[i].flags) == MT76_WED_Q_RX) {
-+			struct mt76_queue *q = &dev->mt76.q_rx[i];
-+
-+			if (!q->rx_page.va)
-+				continue;
-+
-+			page = virt_to_page(q->rx_page.va);
-+			__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
-+			memset(&q->rx_page, 0, sizeof(q->rx_page));
-+		}
-+	}
-+
- 	if (!wed->rx_buf_ring.rx_page.va)
- 		return;
- 
- 	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
- 	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
- 	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
-+
- }
- 
- static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-mt7996-for-build-pass.patch
new file mode 100644
index 0000000..3f327fc
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-mt7996-for-build-pass.patch
@@ -0,0 +1,67 @@
+From c7c415e89ab0e47caa0d0a8d6b62bc179a16c35a Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Fri, 23 Dec 2022 17:28:03 +0800
+Subject: [PATCH 4001/4003] mt76: mt7996: for build pass
+
+---
+ debugfs.c    | 3 +++
+ dma.c        | 4 ++--
+ mt7996/dma.c | 4 ++--
+ 3 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/debugfs.c b/debugfs.c
+index 79064a4..e10d4cb 100644
+--- a/debugfs.c
++++ b/debugfs.c
+@@ -33,8 +33,11 @@ mt76_napi_threaded_set(void *data, u64 val)
+ 	if (!mt76_is_mmio(dev))
+ 		return -EOPNOTSUPP;
+ 
++#if 0
++	/* need to backport patch from networking stack */
+ 	if (dev->napi_dev.threaded != val)
+ 		return dev_set_threaded(&dev->napi_dev, val);
++#endif
+ 
+ 	return 0;
+ }
+diff --git a/dma.c b/dma.c
+index fc24b35..beb03cd 100644
+--- a/dma.c
++++ b/dma.c
+@@ -627,7 +627,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+ 
+ 	switch (type) {
+ 	case MT76_WED_Q_TX:
+-		ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs);
++		ret = mtk_wed_device_tx_ring_setup(wed, ring, q->regs, 0);
+ 		if (!ret)
+ 			q->wed_regs = wed->tx_ring[ring].reg_base;
+ 		break;
+@@ -643,7 +643,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+ 			q->wed_regs = wed->txfree_ring.reg_base;
+ 		break;
+ 	case MT76_WED_Q_RX:
+-		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs);
++		ret = mtk_wed_device_rx_ring_setup(wed, ring, q->regs, 0);
+ 		if (!ret)
+ 			q->wed_regs = wed->rx_ring[ring].reg_base;
+ 		break;
+diff --git a/mt7996/dma.c b/mt7996/dma.c
+index c09fe42..8c2e060 100644
+--- a/mt7996/dma.c
++++ b/mt7996/dma.c
+@@ -343,8 +343,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	netif_napi_add_tx(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
+-			  mt7996_poll_tx);
++	netif_tx_napi_add(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
++			  mt7996_poll_tx, NAPI_POLL_WEIGHT);
+ 	napi_enable(&dev->mt76.tx_napi);
+ 
+ 	mt7996_dma_enable(dev);
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-revert-get_of_mac_addr.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-revert-get_of_mac_addr.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-revert-get_of_mac_addr.patch
index 5fcce4a..ad2ac2e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-revert-get_of_mac_addr.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-revert-get_of_mac_addr.patch
@@ -1,17 +1,17 @@
-From 1b370c429b7193202f6b3df50bd72500b4ec4581 Mon Sep 17 00:00:00 2001
+From 4b50024ac0c221561d57a947fa6e76faf613c1a6 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:51:46 +0800
-Subject: [PATCH 4001/4003] mt76: revert get_of_mac_addr
+Subject: [PATCH 4002/4003] mt76: revert get_of_mac_addr
 
 ---
  eeprom.c | 8 +++++++-
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index d161264..1f29cf9 100644
+index 0a88048..680f76f 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -128,9 +128,15 @@ void
+@@ -106,9 +106,15 @@ void
  mt76_eeprom_override(struct mt76_phy *phy)
  {
  	struct mt76_dev *dev = phy->dev;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4003-mt76-include-header-files-for-module-param.patch
similarity index 67%
rename from recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-include-header-files-for-module-param.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/4003-mt76-include-header-files-for-module-param.patch
index 096a54f..6fc5e0b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-include-header-files-for-module-param.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4003-mt76-include-header-files-for-module-param.patch
@@ -1,14 +1,15 @@
-From c38e6c0b746781a43faa8a7391f45f8f1110117d Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 13 Dec 2022 10:38:13 +0800
-Subject: [PATCH 4002/4003] mt76: include header files for module param
+From 6ca19bb406e52edaed41d8ea84f67e872df113a4 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Fri, 23 Dec 2022 17:06:03 +0800
+Subject: [PATCH 4003/4003] mt76: include header files for module param
 
 ---
  mcu.c             | 1 +
  mt7615/mcu.c      | 1 +
  mt76_connac_mcu.c | 1 +
  mt7915/mcu.c      | 1 +
- 4 files changed, 4 insertions(+)
+ mt7996/mcu.c      | 1 +
+ 5 files changed, 5 insertions(+)
 
 diff --git a/mcu.c b/mcu.c
 index a8cafa3..fa4b054 100644
@@ -35,7 +36,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 14ce09e..d406013 100644
+index 5a047e6..b0dcc5a 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -47,7 +48,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 387967d..88ce44f 100644
+index 35441dc..56b5a24 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -58,6 +59,18 @@
  
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index d781c6e..37cf269 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -8,6 +8,7 @@
+ #include "mt7996.h"
+ #include "mcu.h"
+ #include "mac.h"
++#include <linux/moduleparam.h>
+ #include "eeprom.h"
+ 
+ struct mt7996_patch_hdr {
 -- 
 2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4003-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4003-mt76-revert-for-backports-5.15-wireless-stack.patch
deleted file mode 100644
index 4d23f61..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4003-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ /dev/null
@@ -1,1200 +0,0 @@
-From 13c942651ef9278a618507d1e4de8751e62f6105 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 12 Dec 2022 18:17:12 +0800
-Subject: [PATCH 4003/4003] mt76: revert for backports-5.15 wireless stack
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- debugfs.c         |   2 +
- dma.c             |   2 +-
- mac80211.c        |   4 +-
- mt7615/dma.c      |   4 +-
- mt7615/main.c     |   6 +-
- mt7615/mcu.c      |   8 +--
- mt76_connac_mcu.c | 108 +++++++++++++++---------------
- mt76x02_mac.c     |   6 +-
- mt7915/debugfs.c  |   4 +-
- mt7915/dma.c      |   4 +-
- mt7915/init.c     |   3 +-
- mt7915/mac.c      |   2 +-
- mt7915/main.c     |  10 +--
- mt7915/mcu.c      | 166 +++++++++++++++++++++++-----------------------
- mt7915/testmode.c |   8 +--
- tx.c              |  11 +--
- 16 files changed, 170 insertions(+), 178 deletions(-)
-
-diff --git a/debugfs.c b/debugfs.c
-index 79064a4..4a8e186 100644
---- a/debugfs.c
-+++ b/debugfs.c
-@@ -33,8 +33,10 @@ mt76_napi_threaded_set(void *data, u64 val)
- 	if (!mt76_is_mmio(dev))
- 		return -EOPNOTSUPP;
- 
-+#if 0 /* disable in backport 5.15 */
- 	if (dev->napi_dev.threaded != val)
- 		return dev_set_threaded(&dev->napi_dev, val);
-+#endif
- 
- 	return 0;
- }
-diff --git a/dma.c b/dma.c
-index 0925daf..08169ba 100644
---- a/dma.c
-+++ b/dma.c
-@@ -945,7 +945,7 @@ mt76_dma_init(struct mt76_dev *dev,
- 	dev->napi_dev.threaded = 1;
- 
- 	mt76_for_each_q_rx(dev, i) {
--		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
-+		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll, 64);
- 		mt76_dma_rx_fill(dev, &dev->q_rx[i]);
- 		napi_enable(&dev->napi[i]);
- 	}
-diff --git a/mac80211.c b/mac80211.c
-index 818f4f0..909ab25 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -1508,7 +1508,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
- static void
- __mt76_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
- {
--	if (vif->bss_conf.csa_active && ieee80211_beacon_cntdwn_is_complete(vif))
-+	if (vif->csa_active && ieee80211_beacon_cntdwn_is_complete(vif))
- 		ieee80211_csa_finish(vif);
- }
- 
-@@ -1530,7 +1530,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
- {
- 	struct mt76_dev *dev = priv;
- 
--	if (!vif->bss_conf.csa_active)
-+	if (!vif->csa_active)
- 		return;
- 
- 	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
-diff --git a/mt7615/dma.c b/mt7615/dma.c
-index f191443..ec729db 100644
---- a/mt7615/dma.c
-+++ b/mt7615/dma.c
-@@ -281,8 +281,8 @@ int mt7615_dma_init(struct mt7615_dev *dev)
- 	if (ret < 0)
- 		return ret;
- 
--	netif_napi_add_tx(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
--			  mt7615_poll_tx);
-+	netif_tx_napi_add(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
-+			  mt7615_poll_tx, NAPI_POLL_WEIGHT);
- 	napi_enable(&dev->mt76.tx_napi);
- 
- 	mt76_poll(dev, MT_WPDMA_GLO_CFG,
-diff --git a/mt7615/main.c b/mt7615/main.c
-index ab4c1b4..8fb5b25 100644
---- a/mt7615/main.c
-+++ b/mt7615/main.c
-@@ -474,7 +474,7 @@ static int mt7615_config(struct ieee80211_hw *hw, u32 changed)
- 
- static int
- mt7615_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--	       unsigned int link_id, u16 queue,
-+	       u16 queue,
- 	       const struct ieee80211_tx_queue_params *params)
- {
- 	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
-@@ -556,7 +556,7 @@ static void mt7615_configure_filter(struct ieee80211_hw *hw,
- static void mt7615_bss_info_changed(struct ieee80211_hw *hw,
- 				    struct ieee80211_vif *vif,
- 				    struct ieee80211_bss_conf *info,
--				    u64 changed)
-+				    u32 changed)
- {
- 	struct mt7615_dev *dev = mt7615_hw_dev(hw);
- 	struct mt7615_phy *phy = mt7615_hw_phy(hw);
-@@ -599,7 +599,7 @@ static void mt7615_bss_info_changed(struct ieee80211_hw *hw,
- 	}
- 
- 	if (changed & BSS_CHANGED_ASSOC)
--		mt7615_mac_set_beacon_filter(phy, vif, vif->cfg.assoc);
-+		mt7615_mac_set_beacon_filter(phy, vif, info->assoc);
- 
- 	mt7615_mutex_release(dev);
- }
-diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index e917d02..b2e1f38 100644
---- a/mt7615/mcu.c
-+++ b/mt7615/mcu.c
-@@ -353,7 +353,7 @@ out:
- static void
- mt7615_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
- {
--	if (vif->bss_conf.csa_active)
-+	if (vif->csa_active)
- 		ieee80211_csa_finish(vif);
- }
- 
-@@ -699,7 +699,7 @@ mt7615_mcu_add_beacon_offload(struct mt7615_dev *dev,
- 	if (!enable)
- 		goto out;
- 
--	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
-+	skb = ieee80211_beacon_get_template(hw, vif, &offs);
- 	if (!skb)
- 		return -EINVAL;
- 
-@@ -1074,7 +1074,7 @@ mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
- 	if (!enable)
- 		goto out;
- 
--	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
-+	skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs);
- 	if (!skb)
- 		return -EINVAL;
- 
-@@ -2526,7 +2526,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
- 		u8 pad;
- 	} req = {
- 		.bss_idx = mvif->mt76.idx,
--		.aid = cpu_to_le16(vif->cfg.aid),
-+		.aid = cpu_to_le16(vif->bss_conf.aid),
- 		.dtim_period = vif->bss_conf.dtim_period,
- 		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
- 	};
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index d406013..703ca73 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -197,7 +197,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
- 			      */
- 	} req = {
- 		.bss_idx = mvif->idx,
--		.ps_state = vif->cfg.ps ? 2 : 0,
-+		.ps_state = vif->bss_conf.ps ? 2 : 0,
- 	};
- 
- 	if (vif->type != NL80211_IFTYPE_STATION)
-@@ -409,7 +409,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
- 		else
- 			conn_type = CONNECTION_INFRA_AP;
- 		basic->conn_type = cpu_to_le32(conn_type);
--		basic->aid = cpu_to_le16(vif->cfg.aid);
-+		basic->aid = cpu_to_le16(vif->bss_conf.aid);
- 		break;
- 	case NL80211_IFTYPE_ADHOC:
- 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
-@@ -553,7 +553,7 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
- 
- 	if (sta) {
- 		if (vif->type == NL80211_IFTYPE_STATION)
--			generic->partial_aid = cpu_to_le16(vif->cfg.aid);
-+			generic->partial_aid = cpu_to_le16(vif->bss_conf.aid);
- 		else
- 			generic->partial_aid = cpu_to_le16(sta->aid);
- 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
-@@ -602,14 +602,14 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
- 	    vif->type != NL80211_IFTYPE_STATION)
- 		return;
- 
--	if (!sta->deflink.agg.max_amsdu_len)
-+	if (!sta->max_amsdu_len)
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
- 	amsdu = (struct sta_rec_amsdu *)tlv;
- 	amsdu->max_amsdu_num = 8;
- 	amsdu->amsdu_en = true;
--	amsdu->max_mpdu_size = sta->deflink.agg.max_amsdu_len >=
-+	amsdu->max_mpdu_size = sta->max_amsdu_len >=
- 			       IEEE80211_MAX_MPDU_LEN_VHT_7991;
- 
- 	wcid->amsdu = true;
-@@ -620,7 +620,7 @@ mt76_connac_mcu_sta_amsdu_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
- static void
- mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- {
--	struct ieee80211_sta_he_cap *he_cap = &sta->deflink.he_cap;
-+	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
- 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
- 	struct sta_rec_he *he;
- 	struct tlv *tlv;
-@@ -708,7 +708,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 
- 	he->he_cap = cpu_to_le32(cap);
- 
--	switch (sta->deflink.bandwidth) {
-+	switch (sta->bandwidth) {
- 	case IEEE80211_STA_RX_BW_160:
- 		if (elem->phy_cap_info[0] &
- 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -753,7 +753,7 @@ mt76_connac_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- static void
- mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
- {
--	struct ieee80211_sta_he_cap *he_cap = &sta->deflink.he_cap;
-+	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
- 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
- 	struct sta_rec_he_v2 *he;
- 	struct tlv *tlv;
-@@ -764,7 +764,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
- 	memcpy(he->he_phy_cap, elem->phy_cap_info, sizeof(he->he_phy_cap));
- 	memcpy(he->he_mac_cap, elem->mac_cap_info, sizeof(he->he_mac_cap));
- 
--	switch (sta->deflink.bandwidth) {
-+	switch (sta->bandwidth) {
- 	case IEEE80211_STA_RX_BW_160:
- 		if (elem->phy_cap_info[0] &
- 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -780,7 +780,7 @@ mt76_connac_mcu_sta_he_tlv_v2(struct sk_buff *skb, struct ieee80211_sta *sta)
- 		break;
- 	}
- 
--	he->pkt_ext = IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_16US;
-+	he->pkt_ext = IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US;
- }
- 
- static u8
-@@ -793,9 +793,9 @@ mt76_connac_get_phy_mode_v2(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 	u8 mode = 0;
- 
- 	if (sta) {
--		ht_cap = &sta->deflink.ht_cap;
--		vht_cap = &sta->deflink.vht_cap;
--		he_cap = &sta->deflink.he_cap;
-+		ht_cap = &sta->ht_cap;
-+		vht_cap = &sta->vht_cap;
-+		he_cap = &sta->he_cap;
- 	} else {
- 		struct ieee80211_supported_band *sband;
- 
-@@ -844,25 +844,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
- 	u16 supp_rates;
- 
- 	/* starec ht */
--	if (sta->deflink.ht_cap.ht_supported) {
-+	if (sta->ht_cap.ht_supported) {
- 		struct sta_rec_ht *ht;
- 
- 		tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
- 		ht = (struct sta_rec_ht *)tlv;
--		ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
-+		ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
- 	}
- 
- 	/* starec vht */
--	if (sta->deflink.vht_cap.vht_supported) {
-+	if (sta->vht_cap.vht_supported) {
- 		struct sta_rec_vht *vht;
- 		int len;
- 
- 		len = is_mt7921(dev) ? sizeof(*vht) : sizeof(*vht) - 4;
- 		tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, len);
- 		vht = (struct sta_rec_vht *)tlv;
--		vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
--		vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
--		vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
-+		vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
-+		vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
-+		vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
- 	}
- 
- 	/* starec uapsd */
-@@ -871,11 +871,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
- 	if (!is_mt7921(dev))
- 		return;
- 
--	if (sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he)
-+	if (sta->ht_cap.ht_supported || sta->he_cap.has_he)
- 		mt76_connac_mcu_sta_amsdu_tlv(skb, sta, vif);
- 
- 	/* starec he */
--	if (sta->deflink.he_cap.has_he) {
-+	if (sta->he_cap.has_he) {
- 		mt76_connac_mcu_sta_he_tlv(skb, sta);
- 		mt76_connac_mcu_sta_he_tlv_v2(skb, sta);
- 		if (band == NL80211_BAND_6GHZ &&
-@@ -885,7 +885,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
- 			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
- 						      sizeof(*he_6g_capa));
- 			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
--			he_6g_capa->capa = sta->deflink.he_6ghz_capa.capa;
-+			he_6g_capa->capa = sta->he_6ghz_capa.capa;
- 		}
- 	}
- 
-@@ -895,14 +895,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
- 	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
- 	phy->rcpi = rcpi;
- 	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
--				sta->deflink.ht_cap.ampdu_factor) |
-+				sta->ht_cap.ampdu_factor) |
- 		     FIELD_PREP(IEEE80211_HT_AMPDU_PARM_DENSITY,
--				sta->deflink.ht_cap.ampdu_density);
-+				sta->ht_cap.ampdu_density);
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
- 	ra_info = (struct sta_rec_ra_info *)tlv;
- 
--	supp_rates = sta->deflink.supp_rates[band];
-+	supp_rates = sta->supp_rates[band];
- 	if (band == NL80211_BAND_2GHZ)
- 		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
- 			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
-@@ -911,18 +911,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
- 
- 	ra_info->legacy = cpu_to_le16(supp_rates);
- 
--	if (sta->deflink.ht_cap.ht_supported)
-+	if (sta->ht_cap.ht_supported)
- 		memcpy(ra_info->rx_mcs_bitmask,
--		       sta->deflink.ht_cap.mcs.rx_mask,
-+		       sta->ht_cap.mcs.rx_mask,
- 		       HT_MCS_MASK_NUM);
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_STATE, sizeof(*state));
- 	state = (struct sta_rec_state *)tlv;
- 	state->state = sta_state;
- 
--	if (sta->deflink.vht_cap.vht_supported) {
--		state->vht_opmode = sta->deflink.bandwidth;
--		state->vht_opmode |= (sta->deflink.rx_nss - 1) <<
-+	if (sta->vht_cap.vht_supported) {
-+		state->vht_opmode = sta->bandwidth;
-+		state->vht_opmode |= (sta->rx_nss - 1) <<
- 			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
- 	}
- }
-@@ -938,7 +938,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
- 	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
- 					     wtbl_tlv, sta_wtbl);
- 	smps = (struct wtbl_smps *)tlv;
--	smps->smps = (sta->deflink.smps_mode == IEEE80211_SMPS_DYNAMIC);
-+	smps->smps = (sta->smps_mode == IEEE80211_SMPS_DYNAMIC);
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
- 
-@@ -950,27 +950,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
- 	struct tlv *tlv;
- 	u32 flags = 0;
- 
--	if (sta->deflink.ht_cap.ht_supported || sta->deflink.he_6ghz_capa.capa) {
-+	if (sta->ht_cap.ht_supported || sta->he_6ghz_capa.capa) {
- 		tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_HT, sizeof(*ht),
- 						     wtbl_tlv, sta_wtbl);
- 		ht = (struct wtbl_ht *)tlv;
- 		ht->ldpc = ht_ldpc &&
--			   !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
-+			   !!(sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING);
- 
--		if (sta->deflink.ht_cap.ht_supported) {
--			ht->af = sta->deflink.ht_cap.ampdu_factor;
--			ht->mm = sta->deflink.ht_cap.ampdu_density;
-+		if (sta->ht_cap.ht_supported) {
-+			ht->af = sta->ht_cap.ampdu_factor;
-+			ht->mm = sta->ht_cap.ampdu_density;
- 		} else {
--			ht->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
-+			ht->af = le16_get_bits(sta->he_6ghz_capa.capa,
- 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
--			ht->mm = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
-+			ht->mm = le16_get_bits(sta->he_6ghz_capa.capa,
- 					       IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START);
- 		}
- 
- 		ht->ht = true;
- 	}
- 
--	if (sta->deflink.vht_cap.vht_supported || sta->deflink.he_6ghz_capa.capa) {
-+	if (sta->vht_cap.vht_supported || sta->he_6ghz_capa.capa) {
- 		struct wtbl_vht *vht;
- 		u8 af;
- 
-@@ -979,18 +979,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
- 						     sta_wtbl);
- 		vht = (struct wtbl_vht *)tlv;
- 		vht->ldpc = vht_ldpc &&
--			    !!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
-+			    !!(sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC);
- 		vht->vht = true;
- 
- 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
--			       sta->deflink.vht_cap.cap);
-+			       sta->vht_cap.cap);
- 		if (ht)
- 			ht->af = max(ht->af, af);
- 	}
- 
- 	mt76_connac_mcu_wtbl_smps_tlv(skb, sta, sta_wtbl, wtbl_tlv);
- 
--	if (is_connac_v1(dev) && sta->deflink.ht_cap.ht_supported) {
-+	if (is_connac_v1(dev) && sta->ht_cap.ht_supported) {
- 		/* sgi */
- 		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
- 			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
-@@ -1000,15 +1000,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
- 						     sizeof(*raw), wtbl_tlv,
- 						     sta_wtbl);
- 
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
-+		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
- 			flags |= MT_WTBL_W5_SHORT_GI_20;
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
-+		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
- 			flags |= MT_WTBL_W5_SHORT_GI_40;
- 
--		if (sta->deflink.vht_cap.vht_supported) {
--			if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
-+		if (sta->vht_cap.vht_supported) {
-+			if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
- 				flags |= MT_WTBL_W5_SHORT_GI_80;
--			if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
-+			if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
- 				flags |= MT_WTBL_W5_SHORT_GI_160;
- 		}
- 		raw = (struct wtbl_raw *)tlv;
-@@ -1294,9 +1294,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
- 		return 0x38;
- 
- 	if (sta) {
--		ht_cap = &sta->deflink.ht_cap;
--		vht_cap = &sta->deflink.vht_cap;
--		he_cap = &sta->deflink.he_cap;
-+		ht_cap = &sta->ht_cap;
-+		vht_cap = &sta->vht_cap;
-+		he_cap = &sta->he_cap;
- 	} else {
- 		struct ieee80211_supported_band *sband;
- 
-@@ -1616,7 +1616,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
- 	for (i = 0; i < sreq->n_ssids; i++) {
- 		if (!sreq->ssids[i].ssid_len)
- 			continue;
--
- 		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
- 		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
- 		       sreq->ssids[i].ssid_len);
-@@ -1749,7 +1748,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
- 		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
- 		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
- 	}
--
- 	req->match_num = sreq->n_match_sets;
- 	for (i = 0; i < req->match_num; i++) {
- 		match = &sreq->match_sets[i];
-@@ -2236,10 +2234,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
- 				      struct mt76_vif *vif,
- 				      struct ieee80211_bss_conf *info)
- {
--	struct ieee80211_vif *mvif = container_of(info, struct ieee80211_vif,
--						  bss_conf);
- 	struct sk_buff *skb;
--	int i, len = min_t(int, mvif->cfg.arp_addr_cnt,
-+	int i, len = min_t(int, info->arp_addr_cnt,
- 			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
- 	struct {
- 		struct {
-@@ -2267,7 +2263,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
- 
- 	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
- 	for (i = 0; i < len; i++)
--		skb_put_data(skb, &mvif->cfg.arp_addr_list[i], sizeof(__be32));
-+		skb_put_data(skb, &info->arp_addr_list[i], sizeof(__be32));
- 
- 	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
- }
-diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-index d3f7447..87ea3db 100644
---- a/mt76x02_mac.c
-+++ b/mt76x02_mac.c
-@@ -404,7 +404,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
- 		txwi->rate |= cpu_to_le16(MT_RXWI_RATE_LDPC);
- 	if ((info->flags & IEEE80211_TX_CTL_STBC) && nss == 1)
- 		txwi->rate |= cpu_to_le16(MT_RXWI_RATE_STBC);
--	if (nss > 1 && sta && sta->deflink.smps_mode == IEEE80211_SMPS_DYNAMIC)
-+	if (nss > 1 && sta && sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
- 		txwi_flags |= MT_TXWI_FLAGS_MMPS;
- 	if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
- 		txwi->ack_ctl |= MT_TXWI_ACK_CTL_REQ;
-@@ -412,9 +412,9 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
- 		txwi->ack_ctl |= MT_TXWI_ACK_CTL_NSEQ;
- 	if ((info->flags & IEEE80211_TX_CTL_AMPDU) && sta) {
- 		u8 ba_size = IEEE80211_MIN_AMPDU_BUF;
--		u8 ampdu_density = sta->deflink.ht_cap.ampdu_density;
-+		u8 ampdu_density = sta->ht_cap.ampdu_density;
- 
--		ba_size <<= sta->deflink.ht_cap.ampdu_factor;
-+		ba_size <<= sta->ht_cap.ampdu_factor;
- 		ba_size = min_t(int, 63, ba_size - 1);
- 		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
- 			ba_size = 0;
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index b178036..cecc3ef 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -1905,8 +1905,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
- 
- 	phy.ldpc = (phy.bw || phy.ldpc) * GENMASK(2, 0);
- 	for (i = 0; i <= phy.bw; i++) {
--		phy.sgi |= gi << (i << sta->deflink.he_cap.has_he);
--		phy.he_ltf |= he_ltf << (i << sta->deflink.he_cap.has_he);
-+		phy.sgi |= gi << (i << sta->he_cap.has_he);
-+		phy.he_ltf |= he_ltf << (i << sta->he_cap.has_he);
- 	}
- 	field = RATE_PARAM_FIXED;
- 
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 9cbd362..5743dc5 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -553,8 +553,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 	if (ret < 0)
- 		return ret;
- 
--	netif_napi_add_tx(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
--			  mt7915_poll_tx);
-+	netif_tx_napi_add(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
-+			  mt7915_poll_tx, NAPI_POLL_WEIGHT);
- 	napi_enable(&dev->mt76.tx_napi);
- 
- 	mt7915_dma_enable(dev);
-diff --git a/mt7915/init.c b/mt7915/init.c
-index ef752e1..9ccbc7b 100755
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -1152,8 +1152,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
- 			mt7915_gen_ppe_thresh(he_cap->ppe_thres, nss);
- 		} else {
- 			he_cap_elem->phy_cap_info[9] |=
--				u8_encode_bits(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_16US,
--					       IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_MASK);
-+				IEEE80211_HE_PHY_CAP9_NOMIMAL_PKT_PADDING_16US;
- 		}
- 
- 		if (band == NL80211_BAND_6GHZ) {
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0d0ae7a..d759912 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -915,7 +915,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
- 	u16 fc, tid;
- 	u32 val;
- 
--	if (!sta || !(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
-+	if (!sta || !(sta->ht_cap.ht_supported || sta->he_cap.has_he))
- 		return;
- 
- 	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
-diff --git a/mt7915/main.c b/mt7915/main.c
-index c87f04b..28509d9 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -523,7 +523,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
- 
- static int
- mt7915_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--	       unsigned int link_id, u16 queue,
-+	       u16 queue,
- 	       const struct ieee80211_tx_queue_params *params)
- {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-@@ -618,7 +618,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
- static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
- 				    struct ieee80211_vif *vif,
- 				    struct ieee80211_bss_conf *info,
--				    u64 changed)
-+				    u32 changed)
- {
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -638,7 +638,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
- 	}
- 
- 	if (changed & BSS_CHANGED_ASSOC)
--		mt7915_mcu_add_bss_info(phy, vif, vif->cfg.assoc);
-+		mt7915_mcu_add_bss_info(phy, vif, info->assoc);
- 
- 	if (changed & BSS_CHANGED_ERP_CTS_PROT)
- 		mt7915_mac_enable_rtscts(dev, vif, info->use_cts_prot);
-@@ -1223,10 +1223,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
- {
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
--	s16 txpower = sta->deflink.txpwr.power;
-+	s16 txpower = sta->txpwr.power;
- 	int ret;
- 
--	if (sta->deflink.txpwr.type == NL80211_TX_POWER_AUTOMATIC)
-+	if (sta->txpwr.type == NL80211_TX_POWER_AUTOMATIC)
- 		txpower = 0;
- 
- 	mutex_lock(&dev->mt76.mutex);
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 88ce44f..f2c848d 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -64,7 +64,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
- 	struct mt7915_dev *dev = msta->vif->phy->dev;
- 	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
- 	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
--	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
-+	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
- 
- 	for (nss = 0; nss < max_nss; nss++) {
- 		int mcs;
-@@ -104,7 +104,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
- 
- 		/* only support 2ss on 160MHz for mt7915 */
- 		if (is_mt7915(&dev->mt76) && nss > 1 &&
--		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
-+		    sta->bandwidth == IEEE80211_STA_RX_BW_160)
- 			break;
- 	}
- 
-@@ -117,8 +117,8 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
- {
- 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
- 	struct mt7915_dev *dev = msta->vif->phy->dev;
--	u16 mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
--	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
-+	u16 mcs_map = le16_to_cpu(sta->vht_cap.vht_mcs.rx_mcs_map);
-+	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
- 	u16 mcs;
- 
- 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
-@@ -140,7 +140,7 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
- 
- 		/* only support 2ss on 160MHz for mt7915 */
- 		if (is_mt7915(&dev->mt76) && nss > 1 &&
--		    sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
-+		    sta->bandwidth == IEEE80211_STA_RX_BW_160)
- 			break;
- 	}
- }
-@@ -149,10 +149,10 @@ static void
- mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
- 			  const u8 *mask)
- {
--	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
-+	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
- 
- 	for (nss = 0; nss < max_nss; nss++)
--		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
-+		ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
- }
- 
- static int
-@@ -231,7 +231,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
- static void
- mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
- {
--	if (vif->bss_conf.csa_active)
-+	if (vif->csa_active)
- 		ieee80211_csa_finish(vif);
- }
- 
-@@ -332,7 +332,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
- static void
- mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
- {
--	if (!vif->bss_conf.color_change_active)
-+	if (!vif->color_change_active)
- 		return;
- 
- 	ieee80211_color_change_finish(vif);
-@@ -745,13 +745,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
- 		      struct ieee80211_vif *vif)
- {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
--	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
-+	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
- 	struct ieee80211_he_mcs_nss_supp mcs_map;
- 	struct sta_rec_he *he;
- 	struct tlv *tlv;
- 	u32 cap = 0;
- 
--	if (!sta->deflink.he_cap.has_he)
-+	if (!sta->he_cap.has_he)
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -837,8 +837,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
- 
- 	he->he_cap = cpu_to_le32(cap);
- 
--	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
--	switch (sta->deflink.bandwidth) {
-+	mcs_map = sta->he_cap.he_mcs_nss_supp;
-+	switch (sta->bandwidth) {
- 	case IEEE80211_STA_RX_BW_160:
- 		if (elem->phy_cap_info[0] &
- 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -888,7 +888,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
- {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
--	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
-+	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
- 	struct sta_rec_muru *muru;
- 	struct tlv *tlv;
- 
-@@ -912,11 +912,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
- 	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
- 
--	if (sta->deflink.vht_cap.vht_supported)
-+	if (sta->vht_cap.vht_supported)
- 		muru->mimo_dl.vht_mu_bfee =
--			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
-+			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
- 
--	if (!sta->deflink.he_cap.has_he)
-+	if (!sta->he_cap.has_he)
- 		return;
- 
- 	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -950,13 +950,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 	struct sta_rec_ht *ht;
- 	struct tlv *tlv;
- 
--	if (!sta->deflink.ht_cap.ht_supported)
-+	if (!sta->ht_cap.ht_supported)
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
- 
- 	ht = (struct sta_rec_ht *)tlv;
--	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
-+	ht->ht_cap = cpu_to_le16(sta->ht_cap.cap);
- }
- 
- static void
-@@ -965,15 +965,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 	struct sta_rec_vht *vht;
- 	struct tlv *tlv;
- 
--	if (!sta->deflink.vht_cap.vht_supported)
-+	if (!sta->vht_cap.vht_supported)
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
- 
- 	vht = (struct sta_rec_vht *)tlv;
--	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
--	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
--	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
-+	vht->vht_cap = cpu_to_le32(sta->vht_cap.cap);
-+	vht->vht_rx_mcs_map = sta->vht_cap.vht_mcs.rx_mcs_map;
-+	vht->vht_tx_mcs_map = sta->vht_cap.vht_mcs.tx_mcs_map;
- }
- 
- static void
-@@ -988,7 +988,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 	    vif->type != NL80211_IFTYPE_AP)
- 		return;
- 
--	if (!sta->deflink.agg.max_amsdu_len)
-+	if (!sta->max_amsdu_len)
- 	    return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -997,7 +997,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 	amsdu->amsdu_en = true;
- 	msta->wcid.amsdu = true;
- 
--	switch (sta->deflink.agg.max_amsdu_len) {
-+	switch (sta->max_amsdu_len) {
- 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
- 		if (!is_mt7915(&dev->mt76)) {
- 			amsdu->max_mpdu_size =
-@@ -1060,8 +1060,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 	if (!bfee && tx_ant < 2)
- 		return false;
- 
--	if (sta->deflink.he_cap.has_he) {
--		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
-+	if (sta->he_cap.has_he) {
-+		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
- 
- 		if (bfee)
- 			return mvif->cap.he_su_ebfee &&
-@@ -1071,8 +1071,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
- 	}
- 
--	if (sta->deflink.vht_cap.vht_supported) {
--		u32 cap = sta->deflink.vht_cap.cap;
-+	if (sta->vht_cap.vht_supported) {
-+		u32 cap = sta->vht_cap.cap;
- 
- 		if (bfee)
- 			return mvif->cap.vht_su_ebfee &&
-@@ -1098,7 +1098,7 @@ static void
- mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
- 		       struct sta_rec_bf *bf)
- {
--	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
-+	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
- 	u8 n = 0;
- 
- 	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1123,7 +1123,7 @@ static void
- mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
- 			struct sta_rec_bf *bf, bool explicit)
- {
--	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
-+	struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
- 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
- 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
- 	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1144,14 +1144,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
- 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
- 		bf->ibf_ncol = bf->ncol;
- 
--		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
-+		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
- 			bf->nrow = 1;
- 	} else {
- 		bf->nrow = tx_ant;
- 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
- 		bf->ibf_ncol = nss_mcs;
- 
--		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
-+		if (sta->bandwidth == IEEE80211_STA_RX_BW_160)
- 			bf->ibf_nrow = 1;
- 	}
- }
-@@ -1160,7 +1160,7 @@ static void
- mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
- {
--	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
-+	struct ieee80211_sta_he_cap *pc = &sta->he_cap;
- 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
- 	const struct ieee80211_sta_he_cap *vc =
- 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1185,7 +1185,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
- 	bf->ibf_ncol = bf->ncol;
- 
--	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
-+	if (sta->bandwidth != IEEE80211_STA_RX_BW_160)
- 		return;
- 
- 	/* go over for 160MHz and 80p80 */
-@@ -1233,7 +1233,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 	};
- 	bool ebf;
- 
--	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
-+	if (!(sta->ht_cap.ht_supported || sta->he_cap.has_he))
- 		return;
- 
- 	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1247,21 +1247,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 	 * vht: support eBF and iBF
- 	 * ht: iBF only, since mac80211 lacks of eBF support
- 	 */
--	if (sta->deflink.he_cap.has_he && ebf)
-+	if (sta->he_cap.has_he && ebf)
- 		mt7915_mcu_sta_bfer_he(sta, vif, phy, bf);
--	else if (sta->deflink.vht_cap.vht_supported)
-+	else if (sta->vht_cap.vht_supported)
- 		mt7915_mcu_sta_bfer_vht(sta, phy, bf, ebf);
--	else if (sta->deflink.ht_cap.ht_supported)
-+	else if (sta->ht_cap.ht_supported)
- 		mt7915_mcu_sta_bfer_ht(sta, phy, bf);
- 	else
- 		return;
- 
- 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
--	bf->bw = sta->deflink.bandwidth;
--	bf->ibf_dbw = sta->deflink.bandwidth;
-+	bf->bw = sta->bandwidth;
-+	bf->ibf_dbw = sta->bandwidth;
- 	bf->ibf_nrow = tx_ant;
- 
--	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
-+	if (!ebf && sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
- 		bf->ibf_timeout = 0x48;
- 	else
- 		bf->ibf_timeout = 0x18;
-@@ -1271,7 +1271,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 	else
- 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
- 
--	switch (sta->deflink.bandwidth) {
-+	switch (sta->bandwidth) {
- 	case IEEE80211_STA_RX_BW_160:
- 	case IEEE80211_STA_RX_BW_80:
- 		bf->mem_total = bf->mem_20m * 2;
-@@ -1296,7 +1296,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 	struct tlv *tlv;
- 	u8 nrow = 0;
- 
--	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
-+	if (!(sta->vht_cap.vht_supported || sta->he_cap.has_he))
- 		return;
- 
- 	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1305,13 +1305,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
- 	bfee = (struct sta_rec_bfee *)tlv;
- 
--	if (sta->deflink.he_cap.has_he) {
--		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
-+	if (sta->he_cap.has_he) {
-+		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
- 
- 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
- 			      pe->phy_cap_info[5]);
--	} else if (sta->deflink.vht_cap.vht_supported) {
--		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
-+	} else if (sta->vht_cap.vht_supported) {
-+		struct ieee80211_sta_vht_cap *pc = &sta->vht_cap;
- 
- 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
- 				 pc->cap);
-@@ -1367,7 +1367,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
- 			ra->phy = *phy;
- 		break;
- 	case RATE_PARAM_MMPS_UPDATE:
--		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
-+		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
- 		break;
- 	case RATE_PARAM_SPE_UPDATE:
- 		ra->spe_idx = *(u8 *)data;
-@@ -1442,7 +1442,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
- 	do {									\
- 		u8 i, gi = mask->control[band]._gi;				\
- 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
--		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
-+		for (i = 0; i <= sta->bandwidth; i++) {				\
- 			phy.sgi |= gi << (i << (_he));				\
- 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
- 		}								\
-@@ -1456,11 +1456,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
- 		}								\
- 	} while (0)
- 
--	if (sta->deflink.he_cap.has_he) {
-+	if (sta->he_cap.has_he) {
- 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
--	} else if (sta->deflink.vht_cap.vht_supported) {
-+	} else if (sta->vht_cap.vht_supported) {
- 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
--	} else if (sta->deflink.ht_cap.ht_supported) {
-+	} else if (sta->ht_cap.ht_supported) {
- 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
- 	} else {
- 		nrates = hweight32(mask->control[band].legacy);
-@@ -1494,7 +1494,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
- 		 * actual txrate hardware sends out.
- 		 */
- 		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
--		if (sta->deflink.he_cap.has_he)
-+		if (sta->he_cap.has_he)
- 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
- 		else
- 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1527,7 +1527,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
- 	enum nl80211_band band = chandef->chan->band;
- 	struct sta_rec_ra *ra;
- 	struct tlv *tlv;
--	u32 supp_rate = sta->deflink.supp_rates[band];
-+	u32 supp_rate = sta->supp_rates[band];
- 	u32 cap = sta->wme ? STA_CAP_WMM : 0;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1537,9 +1537,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
- 	ra->auto_rate = true;
- 	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
- 	ra->channel = chandef->chan->hw_value;
--	ra->bw = sta->deflink.bandwidth;
--	ra->phy.bw = sta->deflink.bandwidth;
--	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->deflink.smps_mode);
-+	ra->bw = sta->bandwidth;
-+	ra->phy.bw = sta->bandwidth;
-+	ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
- 
- 	if (supp_rate) {
- 		supp_rate &= mask->control[band].legacy;
-@@ -1559,22 +1559,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
- 		}
- 	}
- 
--	if (sta->deflink.ht_cap.ht_supported) {
-+	if (sta->ht_cap.ht_supported) {
- 		ra->supp_mode |= MODE_HT;
--		ra->af = sta->deflink.ht_cap.ampdu_factor;
--		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
-+		ra->af = sta->ht_cap.ampdu_factor;
-+		ra->ht_gf = !!(sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
- 
- 		cap |= STA_CAP_HT;
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
-+		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
- 			cap |= STA_CAP_SGI_20;
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
-+		if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
- 			cap |= STA_CAP_SGI_40;
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
-+		if (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
- 			cap |= STA_CAP_TX_STBC;
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
-+		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
- 			cap |= STA_CAP_RX_STBC;
- 		if (mvif->cap.ht_ldpc &&
--		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
-+		    (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
- 			cap |= STA_CAP_LDPC;
- 
- 		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1582,37 +1582,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
- 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
- 	}
- 
--	if (sta->deflink.vht_cap.vht_supported) {
-+	if (sta->vht_cap.vht_supported) {
- 		u8 af;
- 
- 		ra->supp_mode |= MODE_VHT;
- 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
--			       sta->deflink.vht_cap.cap);
-+			       sta->vht_cap.cap);
- 		ra->af = max_t(u8, ra->af, af);
- 
- 		cap |= STA_CAP_VHT;
--		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
-+		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
- 			cap |= STA_CAP_VHT_SGI_80;
--		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
-+		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
- 			cap |= STA_CAP_VHT_SGI_160;
--		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
-+		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
- 			cap |= STA_CAP_VHT_TX_STBC;
--		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
-+		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
- 			cap |= STA_CAP_VHT_RX_STBC;
- 		if (mvif->cap.vht_ldpc &&
--		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
-+		    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
- 			cap |= STA_CAP_VHT_LDPC;
- 
- 		mt7915_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
- 					   mask->control[band].vht_mcs);
- 	}
- 
--	if (sta->deflink.he_cap.has_he) {
-+	if (sta->he_cap.has_he) {
- 		ra->supp_mode |= MODE_HE;
- 		cap |= STA_CAP_HE;
- 
--		if (sta->deflink.he_6ghz_capa.capa)
--			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
-+		if (sta->he_6ghz_capa.capa)
-+			ra->af = le16_get_bits(sta->he_6ghz_capa.capa,
- 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
- 	}
- 
-@@ -1821,7 +1821,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
- 	if (!offs->cntdwn_counter_offs[0])
- 		return;
- 
--	sub_tag = vif->bss_conf.csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
-+	sub_tag = vif->csa_active ? BSS_INFO_BCN_CSA : BSS_INFO_BCN_BCC;
- 	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
- 					   &bcn->sub_ntlv, &bcn->len);
- 	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -1906,9 +1906,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 	if (offs->cntdwn_counter_offs[0]) {
- 		u16 offset = offs->cntdwn_counter_offs[0];
- 
--		if (vif->bss_conf.csa_active)
-+		if (vif->csa_active)
- 			cont->csa_ofs = cpu_to_le16(offset - 4);
--		if (vif->bss_conf.color_change_active)
-+		if (vif->color_change_active)
- 			cont->bcc_ofs = cpu_to_le16(offset - 3);
- 	}
- 
-@@ -2092,7 +2092,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	if (!en)
- 		goto out;
- 
--	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
-+	skb = ieee80211_beacon_get_template(hw, vif, &offs);
- 	if (!skb)
- 		return -EINVAL;
- 
-@@ -3308,17 +3308,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
- 	if (txpower) {
- 		u32 offs, len, i;
- 
--		if (sta->deflink.ht_cap.ht_supported) {
-+		if (sta->ht_cap.ht_supported) {
- 			const u8 *sku_len = mt7915_sku_group_len;
- 
- 			offs = sku_len[SKU_CCK] + sku_len[SKU_OFDM];
- 			len = sku_len[SKU_HT_BW20] + sku_len[SKU_HT_BW40];
- 
--			if (sta->deflink.vht_cap.vht_supported) {
-+			if (sta->vht_cap.vht_supported) {
- 				offs += len;
- 				len = sku_len[SKU_VHT_BW20] * 4;
- 
--				if (sta->deflink.he_cap.has_he) {
-+				if (sta->he_cap.has_he) {
- 					offs += len + sku_len[SKU_HE_RU26] * 3;
- 					len = sku_len[SKU_HE_RU242] * 4;
- 				}
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 70382b9..5c71116 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -397,12 +397,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
- 		memcpy(sta->addr, td->addr[0], ETH_ALEN);
- 
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
--		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
-+		memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_VHT)
--		memcpy(&sta->deflink.vht_cap, &sband->vht_cap, sizeof(sta->deflink.vht_cap));
-+		memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
- 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_SU)
--		memcpy(&sta->deflink.he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
--		       sizeof(sta->deflink.he_cap));
-+		memcpy(&sta->he_cap, &sdata[NL80211_IFTYPE_STATION].he_cap,
-+		       sizeof(sta->he_cap));
- 	sta->aid = aid;
- 	sta->wme = 1;
- 
-diff --git a/tx.c b/tx.c
-index a72b777..04b6f2e 100644
---- a/tx.c
-+++ b/tx.c
-@@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
- 			.skb = skb,
- 			.info = IEEE80211_SKB_CB(skb),
- 		};
--		struct ieee80211_rate_status rs = {};
- 		struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
- 		struct mt76_wcid *wcid;
- 
- 		wcid = rcu_dereference(dev->wcid[cb->wcid]);
- 		if (wcid) {
- 			status.sta = wcid_to_sta(wcid);
--			if (status.sta && (wcid->rate.flags || wcid->rate.legacy)) {
--				rs.rate_idx = wcid->rate;
--				status.rates = &rs;
--				status.n_rates = 1;
--			} else {
--				status.n_rates = 0;
--			}
-+
-+			if (status.sta)
-+				status.rate = &wcid->rate;
- 		}
- 
- 		hw = mt76_tx_status_get_hw(dev, skb);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index 0d91264..cc889fc 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -1,55 +1,10 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
-    file://0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch \
-    file://0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch \
-    file://0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch \
-    file://0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch \
-    file://0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch \
-    file://0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch \
-    file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
-    file://1002-mt76-mt7915-csi-implement-csi-support.patch \
-    file://1003-mt76-mt7915-air-monitor-support.patch \
-    file://1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch \
-    file://1005-mt76-mt7915-certification-patches.patch \
-    file://1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch \
-    file://1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
-    file://1008-mt76-mt7915-drop-undefined-action-frame.patch \
-    file://1009-mt76-mt7915-add-fw_version-dump.patch \
-    file://1111-mt76-testmode-rework-testmode-init-registers.patch \
-    file://1112-mt76-testmode-additional-supports.patch \
-    file://1113-mt76-testmode-add-pre-cal-support.patch \
-    file://1114-mt76-testmode-add-iBF-command-mode-support.patch \
-    file://1115-mt76-testmode-add-ZWDFS-test-mode-support.patch \
-    file://1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch \
-    file://1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
-    file://1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch \
-    file://1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
-    file://1121-mt76-mt7915-add-phy-capability-vendor-command.patch \
-    file://1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch \
-    file://1123-mt76-mt7915-implement-bin-file-mode.patch \
-    file://1124-mt76-mt7915-initialize-wcid.patch \
-    file://1125-mt76-mt7915-Add-hemu-dump-support.patch \
-    file://1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
-    file://1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
-    file://1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
-    file://1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
-    file://1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
-    file://1131-mt76-mt7915-amsdu-set-and-get-control.patch \
-    file://3001-mt76-mt7915-wed-add-wed-tx-support.patch \
-    file://3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch \
-    file://3003-mt76-connac-wed-add-wed-rx-copy-skb.patch \
-    file://3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch \
-    file://3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch \
-    file://3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch \
-    file://3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch \
-    file://3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch \
-    file://3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch \
-    file://3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch \
-    file://3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
-    file://3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch \
-    file://3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch \
-    file://4001-mt76-revert-get_of_mac_addr.patch \
-    file://4002-mt76-include-header-files-for-module-param.patch \
-    file://4003-mt76-revert-for-backports-5.15-wireless-stack.patch;apply=no \
+    file://0001-wifi-mt76-mt7996-fix-chainmask-calculation-in-mt7996.patch \
+    file://0002-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch \
+    file://0003-wifi-mt76-mt7996-do-not-hardcode-vht-beamform-cap.patch \
+    file://0004-wifi-mt76-connac-fix-POWER_CTRL-command-name-typo.patch \
+    file://4001-mt76-mt7996-for-build-pass.patch \
+    file://4002-mt76-revert-get_of_mac_addr.patch \
+    file://4003-mt76-include-header-files-for-module-param.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_eeprom.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_eeprom.bin
new file mode 100755
index 0000000..d27e912
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_eeprom.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin
new file mode 100644
index 0000000..9243dae
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin
new file mode 100644
index 0000000..9541e61
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin
new file mode 100644
index 0000000..256dd41
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996_eeprom.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996_eeprom.bin
deleted file mode 100644
index 19d8126..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996_eeprom.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996_rom_patch.bin
deleted file mode 100644
index a734da1..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996_rom_patch.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996_wa.bin
deleted file mode 100644
index 529ba6a..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996_wa.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996_wm.bin
deleted file mode 100644
index 8a0b654..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996_wm.bin
+++ /dev/null
Binary files differ
diff --git a/recipes-wifi/linux-mt76/linux-mt76_2.x.bb b/recipes-wifi/linux-mt76/linux-mt76_2.x.bb
index bbbc47d..1b254a5 100644
--- a/recipes-wifi/linux-mt76/linux-mt76_2.x.bb
+++ b/recipes-wifi/linux-mt76/linux-mt76_2.x.bb
@@ -24,6 +24,7 @@
 
 require files/patches/patches.inc
 SRC_URI_append += "file://5000-mt76-add-internal-wed_tiny-header-file.patch"
+SRC_URI_append += "file://5001-mt76-mt7915-disable-wed.patch"
 
 S = "${WORKDIR}/git"
 
diff --git a/recipes-wifi/linux-mt76/linux-mt76_3.x.bb b/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
index 2a6345f..0df74c2 100644
--- a/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
+++ b/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
@@ -25,9 +25,6 @@
 require files/patches-${PV}/patches.inc
 SRC_URI_append += "file://5000-mt76-add-internal-wed_tiny-header-file.patch"
 
-#wifi7 tmp patch
-SRC_URI_append += "file://2999-rdkb-mt76-mt7996-tmp-build-fix.patch"
-
 S = "${WORKDIR}/git"
 
 
@@ -94,10 +91,7 @@
     install -m 644 ${WORKDIR}/src/firmware/mt7916_eeprom.bin ${D}${base_libdir}/firmware/mediatek/
 
     install -d ${D}/${base_libdir}/firmware/mediatek/mt7996
-    install -m 644 ${WORKDIR}/src/firmware/mt7996_wa.bin ${D}${base_libdir}/firmware/mediatek/mt7996
-    install -m 644 ${WORKDIR}/src/firmware/mt7996_wm.bin ${D}${base_libdir}/firmware/mediatek/mt7996
-    install -m 644 ${WORKDIR}/src/firmware/mt7996_rom_patch.bin ${D}${base_libdir}/firmware/mediatek/mt7996
-    install -m 644 ${WORKDIR}/src/firmware/mt7996_eeprom.bin ${D}${base_libdir}/firmware/mediatek/mt7996
+    install -m 644 ${WORKDIR}/src/firmware/mt7996/mt7996*.* ${D}${base_libdir}/firmware/mediatek/mt7996
 }
 
 do_install_append_mt7988 () {