diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
index 6d8b29c..93e37fb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
@@ -1,7 +1,7 @@
-From ed4d404869179bbebeab820a6271772f198d91fa Mon Sep 17 00:00:00 2001
+From 5278bba5f5096bf42e0d808d4c23b2af3d16dd73 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 19 Sep 2023 11:21:23 +0800
-Subject: [PATCH 01/15] mtk: Revert "wifi: mt76: mt7996: fill txd by host
+Subject: [PATCH 01/17] mtk: Revert "wifi: mt76: mt7996: fill txd by host
  driver"
 
 This reverts commit 325a0c4931990d553487024c4f76c776492bdcc2.
@@ -10,7 +10,7 @@
  1 file changed, 9 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0384fb05..3af537b6 100644
+index bc7111a7..3afdd7eb 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -938,8 +938,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch
index 26f782f..4067faf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch
@@ -1,7 +1,7 @@
-From eefba7039b4edc74c78d70877a59dbb3a4c35ef9 Mon Sep 17 00:00:00 2001
+From b4eb6156a2693382e93c5a2d5d3c564c0a2bb198 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 24 Aug 2023 18:38:11 +0800
-Subject: [PATCH 02/15] mtk: wifi: mt76: connac: use peer address for station
+Subject: [PATCH 02/17] mtk: wifi: mt76: connac: use peer address for station
  BMC entry
 
 Set peer address and aid for the BMC wtbl of station interface. For some
@@ -16,7 +16,7 @@
  2 files changed, 11 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 7602f979..1c910d9d 100644
+index 368c5f46..fec158ec 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -392,7 +392,14 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch
index 33c78b6..520f6a9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch
@@ -1,7 +1,7 @@
-From aa6060100ddbf2bad579b2765e34740ea70f8752 Mon Sep 17 00:00:00 2001
+From ac159c7469469353fa25787ceb7f25c8e33c59fb Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 5 Sep 2023 17:31:49 +0800
-Subject: [PATCH 03/15] mtk: wifi: mt76: mt7996: disable rx header translation
+Subject: [PATCH 03/17] mtk: wifi: mt76: mt7996: disable rx header translation
  for BMC entry
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-mt7996-set-RCPI-value-in-rate-control-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-mt7996-set-RCPI-value-in-rate-control-.patch
index 8f05075..bcbf32a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-mt7996-set-RCPI-value-in-rate-control-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-wifi-mt76-mt7996-set-RCPI-value-in-rate-control-.patch
@@ -1,7 +1,7 @@
-From 4c5eea6f2ddb3d0e47d7e3877989013b0554dae4 Mon Sep 17 00:00:00 2001
+From 8f88d7ea931cb3fcc12f609598f8997e66051bff Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Nov 2023 20:15:39 +0800
-Subject: [PATCH 04/15] mtk: wifi: mt76: mt7996: set RCPI value in rate control
+Subject: [PATCH 04/17] mtk: wifi: mt76: mt7996: set RCPI value in rate control
  command
 
 Set RCPI values in mt7996_mcu_sta_rate_ctrl_tlv(), which can make the
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
index 21427b5..2321fa4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch
@@ -1,7 +1,7 @@
-From d832255d8d7810670d39bc578dd0e04e798d304e Mon Sep 17 00:00:00 2001
+From 01b4af6ea238a69c90d136cdf4684869481d03b7 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Wed, 3 Jan 2024 15:21:44 +0800
-Subject: [PATCH 14/15] mtk: wifi: mt76: mt7996: enable hw cso module
+Subject: [PATCH 05/17] mtk: wifi: mt76: mt7996: enable hw cso module
 
 The cso module needs to be enabled. The cso mudule can help identify if the traffic
 is TCP traffic. This can assist the firmware in adjusting algorithms to
@@ -14,7 +14,7 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 8402097d..482782f7 100644
+index 2a4aa796..f1cd2e50 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -610,6 +610,12 @@ struct sta_rec_ra_fixed {
@@ -39,10 +39,10 @@
  					 MT76_CONNAC_WTBL_UPDATE_MAX_SIZE)
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 52e4f0d1..42fcbd8f 100644
+index 0f1905f2..aa054167 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1753,6 +1753,19 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1748,6 +1748,19 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	bfee->fb_identity_matrix = (nrow == 1 && tx_ant == 2);
  }
  
@@ -62,7 +62,7 @@
  static void
  mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -2164,6 +2177,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2159,6 +2172,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  
  	/* starec hdr trans */
  	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-fix-non-main-BSS-no-beacon-issu.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-fix-non-main-BSS-no-beacon-issu.patch
new file mode 100644
index 0000000..38cb111
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-fix-non-main-BSS-no-beacon-issu.patch
@@ -0,0 +1,42 @@
+From 962986bbac91d5a97482f9ae74655ffca70763b1 Mon Sep 17 00:00:00 2001
+From: Henry Yen <henry.yen@mediatek.com>
+Date: Fri, 2 Feb 2024 16:42:24 +0800
+Subject: [PATCH 06/17] mtk: wifi: mt76: mt7996: fix non-main BSS no beacon
+ issue for legacy MBSS scenario
+
+Fix non-main BSS no beacon issue for mt7992 legacy MBSS scenario.
+
+There are some design differences between mt7996 and mt7992 in terms of
+MBSS time offset. The original MBSS MCU CMD usage is not applicable to
+mt7992, so we modify the flow to avoid abnormal beaconing behavior
+in MBSS scenario.
+
+Signed-off-by: Henry.Yen <henry.yen@mediatek.com>
+
+---
+ mt7996/mcu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index aa054167..6b8a5076 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -819,11 +819,14 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 	struct bss_info_uni_mbssid *mbssid;
+ 	struct tlv *tlv;
+ 
++	if (!vif->bss_conf.bssid_indicator)
++		return;
++
+ 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
+ 
+ 	mbssid = (struct bss_info_uni_mbssid *)tlv;
+ 
+-	if (enable && vif->bss_conf.bssid_indicator) {
++	if (enable) {
+ 		mbssid->max_indicator = vif->bss_conf.bssid_indicator;
+ 		mbssid->mbss_idx = vif->bss_conf.bssid_index;
+ 		mbssid->tx_bss_omac_idx = 0;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-initialize-variable-to-avoid-un.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-initialize-variable-to-avoid-un.patch
new file mode 100644
index 0000000..33200ad
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-initialize-variable-to-avoid-un.patch
@@ -0,0 +1,30 @@
+From 354503529d28d44fc94ea65815da5bf0cbdb79e7 Mon Sep 17 00:00:00 2001
+From: Henry Yen <henry.yen@mediatek.com>
+Date: Fri, 19 Jan 2024 11:11:19 +0800
+Subject: [PATCH 07/17] mtk: wifi: mt76: mt7996: initialize variable to avoid
+ unexpected IRQ handling
+
+Initialize the variable to avoid processing unexpected interrupts given from wrong source.
+
+Signed-off-by: Henry.Yen <henry.yen@mediatek.com>
+
+---
+ mt7996/mmio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7996/mmio.c b/mt7996/mmio.c
+index 341fa089..8fe56ed9 100644
+--- a/mt7996/mmio.c
++++ b/mt7996/mmio.c
+@@ -519,7 +519,7 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
+ 	struct mt7996_dev *dev = from_tasklet(dev, t, mt76.irq_tasklet);
+ 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ 	struct mtk_wed_device *wed_hif2 = &dev->mt76.mmio.wed_hif2;
+-	u32 i, intr, mask, intr1;
++	u32 i, intr, mask, intr1 = 0;
+ 
+ 	if (dev->hif2 && mtk_wed_device_active(wed_hif2)) {
+ 		mtk_wed_device_irq_set_mask(wed_hif2, 0);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-enable-ser-query.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7996-enable-ser-query.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-enable-ser-query.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7996-enable-ser-query.patch
index 8a136ae..e35b141 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-wifi-mt76-mt7996-enable-ser-query.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7996-enable-ser-query.patch
@@ -1,7 +1,7 @@
-From 3874c792c9987f38c91a10db6a9edf3c97ef3bc2 Mon Sep 17 00:00:00 2001
+From f664f6c14d38adc2bf43f4f969ea21eb3daa48a7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Oct 2023 20:19:41 +0800
-Subject: [PATCH 05/15] mtk: wifi: mt76: mt7996: enable ser query
+Subject: [PATCH 08/17] mtk: wifi: mt76: mt7996: enable ser query
 
 Do not return -EINVAL when action is UNI_CMD_SER_QUERY for user
 to dump SER information from FW.
@@ -12,10 +12,10 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0f1905f2..0c1dd93f 100644
+index 6b8a5076..0981f592 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3842,6 +3842,8 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
+@@ -3860,6 +3860,8 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
  	};
  
  	switch (action) {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
index 382c4b3..2cf4eec 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
@@ -1,7 +1,7 @@
-From fdaf32684efac76b6e942db0e0748c4b488413a8 Mon Sep 17 00:00:00 2001
+From 8e5ba5be6820fa12541785907085f312f13e3e04 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 17 Nov 2023 11:01:04 +0800
-Subject: [PATCH 06/15] mtk: wifi: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
+Subject: [PATCH 09/17] mtk: wifi: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
 
 According to sta capability to decide to enable/disable wed pao when create ppe entry.
 without this patch, TGax HE-4.51.1_24G will test fail
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
index d25deff..9c922d6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch
@@ -1,7 +1,7 @@
-From 524436a89b8cfc3bb45d1962280ab8d70cd7472e Mon Sep 17 00:00:00 2001
+From 22607765799dad52bcf304ffd5f393878c4317bf Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 20 Jul 2023 17:27:22 +0800
-Subject: [PATCH 07/15] mtk: wifi: mt76: mt7996: add eagle default bin of
+Subject: [PATCH 10/17] mtk: wifi: mt76: mt7996: add eagle default bin of
  different sku variants
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
similarity index 98%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
index 83ffab0..dd04ff3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch
@@ -1,7 +1,7 @@
-From 5b98ee4acf66ca727a3e467133379636aed407ff Mon Sep 17 00:00:00 2001
+From fcf4d59b7cbd6c298ca90b0eae6aec63544b14d9 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 21 Jul 2023 10:41:28 +0800
-Subject: [PATCH 08/15] mtk: wifi: mt76: mt7996: add kite fw & default bin for
+Subject: [PATCH 11/17] mtk: wifi: mt76: mt7996: add kite fw & default bin for
  different sku variants
 
 Add fem type (2i5i, 2i5e, 2e5e, ...)
@@ -187,7 +187,7 @@
  {
  	int ret, idx;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0c1dd93f..41f7b4b2 100644
+index 0981f592..5aefecb0 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -14,7 +14,12 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
index 12cfd7f..0959871 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
@@ -1,7 +1,7 @@
-From 7b1549ea7bd2b6015a6a3594c2a6b7327e27d0a3 Mon Sep 17 00:00:00 2001
+From 35f210176257373e9b71821ca3246b10f1bb1b2a Mon Sep 17 00:00:00 2001
 From: "fancy.liu" <fancy.liu@mediatek.com>
 Date: Tue, 14 Nov 2023 10:13:24 +0800
-Subject: [PATCH 09/15] mtk: wifi: mt76: mt7996: ACS channel time too long on
+Subject: [PATCH 12/17] mtk: wifi: mt76: mt7996: ACS channel time too long on
  duty channel
 
 Step and issue:
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
index 0afefb2..25d942c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
@@ -1,7 +1,7 @@
-From 956274f340ff76472207679a71f0a9ae3f8db0b8 Mon Sep 17 00:00:00 2001
+From cd699c6764e92f89aef0c75fa0c5a5c69402bcf6 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 26 Oct 2023 10:08:10 +0800
-Subject: [PATCH 10/15] mtk: wifi: mt76: mt7996: Fixed null pointer dereference
+Subject: [PATCH 13/17] mtk: wifi: mt76: mt7996: Fixed null pointer dereference
  issue
 
 Without this patch, when the station is still in Authentication stage and
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
index 3261f00..8839a71 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
@@ -1,7 +1,7 @@
-From d9933bb4c54345dc9e3edc03f93324fcca813fe9 Mon Sep 17 00:00:00 2001
+From 5cb8c91ff8f579d192f93e258314199fc33355c8 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Oct 2023 11:06:19 +0800
-Subject: [PATCH 11/15] mtk: wifi: mt76: add sanity check to prevent kernel
+Subject: [PATCH 14/17] mtk: wifi: mt76: add sanity check to prevent kernel
  crash
 
 wcid may not be initialized when mac80211 calls mt76.tx and it would lead to
@@ -13,7 +13,7 @@
  1 file changed, 8 insertions(+)
 
 diff --git a/tx.c b/tx.c
-index 1809b032..4596b367 100644
+index 5cf6edee..ab42f69b 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -345,6 +345,14 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
index 246cded..66ee8cf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
@@ -1,7 +1,7 @@
-From 1570914f0f8b2b6c5d6de86b71fed6ef5edc355e Mon Sep 17 00:00:00 2001
+From 5a195822d50b588206b18344df61b36bc7e26e6e Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:16:50 +0800
-Subject: [PATCH 12/15] mtk: wifi: mt76: mt7996: add firmware WA's coredump.
+Subject: [PATCH 15/17] mtk: wifi: mt76: mt7996: add firmware WA's coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -428,10 +428,10 @@
  	return NULL;
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 3af537b6..f35b17b6 100644
+index 3afdd7eb..d88bbfb2 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2002,28 +2002,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1998,28 +1998,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
  }
  
  /* firmware coredump */
@@ -464,7 +464,7 @@
  	if (!mem_region || !crash_data->memdump_buf_len) {
  		mutex_unlock(&dev->dump_mutex);
  		goto skip_memdump;
-@@ -2033,6 +2030,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2029,6 +2026,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	buf_len = crash_data->memdump_buf_len;
  
  	/* dumping memory content... */
@@ -474,7 +474,7 @@
  	memset(buf, 0, buf_len);
  	for (i = 0; i < num; i++) {
  		if (mem_region->len > buf_len) {
-@@ -2049,6 +2049,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2045,6 +2045,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
  		mt7996_memcpy_fromio(dev, buf, mem_region->start,
  				     mem_region->len);
  
@@ -482,7 +482,7 @@
  		hdr->start = mem_region->start;
  		hdr->len = mem_region->len;
  
-@@ -2065,8 +2066,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2061,8 +2062,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	mutex_unlock(&dev->dump_mutex);
  
  skip_memdump:
@@ -506,10 +506,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 41f7b4b2..9a03a2b2 100644
+index 5aefecb0..88fb196d 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2684,6 +2684,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
+@@ -2702,6 +2702,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
  
  	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
@@ -518,7 +518,7 @@
  
  	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
  		struct mt7996_patch_sec *sec;
-@@ -2810,6 +2812,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
+@@ -2828,6 +2830,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
  	}
  
  	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
index 334c5be..2ed6aca 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
@@ -1,7 +1,7 @@
-From 63f17f147216ccb96e163af01e407925b50f8187 Mon Sep 17 00:00:00 2001
+From 86aed1e2968dcb516b60cad4361048c2df7a8119 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 22 Sep 2023 10:32:37 +0800
-Subject: [PATCH 13/15] mtk: wifi: mt76: mt7996: add preamble puncture support
+Subject: [PATCH 16/17] mtk: wifi: mt76: mt7996: add preamble puncture support
  for mt7996
 
 Add support configure preamble puncture feature through mcu commands.
@@ -15,10 +15,10 @@
  4 files changed, 37 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 2a4aa796..8402097d 100644
+index f1cd2e50..482782f7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1263,6 +1263,7 @@ enum {
+@@ -1270,6 +1270,7 @@ enum {
  	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
@@ -27,10 +27,10 @@
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9a03a2b2..52e4f0d1 100644
+index 88fb196d..b9939e0c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4522,3 +4522,33 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4540,3 +4540,33 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WM_UNI_CMD(TXPOWER), true);
  }
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch
index 47700b8..dbfb384 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch
@@ -1,7 +1,7 @@
-From 9af475ad49a4b79ebb4589bdf993d6d8bbff5dfc Mon Sep 17 00:00:00 2001
+From 19ea1497e7aea34be6e8851a1aca75e3eb58b58f Mon Sep 17 00:00:00 2001
 From: "Henry.Yen" <henry.yen@mediatek.com>
 Date: Tue, 16 Jan 2024 11:30:02 +0800
-Subject: [PATCH 15/15] mtk: wifi: mt76: mt7996: add sanity check for NAPI
+Subject: [PATCH 17/17] mtk: wifi: mt76: mt7996: add sanity check for NAPI
  schedule
 
 Add sanity check for NAPI schedule.
@@ -21,7 +21,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 341fa089..fd4d41d9 100644
+index 8fe56ed9..367a204d 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -560,7 +560,7 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0999-mtk-wifi-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mtk-wifi-mt76-mt7996-for-build-pass.patch
index 53cc471..9c72243 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0999-mtk-wifi-mt76-mt7996-for-build-pass.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mtk-wifi-mt76-mt7996-for-build-pass.patch
@@ -1,4 +1,4 @@
-From 237f3f6f819983ed6fec2a108df2f645c0319fb6 Mon Sep 17 00:00:00 2001
+From 1df5a85005f59c81ddc50c6378562e4c9bc31056 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 3 Nov 2022 00:27:17 +0800
 Subject: [PATCH 0999/1044] mtk: wifi: mt76: mt7996: for build pass
@@ -33,10 +33,10 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 72a7bd5a..4cf2afdf 100644
+index f4f88c44..56044639 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -882,7 +882,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -883,7 +883,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		    !(dev->drv->rx_check(dev, data, len)))
  			goto free_frag;
  
@@ -91,7 +91,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 1c910d9d..fccca36d 100644
+index fec158ec..42f12672 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -103,7 +103,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 09badb16..2718ba52 100644
+index fe54a2f4..35d57989 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -142,7 +142,7 @@
  		dev->has_eht = !(cap & MODE_HE_ONLY);
  		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 42fcbd8f..7a76d602 100644
+index b9939e0c..e92a3e53 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5,6 +5,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch
index 7409632..bfbb09d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch
@@ -1,4 +1,4 @@
-From 1c9c6a9220ce579ec5e12808c934cc28ae25325d Mon Sep 17 00:00:00 2001
+From 57b3bc3bdbb3fb05897ff92ff59e970598fbf223 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Mar 2023 14:02:32 +0800
 Subject: [PATCH 1000/1044] mtk: wifi: mt76: mt7996: add debug tool
@@ -32,12 +32,18 @@
 mtk: wifi: mt76: mt7996: add mt7992 & mt7996 CR debug offset revision
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+
+mtk: wifi: mt76: mt7992: refactor code for FW log
+
+Refactor code for FW log.
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76.h               |    2 +
  mt7996/Makefile      |    4 +
  mt7996/coredump.c    |   10 +-
  mt7996/coredump.h    |    7 +
- mt7996/debugfs.c     |   66 +-
+ mt7996/debugfs.c     |   64 +-
  mt7996/mac.c         |    3 +
  mt7996/mt7996.h      |   11 +
  mt7996/mtk_debug.h   | 2286 ++++++++++++++++++++++++++++++++++++++
@@ -45,14 +51,14 @@
  mt7996/mtk_mcu.c     |   18 +
  mt7996/mtk_mcu.h     |   16 +
  tools/fwlog.c        |   25 +-
- 12 files changed, 4907 insertions(+), 25 deletions(-)
+ 12 files changed, 4905 insertions(+), 25 deletions(-)
  create mode 100644 mt7996/mtk_debug.h
  create mode 100644 mt7996/mtk_debugfs.c
  create mode 100644 mt7996/mtk_mcu.c
  create mode 100644 mt7996/mtk_mcu.h
 
 diff --git a/mt76.h b/mt76.h
-index 1f249581..5c50681a 100644
+index 294e379a..8cf21f98 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -394,6 +394,8 @@ struct mt76_txwi_cache {
@@ -156,7 +162,7 @@
  mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev, u8 type)
  {
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 9bd95358..c4b82cb2 100644
+index 9bd95358..1637b39d 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -290,11 +290,39 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
@@ -256,20 +262,19 @@
  	return 0;
  }
  
-@@ -831,6 +868,12 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
+@@ -830,7 +867,11 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
+ 	unsigned long flags;
  	void *dest;
  
- 	spin_lock_irqsave(&lock, flags);
-+
-+	if (!dev->relay_fwlog) {
-+		spin_unlock_irqrestore(&lock, flags);
++	if (!dev->relay_fwlog)
 +		return;
-+	}
++
+ 	spin_lock_irqsave(&lock, flags);
 +
  	dest = relay_reserve(dev->relay_fwlog, hdrlen + len + 4);
  	if (dest) {
  		*(u32 *)dest = hdrlen + len;
-@@ -863,9 +906,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
+@@ -863,9 +904,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -280,7 +285,7 @@
  	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
  	hdr.len = *(__le16 *)data;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index f35b17b6..89a03122 100644
+index d88bbfb2..1f53d230 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -936,6 +936,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -2609,7 +2614,7 @@
 +#endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
 new file mode 100644
-index 00000000..ab97a372
+index 00000000..678b009e
 --- /dev/null
 +++ b/mt7996/mtk_debugfs.c
 @@ -0,0 +1,2484 @@
@@ -2950,7 +2955,7 @@
 +static int mt7996_dump_version(struct seq_file *s, void *data)
 +{
 +	struct mt7996_dev *dev = dev_get_drvdata(s->private);
-+	seq_printf(s, "Version: 3.3.16.0\n");
++	seq_printf(s, "Version: 3.3.24.2\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch
index ec7d653..eab9300 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch
@@ -1,4 +1,4 @@
-From 4aa0ffd5f06256ed4b2c128d7e975e7ede6702af Mon Sep 17 00:00:00 2001
+From c772657b0835b02b512b101dc2111c99d6c3448c Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 28 Nov 2023 16:01:33 +0800
 Subject: [PATCH 1001/1044] mtk: wifi: mt76: mt7996: support record muru algo
@@ -24,7 +24,7 @@
  4 files changed, 60 insertions(+)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index c4b82cb2..f4ce3b55 100644
+index 1637b39d..ea78166b 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -423,6 +423,36 @@ remove_buf_file_cb(struct dentry *f)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
index 9a30233..b05982a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
@@ -1,4 +1,4 @@
-From 5329ba85c01100c8baa328e237844d2ab1309e27 Mon Sep 17 00:00:00 2001
+From 90b67bfa2b8f0bfbfd32fd93fb898d20b1e6b984 Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Thu, 8 Jun 2023 17:32:33 +0800
 Subject: [PATCH 1002/1044] mtk: wifi: mt76: mt7996: add check for hostapd
@@ -15,10 +15,10 @@
  1 file changed, 9 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7a76d602..35233c71 100644
+index e92a3e53..b488a78f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1182,7 +1182,8 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1185,7 +1185,8 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  }
  
  static void
@@ -28,7 +28,7 @@
  {
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
  	struct ieee80211_he_mcs_nss_supp mcs_map;
-@@ -1202,6 +1203,11 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1205,6 +1206,11 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  		he->he_phy_cap[i] = elem->phy_cap_info[i];
  	}
  
@@ -40,7 +40,7 @@
  	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
  	switch (sta->deflink.bandwidth) {
  	case IEEE80211_STA_RX_BW_160:
-@@ -2108,7 +2114,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2111,7 +2117,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
@@ -49,7 +49,7 @@
  
  	/* sta_rec_ra accommodates BW, NSS and only MCS range format
  	 * i.e 0-{7,8,9} for VHT.
-@@ -2196,7 +2202,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2199,7 +2205,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		/* starec amsdu */
  		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
  		/* starec he */
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mtk-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mtk-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
index 5b346a1..4b48730 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mtk-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mtk-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
@@ -1,4 +1,4 @@
-From 4ac4b9bc83dca1474bbe1cf189c4436e1adc993a Mon Sep 17 00:00:00 2001
+From a086447ff00030ee7cc2d6b813a0c099ba288990 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 28 Dec 2022 22:24:25 +0800
 Subject: [PATCH 1003/1044] mtk: wifi: mt76: testmode: add atenl support in
@@ -11,7 +11,7 @@
  2 files changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/testmode.c b/testmode.c
-index 4644dace..5c93aa6a 100644
+index ca4feccf..37783160 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -613,7 +613,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
index bc4a5b8..73e9626 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
@@ -1,4 +1,4 @@
-From 6b770050b396997a04c5055fdb397dcb15164b3d Mon Sep 17 00:00:00 2001
+From 4c3bdf16f108c081731b1a73a3bd7730657e81d3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 11:59:16 +0800
 Subject: [PATCH 1004/1044] mtk: wifi: mt76: testmode: add basic testmode
@@ -77,7 +77,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 5c50681a..ea051c03 100644
+index 8cf21f98..f2b1e0c2 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -695,14 +695,21 @@ struct mt76_testmode_ops {
@@ -306,7 +306,7 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 89a03122..9a9d33e6 100644
+index 1f53d230..603f6c0d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -685,7 +685,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -385,10 +385,10 @@
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  #endif
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 35233c71..f1a3fb42 100644
+index b488a78f..d8795d30 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2860,8 +2860,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2863,8 +2863,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  {
  	int ret;
  
@@ -403,7 +403,7 @@
  	if (ret)
  		return ret;
  
-@@ -3552,17 +3556,9 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+@@ -3555,17 +3559,9 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
  				 &req, sizeof(req), true);
  }
  
@@ -423,7 +423,7 @@
  		.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.addr = cpu_to_le32(round_down(offset,
-@@ -3571,6 +3567,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
+@@ -3574,6 +3570,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
  	struct sk_buff *skb;
  	bool valid;
  	int ret;
@@ -431,7 +431,7 @@
  
  	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
  					MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
-@@ -3581,7 +3578,9 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
+@@ -3584,7 +3581,9 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
  	valid = le32_to_cpu(*(__le32 *)(skb->data + 16));
  	if (valid) {
  		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
@@ -442,7 +442,7 @@
  
  		skb_pull(skb, 48);
  		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
-@@ -4574,3 +4573,37 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, bool auto_mode,
+@@ -4577,3 +4576,37 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, bool auto_mode,
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(PP),
  				 &req, sizeof(req), false);
  }
@@ -1692,7 +1692,7 @@
 +
 +#endif
 diff --git a/testmode.c b/testmode.c
-index 5c93aa6a..db2cc255 100644
+index 37783160..44f3a5bf 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -2,11 +2,13 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
index 0bc75af..4d70c33 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
@@ -1,4 +1,4 @@
-From 191480cad9ab8d8ed9e4be9129d3d30f2e638e5c Mon Sep 17 00:00:00 2001
+From 10b5c0f3d23bd9f556654364584d8eb2a9424c6f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:27:24 +0800
 Subject: [PATCH 1005/1044] mtk: wifi: mt76: testmode: add testmode
@@ -53,7 +53,7 @@
  	CHAN2G(1, 2412),
  	CHAN2G(2, 2417),
 diff --git a/mt76.h b/mt76.h
-index ea051c03..1e0488e5 100644
+index f2b1e0c2..14c5fcb1 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -18,6 +18,27 @@
@@ -257,7 +257,7 @@
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(5, 3)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f1a3fb42..30500fbe 100644
+index d8795d30..0e2c1f1c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -712,6 +712,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -834,7 +834,7 @@
  	RF_OPER_NORMAL,
  	RF_OPER_RF_TEST,
 diff --git a/testmode.c b/testmode.c
-index db2cc255..7ed58a77 100644
+index 44f3a5bf..cd8cb655 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -674,6 +674,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
index f6bbdba..df56fb5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
@@ -1,4 +1,4 @@
-From 40875afae4052332ce5178b59643b3b2191f050b Mon Sep 17 00:00:00 2001
+From 50d5f66613427d37f2f714ee4334e36eaa9039f7 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 8 May 2023 09:03:50 +0800
 Subject: [PATCH 1006/1044] mtk: wifi: mt76: mt7996: enable SCS feature for
@@ -44,10 +44,10 @@
  	INIT_LIST_HEAD(&dev->twt_list);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 9a9d33e6..8013ffd1 100644
+index 603f6c0d..c9f45abe 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1799,6 +1799,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1795,6 +1795,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  		cancel_delayed_work_sync(&phy2->mt76->mac_work);
  	if (phy3)
  		cancel_delayed_work_sync(&phy3->mt76->mac_work);
@@ -55,7 +55,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  	for (i = 0; i < 10; i++) {
-@@ -1834,6 +1835,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1830,6 +1831,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  		ieee80211_queue_delayed_work(phy3->mt76->hw,
  					     &phy3->mt76->mac_work,
  					     MT7996_WATCHDOG_TIME);
@@ -94,10 +94,10 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 30500fbe..5ccf462f 100644
+index 0e2c1f1c..62452d6e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4612,3 +4612,108 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
+@@ -4615,3 +4615,108 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TXPOWER),
  				 &req, sizeof(req), false);
  }
@@ -271,7 +271,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index ab97a372..360c4c7e 100644
+index 678b009e..7e4ac77c 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2407,6 +2407,16 @@ static int mt7996_token_read(struct seq_file *s, void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mtk-wifi-mt76-mt7996-add-txpower-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mtk-wifi-mt76-mt7996-add-txpower-support.patch
index 09b7700..e96a9fb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mtk-wifi-mt76-mt7996-add-txpower-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mtk-wifi-mt76-mt7996-add-txpower-support.patch
@@ -1,4 +1,4 @@
-From 7b23bb7c06080cbfdf33d01ec3dd921d8c0f1bae Mon Sep 17 00:00:00 2001
+From 668d96f2685432f602994676ff31f826fb98a99f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Mar 2023 23:35:30 +0800
 Subject: [PATCH 1007/1044] mtk: wifi: mt76: mt7996: add txpower support
@@ -141,7 +141,7 @@
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 360c4c7e..c9b835b2 100644
+index 7e4ac77c..c47d65c9 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2417,6 +2417,328 @@ mt7996_scs_enable_set(void *data, u64 val)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mtk-wifi-mt76-mt7996-add-single-sku.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mtk-wifi-mt76-mt7996-add-single-sku.patch
index de46c86..9099d48 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mtk-wifi-mt76-mt7996-add-single-sku.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mtk-wifi-mt76-mt7996-add-single-sku.patch
@@ -1,4 +1,4 @@
-From baf4f49f59a8991e0e5bfd634b792ece5d7dca77 Mon Sep 17 00:00:00 2001
+From 28aa63ac8f3468494eb58e6dfb424dc3507a3396 Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Mon, 10 Jul 2023 19:56:16 +0800
 Subject: [PATCH 1008/1044] mtk: wifi: mt76: mt7996: add single sku
@@ -103,7 +103,7 @@
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
  
 diff --git a/mt76.h b/mt76.h
-index 1e0488e5..9aa56ac6 100644
+index 14c5fcb1..630b3903 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -1054,6 +1054,14 @@ struct mt76_power_limits {
@@ -130,7 +130,7 @@
  
  static inline bool mt76_queue_is_wed_tx_free(struct mt76_queue *q)
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index fccca36d..58a46ed2 100644
+index 42f12672..75bbb7cc 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -2150,7 +2150,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
@@ -183,10 +183,10 @@
  
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 5ccf462f..fed80421 100644
+index 62452d6e..e103601f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4493,6 +4493,7 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
+@@ -4496,6 +4496,7 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
  int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  {
  #define TX_POWER_LIMIT_TABLE_RATE	0
@@ -194,7 +194,7 @@
  	struct mt7996_dev *dev = phy->dev;
  	struct mt76_phy *mphy = phy->mt76;
  	struct ieee80211_hw *hw = mphy->hw;
-@@ -4506,22 +4507,23 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4509,22 +4510,23 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  		u8 band_idx;
  	} __packed req = {
  		.tag = cpu_to_le16(UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL),
@@ -222,7 +222,7 @@
  	if (!skb)
  		return -ENOMEM;
  
-@@ -4545,6 +4547,37 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4548,6 +4550,37 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  	/* eht */
  	skb_put_data(skb, &la.eht[0], sizeof(la.eht));
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
index 59b874e..59222a4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
@@ -1,4 +1,4 @@
-From 547691d38f2c8984fed244b23f61a650f19d5d74 Mon Sep 17 00:00:00 2001
+From c342da92eba77fea4b62298df80f6b3614c0635f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:36:34 +0800
 Subject: [PATCH 1009/1044] mtk: wifi: mt76: mt7996: add binfile mode support
@@ -61,7 +61,7 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 9aa56ac6..e1b0560b 100644
+index 630b3903..b2cc1085 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -949,6 +949,8 @@ struct mt76_dev {
@@ -290,7 +290,7 @@
  int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev);
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index c9b835b2..669eba9e 100644
+index c47d65c9..09652ef5 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2739,6 +2739,44 @@ static const struct file_operations mt7996_txpower_path_fops = {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1010-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1010-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
index 9d2272e..1ca02bf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1010-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1010-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
@@ -1,4 +1,4 @@
-From 9ce2a5ed55883339f0ea8e0edb5c18752963b367 Mon Sep 17 00:00:00 2001
+From e72fe68d4a6356a2fae17c21971c1fd5a5d9384d Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 12:12:51 +0800
 Subject: [PATCH 1010/1044] mtk: wifi: mt76: mt7996: add normal mode
@@ -90,10 +90,10 @@
  		mt7996_tm_update_channel(phy);
  		goto out;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index fed80421..5712b8a7 100644
+index e103601f..0ee17ff9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3626,6 +3626,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
+@@ -3629,6 +3629,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
  	return 0;
  }
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1011-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1011-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
index bfdd434..20f17b5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1011-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1011-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
@@ -1,4 +1,4 @@
-From 979b974ca118fd6819db0814162d8f0dcfede653 Mon Sep 17 00:00:00 2001
+From ca5e57a566fb60705ae7d6b0767542b32ee42afc Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 22 Mar 2023 11:19:52 +0800
 Subject: [PATCH 1011/1044] mtk: wifi: mt76: testmode: add testmode ZWDFS
@@ -15,7 +15,7 @@
  6 files changed, 326 insertions(+), 12 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index e1b0560b..b0211879 100644
+index b2cc1085..a75277fe 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -778,6 +778,14 @@ struct mt76_testmode_data {
@@ -399,7 +399,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 7ed58a77..805ad83c 100644
+index cd8cb655..69147f86 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,6 +27,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1012-mtk-wifi-mt76-mt7996-add-mu-vendor-command-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1012-mtk-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
index d4cbd2c..8867fe8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1012-mtk-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1012-mtk-wifi-mt76-mt7996-add-mu-vendor-command-support.patch
@@ -1,4 +1,4 @@
-From 093bc6129886e3675d396d5a7be3e57c8b29c559 Mon Sep 17 00:00:00 2001
+From 940f89e5dd90f5554354036614dce057ade743e1 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 13 Dec 2022 15:17:43 +0800
 Subject: [PATCH 1012/1044] mtk: wifi: mt76: mt7996: add mu vendor command
@@ -76,10 +76,10 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 5712b8a7..e74f7b00 100644
+index 0ee17ff9..8348d22a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1370,6 +1370,8 @@ static void
+@@ -1373,6 +1373,8 @@ static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
  {
@@ -88,7 +88,7 @@
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
-@@ -1381,11 +1383,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1384,11 +1386,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
  
  	muru = (struct sta_rec_muru *)tlv;
@@ -108,7 +108,7 @@
  
  	if (sta->deflink.vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
-@@ -4916,3 +4921,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -4919,3 +4924,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(SCS),
  				 &req, sizeof(req), false);
  }
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1013-mtk-wifi-mt76-mt7996-Add-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1013-mtk-wifi-mt76-mt7996-Add-air-monitor-support.patch
index cad1eb5..8f43d6c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1013-mtk-wifi-mt76-mt7996-Add-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1013-mtk-wifi-mt76-mt7996-Add-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From a2cf1f53e11e0311a84949214de98fad1bad9546 Mon Sep 17 00:00:00 2001
+From aaf10c9fa1670faa83c7fade6f970c92239c0853 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 26 Apr 2023 04:40:05 +0800
 Subject: [PATCH 1013/1044] mtk: wifi: mt76: mt7996: Add air monitor support
@@ -25,7 +25,7 @@
  	MCU_UNI_CMD_SER = 0x13,
  	MCU_UNI_CMD_TWT = 0x14,
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8013ffd1..c266dc14 100644
+index c9f45abe..d55e5a76 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -679,6 +679,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1014-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1014-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
index 0a47d0c..ad4b610 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1014-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1014-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
@@ -1,4 +1,4 @@
-From f93b91f5cb564270421034ff9dbc71864646dd10 Mon Sep 17 00:00:00 2001
+From c8dbaeeaff01c35c7e27ef0958d812338e50c054 Mon Sep 17 00:00:00 2001
 From: mtk23510 <rudra.shahi@mediatek.com>
 Date: Fri, 24 Mar 2023 19:18:53 +0800
 Subject: [PATCH 1014/1044] mtk: wifi: mt76: mt7996: add driver support for
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1015-mtk-wifi-mt76-mt7996-add-vendor-cmd-to-get-available.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1015-mtk-wifi-mt76-mt7996-add-vendor-cmd-to-get-available.patch
index c239d77..dc1df69 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1015-mtk-wifi-mt76-mt7996-add-vendor-cmd-to-get-available.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1015-mtk-wifi-mt76-mt7996-add-vendor-cmd-to-get-available.patch
@@ -1,4 +1,4 @@
-From ac974ea7fc0eb73d41a5063e273fb3b1ea971112 Mon Sep 17 00:00:00 2001
+From 109e8c6a16d948bb2b0b685a8d102e91bb89e4ed Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Wed, 3 May 2023 05:08:07 +0800
 Subject: [PATCH 1015/1044] mtk: wifi: mt76: mt7996: add vendor cmd to get
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1016-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1016-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
index 7b2a54a..edd7ca9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1016-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1016-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
@@ -1,4 +1,4 @@
-From 9b1cb9cdfb8ae18820908362a909d854c226e1ce Mon Sep 17 00:00:00 2001
+From 69f8be02d97e911e0a844ac5a1a239a848d41930 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:56:07 +0800
 Subject: [PATCH 1016/1044] mtk: wifi: mt76: mt7996: add debugfs for fw
@@ -13,7 +13,7 @@
  4 files changed, 56 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index f4ce3b55..67c6bd09 100644
+index ea78166b..7a03de12 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -84,6 +84,8 @@ mt7996_sys_recovery_set(struct file *file, const char __user *user_buf,
@@ -65,10 +65,10 @@
  	desc += scnprintf(buff + desc, bufsz - desc,
  			  "\nlet's dump firmware SER statistics...\n");
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c266dc14..75657786 100644
+index d55e5a76..1c1b3eb5 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2084,15 +2084,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2080,15 +2080,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	struct mt7996_dev *dev;
  
  	dev = container_of(work, struct mt7996_dev, dump_work);
@@ -108,7 +108,7 @@
  void mt7996_reset(struct mt7996_dev *dev)
  {
  	if (!dev->recovery.hw_init_done)
-@@ -2110,6 +2131,7 @@ void mt7996_reset(struct mt7996_dev *dev)
+@@ -2106,6 +2127,7 @@ void mt7996_reset(struct mt7996_dev *dev)
  
  		mt7996_irq_disable(dev, MT_INT_MCU_CMD);
  		queue_work(dev->mt76.wq, &dev->dump_work);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1017-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1017-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
index 7fd7681..f9e72ad 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1017-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1017-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
@@ -1,4 +1,4 @@
-From 07a550ff7fbfb8702d7c6adfa0c7fd4ade9bf15b Mon Sep 17 00:00:00 2001
+From 1be676a268fc923a68d8b0338b104f1ac76e0838 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Mon, 25 Dec 2023 15:17:49 +0800
 Subject: [PATCH 1017/1044] mtk: wifi: mt76: mt7996: Add mt7992 coredump
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1018-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1018-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
index ecc86a8..b7304e5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1018-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1018-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
@@ -1,4 +1,4 @@
-From 0e74220e04acc1fb9c10d469e3b287d61a9ae4d6 Mon Sep 17 00:00:00 2001
+From 839e8ed5ee7eb48dd885a1f8f26a8ea9b27517ca Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 6 Jun 2023 16:57:10 +0800
 Subject: [PATCH 1018/1044] mtk: wifi: mt76: mt7996: add support for runtime
@@ -17,10 +17,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index e74f7b00..60b1b62c 100644
+index 8348d22a..cd7f58c3 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2602,8 +2602,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2605,8 +2605,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	if (IS_ERR(rskb))
  		return PTR_ERR(rskb);
  
@@ -30,7 +30,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2638,7 +2637,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2641,7 +2640,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1019-mtk-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-en.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1019-mtk-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-en.patch
index 597728e..fb38f6a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1019-mtk-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-en.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1019-mtk-wifi-mt76-mt7996-add-vendor-subcmd-EDCCA-ctrl-en.patch
@@ -1,4 +1,4 @@
-From 6c3c803dedac7513e8e166fcd2fa0fb9b253fa34 Mon Sep 17 00:00:00 2001
+From 2caf106ced738d65640e21d284e3fee9cb04c611 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Thu, 8 Jun 2023 20:21:04 +0800
 Subject: [PATCH 1019/1044] mtk: wifi: mt76: mt7996: add vendor subcmd EDCCA
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1020-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1020-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
index cdba899..0ae3fc9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1020-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1020-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
@@ -1,4 +1,4 @@
-From f8bfd93b55c37abf0d210bbeab633a6a9877a7a6 Mon Sep 17 00:00:00 2001
+From 090298f97be235c284e47dc8302a39da2f1fa855 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 10 Jul 2023 11:47:29 +0800
 Subject: [PATCH 1020/1044] mtk: wifi: mt76: mt7996: add support spatial reuse
@@ -63,7 +63,7 @@
  					   !dev->dbg.sku_disable);
  #else
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 60b1b62c..03bab7c3 100644
+index cd7f58c3..16341a41 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -712,6 +712,14 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -106,7 +106,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 669eba9e..d1ca9ce7 100644
+index 09652ef5..ed01c089 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2777,6 +2777,83 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1021-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1021-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
index 16e9195..bb58282 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1021-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1021-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
@@ -1,4 +1,4 @@
-From 14177254874d5d9ad7b1e2a04a53481f90d89dc9 Mon Sep 17 00:00:00 2001
+From 424dc1cf297e6bf20ed5c430d215f64517178270 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 1 Aug 2023 16:02:28 +0800
 Subject: [PATCH 1021/1044] mtk: wifi: mt76: mt7996: Establish BA in VO queue
@@ -8,7 +8,7 @@
  1 file changed, 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 75657786..b3762728 100644
+index 1c1b3eb5..4e52aa1b 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1032,8 +1032,6 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1022-mtk-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-w.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1022-mtk-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-w.patch
index 045f81b..ebd565c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1022-mtk-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-w.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1022-mtk-wifi-mt76-mt7996-add-eagle-iFEM-HWITS-ZWDFS-SW-w.patch
@@ -1,4 +1,4 @@
-From 6abdd9bb051eb9791465c19f5e0c0631627a4a86 Mon Sep 17 00:00:00 2001
+From b0a949cc4ac49a2a276949ebbd0cbecc859c8576 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 5 Jul 2023 10:00:17 +0800
 Subject: [PATCH 1022/1044] mtk: wifi: mt76: mt7996: add eagle iFEM HWITS ZWDFS
@@ -10,16 +10,16 @@
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/main.c   | 66 ++++++++++++++++++++++++++++++++++++++++++++++---
+ mt7996/main.c   | 65 ++++++++++++++++++++++++++++++++++++++++++++++---
  mt7996/mcu.c    |  6 +++--
  mt7996/mt7996.h |  1 +
- 3 files changed, 68 insertions(+), 5 deletions(-)
+ 3 files changed, 67 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 9ca37e1e..99bc975e 100644
+index 9ca37e1e..dbe3d33f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1431,6 +1431,62 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
+@@ -1431,6 +1431,61 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -28,8 +28,7 @@
 +					 struct cfg80211_chan_def *user_chandef,
 +					 struct cfg80211_chan_def *fw_chandef)
 +{
-+	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-+	struct mt7996_dev *dev = phy->dev;
++	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 +	struct cfg80211_chan_def *c = user_chandef;
 +	struct ieee80211_channel *first_chan;
 +	bool is_ifem_adie, expand = false;
@@ -82,7 +81,7 @@
  static int
  mt7996_set_radar_background(struct ieee80211_hw *hw,
  			    struct cfg80211_chan_def *chandef)
-@@ -1439,6 +1495,7 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
+@@ -1439,6 +1494,7 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
  	struct mt7996_dev *dev = phy->dev;
  	int ret = -EINVAL;
  	bool running;
@@ -90,7 +89,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1451,13 +1508,14 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
+@@ -1451,13 +1507,14 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
  		goto out;
  	}
  
@@ -107,7 +106,7 @@
  		ret = mt7996_mcu_rdd_background_enable(phy, NULL);
  		if (ret)
  			goto out;
-@@ -1466,7 +1524,9 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
+@@ -1466,7 +1523,9 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
  			goto update_phy;
  	}
  
@@ -119,7 +118,7 @@
  		goto out;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 03bab7c3..17ff251a 100644
+index 16341a41..bc4c3a94 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -369,12 +369,14 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1023-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1023-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
index 9ccd366..aa995e4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1023-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1023-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
@@ -1,4 +1,4 @@
-From a7339ec6678cf02b9efae478bfa82d72612bf404 Mon Sep 17 00:00:00 2001
+From 6bca319efea2666854a49851f7e85aa01e2046ed Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Sat, 12 Aug 2023 04:17:22 +0800
 Subject: [PATCH 1023/1044] mtk: wifi: mt76: mt7996: report tx and rx byte to
@@ -9,7 +9,7 @@
  1 file changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 17ff251a..9a3d0f3c 100644
+index bc4c3a94..03a2402d 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -522,6 +522,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1024-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1024-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
index 17aa675..de8c46e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1024-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1024-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
@@ -1,4 +1,4 @@
-From 7144f4b79987def2a64949b44c0f7250062a6d77 Mon Sep 17 00:00:00 2001
+From ab4e26243d8bbccfe1e8ba69c1af4e3457909f32 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Sep 2023 00:52:46 +0800
 Subject: [PATCH 1024/1044] mtk: wifi: mt76: mt7996: support dup wtbl
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1025-mtk-wifi-mt76-mt7996-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1025-mtk-wifi-mt76-mt7996-add-ibf-control-vendor-cmd.patch
index e70b156..5fc86f1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1025-mtk-wifi-mt76-mt7996-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1025-mtk-wifi-mt76-mt7996-add-ibf-control-vendor-cmd.patch
@@ -1,4 +1,4 @@
-From 3826a1e88d7c7a979550040d1bcacd4358491ad2 Mon Sep 17 00:00:00 2001
+From 4c1c8c14c01399c1851eefde7e56d6dcd7f9f2d3 Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Fri, 22 Sep 2023 09:54:49 +0800
 Subject: [PATCH 1025/1044] mtk: wifi: mt76: mt7996: add ibf control vendor cmd
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1026-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1026-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
index 401bbf1..27628ed 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1026-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1026-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
@@ -1,4 +1,4 @@
-From a9b56c1678204b1f67af27517a95ddfaa8c99618 Mon Sep 17 00:00:00 2001
+From e41cd653fb95b60acd3f7c0ee1690ffa4ba995db Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Nov 2023 11:10:10 +0800
 Subject: [PATCH 1026/1044] mtk: wifi: mt76: try more times when send message
@@ -8,11 +8,11 @@
 ---
  dma.c        |  7 ++++--
  mcu.c        | 65 ++++++++++++++++++++++++++++++++++++----------------
- mt7996/mac.c | 49 ++++++++++-----------------------------
- 3 files changed, 62 insertions(+), 59 deletions(-)
+ mt7996/mac.c | 45 +++++++++++++++---------------------
+ 3 files changed, 68 insertions(+), 49 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 4cf2afdf..e4758e80 100644
+index 56044639..66c000ef 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -504,9 +504,12 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
@@ -131,29 +131,27 @@
  
  	return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index b3762728..7efe7db5 100644
+index 4e52aa1b..c6d79989 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1663,18 +1663,6 @@ mt7996_mac_restart(struct mt7996_dev *dev)
- 			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
- 	}
+@@ -1666,10 +1666,14 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+ 	set_bit(MT76_RESET, &dev->mphy.state);
+ 	set_bit(MT76_MCU_RESET, &dev->mphy.state);
+ 	wake_up(&dev->mt76.mcu.wait);
+-	if (phy2)
++	if (phy2) {
+ 		set_bit(MT76_RESET, &phy2->mt76->state);
+-	if (phy3)
++		set_bit(MT76_MCU_RESET, &phy2->mt76->state);
++	}
++	if (phy3) {
+ 		set_bit(MT76_RESET, &phy3->mt76->state);
++		set_bit(MT76_MCU_RESET, &phy3->mt76->state);
++	}
  
--	set_bit(MT76_RESET, &dev->mphy.state);
--	set_bit(MT76_MCU_RESET, &dev->mphy.state);
--	wake_up(&dev->mt76.mcu.wait);
--	if (phy2) {
--		set_bit(MT76_RESET, &phy2->mt76->state);
--		set_bit(MT76_MCU_RESET, &phy2->mt76->state);
--	}
--	if (phy3) {
--		set_bit(MT76_RESET, &phy3->mt76->state);
--		set_bit(MT76_MCU_RESET, &phy3->mt76->state);
--	}
--
  	/* lock/unlock all queues to ensure that no tx is pending */
  	mt76_txq_schedule_all(&dev->mphy);
- 	if (phy2)
-@@ -1788,13 +1776,24 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1784,13 +1788,24 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  	phy3 = mt7996_phy3(dev);
  	dev->recovery.hw_full_reset = true;
  
@@ -179,7 +177,7 @@
  	cancel_work_sync(&dev->wed_rro.work);
  	cancel_delayed_work_sync(&dev->mphy.mac_work);
  	if (phy2)
-@@ -1897,16 +1896,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1893,16 +1908,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
  	wake_up(&dev->mt76.mcu.wait);
  
@@ -196,7 +194,7 @@
  	mt76_worker_disable(&dev->mt76.tx_worker);
  	mt76_for_each_q_rx(&dev->mt76, i) {
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
-@@ -1917,8 +1906,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1913,8 +1918,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	}
  	napi_disable(&dev->mt76.tx_napi);
  
@@ -205,7 +203,7 @@
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7996_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
-@@ -1991,20 +1978,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1987,20 +1990,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (phy3)
  		ieee80211_wake_queues(phy3->mt76->hw);
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1027-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1027-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
index f4cfee6..54ee436 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1027-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1027-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
@@ -1,4 +1,4 @@
-From 8efecbd24fb7bdcaed27b5608607e6eec71a6b91 Mon Sep 17 00:00:00 2001
+From a86c3c6d2be2e115540d0a6ce5166943fd6657ba Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 21 Nov 2023 09:55:46 +0800
 Subject: [PATCH 1027/1044] mtk: wifi: mt76: mt7996: add SER overlap handle
@@ -26,10 +26,10 @@
  
  		ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb_tmp, cmd, &seq);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 7efe7db5..dc806892 100644
+index c6d79989..2e0fb5d9 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1877,6 +1877,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1889,6 +1889,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -37,7 +37,7 @@
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
-@@ -1894,6 +1895,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1906,6 +1907,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  	set_bit(MT76_RESET, &dev->mphy.state);
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
@@ -48,7 +48,7 @@
  	wake_up(&dev->mt76.mcu.wait);
  
  	mt76_worker_disable(&dev->mt76.tx_worker);
-@@ -2108,6 +2113,9 @@ void mt7996_reset(struct mt7996_dev *dev)
+@@ -2120,6 +2125,9 @@ void mt7996_reset(struct mt7996_dev *dev)
  		return;
  	}
  
@@ -59,7 +59,7 @@
  	wake_up(&dev->reset_wait);
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9a3d0f3c..d381e586 100644
+index 03a2402d..c427ea20 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -246,6 +246,14 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1028-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1028-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
index 32a88fd..578e073 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1028-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1028-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
@@ -1,4 +1,4 @@
-From 44b06188cdb7f5f859049e85d00cf8d1ca9441cb Mon Sep 17 00:00:00 2001
+From b1e9d2e1fd1b0b788bcb42c468b72d7e0fe1d583 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Jul 2023 16:36:36 +0800
 Subject: [PATCH 1028/1044] mtk: wifi: mt76: mt7996: kite default 1-pcie
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1029-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1029-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
index fdefbb3..665f489 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1029-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1029-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
@@ -1,4 +1,4 @@
-From 92db3705c71472d0b822f9aa650ca893b55a5aaf Mon Sep 17 00:00:00 2001
+From 649e775c56c37b314cf69767bbf845237a2674cc Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 28 Apr 2023 10:39:58 +0800
 Subject: [PATCH 1029/1044] mtk: wifi: mt76: mt7996: add debugfs knob for
@@ -14,7 +14,7 @@
  5 files changed, 94 insertions(+), 5 deletions(-)
 
 diff --git a/agg-rx.c b/agg-rx.c
-index 10cbd9e5..adb5a7d7 100644
+index 07c386c7..37588ac2 100644
 --- a/agg-rx.c
 +++ b/agg-rx.c
 @@ -33,10 +33,13 @@ mt76_rx_aggr_release_frames(struct mt76_rx_tid *tid,
@@ -131,7 +131,7 @@
  		napi_gro_receive(napi, skb);
  	}
 diff --git a/mt76.h b/mt76.h
-index b0211879..6ace1a05 100644
+index a75277fe..58fd55b1 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -423,6 +423,7 @@ struct mt76_rx_tid {
@@ -171,7 +171,7 @@
  
  /* per-phy stats.  */
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index dc806892..34dea859 100644
+index 2e0fb5d9..7885bc4c 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -469,8 +469,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -227,7 +227,7 @@
  		break;
  	}
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index d1ca9ce7..17bbed65 100644
+index ed01c089..d290ad4d 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2854,6 +2854,46 @@ mt7996_sr_scene_cond_show(struct seq_file *file, void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1030-mtk-wifi-mt76-mt7996-add-three-wire-pta-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1030-mtk-wifi-mt76-mt7996-add-three-wire-pta-support.patch
index cf53d31..53f6642 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1030-mtk-wifi-mt76-mt7996-add-three-wire-pta-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1030-mtk-wifi-mt76-mt7996-add-three-wire-pta-support.patch
@@ -1,4 +1,4 @@
-From aba1fe485ce5352728380c6cf90ea2ce06bf003a Mon Sep 17 00:00:00 2001
+From 311174c13b07be59176f82594b6704a64acae40c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 24 Oct 2023 15:59:18 +0800
 Subject: [PATCH 1030/1044] mtk: wifi: mt76: mt7996: add three wire pta support
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1031-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1031-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
index 36c36ff..af11090 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1031-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1031-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
@@ -1,4 +1,4 @@
-From 6c67be2cf87c3b74eb4b972b06c89becc4ce09b5 Mon Sep 17 00:00:00 2001
+From 3eac9c285c13a00891a81064bb346b0da307a9e8 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 3 Jan 2023 09:42:07 +0800
 Subject: [PATCH 1031/1044] mtk: wifi: mt76: mt7996: support BF/MIMO debug
@@ -25,7 +25,7 @@
  6 files changed, 1102 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index d381e586..da0d572c 100644
+index c427ea20..d4cd83c6 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -741,6 +741,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -74,7 +74,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 17bbed65..651fb4a9 100644
+index d290ad4d..2104c889 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2894,6 +2894,117 @@ static int mt7996_rx_counters(struct seq_file *s, void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1032-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1032-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
index 781203d..f6e1f07 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1032-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1032-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
@@ -1,4 +1,4 @@
-From bab0b9fcdba8bf3e0bdd1ade984df4548c5c51eb Mon Sep 17 00:00:00 2001
+From e6ce0b945f7cfe7b181223b5e5db4a213c3c4433 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 13 Jun 2023 14:49:02 +0800
 Subject: [PATCH 1032/1044] mtk: wifi: mt76: mt7996: add build the following
@@ -43,7 +43,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 651fb4a9..87c80828 100644
+index 2104c889..9e7acd4b 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -3005,6 +3005,16 @@ static const struct file_operations fops_muru_fixed_group_rate = {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1033-mtk-wifi-mt76-mt7996-add-cert-patch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1033-mtk-wifi-mt76-mt7996-add-cert-patch.patch
index 9b8a517..951e868 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1033-mtk-wifi-mt76-mt7996-add-cert-patch.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1033-mtk-wifi-mt76-mt7996-add-cert-patch.patch
@@ -1,4 +1,4 @@
-From 8d59fe0a6cddf4eacda469e0caffa698425fab77 Mon Sep 17 00:00:00 2001
+From 775ed42df549473e6e9e966ac2d9abcfed74a73b Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 14 Aug 2023 13:36:58 +0800
 Subject: [PATCH 1033/1044] mtk: wifi: mt76: mt7996: add cert patch
@@ -23,7 +23,7 @@
  9 files changed, 778 insertions(+), 7 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 34dea859..9af94d05 100644
+index 7885bc4c..bf42ae07 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -10,6 +10,7 @@
@@ -34,7 +34,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -2273,6 +2274,14 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
+@@ -2285,6 +2286,14 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
  	}
  }
  
@@ -50,7 +50,7 @@
  {
  	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 99bc975e..4a5697a3 100644
+index dbe3d33f..d314d9fb 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -588,6 +588,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -113,10 +113,10 @@
  
  void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index da0d572c..371fd2e7 100644
+index d4cd83c6..3a34afd9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1346,6 +1346,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1349,6 +1349,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
@@ -127,7 +127,7 @@
  
  	/* For 6G band, this tlv is necessary to let hw work normally */
  	if (!sta->deflink.he_6ghz_capa.capa && !sta->deflink.vht_cap.vht_supported)
-@@ -1357,6 +1361,9 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1360,6 +1364,9 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
  	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
  	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
@@ -137,7 +137,7 @@
  }
  
  static void
-@@ -4447,6 +4454,27 @@ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
+@@ -4450,6 +4457,27 @@ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
  				 &req, sizeof(req), true);
  }
  
@@ -165,7 +165,7 @@
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
  {
  	struct {
-@@ -4962,6 +4990,18 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -4965,6 +4993,18 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
  
  	switch (mode) {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1034-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1034-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
index 4486e40..c0cf121 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1034-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1034-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
@@ -1,4 +1,4 @@
-From 044b8e77dbc476e9db82b4fe571ae71b37aef769 Mon Sep 17 00:00:00 2001
+From e5de8b93a62c62b5c44b10022e53d410f93c70d6 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 6 Apr 2023 16:40:28 +0800
 Subject: [PATCH 1034/1044] mtk: wifi: mt76: testmode: add testmode bf support
@@ -32,7 +32,7 @@
  14 files changed, 1354 insertions(+), 59 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 6ace1a05..7d9ee018 100644
+index 58fd55b1..543d9de5 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -752,6 +752,11 @@ struct mt76_testmode_data {
@@ -70,10 +70,10 @@
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
  	MCU_UNI_CMD_RRO = 0x57,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 371fd2e7..1729bb46 100644
+index 3a34afd9..6e3047ba 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1067,7 +1067,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -1070,7 +1070,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	bss->hw_bss_idx = idx;
  
  	if (vif->type == NL80211_IFTYPE_MONITOR) {
@@ -87,7 +87,7 @@
  		return 0;
  	}
  
-@@ -4105,7 +4110,6 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
+@@ -4108,7 +4113,6 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
  int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
  {
  #define MT7996_BF_MAX_SIZE	sizeof(union bf_tag_tlv)
@@ -207,7 +207,7 @@
 +
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 87c80828..9aeb6437 100644
+index 9e7acd4b..c4cdbcdc 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2899,7 +2899,7 @@ mt7996_starec_bf_read_set(void *data, u64 wlan_idx)
@@ -1625,7 +1625,7 @@
  	__le32 func_data;
  	u8 band_idx;
 diff --git a/testmode.c b/testmode.c
-index 805ad83c..7b8f9e66 100644
+index 69147f86..a5c07f8d 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -462,6 +462,42 @@ out:
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1035-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1035-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
index 19e614d..326198c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1035-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1035-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
@@ -1,4 +1,4 @@
-From f3c4b779c6d74afff2532ffc36d9a85d58ec560d Mon Sep 17 00:00:00 2001
+From 68abdcf3519187da5d7fe324b8aa5cbb64ea13a3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 22 Sep 2023 12:33:06 +0800
 Subject: [PATCH 1035/1044] mtk: wifi: mt76: mt7996: add zwdfs cert mode
@@ -13,10 +13,10 @@
  5 files changed, 100 insertions(+), 12 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1729bb46..f3faa42e 100644
+index 6e3047ba..ded28e9a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4503,18 +4503,7 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
+@@ -4506,18 +4506,7 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
  int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val)
  {
@@ -36,7 +36,7 @@
  		.tag = cpu_to_le16(UNI_RDD_CTRL_PARM),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.ctrl = cmd,
-@@ -4527,6 +4516,37 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
+@@ -4530,6 +4519,37 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  				 &req, sizeof(req), true);
  }
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1036-mtk-wifi-mt76-testmode-add-channel-68-96.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1036-mtk-wifi-mt76-testmode-add-channel-68-96.patch
index 16d8c0d..e3e2aa7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1036-mtk-wifi-mt76-testmode-add-channel-68-96.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1036-mtk-wifi-mt76-testmode-add-channel-68-96.patch
@@ -1,4 +1,4 @@
-From 0f71e327905eedf26c651a683e9e9b8f27344d84 Mon Sep 17 00:00:00 2001
+From b159ab04d85f593ca0785404469f2ea23eababef Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 11 Sep 2023 14:43:07 +0800
 Subject: [PATCH 1036/1044] mtk: wifi: mt76: testmode: add channel 68 & 96
@@ -138,10 +138,10 @@
  extern const u32 dpd_5g_bw160_ch_num;
  extern const struct ieee80211_channel dpd_6g_ch_list_bw160[];
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f3faa42e..cb185ff9 100644
+index ded28e9a..cf46fee4 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3777,7 +3777,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3780,7 +3780,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  		chan_list_size = mphy->sband_5g.sband.n_channels;
  		base_offset += dpd_size_2g;
  		if (bw == NL80211_CHAN_WIDTH_160) {
@@ -151,7 +151,7 @@
  			per_chan_size = DPD_PER_CH_GT_BW20_SIZE;
  			cal_id = RF_DPD_FLAT_5G_MEM_CAL;
  			chan_list = dpd_5g_ch_list_bw160;
-@@ -3786,6 +3787,9 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3789,6 +3790,9 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  			/* apply (center channel - 2)'s dpd cal data for bw 40/80 channels */
  			channel -= 2;
  		}
@@ -161,7 +161,7 @@
  		break;
  	case NL80211_BAND_6GHZ:
  		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
-@@ -3825,6 +3829,10 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3828,6 +3832,10 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	if (idx == chan_list_size)
  		return -EINVAL;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1037-mtk-wifi-mt76-mt7996-support-enable-disable-pp-featu.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1037-mtk-wifi-mt76-mt7996-support-enable-disable-pp-featu.patch
index f663f2f..a914829 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1037-mtk-wifi-mt76-mt7996-support-enable-disable-pp-featu.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1037-mtk-wifi-mt76-mt7996-support-enable-disable-pp-featu.patch
@@ -1,4 +1,4 @@
-From 0b7c164634820842ce1d64057328d3eca657e4bd Mon Sep 17 00:00:00 2001
+From 8548624e0e3323cf0e14ce21ab988cd5ed5167cf Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 25 Sep 2023 19:20:49 +0800
 Subject: [PATCH 1037/1044] mtk: wifi: mt76: mt7996: support enable/disable pp
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1038-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1038-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
index a02940e..b005bee 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1038-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1038-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
@@ -1,4 +1,4 @@
-From de9931f5a5ad72925811312b069170ef0ab5e763 Mon Sep 17 00:00:00 2001
+From 911e50206b1155bb240eaa7670fa6715ac6cb500 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 12 Oct 2023 16:17:33 +0800
 Subject: [PATCH 1038/1044] mtk: wifi: mt76: testmode: add kite testmode
@@ -211,10 +211,10 @@
  #define RF_DPD_FLAT_CAL				BIT(28)
  #define RF_PRE_CAL				BIT(29)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index cb185ff9..dde2a505 100644
+index cf46fee4..a39b8bab 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3746,13 +3746,11 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3749,13 +3749,11 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	enum nl80211_chan_width bw = chandef->width;
  	const struct ieee80211_channel *chan_list;
  	u32 cal_id, chan_list_size, base_offset = 0, offs = MT_EE_DO_PRE_CAL;
@@ -230,7 +230,7 @@
  
  	switch (band) {
  	case NL80211_BAND_2GHZ:
-@@ -3768,27 +3766,35 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3771,27 +3769,35 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  			return 0;
  		cal_id = RF_DPD_FLAT_CAL;
  		chan_list = dpd_2g_ch_list_bw20;
@@ -272,7 +272,7 @@
  			return 0;
  		break;
  	case NL80211_BAND_6GHZ:
-@@ -3796,20 +3802,27 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3799,20 +3805,27 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  		cal_id = RF_DPD_FLAT_6G_CAL;
  		chan_list = mphy->sband_6g.sband.channels;
  		chan_list_size = mphy->sband_6g.sband.n_channels;
@@ -305,7 +305,7 @@
  		} else if (bw > NL80211_CHAN_WIDTH_20) {
  			/* apply (center channel - 2)'s dpd cal data for bw 40/80 channels */
  			channel -= 2;
-@@ -3829,9 +3842,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3832,9 +3845,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	if (idx == chan_list_size)
  		return -EINVAL;
  
@@ -551,7 +551,7 @@
  	cal_idx = le32_to_cpu(data->cal_idx);
  	cal_type = le32_to_cpu(data->cal_type);
 diff --git a/testmode.c b/testmode.c
-index 7b8f9e66..81b492a5 100644
+index a5c07f8d..09ab68ce 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -37,6 +37,11 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1039-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1039-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
index cd75989..744e679 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1039-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1039-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
@@ -1,4 +1,4 @@
-From 9a9ccfab916669ad514ca41f84b8e76462ec9070 Mon Sep 17 00:00:00 2001
+From 9c7e1159e0daa47df31d51c73b26a12b7c3c0a42 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Tue, 14 Nov 2023 11:27:06 +0800
 Subject: [PATCH 1039/1044] mtk: wifi: mt76: mt7996: assign DEAUTH to ALTX
@@ -10,7 +10,7 @@
  1 file changed, 10 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 9af94d05..31ec6f89 100644
+index bf42ae07..6fa46e46 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -753,6 +753,8 @@ static void
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1040-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1040-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
index d348572..b1cd4c6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1040-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1040-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
@@ -1,4 +1,4 @@
-From 139cc10423d9b2c5e5528bf45a12a54bbe265c20 Mon Sep 17 00:00:00 2001
+From ba07e0c01317f0d39fb56aceef557c04c0f770c2 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Nov 2023 22:42:09 +0800
 Subject: [PATCH 1040/1044] mtk: wifi: mt76: mt7996: add no_beacon vendor
@@ -21,10 +21,10 @@
  4 files changed, 65 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index dde2a505..2bcee895 100644
+index a39b8bab..c97a3204 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5055,4 +5055,15 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5058,4 +5058,15 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		break;
  	}
  }
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1041-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1041-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
index 003aa07..e104a02 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1041-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1041-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
@@ -1,4 +1,4 @@
-From 7de1a3bf90d697b5b7672c605fab6cd789128b5e Mon Sep 17 00:00:00 2001
+From 5e847c789f6a3b7e234067e33171207fb32f46ea Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Nov 2023 09:49:08 +0800
 Subject: [PATCH 1041/1044] mtk: wifi: mt76: mt7996: add adie efuse merge
@@ -16,7 +16,7 @@
  3 files changed, 190 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 67c6bd09..bc6b5aa6 100644
+index 7a03de12..50ac6d4d 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -862,6 +862,46 @@ mt7996_rf_regval_set(void *data, u64 val)
@@ -238,10 +238,10 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2bcee895..264c6651 100644
+index c97a3204..26d0a1c1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3617,7 +3617,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
+@@ -3620,7 +3620,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
  	};
  	struct sk_buff *skb;
  	bool valid;
@@ -250,7 +250,7 @@
  	u8 *buf = read_buf;
  
  	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
-@@ -3635,11 +3635,13 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
+@@ -3638,11 +3638,13 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
  
  		skb_pull(skb, 48);
  		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1042-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1042-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
index 8e04a22..f515e7f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1042-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1042-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
@@ -1,4 +1,4 @@
-From 44bfda573b977afdb916becfc8a2fa0a8d34192a Mon Sep 17 00:00:00 2001
+From cbc1ac7f49105b788c535d71885fecd5c64cffee Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 5 Dec 2023 16:48:33 +0800
 Subject: [PATCH 1042/1044] mtk: wifi: mt7996: add Eagle 2adie TBTC (BE14000)
@@ -102,7 +102,7 @@
  		if (adie_comb <= 1)
  			dev->chip_sku = MT7996_SKU_444;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 264c6651..ff811357 100644
+index 26d0a1c1..2cdaf845 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -23,6 +23,11 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1043-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1043-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
index 5683b3a..5aefd99 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1043-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1043-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
@@ -1,4 +1,4 @@
-From fb955a0f6fbe7b30d12a1a143b9866178443ee8d Mon Sep 17 00:00:00 2001
+From e38dd3530b0bce868b754b9fb02648974a036ab6 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 22 Dec 2023 17:27:10 +0800
 Subject: [PATCH 1043/1044] mtk: wifi: mt76: mt7996: add background radar hw
@@ -12,7 +12,7 @@
  3 files changed, 29 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index bc6b5aa6..ecaa2345 100644
+index 50ac6d4d..2a5f82da 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -257,6 +257,11 @@ mt7996_rdd_monitor(struct seq_file *s, void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1044-mtk-wifi-mt76-mt7996-support-disable-muru-debug-info.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1044-mtk-wifi-mt76-mt7996-support-disable-muru-debug-info.patch
index fe4e3cf..1d601d3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1044-mtk-wifi-mt76-mt7996-support-disable-muru-debug-info.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1044-mtk-wifi-mt76-mt7996-support-disable-muru-debug-info.patch
@@ -1,4 +1,4 @@
-From 258008a28975b79d35e2572028653aef82490255 Mon Sep 17 00:00:00 2001
+From f3eec1dbbbf7cb3096017f968e616d3311172c1e Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 22 Dec 2023 10:53:00 +0800
 Subject: [PATCH 1044/1044] mtk: wifi: mt76: mt7996: support disable muru debug
@@ -28,7 +28,7 @@
  2 files changed, 30 insertions(+)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index ecaa2345..a97706f5 100644
+index 2a5f82da..dff9e467 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -463,6 +463,9 @@ mt7996_fw_debug_muru_set(void *data)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2000-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2000-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
index c6773a9..f17bdc5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2000-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2000-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
@@ -1,4 +1,4 @@
-From a394aa81005b628630f4593661613682d514df36 Mon Sep 17 00:00:00 2001
+From 531fa0a7bd4865ee9e631c6cd1d5655c8e8995a6 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 19:49:22 +0800
 Subject: [PATCH 2000/2032] mtk: wifi: mt76: revert page_poll for kernel 5.4
@@ -15,7 +15,7 @@
  6 files changed, 104 insertions(+), 169 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index e4758e80..d076faa1 100644
+index 66c000ef..33a84f5f 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -178,7 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
@@ -53,7 +53,7 @@
  	}
  
  done:
-@@ -637,7 +637,8 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -638,7 +638,8 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  		     bool allow_direct)
  {
  	int len = SKB_WITH_OVERHEAD(q->buf_size);
@@ -63,7 +63,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -646,28 +647,29 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -647,28 +648,29 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  
  	while (q->queued < q->ndesc - 1) {
  		struct mt76_queue_buf qbuf = {};
@@ -103,7 +103,7 @@
  			break;
  		}
  		frames++;
-@@ -721,10 +723,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -722,10 +724,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -114,7 +114,7 @@
  	ret = mt76_wed_dma_setup(dev, q, false);
  	if (ret)
  		return ret;
-@@ -743,6 +741,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -744,6 +742,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -122,7 +122,7 @@
  	void *buf;
  	bool more;
  
-@@ -758,7 +757,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -759,7 +758,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  			break;
  
  		if (!mt76_queue_is_wed_rro(q))
@@ -131,7 +131,7 @@
  	} while (1);
  
  	spin_lock_bh(&q->lock);
-@@ -768,6 +767,16 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -769,6 +768,16 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	}
  
  	spin_unlock_bh(&q->lock);
@@ -148,7 +148,7 @@
  }
  
  static void
-@@ -790,15 +799,10 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -791,15 +800,10 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  	/* reset WED rx queues */
  	mt76_wed_dma_setup(dev, q, true);
  
@@ -168,7 +168,7 @@
  }
  
  static void
-@@ -815,7 +819,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -816,7 +820,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
  	} else {
@@ -177,7 +177,7 @@
  	}
  
  	if (more)
-@@ -890,7 +894,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -891,7 +895,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  			goto free_frag;
  
  		skb_reserve(skb, q->buf_offset);
@@ -185,7 +185,7 @@
  
  		*(u32 *)skb->cb = info;
  
-@@ -906,7 +909,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -907,7 +910,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		continue;
  
  free_frag:
@@ -194,7 +194,7 @@
  	}
  
  	mt76_dma_rx_fill(dev, q, true);
-@@ -1009,8 +1012,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -1010,8 +1013,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  		netif_napi_del(&dev->napi[i]);
  		mt76_dma_rx_cleanup(dev, q);
@@ -286,7 +286,7 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mt76.h b/mt76.h
-index 7d9ee018..ce4e87b4 100644
+index 543d9de5..540814f1 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -246,7 +246,7 @@ struct mt76_queue {
@@ -333,10 +333,10 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3709d18d..75a55955 100644
+index 49d5b459..103a0709 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1398,22 +1398,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1402,22 +1402,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
@@ -365,7 +365,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1441,7 +1438,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1445,7 +1442,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		.idx = mvif->mt76.idx,
  	};
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -374,7 +374,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1553,12 +1550,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1557,12 +1554,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -391,7 +391,7 @@
  
  static void
 diff --git a/usb.c b/usb.c
-index 1b25f2e5..46831a27 100644
+index dc690d1c..058f2d12 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2001-mtk-wifi-mt76-rework-wed-rx-flow.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2001-mtk-wifi-mt76-rework-wed-rx-flow.patch
index f413ca1..1259a33 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2001-mtk-wifi-mt76-rework-wed-rx-flow.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2001-mtk-wifi-mt76-rework-wed-rx-flow.patch
@@ -1,4 +1,4 @@
-From 2b103fe6990bafb386d6f036068ad35713903817 Mon Sep 17 00:00:00 2001
+From c6914b48e41c17245715400f8733ed9a38a4d5da Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 13:37:23 +0800
 Subject: [PATCH 2001/2032] mtk: wifi: mt76: rework wed rx flow
@@ -15,7 +15,7 @@
  7 files changed, 144 insertions(+), 85 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index d076faa1..f4ecd117 100644
+index 33a84f5f..c54187bd 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -64,17 +64,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -249,7 +249,7 @@
  }
  
  static int
-@@ -666,7 +701,7 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -667,7 +702,7 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  done:
  		qbuf.len = len - offset;
  		qbuf.skip_unmap = false;
@@ -279,7 +279,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index ce4e87b4..59cf6a16 100644
+index 540814f1..878553a2 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -200,6 +200,7 @@ struct mt76_queue_entry {
@@ -373,7 +373,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6e79bc65..e5a86759 100644
+index a30d08eb..f1e2c93a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,6 +62,7 @@
@@ -385,7 +385,7 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index 4596b367..e0c3e854 100644
+index ab42f69b..46dae6e0 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -851,16 +851,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2002-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2002-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
index 1ad01a8..c1d7f8f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2002-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2002-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
@@ -1,4 +1,4 @@
-From 7d98801b7316b08f29d6dac3f2459ae45196850e Mon Sep 17 00:00:00 2001
+From 397754d5ae1770a66b1a1cb05ba93360f3b3b533 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Apr 2023 17:13:41 +0800
 Subject: [PATCH 2002/2032] mtk: wifi: mt76: wed: change wed token init size to
@@ -10,7 +10,7 @@
  1 file changed, 7 insertions(+), 3 deletions(-)
 
 diff --git a/tx.c b/tx.c
-index e0c3e854..1420ff71 100644
+index 46dae6e0..e2795067 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -827,12 +827,16 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2003-mtk-wifi-mt76-add-random-early-drop-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2003-mtk-wifi-mt76-add-random-early-drop-support.patch
index 997ccd6..547c268 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2003-mtk-wifi-mt76-add-random-early-drop-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2003-mtk-wifi-mt76-add-random-early-drop-support.patch
@@ -1,4 +1,4 @@
-From 5bf8bbd55bc552022024ea5461bd4f30e0fddab4 Mon Sep 17 00:00:00 2001
+From 5a8454a960379567f438f55eda39635a54a7bfbf Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 19 Apr 2023 18:32:41 +0800
 Subject: [PATCH 2003/2032] mtk: wifi: mt76: add random early drop support
@@ -15,7 +15,7 @@
  8 files changed, 167 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index a97706f5..37b36dce 100644
+index dff9e467..01f98b2e 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -629,6 +629,7 @@ mt7996_tx_stats_show(struct seq_file *file, void *data)
@@ -27,7 +27,7 @@
  	mt7996_txbf_stat_read_phy(phy, file);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 31ec6f89..26bed9e2 100644
+index 6fa46e46..64cec164 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1176,6 +1176,13 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
@@ -45,10 +45,10 @@
  		}
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ff811357..c969e4d9 100644
+index 2cdaf845..be21dd62 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3142,8 +3142,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
+@@ -3145,8 +3145,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -59,7 +59,7 @@
  }
  
  int mt7996_mcu_init(struct mt7996_dev *dev)
-@@ -3175,6 +3175,83 @@ out:
+@@ -3178,6 +3178,83 @@ out:
  	skb_queue_purge(&dev->mt76.mcu.res_q);
  }
  
@@ -201,7 +201,7 @@
 -
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 9aeb6437..7fecdb74 100644
+index c4cdbcdc..03f88780 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -3015,6 +3015,27 @@ static int mt7996_muru_prot_thr_set(void *data, u64 val)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2004-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2004-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
index 9bc1587..4f0a133 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2004-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2004-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
@@ -1,4 +1,4 @@
-From dca83d64aecd90492867a471db310b618b00ae0c Mon Sep 17 00:00:00 2001
+From 240627635f05c66751095e95a1265feb99be8224 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 18 May 2023 15:01:47 +0800
 Subject: [PATCH 2004/2032] mtk: wifi: mt76: mt7996: reset addr_elem when
@@ -20,7 +20,7 @@
  2 files changed, 47 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 59cf6a16..1080384b 100644
+index 878553a2..17418e86 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -439,6 +439,7 @@ struct mt76_rx_tid {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2005-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2005-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
index 33076e2..14c8084 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2005-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2005-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
@@ -1,7 +1,7 @@
-From 662e607bf3bbc4d5c433116d183cd5ca150525c8 Mon Sep 17 00:00:00 2001
+From 57ec71ee33dacaf5050f535fc83ce0497c141b33 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 6 Oct 2023 14:01:41 +0800
-Subject: [PATCH 2005/2032] mtk: wifi: mt76 : wed : change pcie0 R5 to pcie1 to
+Subject: [PATCH 2005/2032] mtk: wifi: mt76: wed: change pcie0 R5 to pcie1 to
  get 6G ICS
 
 ---
@@ -43,7 +43,7 @@
  
  	return 0;
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index fd4d41d9..12250f9e 100644
+index 367a204d..44e64f86 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -527,12 +527,15 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2006-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2006-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
index 0eb3342..99ac2f6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2006-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2006-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
@@ -1,4 +1,4 @@
-From 9d1fde2b172d48638556f5c326792f3de6d85973 Mon Sep 17 00:00:00 2001
+From 6cf957f7acc9124acdb7b231b54e98d305b968f3 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Tue, 23 May 2023 12:06:29 +0800
 Subject: [PATCH 2006/2032] mtk: wifi: mt76: add SER support for wed3.0
@@ -9,10 +9,10 @@
  2 files changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index f4ecd117..89ae929f 100644
+index c54187bd..e5be891c 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -833,8 +833,9 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -834,8 +834,9 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  
  	/* reset WED rx queues */
  	mt76_wed_dma_setup(dev, q, true);
@@ -25,7 +25,7 @@
  		mt76_dma_rx_fill(dev, q, false);
  	}
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 12250f9e..e033a785 100644
+index 44e64f86..92ae5138 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -297,6 +297,7 @@ out:
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2007-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2007-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
index f99c32b..daaace2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2007-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2007-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
@@ -1,4 +1,4 @@
-From 3fd9079da8481df27e2ce65a99e3638bae6c7a33 Mon Sep 17 00:00:00 2001
+From cbe204fc70c0aebce3a42cfc314ef0c5bd8a16cf Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Jul 2023 10:55:09 +0800
 Subject: [PATCH 2007/2032] mtk: wifi: mt76: mt7915: wed: find rx token by
@@ -14,7 +14,7 @@
  1 file changed, 25 insertions(+), 2 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 89ae929f..6bfcee1a 100644
+index e5be891c..1021b3e5 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -446,9 +446,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -51,7 +51,7 @@
  		if (!r)
  			return NULL;
  
-@@ -901,7 +924,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -902,7 +925,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		if (!data)
  			break;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2008-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2008-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
index 6108b6b..8075e12 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2008-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2008-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
@@ -1,4 +1,4 @@
-From da80c597a654bba39a056543c9fdcf71f28a4a68 Mon Sep 17 00:00:00 2001
+From 51238985cbb77e8955cc727e6f3853b53c9c088d Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 20 Jul 2023 10:25:50 +0800
 Subject: [PATCH 2008/2032] mtk: wifi: mt76: mt7996: add dma mask limitation
@@ -10,7 +10,7 @@
  2 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 6bfcee1a..6a30adcc 100644
+index 1021b3e5..da21f641 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -488,7 +488,7 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -22,7 +22,7 @@
  			if (!buf)
  				return NULL;
  
-@@ -710,7 +710,7 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -711,7 +711,7 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  		if (mt76_queue_is_wed_rro_ind(q))
  			goto done;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2009-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2009-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
index 0fd2a0d..d38058c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2009-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2009-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
@@ -1,4 +1,4 @@
-From 4ea30536b63156f7ab2a12d1831ca13950fe51b5 Mon Sep 17 00:00:00 2001
+From f2dfba0451106438a4cb312552b95da9a0857c68 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Fri, 18 Aug 2023 10:17:08 +0800
 Subject: [PATCH 2009/2032] mtk: wifi: mt76: mt7996: add per bss statistic info
@@ -34,7 +34,7 @@
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 4a5697a3..4880807e 100644
+index d314d9fb..e1c107fb 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -251,6 +251,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -46,7 +46,7 @@
  
  	mt7996_mac_wtbl_update(dev, idx,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c969e4d9..5d19d6fc 100644
+index be21dd62..479eee0e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -521,6 +521,27 @@ mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rat
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2010-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2010-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
index f887c55..26dc702 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2010-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2010-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
@@ -1,4 +1,4 @@
-From 63d8c717443332fe21313e30e2301c5c9d8a4eb9 Mon Sep 17 00:00:00 2001
+From 1b648b7fe779a9862e966a27d274ac42c24e4bcd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 26 Oct 2023 17:27:43 +0800
 Subject: [PATCH 2010/2032] mtk: wifi: mt76: mt7996: do not report netdev stats
@@ -19,7 +19,7 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 5d19d6fc..ea22aa41 100644
+index 479eee0e..15644029 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -537,6 +537,9 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2011-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2011-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
index 7d267fe..2db4015 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2011-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2011-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
@@ -1,4 +1,4 @@
-From aff85911d271637879c9cd0a60f159bcc63594a3 Mon Sep 17 00:00:00 2001
+From 655711c39cac51c4b63ec8e32dd79ec362081293 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Mon, 11 Sep 2023 16:35:15 +0800
 Subject: [PATCH 2011/2032] mtk: wifi: mt76: mt7996: add support for HW-ATF
@@ -13,7 +13,7 @@
  6 files changed, 475 insertions(+), 26 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 37b36dce..c4adee9a 100644
+index 01f98b2e..8e4ceeeb 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -935,6 +935,91 @@ DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_muru_disable,
@@ -189,7 +189,7 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 26bed9e2..339c92bb 100644
+index 64cec164..8de4ab9a 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -103,6 +103,7 @@ static void mt7996_mac_sta_poll(struct mt7996_dev *dev)
@@ -220,10 +220,10 @@
  
  		/* get signal strength of resp frames (CTS/BA/ACK) */
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ea22aa41..6aa37d44 100644
+index 15644029..a907e667 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2220,34 +2220,37 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2223,34 +2223,37 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  }
  
  static int
@@ -285,7 +285,7 @@
  }
  
  int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-@@ -2303,7 +2306,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2306,7 +2309,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
  	}
  
@@ -294,7 +294,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -5140,6 +5143,218 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -5143,6 +5146,218 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  				 &req, sizeof(req), false);
  }
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2012-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2012-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
index 0f3c078..7b3e94a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2012-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2012-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
@@ -1,4 +1,4 @@
-From 52dd48547a15ef9060f3f594660c846268b763e3 Mon Sep 17 00:00:00 2001
+From 12a52d5e5a8643d0fe1448469d228aeeb85df362 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 12 Oct 2023 10:04:54 +0800
 Subject: [PATCH 2012/2032] mtk: wifi: mt76: mt7996: wed: add SER0.5 support w/
@@ -18,7 +18,7 @@
  9 files changed, 146 insertions(+), 64 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 6a30adcc..a5225db5 100644
+index da21f641..e23b744b 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -218,9 +218,9 @@ void __mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q,
@@ -43,7 +43,7 @@
  		return NULL;
  
  	if (!mt76_queue_is_wed_rro_ind(q)) {
-@@ -791,7 +792,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -792,7 +793,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  			return 0;
  	}
  
@@ -72,7 +72,7 @@
  		mt76_wed_dma_setup(dev, q, true);
  }
 diff --git a/mt76.h b/mt76.h
-index 1080384b..fbf66407 100644
+index 17418e86..6ac8a279 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -296,7 +296,7 @@ struct mt76_queue_ops {
@@ -323,10 +323,10 @@
  #else
  	return 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 339c92bb..53049672 100644
+index 8de4ab9a..48e4ce90 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1756,6 +1756,31 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+@@ -1768,6 +1768,31 @@ mt7996_mac_restart(struct mt7996_dev *dev)
  	if (ret)
  		goto out;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2013-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2013-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
index 1ab2408..7bb9eea 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2013-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2013-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
@@ -1,4 +1,4 @@
-From f6a39ce81cf18154d27f027afe243e988f98deba Mon Sep 17 00:00:00 2001
+From b4130d60aec743429b0bf9156a79b99776bbdc06 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 6 Oct 2023 20:59:42 +0800
 Subject: [PATCH 2013/2032] mtk: wifi: mt76: mt7996: support backaward
@@ -15,66 +15,56 @@
 N/A
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
 ---
- mt7996/dma.c    |  2 +-
- mt7996/mac.c    |  2 +-
- mt7996/main.c   |  6 +++---
+ mt76.h          |  2 ++
+ mt7996/mac.c    |  3 ++-
  mt7996/mcu.c    |  2 +-
- mt7996/mmio.c   | 20 +++++++++++---------
+ mt7996/mmio.c   | 12 +++++++-----
  mt7996/mt7996.h |  1 +
  mt7996/pci.c    | 17 +++++++++--------
- wed.c           |  2 +-
- 8 files changed, 28 insertions(+), 24 deletions(-)
+ wed.c           |  4 ++--
+ 7 files changed, 24 insertions(+), 17 deletions(-)
 
-diff --git a/mt7996/dma.c b/mt7996/dma.c
-index d9e1b17f..eac5b9ed 100644
---- a/mt7996/dma.c
-+++ b/mt7996/dma.c
-@@ -432,7 +432,7 @@ int mt7996_dma_rro_init(struct mt7996_dev *dev)
- 	irq_mask = mdev->mmio.irqmask | MT_INT_RRO_RX_DONE |
- 		   MT_INT_TX_DONE_BAND2;
- 	mt76_wr(dev, MT_INT_MASK_CSR, irq_mask);
--	mtk_wed_device_start_hw_rro(&mdev->mmio.wed, irq_mask, false);
-+	mtk_wed_device_start_hwrro(&mdev->mmio.wed, irq_mask, false);
- 	mt7996_irq_enable(dev, irq_mask);
+diff --git a/mt76.h b/mt76.h
+index 6ac8a279..49b66ff2 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -48,6 +48,8 @@
  
- 	return 0;
+ #define MT76_TOKEN_FREE_THR	64
+ 
++#define MT76_WED_SW_TOKEN_SIZE	15360
++
+ #define MT_QFLAG_WED_RING	GENMASK(1, 0)
+ #define MT_QFLAG_WED_TYPE	GENMASK(4, 2)
+ #define MT_QFLAG_WED		BIT(5)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 53049672..4b51f388 100644
+index 48e4ce90..ed22d94e 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1999,7 +1999,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1781,7 +1781,7 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+ 		}
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
+-		mtk_wed_device_start_hwrro(&dev->mt76.mmio.wed, wed_irq_mask, false);
++		mtk_wed_device_start_hw_rro(&dev->mt76.mmio.wed, wed_irq_mask, false);
+ 		mt7996_irq_enable(dev, wed_irq_mask);
+ 		mt7996_irq_disable(dev, 0);
+ 	}
+@@ -2013,6 +2013,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
--		mtk_wed_device_start_hw_rro(&dev->mt76.mmio.wed, wed_irq_mask,
-+		mtk_wed_device_start_hwrro(&dev->mt76.mmio.wed, wed_irq_mask,
+ 		mtk_wed_device_start_hw_rro(&dev->mt76.mmio.wed, wed_irq_mask,
  					    true);
++
  		mt7996_irq_enable(dev, wed_irq_mask);
  		mt7996_irq_disable(dev, 0);
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 4880807e..becfe20a 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -1601,10 +1601,10 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
- 	path->mtk_wdma.wcid = msta->wcid.idx;
- 
- 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU) &&
--	    mtk_wed_is_amsdu_supported(wed))
--		path->mtk_wdma.amsdu = msta->wcid.amsdu;
-+	    mtk_wed_device_support_pao(wed))
-+		path->mtk_wdma.amsdu_en = msta->wcid.amsdu;
- 	else
--		path->mtk_wdma.amsdu = 0;
-+		path->mtk_wdma.amsdu_en = 0;
- 
- 	ctx->dev = NULL;
- 
+ 	}
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6aa37d44..3a816713 100644
+index a907e667..08979465 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3249,7 +3249,7 @@ static int mt7996_mcu_wa_red_config(struct mt7996_dev *dev)
+@@ -3252,7 +3252,7 @@ static int mt7996_mcu_wa_red_config(struct mt7996_dev *dev)
  
  	if (!mtk_wed_device_active(&dev->mt76.mmio.wed))
  		req.token_per_src[RED_TOKEN_SRC_CNT - 1] =
@@ -84,7 +74,7 @@
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET),
  				 &req, sizeof(req), false);
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index e033a785..e32d3848 100644
+index 92ae5138..eef70faf 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -14,7 +14,7 @@
@@ -96,7 +86,7 @@
  module_param(wed_enable, bool, 0644);
  
  static const struct __base mt7996_reg_base[] = {
-@@ -347,14 +347,14 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -347,7 +347,7 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  		}
  
  		wed->wlan.wpdma_rx_glo = wed->wlan.phy_base + hif1_ofs + MT_WFDMA0_GLO_CFG;
@@ -105,15 +95,6 @@
  				     MT_RXQ_RING_BASE(MT7996_RXQ_BAND0) +
  				     MT7996_RXQ_BAND0 * MT_RING_SIZE;
  
--		wed->wlan.id = 0x7991;
-+		wed->wlan.chip_id = 0x7991;
- 		wed->wlan.tx_tbit[0] = ffs(MT_INT_TX_DONE_BAND2) - 1;
- 	} else {
--		wed->wlan.hw_rro = dev->has_rro; /* default on */
-+		wed->wlan.hwrro = dev->has_rro; /* default on */
- 		wed->wlan.wpdma_int = wed->wlan.phy_base + MT_INT_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = wed->wlan.phy_base + MT_INT_MASK_CSR;
- 		wed->wlan.wpdma_tx = wed->wlan.phy_base + MT_TXQ_RING_BASE(0) +
 @@ -362,7 +362,7 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  
  		wed->wlan.wpdma_rx_glo = wed->wlan.phy_base + MT_WFDMA0_GLO_CFG;
@@ -123,7 +104,7 @@
  				     MT_RXQ_RING_BASE(MT7996_RXQ_BAND0) +
  				     MT7996_RXQ_BAND0 * MT_RING_SIZE;
  
-@@ -404,11 +404,11 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -404,8 +404,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  		dev->mt76.rx_token_size = MT7996_TOKEN_SIZE + wed->wlan.rx_npkt;
  	}
  
@@ -132,13 +113,8 @@
 +	wed->wlan.nbuf = MT7996_TOKEN_SIZE;
 +	wed->wlan.token_start = 0;
  
--	wed->wlan.amsdu_max_subframes = 8;
--	wed->wlan.amsdu_max_len = 1536;
-+	wed->wlan.max_amsdu_nums = 8;
-+	wed->wlan.max_amsdu_len = 1536;
- 
- 	wed->wlan.init_buf = mt7996_wed_init_buf;
- 	wed->wlan.init_rx_buf = mt76_wed_init_rx_buf;
+ 	wed->wlan.amsdu_max_subframes = 8;
+ 	wed->wlan.amsdu_max_len = 1536;
 @@ -426,6 +426,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
@@ -206,18 +182,27 @@
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2))
  			mtk_wed_device_detach(&dev->mt76.mmio.wed_hif2);
 diff --git a/wed.c b/wed.c
-index 61a6badf..53dc7474 100644
+index 61a6badf..634c95cf 100644
 --- a/wed.c
 +++ b/wed.c
-@@ -55,7 +55,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_release_rx_buf);
- u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- {
+@@ -120,7 +120,7 @@ int mt76_wed_offload_enable(struct mtk_wed_device *wed)
+ 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ 
+ 	spin_lock_bh(&dev->token_lock);
+-	dev->token_size = wed->wlan.token_start;
++	dev->token_size = MT76_WED_SW_TOKEN_SIZE;
+ 	spin_unlock_bh(&dev->token_lock);
+ 
+ 	return !wait_event_timeout(dev->tx_wait, !dev->wed_token_count, HZ);
+@@ -204,7 +204,7 @@ void mt76_wed_offload_disable(struct mtk_wed_device *wed)
  	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
--	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
-+	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
- 	u32 length;
- 	int i;
  
+ 	spin_lock_bh(&dev->token_lock);
+-	dev->token_size = dev->drv->token_size;
++	dev->token_size = MT76_WED_SW_TOKEN_SIZE;
+ 	spin_unlock_bh(&dev->token_lock);
+ }
+ EXPORT_SYMBOL_GPL(mt76_wed_offload_disable);
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2014-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2014-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
index 381dd86..e7a590a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2014-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2014-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
@@ -1,4 +1,4 @@
-From 8e485ad97007c39c041751c51dbcc3a6f342b654 Mon Sep 17 00:00:00 2001
+From 2fd58d785c6aaf330211787b8fcbc3662a6f69d8 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 8 Sep 2023 11:57:39 +0800
 Subject: [PATCH 2014/2032] mtk: wifi: mt76: mt7996: wed: add wed support for
@@ -20,7 +20,7 @@
  7 files changed, 142 insertions(+), 48 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index eac5b9ed..bdb9f585 100644
+index d9e1b17f..d62dc8ba 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -77,18 +77,23 @@ static void mt7996_dma_config(struct mt7996_dev *dev)
@@ -198,10 +198,10 @@
  				  MT7996_RRO_WINDOW_MAX_LEN * sizeof(*addr),
  				  &dev->wed_rro.session.phy_addr,
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 4b51f388..da7c387e 100644
+index ed22d94e..48cb2ac0 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1999,6 +1999,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2011,6 +2011,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
  
@@ -209,11 +209,11 @@
 +			mt76_wr(dev, MT_RRO_3_0_EMU_CONF,
 +				MT_RRO_3_0_EMU_CONF_EN_MASK);
 +
- 		mtk_wed_device_start_hwrro(&dev->mt76.mmio.wed, wed_irq_mask,
+ 		mtk_wed_device_start_hw_rro(&dev->mt76.mmio.wed, wed_irq_mask,
  					    true);
- 		mt7996_irq_enable(dev, wed_irq_mask);
+ 
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index e32d3848..b1600a97 100644
+index eef70faf..e23c79fc 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -313,7 +313,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
@@ -235,7 +235,7 @@
 +				     MT_RXQ_RING_BASE(MT7996_RXQ_BAND2) +
 +				     MT7996_RXQ_BAND2 * MT_RING_SIZE;
  
- 		wed->wlan.chip_id = 0x7991;
+ 		wed->wlan.id = 0x7991;
  		wed->wlan.tx_tbit[0] = ffs(MT_INT_TX_DONE_BAND2) - 1;
 @@ -369,9 +370,19 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  		wed->wlan.wpdma_rx_rro[0] = wed->wlan.phy_base +
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2015-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2015-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
index 824f4cd..a0a1b01 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2015-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2015-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
@@ -1,4 +1,4 @@
-From ee0e35680a1a7d1acc84709e2045417df24899a6 Mon Sep 17 00:00:00 2001
+From 5fa40f1780c96c66b3c7a01ac43c8bdebe8b746e Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 13 Sep 2023 17:35:43 +0800
 Subject: [PATCH 2015/2032] mtk: wifi: mt76: mt7992: wed: add 2pcie one wed
@@ -14,7 +14,7 @@
  5 files changed, 39 insertions(+), 13 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index bdb9f585..cf346845 100644
+index d62dc8ba..c23b0d65 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -355,6 +355,13 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
@@ -55,7 +55,7 @@
  			dev->mt76.q_rx[MT_RXQ_TXFREE_BAND0].wed = wed;
  
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index b1600a97..613b5185 100644
+index e23c79fc..764c1244 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -375,10 +375,10 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
@@ -100,7 +100,7 @@
  //#define WF_WFDMA_MCU_DMA0_BASE                                 0x02000
  #define WF_WFDMA_MCU_DMA0_BASE                                 0x54000000
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 7fecdb74..42370205 100644
+index 03f88780..6eea2c3c 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -536,14 +536,22 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2016-mtk-wifi-mt76-mt7996-add-SER-state-log-for-debug.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2016-mtk-wifi-mt76-mt7996-add-SER-state-log-for-debug.patch
index d88cf8c..62ae0f3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2016-mtk-wifi-mt76-mt7996-add-SER-state-log-for-debug.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2016-mtk-wifi-mt76-mt7996-add-SER-state-log-for-debug.patch
@@ -1,4 +1,4 @@
-From 0c5845f500c06a243402ed2d08fff924025b6c0b Mon Sep 17 00:00:00 2001
+From 720514e0de2e86d79e4423b824734014c6040e1b Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Nov 2023 16:37:23 +0800
 Subject: [PATCH 2016/2032] mtk: wifi: mt76: mt7996: add SER state log for
@@ -10,10 +10,10 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index da7c387e..28b4d72b 100644
+index 48cb2ac0..912ae650 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2159,6 +2159,9 @@ void mt7996_coredump(struct mt7996_dev *dev, u8 state)
+@@ -2172,6 +2172,9 @@ void mt7996_coredump(struct mt7996_dev *dev, u8 state)
  
  void mt7996_reset(struct mt7996_dev *dev)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2017-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2017-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
index 68a3863..5958fe2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2017-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2017-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
@@ -1,4 +1,4 @@
-From 10f74d24c6e1616567693e8e86a57402101f7515 Mon Sep 17 00:00:00 2001
+From 253dc25979390b559324187a5a2d1e35552a93c8 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Mon, 6 Nov 2023 10:16:34 +0800
 Subject: [PATCH 2017/2032] mtk: wifi: mt76: mt7996: Remove wed rro ring add
@@ -12,10 +12,10 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index a5225db5..385a3c81 100644
+index e23b744b..38701c71 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -1016,6 +1016,10 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -1017,6 +1017,10 @@ mt76_dma_init(struct mt76_dev *dev,
  	init_completion(&dev->mmio.wed_reset_complete);
  
  	mt76_for_each_q_rx(dev, i) {
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2018-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2018-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
index 62564d0..3bfbbc4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2018-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2018-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
@@ -1,4 +1,4 @@
-From ea7a8b06c72f61a3a77c82a8919a4174a7b97f38 Mon Sep 17 00:00:00 2001
+From 4ce1116a988fa2b0172ec96797a0a81ff4899c35 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 13:56:52 +0800
 Subject: [PATCH 2018/2032] mtk: wifi: mt76: mt7996: Remove wed_stop during L1
@@ -12,10 +12,10 @@
  1 file changed, 6 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 28b4d72b..bc335fd3 100644
+index 912ae650..142e9372 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1942,12 +1942,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1954,12 +1954,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2019-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2019-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
index 5e3052e..4b021cb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2019-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2019-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
@@ -1,4 +1,4 @@
-From b3d10fbe8c8faec735dc2f083debc7c3c802c043 Mon Sep 17 00:00:00 2001
+From 302b6abf2ae7eb56c7e437d67b2aa49a7d47d4fa Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 15:51:04 +0800
 Subject: [PATCH 2019/2032] mtk: wifi: mt76: mt7996: Refactor rro del ba
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2020-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2020-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
index 0b6f565..6860f6c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2020-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2020-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
@@ -1,4 +1,4 @@
-From d71f046693ba8f6e80a0c349d9ef1b9e857a8c34 Mon Sep 17 00:00:00 2001
+From da85f2d8c8f3147aab467ba9d65c6457cba0ad1e Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Fri, 17 Nov 2023 18:08:06 +0800
 Subject: [PATCH 2020/2032] mtk: wifi: mt76: mt7996: get airtime and RSSI via
@@ -23,10 +23,10 @@
  9 files changed, 361 insertions(+), 143 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index fbf66407..8db61815 100644
+index 49b66ff2..c7816721 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -325,11 +325,15 @@ struct mt76_sta_stats {
+@@ -327,11 +327,15 @@ struct mt76_sta_stats {
  	u32 tx_packets;		/* unit: MSDU */
  	u32 tx_retries;
  	u32 tx_failed;
@@ -42,7 +42,7 @@
  };
  
  enum mt76_wcid_flags {
-@@ -1328,6 +1332,22 @@ static inline int mt76_decr(int val, int size)
+@@ -1330,6 +1334,22 @@ static inline int mt76_decr(int val, int size)
  
  u8 mt76_ac_to_hwq(u8 ac);
  
@@ -95,7 +95,7 @@
  	UNI_ALL_STA_GI_MODE,
  	UNI_ALL_STA_TXRX_MSDU_COUNT,
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index c4adee9a..5e9ab9ab 100644
+index 8e4ceeeb..6ccf0827 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -987,12 +987,11 @@ mt7996_airtime_read(struct seq_file *s, void *data)
@@ -137,7 +137,7 @@
  	rcu_read_unlock();
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bc335fd3..2e48ab8b 100644
+index 142e9372..901c2036 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -12,8 +12,6 @@
@@ -269,7 +269,7 @@
  	if (wake)
  		mt76_set_tx_blocked(&dev->mt76, false);
  
-@@ -2370,31 +2262,42 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2383,31 +2275,42 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  
  void mt7996_mac_work(struct work_struct *work)
  {
@@ -326,7 +326,7 @@
  	ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
  				     MT7996_WATCHDOG_TIME);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3a816713..35a44fee 100644
+index 08979465..4907f729 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -560,7 +560,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -373,7 +373,7 @@
  		default:
  			break;
  		}
-@@ -2239,8 +2258,6 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
+@@ -2242,8 +2261,6 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_VI] = VOW_DRR_QUANTUM_IDX1;
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
@@ -382,7 +382,7 @@
  
  	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
  	if (ret)
-@@ -4846,9 +4863,155 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
+@@ -4849,9 +4866,155 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
  				 sizeof(req), true);
  }
  
@@ -540,7 +540,7 @@
  	struct {
  		u8 _rsv[4];
  
-@@ -4859,7 +5022,7 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
+@@ -4862,7 +5025,7 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
  		.len = cpu_to_le16(sizeof(req) - 4),
  	};
  
@@ -678,7 +678,7 @@
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
  int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 42370205..1c1f2c9c 100644
+index 6eea2c3c..916c7c06 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -3047,6 +3047,69 @@ mt7996_vow_drr_dbg(void *data, u64 val)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2021-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2021-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
index 6641bf6..6366876 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/2021-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2021-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
@@ -1,4 +1,4 @@
-From 5bb85ef54208f23c7b6ba8b9edd09f81a411c2aa Mon Sep 17 00:00:00 2001
+From 8871427856374447f4275cde02936e73e452c080 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 4 Jan 2024 09:47:00 +0800
 Subject: [PATCH 2021/2032] mtk: wifi: mt76: mt7996: add support for WMM PBC
@@ -51,10 +51,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 2e48ab8b..471fb9c5 100644
+index 901c2036..88e1fd14 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2289,6 +2289,10 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2302,6 +2302,10 @@ void mt7996_mac_work(struct work_struct *work)
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
  				}
@@ -66,7 +66,7 @@
  			           test_bit(MT76_STATE_RUNNING, &mdev->phys[i]->state))
  				break;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 35a44fee..1426e4b1 100644
+index 4907f729..6405c2fa 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -666,6 +666,82 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2022-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2022-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch
new file mode 100644
index 0000000..8cf8f0f
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2022-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch
@@ -0,0 +1,325 @@
+From f513775361c7aae98ca2f816edb62b1744350325 Mon Sep 17 00:00:00 2001
+From: Rex Lu <rex.lu@mediatek.com>
+Date: Thu, 1 Feb 2024 10:32:42 +0800
+Subject: [PATCH 2022/2032] mtk: wifi: mt76: mt7996: eagle support extra
+ option_type
+
+1. eagle + mt7988d option_type 2 support
+2. eagle single pcie support
+
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
+
+1. adjust pcie outstanding value by pcie speed. not no longer by option_type.
+
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
+---
+ mt7996/dma.c    | 51 +++++++++++++++++++++++++++++++++----
+ mt7996/init.c   | 67 ++++++++++++++++++++++++++++++++++++++-----------
+ mt7996/main.c   | 15 +++++++++--
+ mt7996/mt7996.h |  5 ++++
+ mt7996/pci.c    |  2 +-
+ mt7996/regs.h   |  5 ++++
+ 6 files changed, 123 insertions(+), 22 deletions(-)
+
+diff --git a/mt7996/dma.c b/mt7996/dma.c
+index c23b0d65..3dc0e8a1 100644
+--- a/mt7996/dma.c
++++ b/mt7996/dma.c
+@@ -12,12 +12,20 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx, int n_desc,
+ {
+ 	struct mt7996_dev *dev = phy->dev;
+ 	u32 flags = 0;
++	int i;
++
++	if (phy->mt76->band_idx == MT_BAND1 && !dev->hif2 && is_mt7996(&dev->mt76)) {
++		phy->mt76->q_tx[0] = phy->mt76->dev->phys[MT_BAND0]->q_tx[0];
++		for (i = 1; i <= MT_TXQ_PSD; i++)
++			phy->mt76->q_tx[i] = phy->mt76->q_tx[0];
++		return 0;
++	}
+ 
+ 	if (mtk_wed_device_active(wed)) {
+ 		ring_base += MT_TXQ_ID(0) * MT_RING_SIZE;
+ 		idx -= MT_TXQ_ID(0);
+ 
+-		if (phy->mt76->band_idx == MT_BAND2)
++		if (wed == &dev->mt76.mmio.wed_hif2)
+ 			flags = MT_WED_Q_TX(0);
+ 		else
+ 			flags = MT_WED_Q_TX(idx);
+@@ -102,8 +110,20 @@ static void mt7996_dma_config(struct mt7996_dev *dev)
+ 	/* data tx queue */
+ 	TXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0, MT7996_TXQ_BAND0);
+ 	if (is_mt7996(&dev->mt76)) {
+-		TXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1, MT7996_TXQ_BAND1);
+-		TXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND2, MT7996_TXQ_BAND2);
++		if (dev->hif2) {
++			if (dev->option_type == 2) {
++				/*  bn1:ring21 bn2:ring19 */
++				TXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND2, MT7996_TXQ_BAND2);
++				TXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND1, MT7996_TXQ_BAND1);
++			} else {
++				/* default bn1:ring19 bn2:ring21 */
++				TXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1, MT7996_TXQ_BAND1);
++				TXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND2, MT7996_TXQ_BAND2);
++			}
++		} else {
++			/* single pcie bn0/1:ring18 bn2:ring19 */
++			TXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND1, MT7996_TXQ_BAND1);
++		}
+ 	} else {
+ 		TXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1, MT7996_TXQ_BAND1);
+ 	}
+@@ -352,8 +372,20 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+ 			 WF_WFDMA0_GLO_CFG_EXT1_TX_FCTRL_MODE);
+ 
+ 		mt76_set(dev, MT_WFDMA_HOST_CONFIG,
+-			 MT_WFDMA_HOST_CONFIG_PDMA_BAND |
+-			 MT_WFDMA_HOST_CONFIG_BAND2_PCIE1);
++			 MT_WFDMA_HOST_CONFIG_PDMA_BAND);
++
++		mt76_clear(dev, MT_WFDMA_HOST_CONFIG,
++			   MT_WFDMA_HOST_CONFIG_BAND0_PCIE1 |
++			   MT_WFDMA_HOST_CONFIG_BAND1_PCIE1 |
++			   MT_WFDMA_HOST_CONFIG_BAND2_PCIE1);
++
++		if (dev->option_type == 2)
++			mt76_set(dev, MT_WFDMA_HOST_CONFIG,
++				 MT_WFDMA_HOST_CONFIG_BAND0_PCIE1 |
++				 MT_WFDMA_HOST_CONFIG_BAND1_PCIE1);
++		else
++			mt76_set(dev, MT_WFDMA_HOST_CONFIG,
++				 MT_WFDMA_HOST_CONFIG_BAND2_PCIE1);
+ 
+ 		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
+ 		    is_mt7992(&dev->mt76)) {
+@@ -366,6 +398,15 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
+ 		mt76_rmw(dev, MT_WFDMA_AXI_R2A_CTRL,
+ 			 MT_WFDMA_AXI_R2A_CTRL_OUTSTAND_MASK, 0x14);
+ 
++		if (dev->hif2->speed < PCIE_SPEED_8_0GT ||
++		    (dev->hif2->speed == PCIE_SPEED_8_0GT && dev->hif2->width < 2)) {
++			mt76_rmw(dev, WF_WFDMA0_GLO_CFG_EXT0 + hif1_ofs,
++				 WF_WFDMA0_GLO_CFG_EXT0_OUTSTAND_MASK,
++				 FIELD_PREP(WF_WFDMA0_GLO_CFG_EXT0_OUTSTAND_MASK, 0x3));
++			mt76_rmw(dev, MT_WFDMA_AXI_R2A_CTRL2,
++				 MT_WFDMA_AXI_R2A_CTRL2_OUTSTAND_MASK,
++				 FIELD_PREP(MT_WFDMA_AXI_R2A_CTRL2_OUTSTAND_MASK, 0x3));
++		}
+ 		/* WFDMA rx threshold */
+ 		mt76_wr(dev, MT_WFDMA0_PAUSE_RX_Q_45_TH + hif1_ofs, 0xc000c);
+ 		mt76_wr(dev, MT_WFDMA0_PAUSE_RX_Q_67_TH + hif1_ofs, 0x10008);
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 90f3a417..85fedca6 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -500,7 +500,7 @@ static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
+ void mt7996_mac_init(struct mt7996_dev *dev)
+ {
+ #define HIF_TXD_V2_1	0x21
+-	int i;
++	int i, rx_path_type, rro_bypass, txfree_path;
+ 
+ 	mt76_clear(dev, MT_MDP_DCR2, MT_MDP_DCR2_RX_TRANS_SHORT);
+ 
+@@ -514,22 +514,45 @@ void mt7996_mac_init(struct mt7996_dev *dev)
+ 	}
+ 
+ 	/* rro module init */
+-	if (is_mt7996(&dev->mt76))
+-		mt7996_mcu_set_rro(dev, UNI_RRO_SET_PLATFORM_TYPE, 2);
+-	else
+-		mt7996_mcu_set_rro(dev, UNI_RRO_SET_PLATFORM_TYPE,
+-				   dev->hif2 ? 7 : 0);
++	switch (dev->option_type) {
++	case 2:
++		/* eagle + 7988d */
++		rx_path_type = 3;
++		rro_bypass = dev->has_rro ? 1 : 3;
++		txfree_path = dev->has_rro ? 0 : 1;
++		break;
++	case 3:
++		/* eagle + Airoha */
++		rx_path_type = 6;
++		rro_bypass = dev->has_rro ? 1 : 3;
++		txfree_path = dev->has_rro ? 0 : 1;
++		break;
++	case 4:
++		/* Bollinger */
++		rx_path_type = 2;
++		rro_bypass = dev->has_rro ? 1 : 3;
++		txfree_path = dev->has_rro ? 0 : 1;
++		break;
++	default:
++		if (is_mt7996(&dev->mt76))
++			rx_path_type = 2;
++		else
++			rx_path_type = 7;
++
++		rro_bypass = dev->has_rro ? 1 : 3;
++		txfree_path = dev->has_rro ? 0 : 1;
++		break;
++	}
++
++	mt7996_mcu_set_rro(dev, UNI_RRO_SET_PLATFORM_TYPE, dev->hif2 ? rx_path_type : 0);
++	mt7996_mcu_set_rro(dev, UNI_RRO_SET_BYPASS_MODE, rro_bypass);
++	mt7996_mcu_set_rro(dev, UNI_RRO_SET_TXFREE_PATH, txfree_path);
+ 
+ 	if (dev->has_rro) {
+ 		u16 timeout;
+ 
+ 		timeout = mt76_rr(dev, MT_HW_REV) == MT_HW_REV1 ? 512 : 128;
+ 		mt7996_mcu_set_rro(dev, UNI_RRO_SET_FLUSH_TIMEOUT, timeout);
+-		mt7996_mcu_set_rro(dev, UNI_RRO_SET_BYPASS_MODE, 1);
+-		mt7996_mcu_set_rro(dev, UNI_RRO_SET_TXFREE_PATH, 0);
+-	} else {
+-		mt7996_mcu_set_rro(dev, UNI_RRO_SET_BYPASS_MODE, 3);
+-		mt7996_mcu_set_rro(dev, UNI_RRO_SET_TXFREE_PATH, 1);
+ 	}
+ 
+ 	mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
+@@ -607,9 +630,22 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+ 	if (phy)
+ 		return 0;
+ 
+-	if (is_mt7996(&dev->mt76) && band == MT_BAND2 && dev->hif2) {
+-		hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
+-		wed = &dev->mt76.mmio.wed_hif2;
++	if (is_mt7996(&dev->mt76) && dev->hif2) {
++		switch (dev->option_type) {
++		case 2:
++			/* eagle + 7988d */
++			if (band == MT_BAND1) {
++				hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
++				wed = &dev->mt76.mmio.wed_hif2;
++			}
++			break;
++		default:
++			if (band == MT_BAND2) {
++				hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
++				wed = &dev->mt76.mmio.wed_hif2;
++			}
++			break;
++		}
+ 	}
+ 
+ 	mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7996_ops, band);
+@@ -1048,6 +1084,9 @@ int mt7996_get_chip_sku(struct mt7996_dev *dev)
+ static int mt7996_init_hardware(struct mt7996_dev *dev)
+ {
+ 	int ret, idx;
++	struct device_node *np = dev->mt76.dev->of_node;
++
++	of_property_read_u32(np, "option_type", &dev->option_type);
+ 
+ 	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
+ 	if (is_mt7992(&dev->mt76)) {
+diff --git a/mt7996/main.c b/mt7996/main.c
+index e1c107fb..fd6fd78b 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -1583,8 +1583,19 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+ 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ 
+-	if (phy != &dev->phy && phy->mt76->band_idx == MT_BAND2)
+-		wed = &dev->mt76.mmio.wed_hif2;
++	if (phy != &dev->phy && dev->hif2) {
++		switch (dev->option_type) {
++		case 2:
++			/* eagle + 7988d */
++			if (phy->mt76->band_idx == MT_BAND1)
++				wed = &dev->mt76.mmio.wed_hif2;
++			break;
++		default:
++			if (phy->mt76->band_idx == MT_BAND2)
++				wed = &dev->mt76.mmio.wed_hif2;
++			break;
++		}
++	}
+ 
+ 	if (!mtk_wed_device_active(wed))
+ 		return -ENODEV;
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 6ea024ef..2ca6e55d 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -8,6 +8,7 @@
+ 
+ #include <linux/interrupt.h>
+ #include <linux/ktime.h>
++#include <linux/pci.h>
+ #include "../mt76_connac.h"
+ #include "regs.h"
+ 
+@@ -350,6 +351,8 @@ struct mt7996_hif {
+ 	struct device *dev;
+ 	void __iomem *regs;
+ 	int irq;
++	enum pci_bus_speed speed;
++	enum pcie_link_width width;
+ };
+ 
+ struct mt7996_scs_ctrl {
+@@ -574,6 +577,8 @@ struct mt7996_dev {
+ 	u8 eeprom_mode;
+ 	u32 bg_nxt_freq;
+ 
++	u32 option_type;
++
+ 	bool ibf;
+ 	u8 fw_debug_wm;
+ 	u8 fw_debug_wa;
+diff --git a/mt7996/pci.c b/mt7996/pci.c
+index f0d3f199..24d69d4d 100644
+--- a/mt7996/pci.c
++++ b/mt7996/pci.c
+@@ -5,7 +5,6 @@
+ 
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+-#include <linux/pci.h>
+ 
+ #include "mt7996.h"
+ #include "mac.h"
+@@ -93,6 +92,7 @@ static int mt7996_pci_hif2_probe(struct pci_dev *pdev)
+ 	hif->dev = &pdev->dev;
+ 	hif->regs = pcim_iomap_table(pdev)[0];
+ 	hif->irq = pdev->irq;
++	pcie_bandwidth_available(pdev, NULL, &hif->speed, &hif->width);
+ 	spin_lock_bh(&hif_lock);
+ 	list_add(&hif->list, &hif_list);
+ 	spin_unlock_bh(&hif_lock);
+diff --git a/mt7996/regs.h b/mt7996/regs.h
+index 476b23c3..050637c1 100644
+--- a/mt7996/regs.h
++++ b/mt7996/regs.h
+@@ -435,6 +435,7 @@ enum offs_rev {
+ #define WF_WFDMA0_GLO_CFG_EXT0			MT_WFDMA0(0x2b0)
+ #define WF_WFDMA0_GLO_CFG_EXT0_RX_WB_RXD	BIT(18)
+ #define WF_WFDMA0_GLO_CFG_EXT0_WED_MERGE_MODE	BIT(14)
++#define WF_WFDMA0_GLO_CFG_EXT0_OUTSTAND_MASK	GENMASK(27, 24)
+ 
+ #define WF_WFDMA0_GLO_CFG_EXT1			MT_WFDMA0(0x2b4)
+ #define WF_WFDMA0_GLO_CFG_EXT1_CALC_MODE	BIT(31)
+@@ -454,6 +455,7 @@ enum offs_rev {
+ 
+ #define MT_WFDMA_HOST_CONFIG			MT_WFDMA_EXT_CSR(0x30)
+ #define MT_WFDMA_HOST_CONFIG_PDMA_BAND		BIT(0)
++#define MT_WFDMA_HOST_CONFIG_BAND0_PCIE1	BIT(20)
+ #define MT_WFDMA_HOST_CONFIG_BAND1_PCIE1	BIT(21)
+ #define MT_WFDMA_HOST_CONFIG_BAND2_PCIE1	BIT(22)
+ 
+@@ -463,6 +465,9 @@ enum offs_rev {
+ #define MT_WFDMA_AXI_R2A_CTRL			MT_WFDMA_EXT_CSR(0x500)
+ #define MT_WFDMA_AXI_R2A_CTRL_OUTSTAND_MASK	GENMASK(4, 0)
+ 
++#define MT_WFDMA_AXI_R2A_CTRL2			MT_WFDMA_EXT_CSR(0x508)
++#define MT_WFDMA_AXI_R2A_CTRL2_OUTSTAND_MASK	GENMASK(31, 28)
++
+ #define MT_PCIE_RECOG_ID			0xd7090
+ #define MT_PCIE_RECOG_ID_MASK			GENMASK(30, 0)
+ #define MT_PCIE_RECOG_ID_SEM			BIT(31)
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2023-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2023-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch
new file mode 100644
index 0000000..aa7a600
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2023-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch
@@ -0,0 +1,115 @@
+From 918509adeb892bda553d29794bf475831a49f6d0 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 27 Jul 2023 19:35:32 +0800
+Subject: [PATCH 2023/2032] mtk: wifi: mt76: mt7996: support enable/disable
+ thermal protection mechanism
+
+This commit adds a new debugfs thermal_enable to enable/disable thermal
+protection mechanism. The purpose of this commit is for autotest to
+verify thermal protection mechanism.
+
+[Usage]
+Enable thermal protection: echo 1 > thermal_enable
+Disable thermal protection: echo 0 > thermal_enable
+
+Please note that if you re-enable thermal protection mechanism, all the
+configuration values will be retained from the exising configuration,
+rather than using the default values.
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+---
+ mt7996/main.c        |  1 +
+ mt7996/mt7996.h      |  1 +
+ mt7996/mtk_debugfs.c | 45 ++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 47 insertions(+)
+
+diff --git a/mt7996/main.c b/mt7996/main.c
+index fd6fd78b..91c06cfb 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -83,6 +83,7 @@ int mt7996_run(struct ieee80211_hw *hw)
+ #ifdef CONFIG_MTK_DEBUG
+ 	phy->sr_enable = true;
+ 	phy->enhanced_sr_enable = true;
++	phy->thermal_protection_enable = true;
+ 
+ 	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_SKU_POWER_LIMIT_CTRL,
+ 					   !dev->dbg.sku_disable);
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 2ca6e55d..d6f7828e 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -483,6 +483,7 @@ struct mt7996_phy {
+ #ifdef CONFIG_MTK_DEBUG
+ 	bool sr_enable:1;
+ 	bool enhanced_sr_enable:1;
++	bool thermal_protection_enable:1;
+ #endif
+ };
+ 
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+index 916c7c06..afef17cf 100644
+--- a/mt7996/mtk_debugfs.c
++++ b/mt7996/mtk_debugfs.c
+@@ -3110,6 +3110,49 @@ mt7996_show_rro_mib(struct seq_file *s, void *data)
+ 	return 0;
+ }
+ 
++static int
++mt7996_thermal_enable_get(void *data, u64 *enable)
++{
++	struct mt7996_phy *phy = data;
++
++	*enable = phy->thermal_protection_enable;
++
++	return 0;
++}
++
++static int
++mt7996_thermal_enable_set(void *data, u64 action)
++{
++	struct mt7996_phy *phy = data;
++	int ret;
++	u8 throttling;
++
++	if (action > 1)
++		return -EINVAL;
++
++	if (!!action == phy->thermal_protection_enable)
++		return 0;
++
++	ret = mt7996_mcu_set_thermal_protect(phy, !!action);
++	if (ret)
++		return ret;
++
++	if (!!!action)
++		goto out;
++
++	throttling = MT7996_THERMAL_THROTTLE_MAX - phy->cdev_state;
++	ret = mt7996_mcu_set_thermal_throttling(phy, throttling);
++	if (ret)
++		return ret;
++
++out:
++	phy->thermal_protection_enable = !!action;
++
++	return 0;
++}
++DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_enable, mt7996_thermal_enable_get,
++			 mt7996_thermal_enable_set, "%lld\n");
++
+ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+ {
+ 	struct mt7996_dev *dev = phy->dev;
+@@ -3217,6 +3260,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+ 					    mt7996_show_rro_mib);
+ 	}
+ 
++	debugfs_create_file("thermal_enable", 0600, dir, phy, &fops_thermal_enable);
++
+ 	return 0;
+ }
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2024-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2024-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch
new file mode 100644
index 0000000..8f0e9b2
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2024-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch
@@ -0,0 +1,116 @@
+From 4d28b5d5f45a4494fffd03694caeff4f59765b80 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 4 Jan 2024 19:53:37 +0800
+Subject: [PATCH 2024/2032] mtk: wifi: mt76: mt7996: support thermal recal
+ debug command
+
+Add support thermal recal debug command.
+
+Usage:
+$ echo val > debugfs/thermal_recal
+
+The val can be the following values:
+0 = disable
+1 = enable
+2 = manual trigger
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+---
+ mt76_connac_mcu.h    |  1 +
+ mt7996/mt7996.h      |  1 +
+ mt7996/mtk_debugfs.c | 17 +++++++++++++++++
+ mt7996/mtk_mcu.c     | 21 +++++++++++++++++++++
+ 4 files changed, 40 insertions(+)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index b2b8f2a2..97c2f5c0 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1284,6 +1284,7 @@ enum {
+ 	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
+ 	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
+ 	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
++	MCU_UNI_CMD_THERMAL_CAL = 0x4c,
+ 	MCU_UNI_CMD_RRO = 0x57,
+ 	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
+ 	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index d6f7828e..b5673bdd 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -1027,6 +1027,7 @@ void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
+ void mt7996_tm_update_channel(struct mt7996_phy *phy);
+ 
+ int mt7996_mcu_set_vow_drr_dbg(struct mt7996_dev *dev, u32 val);
++int mt7996_mcu_thermal_debug(struct mt7996_dev *dev, u8 mode, u8 action);
+ #endif
+ 
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+index afef17cf..25c21f37 100644
+--- a/mt7996/mtk_debugfs.c
++++ b/mt7996/mtk_debugfs.c
+@@ -3153,6 +3153,22 @@ out:
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_enable, mt7996_thermal_enable_get,
+ 			 mt7996_thermal_enable_set, "%lld\n");
+ 
++static int
++mt7996_thermal_recal_set(void *data, u64 val)
++{
++#define THERMAL_DEBUG_OPERATION_MANUAL_TRIGGER 2
++#define THERMAL_DEBUG_MODE_RECAL 1
++	struct mt7996_dev *dev = data;
++
++	if (val > THERMAL_DEBUG_OPERATION_MANUAL_TRIGGER)
++		return -EINVAL;
++
++	return mt7996_mcu_thermal_debug(dev, THERMAL_DEBUG_MODE_RECAL, val);
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_recal, NULL,
++			 mt7996_thermal_recal_set, "%llu\n");
++
+ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+ {
+ 	struct mt7996_dev *dev = phy->dev;
+@@ -3261,6 +3277,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+ 	}
+ 
+ 	debugfs_create_file("thermal_enable", 0600, dir, phy, &fops_thermal_enable);
++	debugfs_create_file("thermal_recal", 0200, dir, dev, &fops_thermal_recal);
+ 
+ 	return 0;
+ }
+diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
+index 9a6636fd..063c2516 100644
+--- a/mt7996/mtk_mcu.c
++++ b/mt7996/mtk_mcu.c
+@@ -1280,4 +1280,25 @@ int mt7996_mcu_set_vow_drr_dbg(struct mt7996_dev *dev, u32 val)
+ 				 sizeof(req), true);
+ }
+ 
++int mt7996_mcu_thermal_debug(struct mt7996_dev *dev, u8 mode, u8 action)
++{
++	struct {
++		u8 __rsv1[4];
++
++		__le16 tag;
++		__le16 len;
++
++		u8 mode;
++		u8 action;
++		u8 __rsv2[2];
++	} __packed req = {
++		.tag = cpu_to_le16(mode),
++		.len = cpu_to_le16(sizeof(req) - 4),
++		.mode = mode,
++		.action = action,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(THERMAL_CAL), &req,
++	                         sizeof(req), true);
++}
+ #endif
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2025-mtk-wifi-mt76-mt7996-Porting-wifi6-txpower-fix-to-ea.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2025-mtk-wifi-mt76-mt7996-Porting-wifi6-txpower-fix-to-ea.patch
new file mode 100644
index 0000000..f1c1890
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2025-mtk-wifi-mt76-mt7996-Porting-wifi6-txpower-fix-to-ea.patch
@@ -0,0 +1,470 @@
+From 456a6bddcbec9ba8c18648735327542b837dae0d Mon Sep 17 00:00:00 2001
+From: Allen Ye <allen.ye@mediatek.com>
+Date: Thu, 25 Jan 2024 10:57:08 +0800
+Subject: [PATCH 2025/2032] mtk: wifi: mt76: mt7996: Porting wifi6 txpower fix
+ to eagle
+
+Refactor txpower flow.
+1. Fix wrong bbp CR address
+2. Ignore RegDB power limit when we have single sku table. And dump more informaiton in debugfs.
+3. Refactor get_txpower ops flow, we only consider CCK and OFDM power value as maximum.
+4. Remove sku_disable due to SQC is over and default enable both sku tables.
+
+
+Fix wrong power value when user set limit close to path table limit.
+
+---
+ eeprom.c             |  20 ++++----
+ mt7996/init.c        |  14 ++++-
+ mt7996/main.c        |  11 ++--
+ mt7996/mcu.c         |  41 ++++++++++++---
+ mt7996/mt7996.h      |   3 ++
+ mt7996/mtk_debugfs.c | 120 ++++++++++++++++++++++++++++---------------
+ mt7996/regs.h        |  10 ++--
+ 7 files changed, 149 insertions(+), 70 deletions(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index adb87924..57b9b769 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -336,9 +336,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
+ static void
+ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+ 			     const __be32 *data, size_t len, s8 target_power,
+-			     s8 nss_delta, s8 *max_power)
++			     s8 nss_delta)
+ {
+ 	int i, cur;
++	s8 max_power = -128;
+ 
+ 	if (!data)
+ 		return;
+@@ -350,7 +351,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+ 			break;
+ 
+ 		mt76_apply_array_limit(pwr + pwr_len * i, pwr_len, data + 1,
+-				       target_power, nss_delta, max_power);
++				       target_power, nss_delta, &max_power);
+ 		if (--cur > 0)
+ 			continue;
+ 
+@@ -433,17 +434,17 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+ 	val = mt76_get_of_array(np, "rates-mcs", &len, mcs_rates + 1);
+ 	mt76_apply_multi_array_limit(dest->mcs[0], ARRAY_SIZE(dest->mcs[0]),
+ 				     ARRAY_SIZE(dest->mcs), val, len,
+-				     target_power, txs_delta, &max_power);
++				     target_power, txs_delta);
+ 
+ 	val = mt76_get_of_array(np, "rates-ru", &len, ARRAY_SIZE(dest->ru[0]) + 1);
+ 	mt76_apply_multi_array_limit(dest->ru[0], ARRAY_SIZE(dest->ru[0]),
+ 				     ARRAY_SIZE(dest->ru), val, len,
+-				     target_power, txs_delta, &max_power);
++				     target_power, txs_delta);
+ 
+ 	val = mt76_get_of_array(np, "rates-eht", &len, ARRAY_SIZE(dest->eht[0]) + 1);
+ 	mt76_apply_multi_array_limit(dest->eht[0], ARRAY_SIZE(dest->eht[0]),
+ 				     ARRAY_SIZE(dest->eht), val, len,
+-				     target_power, txs_delta, &max_power);
++				     target_power, txs_delta);
+ 
+ 	if (dest_path == NULL)
+ 		return max_power;
+@@ -465,17 +466,14 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+ 	val = mt76_get_of_array(np, "paths-ru", &len, ARRAY_SIZE(dest_path->ru[0]) + 1);
+ 	mt76_apply_multi_array_limit(dest_path->ru[0], ARRAY_SIZE(dest_path->ru[0]),
+ 				     ARRAY_SIZE(dest_path->ru), val, len,
+-				     target_power_combine, txs_delta, &max_power_backoff);
++				     target_power_combine, txs_delta);
+ 
+ 	val = mt76_get_of_array(np, "paths-ru-bf", &len, ARRAY_SIZE(dest_path->ru_bf[0]) + 1);
+ 	mt76_apply_multi_array_limit(dest_path->ru_bf[0], ARRAY_SIZE(dest_path->ru_bf[0]),
+ 				     ARRAY_SIZE(dest_path->ru_bf), val, len,
+-				     target_power_combine, txs_delta, &max_power_backoff);
++				     target_power_combine, txs_delta);
+ 
+-	if (max_power_backoff == target_power_combine)
+-		return max_power;
+-
+-	return max_power_backoff;
++	return max_power;
+ }
+ EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
+ 
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 85fedca6..bc8cfdbd 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -296,7 +296,11 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
+ 	int pwr_delta = mt7996_eeprom_get_power_delta(dev, sband->band);
+ 	struct mt76_power_limits limits;
+ 	struct mt76_power_path_limits limits_path;
++	struct device_node *np;
+ 
++	phy->sku_limit_en = true;
++	phy->sku_path_en = true;
++	np = mt76_find_power_limits_node(&dev->mt76);
+ 	for (i = 0; i < sband->n_channels; i++) {
+ 		struct ieee80211_channel *chan = &sband->channels[i];
+ 		int target_power = mt7996_eeprom_get_target_power(dev, chan);
+@@ -306,10 +310,16 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
+ 							  &limits,
+ 							  &limits_path,
+ 							  target_power);
++		if (!limits_path.ofdm[0])
++			phy->sku_path_en = false;
++
+ 		target_power += nss_delta;
+ 		target_power = DIV_ROUND_UP(target_power, 2);
+-		chan->max_power = min_t(int, chan->max_reg_power,
+-					target_power);
++		if (!np)
++			chan->max_power = min_t(int, chan->max_reg_power,
++						target_power);
++		else
++			chan->max_power = target_power;
+ 		chan->orig_mpwr = target_power;
+ 	}
+ }
+diff --git a/mt7996/main.c b/mt7996/main.c
+index 91c06cfb..ca8e6125 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -84,11 +84,16 @@ int mt7996_run(struct ieee80211_hw *hw)
+ 	phy->sr_enable = true;
+ 	phy->enhanced_sr_enable = true;
+ 	phy->thermal_protection_enable = true;
+-
+ 	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_SKU_POWER_LIMIT_CTRL,
+-					   !dev->dbg.sku_disable);
++						dev->dbg.sku_disable ? 0 : phy->sku_limit_en);
++
++	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL,
++						dev->dbg.sku_disable ? 0 : phy->sku_path_en);
+ #else
+-	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_SKU_POWER_LIMIT_CTRL, true);
++	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_SKU_POWER_LIMIT_CTRL,
++						phy->sku_limit_en);
++	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL,
++						phy->sku_path_en);
+ #endif
+ 	if (ret)
+ 		goto out;
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 6405c2fa..52651693 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -5126,6 +5126,27 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
+ 				 sizeof(req), true);
+ }
+ 
++static void
++mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
++{
++	struct mt76_phy *mphy = phy->mt76;
++	struct ieee80211_channel *chan = mphy->main_chan;
++	int e2p_power_limit = 0;
++
++	if (chan == NULL) {
++		mphy->txpower_cur = tx_power;
++		return;
++	}
++
++	e2p_power_limit = mt7996_eeprom_get_target_power(phy->dev, chan);
++	e2p_power_limit += mt7996_eeprom_get_power_delta(phy->dev, chan->band);
++
++	if (phy->sku_limit_en)
++		mphy->txpower_cur = min_t(int, e2p_power_limit, tx_power);
++	else
++		mphy->txpower_cur = e2p_power_limit;
++}
++
+ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+ {
+ #define TX_POWER_LIMIT_TABLE_RATE	0
+@@ -5151,12 +5172,20 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+ 	struct mt76_power_limits la = {};
+ 	struct mt76_power_path_limits la_path = {};
+ 	struct sk_buff *skb;
+-	int i, ret, tx_power;
++	int i, ret, txpower_limit;
++
++	if (hw->conf.power_level == INT_MIN)
++		hw->conf.power_level = 127;
++	txpower_limit = mt7996_get_power_bound(phy, hw->conf.power_level);
+ 
+-	tx_power = mt7996_get_power_bound(phy, hw->conf.power_level);
+-	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
+-					      &la, &la_path, tx_power);
+-	mphy->txpower_cur = tx_power;
++	if (phy->sku_limit_en) {
++		txpower_limit = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
++							   &la, &la_path, txpower_limit);
++		mt7996_update_max_txpower_cur(phy, txpower_limit);
++	} else {
++		mt7996_update_max_txpower_cur(phy, txpower_limit);
++		return 0;
++	}
+ 
+ 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
+ 				 sizeof(req) + MT7996_SKU_PATH_NUM);
+@@ -5192,7 +5221,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+ 		return ret;
+ 
+ 	/* only set per-path power table when it's configured */
+-	if (!la_path.ofdm[0])
++	if (!phy->sku_path_en)
+ 		return 0;
+ 
+ 	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index b5673bdd..f1308112 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -461,6 +461,9 @@ struct mt7996_phy {
+ 
+ 	u8 muru_onoff;
+ 
++	bool sku_limit_en;
++	bool sku_path_en;
++
+ #ifdef CONFIG_NL80211_TESTMODE
+ 	struct {
+ 		u32 *reg_backup;
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+index 25c21f37..3f82b58c 100644
+--- a/mt7996/mtk_debugfs.c
++++ b/mt7996/mtk_debugfs.c
+@@ -2454,6 +2454,7 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
+ 	struct mt7996_phy *phy = file->private_data;
+ 	struct mt7996_mcu_txpower_event *event;
+ 	struct txpower_basic_info *basic_info;
++	struct device_node *np;
+ 	static const size_t size = 2048;
+ 	int len = 0;
+ 	ssize_t ret;
+@@ -2510,7 +2511,10 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
+ 	len += scnprintf(buf + len, size - len,
+ 			 "    Theraml Compensation Value: %d\n",
+ 			 basic_info->thermal_compensate_value);
+-
++	np = mt76_find_power_limits_node(phy->mt76->dev);
++	len += scnprintf(buf + len, size - len,
++			 "    RegDB:  %s\n",
++			 !np ? "enable" : "disable");
+ 	ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+ 
+ out:
+@@ -2526,9 +2530,9 @@ static const struct file_operations mt7996_txpower_info_fops = {
+ 	.llseek = default_llseek,
+ };
+ 
+-#define mt7996_txpower_puts(rate)							\
++#define mt7996_txpower_puts(rate, _len)							\
+ ({											\
+-	len += scnprintf(buf + len, size - len, "%-21s:", #rate " (TMAC)");		\
++	len += scnprintf(buf + len, size - len, "%-*s:", _len, #rate " (TMAC)");	\
+ 	for (i = 0; i < mt7996_sku_group_len[SKU_##rate]; i++, offs++)			\
+ 		len += scnprintf(buf + len, size - len, " %6d",				\
+ 				 event->phy_rate_info.frame_power[offs][band_idx]);	\
+@@ -2542,9 +2546,15 @@ mt7996_get_txpower_sku(struct file *file, char __user *user_buf,
+ 	struct mt7996_phy *phy = file->private_data;
+ 	struct mt7996_dev *dev = phy->dev;
+ 	struct mt7996_mcu_txpower_event *event;
++	struct ieee80211_channel *chan = phy->mt76->chandef.chan;
++	struct ieee80211_supported_band sband;
+ 	u8 band_idx = phy->mt76->band_idx;
+ 	static const size_t size = 5120;
+ 	int i, offs = 0, len = 0;
++	u32 target_power = 0;
++	int n_chains = hweight16(phy->mt76->chainmask);
++	int nss_delta = mt76_tx_power_nss_delta(n_chains);
++	int pwr_delta;
+ 	ssize_t ret;
+ 	char *buf;
+ 	u32 reg;
+@@ -2566,41 +2576,45 @@ mt7996_get_txpower_sku(struct file *file, char __user *user_buf,
+ 			 band_idx, phy->mt76->chandef.chan->hw_value);
+ 	len += scnprintf(buf + len, size - len, "%-21s  %6s %6s %6s %6s\n",
+ 			 " ", "1m", "2m", "5m", "11m");
+-	mt7996_txpower_puts(CCK);
++	mt7996_txpower_puts(CCK, 21);
+ 
+ 	len += scnprintf(buf + len, size - len,
+ 			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s\n",
+ 			 " ", "6m", "9m", "12m", "18m", "24m", "36m", "48m",
+ 			 "54m");
+-	mt7996_txpower_puts(OFDM);
++	mt7996_txpower_puts(OFDM, 21);
+ 
+ 	len += scnprintf(buf + len, size - len,
+ 			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s\n",
+ 			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4",
+ 			 "mcs5", "mcs6", "mcs7");
+-	mt7996_txpower_puts(HT20);
++	mt7996_txpower_puts(HT20, 21);
+ 
+ 	len += scnprintf(buf + len, size - len,
+ 			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s %6s\n",
+ 			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4", "mcs5",
+ 			 "mcs6", "mcs7", "mcs32");
+-	mt7996_txpower_puts(HT40);
++	mt7996_txpower_puts(HT40, 21);
+ 
+ 	len += scnprintf(buf + len, size - len,
+ 			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s\n",
+ 			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4", "mcs5",
+ 			 "mcs6", "mcs7", "mcs8", "mcs9", "mcs10", "mcs11");
+-	mt7996_txpower_puts(VHT20);
+-	mt7996_txpower_puts(VHT40);
+-	mt7996_txpower_puts(VHT80);
+-	mt7996_txpower_puts(VHT160);
+-	mt7996_txpower_puts(HE26);
+-	mt7996_txpower_puts(HE52);
+-	mt7996_txpower_puts(HE106);
+-	mt7996_txpower_puts(HE242);
+-	mt7996_txpower_puts(HE484);
+-	mt7996_txpower_puts(HE996);
+-	mt7996_txpower_puts(HE2x996);
++	mt7996_txpower_puts(VHT20, 21);
++	mt7996_txpower_puts(VHT40, 21);
++	mt7996_txpower_puts(VHT80, 21);
++	mt7996_txpower_puts(VHT160, 21);
++	mt7996_txpower_puts(HE26, 21);
++	mt7996_txpower_puts(HE52, 21);
++	mt7996_txpower_puts(HE106, 21);
++	len += scnprintf(buf + len, size - len, "BW20/");
++	mt7996_txpower_puts(HE242, 16);
++	len += scnprintf(buf + len, size - len, "BW40/");
++	mt7996_txpower_puts(HE484, 16);
++	len += scnprintf(buf + len, size - len, "BW80/");
++	mt7996_txpower_puts(HE996, 16);
++	len += scnprintf(buf + len, size - len, "BW160/");
++	mt7996_txpower_puts(HE2x996, 15);
+ 
+ 	len += scnprintf(buf + len, size - len,
+ 			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s ",
+@@ -2608,22 +2622,27 @@ mt7996_get_txpower_sku(struct file *file, char __user *user_buf,
+ 	len += scnprintf(buf + len, size - len,
+ 			 "%6s %6s %6s %6s %6s %6s %6s %6s\n",
+ 			 "mcs8", "mcs9", "mcs10", "mcs11", "mcs12", "mcs13", "mcs14", "mcs15");
+-	mt7996_txpower_puts(EHT26);
+-	mt7996_txpower_puts(EHT52);
+-	mt7996_txpower_puts(EHT106);
+-	mt7996_txpower_puts(EHT242);
+-	mt7996_txpower_puts(EHT484);
+-	mt7996_txpower_puts(EHT996);
+-	mt7996_txpower_puts(EHT2x996);
+-	mt7996_txpower_puts(EHT4x996);
+-	mt7996_txpower_puts(EHT26_52);
+-	mt7996_txpower_puts(EHT26_106);
+-	mt7996_txpower_puts(EHT484_242);
+-	mt7996_txpower_puts(EHT996_484);
+-	mt7996_txpower_puts(EHT996_484_242);
+-	mt7996_txpower_puts(EHT2x996_484);
+-	mt7996_txpower_puts(EHT3x996);
+-	mt7996_txpower_puts(EHT3x996_484);
++	mt7996_txpower_puts(EHT26, 21);
++	mt7996_txpower_puts(EHT52, 21);
++	mt7996_txpower_puts(EHT106, 21);
++	len += scnprintf(buf + len, size - len, "BW20/");
++	mt7996_txpower_puts(EHT242, 16);
++	len += scnprintf(buf + len, size - len, "BW40/");
++	mt7996_txpower_puts(EHT484, 16);
++	len += scnprintf(buf + len, size - len, "BW80/");
++	mt7996_txpower_puts(EHT996, 16);
++	len += scnprintf(buf + len, size - len, "BW160/");
++	mt7996_txpower_puts(EHT2x996, 15);
++	len += scnprintf(buf + len, size - len, "BW320/");
++	mt7996_txpower_puts(EHT4x996, 15);
++	mt7996_txpower_puts(EHT26_52, 21);
++	mt7996_txpower_puts(EHT26_106, 21);
++	mt7996_txpower_puts(EHT484_242, 21);
++	mt7996_txpower_puts(EHT996_484, 21);
++	mt7996_txpower_puts(EHT996_484_242, 21);
++	mt7996_txpower_puts(EHT2x996_484, 21);
++	mt7996_txpower_puts(EHT3x996, 21);
++	mt7996_txpower_puts(EHT3x996_484, 21);
+ 
+ 	len += scnprintf(buf + len, size - len, "\nePA Gain: %d\n",
+ 			 event->phy_rate_info.epa_gain);
+@@ -2632,16 +2651,33 @@ mt7996_get_txpower_sku(struct file *file, char __user *user_buf,
+ 	len += scnprintf(buf + len, size - len, "Min Power Bound: %d\n",
+ 			 event->phy_rate_info.min_power_bound);
+ 
+-	reg = MT_WF_PHYDFE_BAND_TPC_CTRL_STAT0(band_idx);
++	reg = MT_WF_PHYDFE_TSSI_TXCTRL01(band_idx);
+ 	len += scnprintf(buf + len, size - len,
+-			 "BBP TX Power (target power from TMAC)  : %6ld [0.5 dBm]\n",
+-			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER_TMAC));
++			 "\nBBP TX Power (target power from TMAC)  : %6ld [0.5 dBm]\n",
++			 mt76_get_field(dev, reg, MT_WF_PHYDFE_TSSI_TXCTRL_POWER_TMAC));
+ 	len += scnprintf(buf + len, size - len,
+-			 "BBP TX Power (target power from RMAC)  : %6ld [0.5 dBm]\n",
+-			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER_RMAC));
++			 "RegDB maximum power:\t%d [dBm]\n",
++			 chan->max_reg_power);
++
++	if (chan->band == NL80211_BAND_2GHZ)
++		sband = phy->mt76->sband_2g.sband;
++	else if (chan->band == NL80211_BAND_5GHZ)
++		sband = phy->mt76->sband_5g.sband;
++	else if (chan->band == NL80211_BAND_6GHZ)
++		sband = phy->mt76->sband_6g.sband;
++
++	pwr_delta = mt7996_eeprom_get_power_delta(dev, sband.band);
++
++	target_power = max_t(u32, target_power, mt7996_eeprom_get_target_power(dev, chan));
++	target_power += pwr_delta + nss_delta;
++	target_power = DIV_ROUND_UP(target_power, 2);
++	len += scnprintf(buf + len, size - len,
++			 "eeprom maximum power:\t%d [dBm]\n",
++			 target_power);
++
+ 	len += scnprintf(buf + len, size - len,
+-			 "BBP TX Power (TSSI module power input)  : %6ld [0.5 dBm]\n",
+-			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER_TSSI));
++			 "nss_delta:\t%d [0.5 dBm]\n",
++			 nss_delta);
+ 
+ 	ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+ 
+@@ -2660,7 +2696,7 @@ static const struct file_operations mt7996_txpower_sku_fops = {
+ 
+ #define mt7996_txpower_path_puts(rate, arr_length)					\
+ ({											\
+-	len += scnprintf(buf + len, size - len, "%-23s:", #rate " (TMAC)");		\
++	len += scnprintf(buf + len, size - len, "%23s:", #rate " (TMAC)");		\
+ 	for (i = 0; i < arr_length; i++, offs++)					\
+ 		len += scnprintf(buf + len, size - len, " %4d",				\
+ 				 event->backoff_table_info.frame_power[offs]);		\
+diff --git a/mt7996/regs.h b/mt7996/regs.h
+index 050637c1..a0e4b3e1 100644
+--- a/mt7996/regs.h
++++ b/mt7996/regs.h
+@@ -718,6 +718,10 @@ enum offs_rev {
+ 						 ((_wf) << 16) + (ofs))
+ #define MT_WF_PHYRX_CSD_IRPI(_band, _wf)	MT_WF_PHYRX_CSD(_band, _wf, 0x1000)
+ 
++/* PHYDFE CTRL */
++#define MT_WF_PHYDFE_TSSI_TXCTRL01(_band)	MT_WF_PHYRX_CSD(_band, 0, 0xc718)
++#define MT_WF_PHYDFE_TSSI_TXCTRL_POWER_TMAC	GENMASK(31, 24)
++
+ /* PHY CTRL */
+ #define MT_WF_PHY_BAND_BASE			0x83080000
+ #define MT_WF_PHY_BAND(_band, ofs)		(MT_WF_PHY_BAND_BASE + \
+@@ -735,12 +739,6 @@ enum offs_rev {
+ #define MT_WF_PHYRX_BAND_RX_CTRL1_IPI_EN	GENMASK(2, 0)
+ #define MT_WF_PHYRX_BAND_RX_CTRL1_STSCNT_EN	GENMASK(11, 9)
+ 
+-/* PHYDFE CTRL */
+-#define MT_WF_PHYDFE_BAND_TPC_CTRL_STAT0(_phy)	MT_WF_PHY_BAND(_phy, 0xe7a0)
+-#define MT_WF_PHY_TPC_POWER_TMAC		GENMASK(15, 8)
+-#define MT_WF_PHY_TPC_POWER_RMAC		GENMASK(23, 16)
+-#define MT_WF_PHY_TPC_POWER_TSSI		GENMASK(31, 24)
+-
+ /* PHYRX CSD BAND */
+ #define MT_WF_PHYRX_CSD_BAND_RXTD12(_band)		MT_WF_PHY_BAND(_band, 0x8230)
+ #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR_ONLY	BIT(18)
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2026-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2026-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch
new file mode 100644
index 0000000..9cece6d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2026-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch
@@ -0,0 +1,1090 @@
+From 7bbed79a6d043eb149cf3b6be7982ae845ad8450 Mon Sep 17 00:00:00 2001
+From: mtk20656 <chank.chen@mediatek.com>
+Date: Sat, 20 Jan 2024 12:03:24 +0800
+Subject: [PATCH 2026/2032] mtk: wifi: mt76: mt7996: Add connac3 csi feature.
+
+1. format align to wifi6.
+2. add bw320 support.
+3. add active mode.
+
+Signed-off-by: mtk20656 <chank.chen@mediatek.com>
+---
+ mt76_connac_mcu.h |   2 +
+ mt7996/init.c     |  22 +++
+ mt7996/main.c     |   4 +
+ mt7996/mcu.c      | 465 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mcu.h      | 105 +++++++++++
+ mt7996/mt7996.h   |  55 ++++++
+ mt7996/vendor.c   | 208 +++++++++++++++++++++
+ mt7996/vendor.h   |  50 +++++
+ 8 files changed, 911 insertions(+)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 97c2f5c0..8c0200a3 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1049,6 +1049,7 @@ enum {
+ 	MCU_UNI_EVENT_THERMAL = 0x35,
+ 	MCU_UNI_EVENT_NIC_CAPAB = 0x43,
+ 	MCU_UNI_EVENT_TESTMODE_CTRL = 0x46,
++	MCU_UNI_EVENT_CSI_REPORT = 0x4A,
+ 	MCU_UNI_EVENT_WED_RRO = 0x57,
+ 	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
+ 	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
+@@ -1284,6 +1285,7 @@ enum {
+ 	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
+ 	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
+ 	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
++	MCU_UNI_CMD_CSI_CTRL = 0x4A,
+ 	MCU_UNI_CMD_THERMAL_CAL = 0x4c,
+ 	MCU_UNI_CMD_RRO = 0x57,
+ 	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
+diff --git a/mt7996/init.c b/mt7996/init.c
+index bc8cfdbd..a3d7a2ed 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -734,6 +734,24 @@ error:
+ 	return ret;
+ }
+ 
++#ifdef CONFIG_MTK_VENDOR
++static int mt7996_unregister_csi(struct mt7996_phy *phy)
++{
++	struct csi_data *c, *tmp_c;
++
++	spin_lock_bh(&phy->csi.lock);
++	phy->csi.enable = 0;
++
++	list_for_each_entry_safe(c, tmp_c, &phy->csi.list, node) {
++		list_del(&c->node);
++		kfree(c);
++	}
++	spin_unlock_bh(&phy->csi.lock);
++
++	return 0;
++}
++#endif
++
+ static void
+ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
+ {
+@@ -742,6 +760,10 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
+ 	if (!phy)
+ 		return;
+ 
++#ifdef CONFIG_MTK_VENDOR
++	mt7996_unregister_csi(phy);
++#endif
++
+ 	mt7996_unregister_thermal(phy);
+ 
+ 	mphy = phy->dev->mt76.phys[band];
+diff --git a/mt7996/main.c b/mt7996/main.c
+index ca8e6125..97101985 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -797,6 +797,10 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	int i;
+ 
++#ifdef CONFIG_MTK_VENDOR
++	mt7996_mcu_set_csi(&dev->phy, 2, 8, 1, 0, sta->addr);
++#endif
++
+ 	mt7996_mcu_add_sta(dev, vif, sta, false);
+ 
+ 	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 52651693..9e04ea2b 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -638,6 +638,263 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	}
+ }
+ 
++static int
++csi_integrate_segment_data(struct mt7996_phy *phy, struct csi_data *csi)
++{
++	struct csi_data *csi_temp = NULL;
++
++	if (csi->segment_num == 0 && csi->remain_last == 0)
++		return CSI_CHAIN_COMPLETE;
++	else if (csi->segment_num == 0 && csi->remain_last == 1) {
++		memcpy(&phy->csi.buffered_csi,
++		       csi, sizeof(struct csi_data));
++
++		return CSI_CHAIN_SEGMENT_FIRST;
++	} else if (csi->segment_num != 0) {
++		csi_temp = &phy->csi.buffered_csi;
++		if (csi->chain_info != csi_temp->chain_info ||
++		csi->segment_num != (csi_temp->segment_num + 1))
++			return CSI_CHAIN_SEGMENT_ERR;
++
++		memcpy(&csi_temp->data_i[csi_temp->data_num],
++		       csi->data_i, csi->data_num * sizeof(s16));
++
++		memcpy(&csi_temp->data_q[csi_temp->data_num],
++		       csi->data_q, csi->data_num * sizeof(s16));
++
++		csi_temp->data_num += csi->data_num;
++		csi_temp->segment_num = csi->segment_num;
++		csi_temp->remain_last = csi->remain_last;
++
++		if (csi->remain_last == 0)
++			return CSI_CHAIN_SEGMENT_LAST;
++		else if (csi->remain_last == 1)
++			return CSI_CHAIN_SEGMENT_MIDDLE;
++	}
++
++	return CSI_CHAIN_ERR;
++}
++
++static int
++mt7996_mcu_csi_report_data(struct mt7996_phy *phy, u8 *tlv_buf, u32 len)
++{
++	int ret, i;
++	struct csi_data *current_csi;
++	struct csi_data *target_csi;
++	struct csi_tlv *tlv_data;
++	u8 *buf_tmp;
++	u32 rx_info, tx_rx_idx;
++	u32 buf_len_last, offset;
++
++	buf_tmp = tlv_buf;
++	buf_len_last = len;
++	offset = sizeof(((struct csi_tlv *)0)->basic);
++
++	current_csi = kzalloc(sizeof(*current_csi), GFP_KERNEL);
++	if (!current_csi)
++		return -ENOMEM;
++
++	while (buf_len_last >= offset) {
++		u32 tag, len;
++		s16 *data_tmp = NULL;
++
++		tlv_data = (struct csi_tlv *)buf_tmp;
++		tag = le32_to_cpu(tlv_data->basic.tag);
++		len = le32_to_cpu(tlv_data->basic.len);
++
++		switch (tag) {
++		case CSI_EVENT_FW_VER:
++			current_csi->fw_ver = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_CBW:
++			current_csi->ch_bw = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_RSSI:
++			current_csi->rssi = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_SNR:
++			current_csi->snr = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_BAND:
++			current_csi->band = le32_to_cpu(tlv_data->info);
++
++			if (current_csi->band != phy->mt76->band_idx) {
++				kfree(current_csi);
++				return -EINVAL;
++			}
++
++			break;
++		case CSI_EVENT_CSI_NUM:
++			current_csi->data_num = le32_to_cpu(tlv_data->info);
++
++			if (current_csi->data_num > CSI_BW80_DATA_COUNT) {
++				kfree(current_csi);
++				return -EINVAL;
++			}
++
++			break;
++		case CSI_EVENT_CSI_I_DATA:
++			if (len != sizeof(s16) * current_csi->data_num) {
++				kfree(current_csi);
++				return -EINVAL;
++			}
++
++			data_tmp = tlv_data->data;
++			for (i = 0; i < current_csi->data_num; i++)
++				current_csi->data_i[i] = le16_to_cpu(*(data_tmp + i));
++			break;
++		case CSI_EVENT_CSI_Q_DATA:
++			if (len != sizeof(s16) * current_csi->data_num) {
++				kfree(current_csi);
++				return -EINVAL;
++			}
++
++			data_tmp = tlv_data->data;
++			for (i = 0; i < current_csi->data_num; i++)
++				current_csi->data_q[i] = le16_to_cpu(*(data_tmp + i));
++			break;
++		case CSI_EVENT_DBW:
++			current_csi->data_bw = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_CH_IDX:
++			current_csi->pri_ch_idx = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_TA:
++			memcpy(current_csi->ta, tlv_data->mac, ETH_ALEN);
++			break;
++		case CSI_EVENT_EXTRA_INFO:
++			current_csi->ext_info = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_RX_MODE:
++			rx_info = le32_to_cpu(tlv_data->info);
++			current_csi->rx_mode = u32_get_bits(rx_info, GENMASK(15, 0));
++			current_csi->rx_rate = u32_get_bits(rx_info, GENMASK(31, 16));
++			break;
++		case CSI_EVENT_H_IDX:
++			current_csi->chain_info = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_TX_RX_IDX:
++			tx_rx_idx = le32_to_cpu(tlv_data->info);
++			current_csi->tx_idx = u32_get_bits(tx_rx_idx, GENMASK(31, 16));
++			current_csi->rx_idx = u32_get_bits(tx_rx_idx, GENMASK(15, 0));
++			break;
++		case CSI_EVENT_TS:
++			current_csi->ts = le32_to_cpu(tlv_data->info);
++
++			if (phy->csi.interval &&
++				current_csi->ts < phy->csi.last_record + phy->csi.interval) {
++				kfree(current_csi);
++				return 0;
++			}
++
++			break;
++		case CSI_EVENT_PKT_SN:
++			current_csi->pkt_sn = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_BW_SEG:
++			current_csi->segment_num = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_REMAIN_LAST:
++			current_csi->remain_last = le32_to_cpu(tlv_data->info);
++			break;
++		case CSI_EVENT_TR_STREAM:
++			current_csi->tr_stream = le32_to_cpu(tlv_data->info);
++			break;
++		default:
++			break;
++		};
++
++		buf_len_last -= (offset + len);
++
++		if (buf_len_last >= offset)
++			buf_tmp += (offset + len);
++	}
++
++	/* integret the bw80 segment */
++	if (current_csi->ch_bw >= CSI_BW80) {
++		ret = csi_integrate_segment_data(phy, current_csi);
++
++		switch (ret) {
++		case CSI_CHAIN_ERR:
++		case CSI_CHAIN_SEGMENT_ERR:
++			kfree(current_csi);
++			return -EINVAL;
++			break;
++		case CSI_CHAIN_SEGMENT_FIRST:
++		case CSI_CHAIN_SEGMENT_MIDDLE:
++			kfree(current_csi);
++			return 0;
++			break;
++		case CSI_CHAIN_COMPLETE:
++			target_csi = current_csi;
++			break;
++		case CSI_CHAIN_SEGMENT_LAST:
++			target_csi = current_csi;
++			memcpy(target_csi, &phy->csi.buffered_csi, sizeof(struct csi_data));
++			memset(&phy->csi.buffered_csi, 0, sizeof(struct csi_data));
++			break;
++		default:
++			break;
++		}
++	} else {
++		target_csi = current_csi;
++	}
++
++	/* put the csi data into list */
++	INIT_LIST_HEAD(&target_csi->node);
++	spin_lock_bh(&phy->csi.lock);
++
++	if (!phy->csi.enable) {
++		kfree(target_csi);
++		goto out;
++	}
++
++	list_add_tail(&target_csi->node, &phy->csi.list);
++	phy->csi.count++;
++
++	if (phy->csi.count > CSI_MAX_BUF_NUM) {
++		struct csi_data *old;
++
++		old = list_first_entry(&phy->csi.list,
++				       struct csi_data, node);
++
++		list_del(&old->node);
++		kfree(old);
++		phy->csi.count--;
++	}
++
++	if (target_csi->chain_info & BIT(15)) /* last chain */
++		phy->csi.last_record = target_csi->ts;
++
++out:
++	spin_unlock_bh(&phy->csi.lock);
++	return 0;
++}
++
++void
++mt7996_mcu_csi_report_event(struct mt7996_dev *dev, struct sk_buff *skb)
++{
++	struct mt7996_mcu_csi_event *event;
++	struct mt76_phy *mphy;
++	struct mt7996_phy *phy;
++
++	event = (struct mt7996_mcu_csi_event *)skb->data;
++
++	mphy = dev->mt76.phys[event->band_idx];
++	if (!mphy)
++		return;
++
++	phy = mphy->priv;
++
++	switch (le16_to_cpu(event->tag)) {
++	case UNI_EVENT_CSI_DATA:
++		mt7996_mcu_csi_report_data(phy, event->tlv_buf, le16_to_cpu(event->len) - 4);
++		break;
++	default:
++		break;
++	}
++}
++
+ static void
+ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
+ {
+@@ -881,6 +1138,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	case MCU_UNI_EVENT_BF:
+ 		mt7996_mcu_rx_bf_event(dev, skb);
+ 		break;
++#endif
++#ifdef CONFIG_MTK_VENDOR
++	case MCU_UNI_EVENT_CSI_REPORT:
++		mt7996_mcu_csi_report_event(dev, skb);
++		break;
+ #endif
+ 	default:
+ 		break;
+@@ -5671,4 +5933,207 @@ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+ 
+ 	mt7996_mcu_add_beacon(hw, vif, val);
+ }
++
++static int mt7996_mcu_set_csi_enable(struct mt7996_phy *phy, u16 tag)
++{
++	struct {
++		u8 band;
++		u8 rsv1[3];
++
++		__le16 tag;
++		__le16 len;
++	} __packed req = {
++		.band = phy->mt76->band_idx,
++		.tag = cpu_to_le16(tag),
++		.len = cpu_to_le16(sizeof(req) - 4),
++	};
++
++	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(CSI_CTRL), &req,
++				sizeof(req), false);
++}
++
++static int mt7996_mcu_set_csi_frame_type(struct mt7996_phy *phy, u16 tag, u8 type_idx, u32 type)
++{
++	struct {
++		u8 band;
++		u8 rsv1[3];
++
++		__le16 tag;
++		__le16 len;
++		u8 frame_type_idx;
++		u8 frame_type;
++		u8 rsv2[2];
++	} __packed req = {
++		.band = phy->mt76->band_idx,
++		.tag = cpu_to_le16(tag),
++		.len = cpu_to_le16(sizeof(req) - 4),
++		.frame_type_idx = type_idx,
++		.frame_type = type,
++	};
++
++	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(CSI_CTRL), &req,
++				sizeof(req), false);
++}
++
++static int mt7996_mcu_set_csi_chain_filter(struct mt7996_phy *phy, u16 tag, u8 func, u32 value)
++{
++	struct {
++		u8 band;
++		u8 rsv1[3];
++
++		__le16 tag;
++		__le16 len;
++		u8 function;
++		u8 chain_value;
++		u8 rsv2[2];
++	} __packed req = {
++		.band = phy->mt76->band_idx,
++		.tag = cpu_to_le16(tag),
++		.len = cpu_to_le16(sizeof(req) - 4),
++		.function = func,
++		.chain_value = value,
++	};
++
++	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(CSI_CTRL), &req,
++				sizeof(req), false);
++}
++
++static int mt7996_mcu_set_csi_sta_filter(struct mt7996_phy *phy, u16 tag, u32 op, u8 *sta_mac)
++{
++	struct {
++		u8 band;
++		u8 rsv1[3];
++
++		__le16 tag;
++		__le16 len;
++		u8 operation;
++		u8 rsv2[1];
++		u8 mac[6];
++	} __packed req = {
++		.band = phy->mt76->band_idx,
++		.tag = cpu_to_le16(tag),
++		.len = cpu_to_le16(sizeof(req) - 4),
++		.operation = op,
++	};
++
++	memcpy(req.mac, sta_mac, ETH_ALEN);
++
++	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(CSI_CTRL), &req,
++				sizeof(req), false);
++}
++
++static int mt7996_mcu_set_csi_active_mode(struct mt7996_phy *phy, u16 tag,
++					  u32 interval, u8 frame_idx, u8 subframe_idx, u32 bitmap)
++{
++	struct {
++		u8 band;
++		u8 rsv1[3];
++
++		__le16 tag;
++		__le16 len;
++		__le16 interval; /* uint: ms */
++		u8 frame_type_idx;
++		u8 subframe_type_idx;
++		__le32 bitmap; /* sta wcid bitmap */
++		u8 rsv2[4];
++	} __packed req = {
++		.band = phy->mt76->band_idx,
++		.tag = cpu_to_le16(tag),
++		.len = cpu_to_le16(sizeof(req) - 4),
++		.interval = cpu_to_le16(interval),
++		.frame_type_idx = frame_idx,
++		.subframe_type_idx = subframe_idx,
++		.bitmap = cpu_to_le32(bitmap),
++	};
++
++	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(CSI_CTRL), &req,
++				sizeof(req), false);
++}
++
++void mt7996_csi_wcid_bitmap_update(void *data, struct ieee80211_sta *sta)
++{
++	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_phy *phy = msta->vif->phy;
++	struct csi_bitmap_info_update *sta_info = (struct csi_bitmap_info_update *)data;
++	u16 wcid = 0;
++
++#define CSI_ACTIVE_MODE_ADD 1
++#define CSI_ACTIVE_MODE_REMOVE 0
++
++	if (!memcmp(sta_info->addr, sta->addr, ETH_ALEN)) {
++		wcid = msta->wcid.idx;
++
++		/* active mode: only support station with wcid less than 32 */
++		if (wcid > 32)
++			return;
++
++		if (sta_info->action == CSI_ACTIVE_MODE_ADD)
++			phy->csi.active_bitmap |= BIT(wcid);
++		else if (sta_info->action == CSI_ACTIVE_MODE_REMOVE)
++			phy->csi.active_bitmap &= ~(BIT(wcid));
++	}
++}
++
++int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
++			u8 cfg, u8 v1, u32 v2, u8 *mac_addr)
++{
++	switch (mode) {
++	case CSI_CONTROL_MODE_STOP:
++		return mt7996_mcu_set_csi_enable(phy, UNI_CMD_CSI_STOP);
++	case CSI_CONTROL_MODE_START:
++		return mt7996_mcu_set_csi_enable(phy, UNI_CMD_CSI_START);
++	case CSI_CONTROL_MODE_SET:
++		switch (cfg) {
++		case CSI_CONFIG_FRAME_TYPE:
++			if (v2 > 255)
++				return -EINVAL;
++
++			return mt7996_mcu_set_csi_frame_type(phy,
++					UNI_CMD_CSI_SET_FRAME_TYPE, v1, v2);
++		case CSI_CONFIG_CHAIN_FILTER:
++			if (v2 > 255)
++				return -EINVAL;
++
++			return mt7996_mcu_set_csi_chain_filter(phy,
++					UNI_CMD_CSI_SET_CHAIN_FILTER, v1, v2);
++		case CSI_CONFIG_STA_FILTER:
++			if (!is_valid_ether_addr(mac_addr))
++				return -EINVAL;
++
++			if (v2 > 255)
++				return -EINVAL;
++
++			return mt7996_mcu_set_csi_sta_filter(phy,
++					UNI_CMD_CSI_SET_STA_FILTER, v2, mac_addr);
++		case CSI_CONFIG_ACTIVE_MODE:
++			if (is_valid_ether_addr(mac_addr)) {
++				struct csi_bitmap_info_update sta_info;
++
++				if (v2 > 255)
++					return -EINVAL;
++
++				memcpy(sta_info.addr, mac_addr, ETH_ALEN);
++				sta_info.action = v2;
++
++				ieee80211_iterate_stations_atomic(phy->mt76->hw,
++								mt7996_csi_wcid_bitmap_update, &sta_info);
++				return 0;
++			} else {
++				u8 frame_type = v1 & 0x3;
++				u8 frame_subtype = (v1 & 0x3c) >> 2;
++
++					/* active mode: max interval is 3000ms */
++					if (v2 > 3000)
++						return -EINVAL;
++
++				return mt7996_mcu_set_csi_active_mode(phy, UNI_CMD_CSI_SET_ACTIVE_MODE,
++						v2, frame_type, frame_subtype, phy->csi.active_bitmap);
++			}
++		default:
++			return -EINVAL;
++		}
++	default:
++		return -EINVAL;
++	}
++}
+ #endif
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index 9dc7946b..7721a01b 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -1112,4 +1112,109 @@ struct fixed_rate_table_ctrl {
+ 	u8 _rsv2;
+ } __packed;
+ 
++#ifdef CONFIG_MTK_VENDOR
++struct mt7996_mcu_csi_event {
++	struct mt7996_mcu_rxd rxd;
++
++	u8 band_idx;
++	u8 _rsv[3];
++
++	__le16 tag;
++	__le16 len;
++	u8 tlv_buf[0];
++};
++
++enum UNI_EVENT_CSI_TAG_T {
++	UNI_EVENT_CSI_DATA = 0,
++	UNI_EVENT_CSI_MAX_NUM
++};
++
++struct csi_tlv {
++	struct {
++		__le32 tag;
++		__le32 len;
++	} basic;
++	union {
++		u8 mac[ETH_ALEN];
++		__le32 info;
++		s16 data[0];
++	};
++} __packed;
++
++struct csi_bitmap_info_update {
++	u8 action;
++	u8 addr[ETH_ALEN];
++};
++
++#define CSI_MAX_BUF_NUM	3000
++
++enum CSI_EVENT_TLV_TAG {
++	CSI_EVENT_FW_VER,
++	CSI_EVENT_CBW,
++	CSI_EVENT_RSSI,
++	CSI_EVENT_SNR,
++	CSI_EVENT_BAND,
++	CSI_EVENT_CSI_NUM,
++	CSI_EVENT_CSI_I_DATA,
++	CSI_EVENT_CSI_Q_DATA,
++	CSI_EVENT_DBW,
++	CSI_EVENT_CH_IDX,
++	CSI_EVENT_TA,
++	CSI_EVENT_EXTRA_INFO,
++	CSI_EVENT_RX_MODE,
++	CSI_EVENT_RSVD1,
++	CSI_EVENT_RSVD2,
++	CSI_EVENT_RSVD3,
++	CSI_EVENT_RSVD4,
++	CSI_EVENT_H_IDX,
++	CSI_EVENT_TX_RX_IDX,
++	CSI_EVENT_TS,
++	CSI_EVENT_PKT_SN,
++	CSI_EVENT_BW_SEG,
++	CSI_EVENT_REMAIN_LAST,
++	CSI_EVENT_TR_STREAM,
++	CSI_EVENT_TLV_TAG_NUM,
++};
++
++enum CSI_CHAIN_TYPE {
++	CSI_CHAIN_ERR,
++	CSI_CHAIN_COMPLETE,
++	CSI_CHAIN_SEGMENT_FIRST,
++	CSI_CHAIN_SEGMENT_MIDDLE,
++	CSI_CHAIN_SEGMENT_LAST,
++	CSI_CHAIN_SEGMENT_ERR,
++};
++
++enum CSI_CONTROL_MODE_T {
++	CSI_CONTROL_MODE_STOP,
++	CSI_CONTROL_MODE_START,
++	CSI_CONTROL_MODE_SET,
++	CSI_CONTROL_MODE_NUM
++};
++
++enum CSI_CONFIG_ITEM_T {
++	CSI_CONFIG_RSVD1,
++	CSI_CONFIG_WF,
++	CSI_CONFIG_RSVD2,
++	CSI_CONFIG_FRAME_TYPE,
++	CSI_CONFIG_TX_PATH,
++	CSI_CONFIG_OUTPUT_FORMAT,
++	CSI_CONFIG_INFO,
++	CSI_CONFIG_CHAIN_FILTER,
++	CSI_CONFIG_STA_FILTER,
++	CSI_CONFIG_ACTIVE_MODE,
++	CSI_CONFIG_ITEM_NUM
++};
++
++/* CSI config Tag */
++enum UNI_CMD_CSI_TAG_T {
++	UNI_CMD_CSI_STOP = 0,
++	UNI_CMD_CSI_START = 1,
++	UNI_CMD_CSI_SET_FRAME_TYPE = 2,
++	UNI_CMD_CSI_SET_CHAIN_FILTER = 3,
++	UNI_CMD_CSI_SET_STA_FILTER = 4,
++	UNI_CMD_CSI_SET_ACTIVE_MODE = 5,
++};
++#endif
++
+ #endif
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index f1308112..f172eea2 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -405,6 +405,47 @@ struct mt7996_air_monitor_ctrl {
+ 	struct mt7996_air_monitor_group group[MT7996_AIR_MONITOR_MAX_GROUP];
+ 	struct mt7996_air_monitor_entry entry[MT7996_AIR_MONITOR_MAX_ENTRY];
+ };
++
++enum {
++	CSI_BW20,
++	CSI_BW40,
++	CSI_BW80,
++	CSI_BW160,
++	CSI_BW320
++};
++
++#define CSI_BW20_DATA_COUNT	64
++#define CSI_BW40_DATA_COUNT	128
++#define CSI_BW80_DATA_COUNT	256
++#define CSI_BW160_DATA_COUNT	512
++#define CSI_BW320_DATA_COUNT	1024
++
++struct csi_data {
++	u8 fw_ver;
++	u8 ch_bw;
++	u16 data_num;
++	s16 data_i[CSI_BW320_DATA_COUNT];
++	s16 data_q[CSI_BW320_DATA_COUNT];
++	u8 band;
++	s8 rssi;
++	u8 snr;
++	u32 ts;
++	u8 data_bw;
++	u8 pri_ch_idx;
++	u8 ta[ETH_ALEN];
++	u32 ext_info;
++	u16 rx_mode;
++	u16 rx_rate;
++	u32 chain_info;
++	u16 tx_idx;
++	u16 rx_idx;
++	u32 segment_num;
++	u8 remain_last;
++	u16 pkt_sn;
++	u8 tr_stream;
++
++	struct list_head node;
++};
+ #endif
+ 
+ struct mt7996_rro_ba_session {
+@@ -482,6 +523,18 @@ struct mt7996_phy {
+ 	u8 rts_bw_sig;
+ 	spinlock_t amnt_lock;
+ 	struct mt7996_air_monitor_ctrl amnt_ctrl;
++
++	struct {
++		struct list_head list;
++		spinlock_t lock;
++		u32 count;
++		bool enable;
++
++		struct csi_data buffered_csi;
++		u32 active_bitmap;
++		u32 interval;
++		u32 last_record;
++	} csi;
+ #endif
+ #ifdef CONFIG_MTK_DEBUG
+ 	bool sr_enable:1;
+@@ -996,6 +1049,8 @@ void mt7996_mcu_set_mimo(struct mt7996_phy *phy);
+ int mt7996_set_muru_cfg(struct mt7996_phy *phy, u8 action, u8 val);
+ int mt7996_mcu_set_muru_cfg(struct mt7996_phy *phy, void *data);
+ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
++int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
++		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
+ #endif
+ 
+ int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
+diff --git a/mt7996/vendor.c b/mt7996/vendor.c
+index c87cc5c1..c37f1dba 100644
+--- a/mt7996/vendor.c
++++ b/mt7996/vendor.c
+@@ -117,6 +117,18 @@ beacon_ctrl_policy[NUM_MTK_VENDOR_ATTRS_BEACON_CTRL] = {
+ 	[MTK_VENDOR_ATTR_BEACON_CTRL_MODE] = { .type = NLA_U8 },
+ };
+ 
++static const struct nla_policy
++csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG] = {.type = NLA_NESTED },
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2] = { .type = NLA_U32 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR] = { .type = NLA_NESTED },
++	[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM] = { .type = NLA_U16 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_DATA] = { .type = NLA_NESTED },
++};
++
+ struct mt7996_amnt_data {
+ 	u8 idx;
+ 	u8 addr[ETH_ALEN];
+@@ -932,7 +944,188 @@ static int mt7996_vendor_beacon_ctrl(struct wiphy *wiphy,
+ 
+ 	return 0;
+ }
++static int mt7996_vendor_csi_ctrl(struct wiphy *wiphy,
++				  struct wireless_dev *wdev,
++				  const void *data,
++				  int data_len)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7996_phy *phy = mt7996_hw_phy(hw);
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_CSI_CTRL];
++	int err;
++
++	err = nla_parse(tb, MTK_VENDOR_ATTR_CSI_CTRL_MAX, data, data_len,
++			csi_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	if (tb[MTK_VENDOR_ATTR_CSI_CTRL_CFG]) {
++		u8 mode = 0, type = 0, v1 = 0;
++		u32 v2 = 0;
++		u8 mac_addr[ETH_ALEN] = {};
++		struct nlattr *cur;
++		int rem;
++
++		nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_CSI_CTRL_CFG], rem) {
++			switch (nla_type(cur)) {
++			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE:
++				mode = nla_get_u8(cur);
++				break;
++			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE:
++				type = nla_get_u8(cur);
++				break;
++			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1:
++				v1 = nla_get_u8(cur);
++				break;
++			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2:
++				v2 = nla_get_u32(cur);
++				break;
++			default:
++				return -EINVAL;
++			};
++		}
++
++		if (tb[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR]) {
++			u8 idx = 0;
++
++			nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR], rem) {
++				mac_addr[idx++] = nla_get_u8(cur);
++			}
++		}
++
++		err = mt7996_mcu_set_csi(phy, mode, type, v1, v2, mac_addr);
++		if (err < 0)
++			return err;
++
++		spin_lock_bh(&phy->csi.lock);
+ 
++		phy->csi.enable = !!mode;
++
++		/* clean up old csi stats */
++		if ((mode == CSI_CONTROL_MODE_STOP || mode == CSI_CONTROL_MODE_SET)
++			&& !list_empty(&phy->csi.list)) {
++			struct csi_data *c, *tmp_c;
++
++			list_for_each_entry_safe(c, tmp_c, &phy->csi.list, node) {
++				list_del(&c->node);
++				kfree(c);
++				phy->csi.count--;
++			}
++		} else if (mode == CSI_CONTROL_MODE_START) {
++			phy->csi.last_record = 0;
++		}
++
++		spin_unlock_bh(&phy->csi.lock);
++
++		if (mode == CSI_CONTROL_MODE_SET && type == CSI_CONFIG_STA_FILTER && v1 == 2)
++			phy->csi.interval = v2;
++	}
++
++	return 0;
++}
++
++static int
++mt7996_vendor_csi_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++			    struct sk_buff *skb, const void *data, int data_len,
++			    unsigned long *storage)
++{
++#define RESERVED_SET	BIT(31)
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7996_phy *phy = mt7996_hw_phy(hw);
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {0};
++	int err = 0;
++
++	if (*storage & RESERVED_SET) {
++		if ((*storage & GENMASK(15, 0)) == 0)
++			return -ENOENT;
++		(*storage)--;
++	}
++
++	if (data) {
++		err = nla_parse(tb, MTK_VENDOR_ATTR_CSI_CTRL_MAX, data, data_len,
++				csi_ctrl_policy, NULL);
++		if (err)
++			return err;
++	}
++
++	if (!(*storage & RESERVED_SET) && tb[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM]) {
++		*storage = nla_get_u16(tb[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM]);
++		*storage |= RESERVED_SET;
++	}
++
++	spin_lock_bh(&phy->csi.lock);
++
++	if (!list_empty(&phy->csi.list)) {
++		struct csi_data *csi;
++		void *a, *b;
++		int i;
++
++		csi = list_first_entry(&phy->csi.list, struct csi_data, node);
++
++		a = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_CTRL_DATA);
++		if (!a)
++			goto out;
++
++		if (nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_VER, 1) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_RSSI, csi->rssi) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_SNR, csi->snr) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_BW, csi->data_bw) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_CH_IDX, csi->pri_ch_idx) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_MODE, csi->rx_mode))
++			goto out;
++
++		if (nla_put_u16(skb, MTK_VENDOR_ATTR_CSI_DATA_TX_ANT, csi->tx_idx) ||
++		    nla_put_u16(skb, MTK_VENDOR_ATTR_CSI_DATA_RX_ANT, csi->rx_idx))
++			goto out;
++
++		if (nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_INFO, csi->ext_info) ||
++		    nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_CHAIN_INFO, csi->chain_info) ||
++		    nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_TS, csi->ts))
++			goto out;
++
++		b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_TA);
++		if (!b)
++			goto out;
++
++		for (i = 0; i < ARRAY_SIZE(csi->ta); i++)
++			if (nla_put_u8(skb, i, csi->ta[i]))
++				goto out;
++		nla_nest_end(skb, b);
++
++		if (nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_NUM, csi->data_num))
++			goto out;
++
++		b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_I);
++		if (!b)
++			goto out;
++
++		for (i = 0; i < csi->data_num; i++)
++			if (nla_put_u16(skb, i, csi->data_i[i]))
++				goto out;
++		nla_nest_end(skb, b);
++
++		b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_Q);
++		if (!b)
++			goto out;
++
++		for (i = 0; i < csi->data_num; i++)
++			if (nla_put_u16(skb, i, csi->data_q[i]))
++				goto out;
++		nla_nest_end(skb, b);
++
++		nla_nest_end(skb, a);
++
++		list_del(&csi->node);
++		kfree(csi);
++		phy->csi.count--;
++
++		err = phy->csi.count;
++	}
++out:
++	spin_unlock_bh(&phy->csi.lock);
++
++	return err;
++}
+ 
+ static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
+ 	{
+@@ -1061,6 +1254,18 @@ static const struct wiphy_vendor_command mt7996_vendor_commands[] = {
+ 		.policy = beacon_ctrl_policy,
+ 		.maxattr = MTK_VENDOR_ATTR_BEACON_CTRL_MAX,
+ 	},
++	{
++		.info = {
++			.vendor_id = MTK_NL80211_VENDOR_ID,
++			.subcmd = MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL,
++		},
++		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++			 WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = mt7996_vendor_csi_ctrl,
++		.dumpit = mt7996_vendor_csi_ctrl_dump,
++		.policy = csi_ctrl_policy,
++		.maxattr = MTK_VENDOR_ATTR_CSI_CTRL_MAX,
++	},
+ };
+ 
+ void mt7996_vendor_register(struct mt7996_phy *phy)
+@@ -1068,6 +1273,9 @@ void mt7996_vendor_register(struct mt7996_phy *phy)
+ 	phy->mt76->hw->wiphy->vendor_commands = mt7996_vendor_commands;
+ 	phy->mt76->hw->wiphy->n_vendor_commands = ARRAY_SIZE(mt7996_vendor_commands);
+ 
++	INIT_LIST_HEAD(&phy->csi.list);
++	spin_lock_init(&phy->csi.lock);
++
+ 	spin_lock_init(&phy->amnt_lock);
+ }
+ #endif
+diff --git a/mt7996/vendor.h b/mt7996/vendor.h
+index e7d88828..7c9d12bb 100644
+--- a/mt7996/vendor.h
++++ b/mt7996/vendor.h
+@@ -7,6 +7,7 @@
+ 
+ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
++	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ 	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
+ 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
+ 	MTK_NL80211_VENDOR_SUBCMD_MU_CTRL = 0xc5,
+@@ -238,6 +239,55 @@ enum mtk_vendor_attr_beacon_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_BEACON_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_csi_ctrl {
++	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
++	MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_DATA,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
++	MTK_VENDOR_ATTR_CSI_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
++};
++
++enum mtk_vendor_attr_csi_data {
++	MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
++	MTK_VENDOR_ATTR_CSI_DATA_PAD,
++
++	MTK_VENDOR_ATTR_CSI_DATA_VER,
++	MTK_VENDOR_ATTR_CSI_DATA_TS,
++	MTK_VENDOR_ATTR_CSI_DATA_RSSI,
++	MTK_VENDOR_ATTR_CSI_DATA_SNR,
++	MTK_VENDOR_ATTR_CSI_DATA_BW,
++	MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
++	MTK_VENDOR_ATTR_CSI_DATA_TA,
++	MTK_VENDOR_ATTR_CSI_DATA_NUM,
++	MTK_VENDOR_ATTR_CSI_DATA_I,
++	MTK_VENDOR_ATTR_CSI_DATA_Q,
++	MTK_VENDOR_ATTR_CSI_DATA_INFO,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
++	MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
++	MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
++	MTK_VENDOR_ATTR_CSI_DATA_MODE,
++	MTK_VENDOR_ATTR_CSI_DATA_CHAIN_INFO,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_CSI_DATA,
++	MTK_VENDOR_ATTR_CSI_DATA_MAX =
++		NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
++};
+ #endif
+ 
+ #endif
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/2027-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/2027-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch
new file mode 100644
index 0000000..42650f3
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/2027-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch
@@ -0,0 +1,628 @@
+From f55be6f6596db120b2e48a7c87fcacf9d9df25ef Mon Sep 17 00:00:00 2001
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Date: Thu, 11 Jan 2024 08:55:13 +0800
+Subject: [PATCH 2027/2032] mtk: wifi: mt76: mt7992: add support to enable
+ index FW log for ConsysPlanet
+
+Add support to enable and record index FW log, which is the input for ConsysPlanet, via mt76-test command.
+
+Usage:
+1. Foreground logging
+	1) Start: mt76-test phy0 idxlog
+	2) Stop: Ctrl + C
+2. Background logging
+	1) Start: mt76-test phy0 idxlog &
+	2) Stop: killall mt76-test
+3. Logging with FW Parser
+	1) Start Ethernet recording of FW Parser.
+	2) Start: mt76-test phy0 idxlog <PC's IP Address>
+	3) Stop: Ctrl + C
+	4) Stop FW Parser.
+
+Log Files
+- FW Log: FW text message
+	- Location: /tmp/log/clog_(timestamp)/WIFI_FW_(timestamp).clog
+- Driver Log: log message printed at driver layer
+	- Location: /tmp/log/clog_(timestamp)/WIFI_KERNEL_(timestamp).clog
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+---
+ mt7996/debugfs.c  |  90 +++++++++++++++++--
+ mt7996/mac.c      |  10 ++-
+ mt7996/mcu.c      |  34 +++++++-
+ mt7996/mcu.h      |   4 +-
+ mt7996/mt7996.h   |   3 +
+ tools/fwlog.c     | 218 ++++++++++++++++++++++++++++++++++------------
+ tools/main.c      |   2 +
+ tools/mt76-test.h |   3 +
+ 8 files changed, 295 insertions(+), 69 deletions(-)
+
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index 6ccf0827..c236ec98 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -425,8 +425,8 @@ create_buf_file_cb(const char *filename, struct dentry *parent, umode_t mode,
+ {
+ 	struct dentry *f;
+ 
+-	f = debugfs_create_file("fwlog_data", mode, parent, buf,
+-				&relay_file_operations);
++	f = debugfs_create_file(filename[0] == 'f' ? "fwlog_data" : "idxlog_data",
++	                        mode, parent, buf, &relay_file_operations);
+ 	if (IS_ERR(f))
+ 		return NULL;
+ 
+@@ -517,6 +517,53 @@ mt7996_fw_debug_bin_get(void *data, u64 *val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_bin, mt7996_fw_debug_bin_get,
+ 			 mt7996_fw_debug_bin_set, "%lld\n");
+ 
++static int
++mt7996_idxlog_enable_get(void *data, u64 *val)
++{
++	struct mt7996_dev *dev = data;
++
++	*val = dev->idxlog_enable;
++
++	return 0;
++}
++
++static int
++mt7996_idxlog_enable_set(void *data, u64 val)
++{
++	static struct rchan_callbacks relay_cb = {
++		.create_buf_file = create_buf_file_cb,
++		.remove_buf_file = remove_buf_file_cb,
++	};
++	struct mt7996_dev *dev = data;
++
++	if (dev->idxlog_enable == !!val)
++		return 0;
++
++	if (!dev->relay_idxlog) {
++		dev->relay_idxlog = relay_open("idxlog_data", dev->debugfs_dir,
++		                               1500, 512, &relay_cb, NULL);
++		if (!dev->relay_idxlog)
++			return -ENOMEM;
++	}
++
++	dev->idxlog_enable = !!val;
++
++	if (val) {
++		int ret = mt7996_mcu_fw_time_sync(&dev->mt76);
++		if (ret)
++			return ret;
++
++		/* Reset relay channel only when it is not being written to. */
++		relay_reset(dev->relay_idxlog);
++	}
++
++	return mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM,
++	                                val ? MCU_FW_LOG_RELAY_IDX : 0);
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_idxlog_enable, mt7996_idxlog_enable_get,
++	                 mt7996_idxlog_enable_set, "%llu\n");
++
+ static int
+ mt7996_fw_util_wa_show(struct seq_file *file, void *data)
+ {
+@@ -1037,6 +1084,7 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
+ 	debugfs_create_file("fw_debug_wm", 0600, dir, dev, &fops_fw_debug_wm);
+ 	debugfs_create_file("fw_debug_wa", 0600, dir, dev, &fops_fw_debug_wa);
+ 	debugfs_create_file("fw_debug_bin", 0600, dir, dev, &fops_fw_debug_bin);
++	debugfs_create_file("idxlog_enable", 0600, dir, dev, &fops_idxlog_enable);
+ 	/* TODO: wm fw cpu utilization */
+ 	debugfs_create_file("fw_util_wa", 0400, dir, dev,
+ 			    &mt7996_fw_util_wa_fops);
+@@ -1103,6 +1151,32 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
+ 	spin_unlock_irqrestore(&lock, flags);
+ }
+ 
++static void
++mt7996_debugfs_write_idxlog(struct mt7996_dev *dev, const void *data, int len)
++{
++	static DEFINE_SPINLOCK(lock);
++	unsigned long flags;
++	void *dest;
++
++	if (!dev->relay_idxlog)
++		return;
++
++	spin_lock_irqsave(&lock, flags);
++
++	dest = relay_reserve(dev->relay_idxlog, len + 4);
++	if (!dest)
++		dev_err(dev->mt76.dev, "Failed to reserve slot in %s\n",
++		        dev->relay_idxlog->base_filename);
++	else {
++		*(u32 *)dest = len;
++		dest += 4;
++		memcpy(dest, data, len);
++		relay_flush(dev->relay_idxlog);
++	}
++
++	spin_unlock_irqrestore(&lock, flags);
++}
++
+ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len)
+ {
+ 	struct {
+@@ -1127,11 +1201,15 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
+ 
+ bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len)
+ {
+-	if (get_unaligned_le32(data) != FW_BIN_LOG_MAGIC)
+-		return false;
++	bool is_fwlog = get_unaligned_le32(data) == FW_BIN_LOG_MAGIC;
+ 
+-	if (dev->relay_fwlog)
+-		mt7996_debugfs_write_fwlog(dev, NULL, 0, data, len);
++	if (is_fwlog) {
++		if (dev->relay_fwlog)
++			mt7996_debugfs_write_fwlog(dev, NULL, 0, data, len);
++	} else if (dev->relay_idxlog)
++		mt7996_debugfs_write_idxlog(dev, data, len);
++	else
++		return false;
+ 
+ 	return true;
+ }
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 88e1fd14..c2a8e752 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -2283,11 +2283,9 @@ void mt7996_mac_work(struct work_struct *work)
+ 	mutex_lock(&mdev->mutex);
+ 
+ 	mt76_update_survey(mphy);
+-	if (++mphy->mac_work_count == 5) {
++	if (++mphy->mac_work_count % 5 == 0) {
+ 		int i;
+ 
+-		mphy->mac_work_count = 0;
+-
+ 		mt7996_mac_update_stats(phy);
+ 
+ 		/* Update DEV-wise information only in
+@@ -2306,6 +2304,12 @@ void mt7996_mac_work(struct work_struct *work)
+ 				if (mt7996_mcu_wa_cmd(phy->dev, MCU_WA_PARAM_CMD(QUERY), MCU_WA_PARAM_BSS_ACQ_PKT_CNT,
+ 				                      BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL | BSS_ACQ_PKT_CNT_READ_CLR, 0))
+ 					dev_err(mdev->dev, "Failed to query per-AC-queue packet counts.\n");
++
++				if (mphy->mac_work_count == 100) {
++					if (phy->dev->idxlog_enable && mt7996_mcu_fw_time_sync(mdev))
++						dev_err(mdev->dev, "Failed to synchronize time with FW.\n");
++					mphy->mac_work_count = 0;
++				}
+ 			} else if (mt7996_band_valid(phy->dev, i) &&
+ 			           test_bit(MT76_STATE_RUNNING, &mdev->phys[i]->state))
+ 				break;
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 9e04ea2b..0cb4cfa5 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -397,6 +397,7 @@ static void
+ mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
+ {
+ #define UNI_EVENT_FW_LOG_FORMAT 0
++#define UNI_EVENT_FW_LOG_MEMORY	1
+ 	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
+ 	const char *data = (char *)&rxd[1] + 4, *type;
+ 	struct tlv *tlv = (struct tlv *)data;
+@@ -408,7 +409,8 @@ mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
+ 		goto out;
+ 	}
+ 
+-	if (le16_to_cpu(tlv->tag) != UNI_EVENT_FW_LOG_FORMAT)
++	if (le16_to_cpu(tlv->tag) != UNI_EVENT_FW_LOG_FORMAT &&
++	    le16_to_cpu(tlv->tag) != UNI_EVENT_FW_LOG_MEMORY)
+ 		return;
+ 
+ 	data += sizeof(*tlv) + 4;
+@@ -3444,6 +3446,36 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level)
+ 				 sizeof(data), false);
+ }
+ 
++int mt7996_mcu_fw_time_sync(struct mt76_dev *dev)
++{
++	struct {
++		u8 _rsv[4];
++
++		__le16 tag;
++		__le16 len;
++		__le32 sec;
++		__le32 usec;
++	} data = {
++		.tag = cpu_to_le16(UNI_WSYS_CONFIG_FW_TIME_SYNC),
++		.len = cpu_to_le16(sizeof(data) - 4),
++	};
++	struct timespec64 ts;
++	struct tm tm;
++
++	ktime_get_real_ts64(&ts);
++	data.sec = cpu_to_le32((u32)ts.tv_sec);
++	data.usec = cpu_to_le32((u32)(ts.tv_nsec / 1000));
++
++	/* Dump synchronized time for ConsysPlanet to parse. */
++	time64_to_tm(ts.tv_sec, 0, &tm);
++	dev_info(dev->dev, "%ld-%02d-%02d %02d:%02d:%02d.%ld UTC\n",
++	        tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
++	        tm.tm_hour, tm.tm_min, tm.tm_sec, ts.tv_nsec / 1000);
++
++	return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(WSYS_CONFIG), &data,
++	                         sizeof(data), true);
++}
++
+ static int mt7996_mcu_set_mwds(struct mt7996_dev *dev, bool enabled)
+ {
+ 	struct {
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index 7721a01b..826cf204 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -357,7 +357,8 @@ enum {
+ 	MCU_FW_LOG_WM,
+ 	MCU_FW_LOG_WA,
+ 	MCU_FW_LOG_TO_HOST,
+-	MCU_FW_LOG_RELAY = 16
++	MCU_FW_LOG_RELAY = 16,
++	MCU_FW_LOG_RELAY_IDX = 40
+ };
+ 
+ enum {
+@@ -949,6 +950,7 @@ enum {
+ 	UNI_WSYS_CONFIG_FW_LOG_CTRL,
+ 	UNI_WSYS_CONFIG_FW_DBG_CTRL,
+ 	UNI_CMD_CERT_CFG = 6,
++	UNI_WSYS_CONFIG_FW_TIME_SYNC, /* UNI_CMD_FW_TIME_SYNC in FW */
+ };
+ 
+ enum {
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index f172eea2..10886cb1 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -642,9 +642,11 @@ struct mt7996_dev {
+ 	u8 fw_debug_bin;
+ 	u16 fw_debug_seq;
+ 	bool fw_debug_muru_disable;
++	bool idxlog_enable;
+ 
+ 	struct dentry *debugfs_dir;
+ 	struct rchan *relay_fwlog;
++	struct rchan *relay_idxlog;
+ 
+ 	void *cal;
+ 	u32 cur_prek_offset;
+@@ -896,6 +898,7 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
+ int mt7996_mcu_red_config(struct mt7996_dev *dev, bool enable);
+ int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
+ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
++int mt7996_mcu_fw_time_sync(struct mt76_dev *dev);
+ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
+ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+ void mt7996_mcu_exit(struct mt7996_dev *dev);
+diff --git a/tools/fwlog.c b/tools/fwlog.c
+index 3c6a61d7..0e2de2dc 100644
+--- a/tools/fwlog.c
++++ b/tools/fwlog.c
+@@ -29,10 +29,9 @@ static const char *debugfs_path(const char *phyname, const char *file)
+ static int mt76_set_fwlog_en(const char *phyname, bool en, char *val)
+ {
+ 	FILE *f = fopen(debugfs_path(phyname, "fw_debug_bin"), "w");
+-
+ 	if (!f) {
+-		fprintf(stderr, "Could not open fw_debug_bin file\n");
+-		return 1;
++		perror("fopen");
++		return -1;
+ 	}
+ 
+ 	if (en && val)
+@@ -47,6 +46,21 @@ static int mt76_set_fwlog_en(const char *phyname, bool en, char *val)
+ 	return 0;
+ }
+ 
++static int mt76_set_idxlog_enable(const char *phyname, bool enable)
++{
++	FILE *f = fopen(debugfs_path(phyname, "idxlog_enable"), "w");
++	if (!f) {
++		perror("fopen");
++		return -1;
++	}
++
++	fprintf(f, "%hhu", enable);
++
++	fclose(f);
++
++	return 0;
++}
++
+ int read_retry(int fd, void *buf, int len)
+ {
+ 	int out_len = 0;
+@@ -80,105 +94,193 @@ static void handle_signal(int sig)
+ 	done = true;
+ }
+ 
+-int mt76_fwlog(const char *phyname, int argc, char **argv)
++static int mt76_log_socket(struct sockaddr_in *remote, char *ip)
+ {
+-#define BUF_SIZE 1504
+ 	struct sockaddr_in local = {
+ 		.sin_family = AF_INET,
+ 		.sin_addr.s_addr = INADDR_ANY,
+ 	};
+-	struct sockaddr_in remote = {
+-		.sin_family = AF_INET,
+-		.sin_port = htons(55688),
+-	};
+-	char *buf = calloc(BUF_SIZE, sizeof(char));
+-	int ret = 0;
+-	/* int yes = 1; */
+-	int s, fd;
+-
+-	if (argc < 1) {
+-		fprintf(stderr, "need destination address\n");
+-		return 1;
+-	}
++	int s, ret;
+ 
+-	if (!inet_aton(argv[0], &remote.sin_addr)) {
+-		fprintf(stderr, "invalid destination address\n");
+-		return 1;
++	remote->sin_family = AF_INET;
++	remote->sin_port = htons(55688);
++	if (!inet_aton(ip, &remote->sin_addr)) {
++		fprintf(stderr, "Invalid destination IP address: %s\n", ip);
++		return -EINVAL;
+ 	}
+ 
+ 	s = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
+ 	if (s < 0) {
+ 		perror("socket");
+-		return 1;
++		return s;
+ 	}
+ 
+-	/* setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes)); */
+-	if (bind(s, (struct sockaddr *)&local, sizeof(local)) < 0) {
++	ret = bind(s, (struct sockaddr *)&local, sizeof(local));
++	if (ret) {
+ 		perror("bind");
+-		return 1;
++		close(s);
++		return ret;
+ 	}
+ 
+-	if (mt76_set_fwlog_en(phyname, true, argv[1]))
+-		return 1;
++	return s;
++}
++
++static int mt76_log_relay(int in_fd, int out_fd, struct sockaddr_in *remote)
++{
++	char *buf = malloc(FWLOG_BUF_SIZE);
++	int ret = 0;
+ 
+-	fd = open(debugfs_path(phyname, "fwlog_data"), O_RDONLY);
+-	if (fd < 0) {
+-		fprintf(stderr, "Could not open fwlog_data file: %s\n", strerror(errno));
+-		ret = 1;
+-		goto out;
++	if (!buf) {
++		perror("malloc");
++		return -ENOMEM;
+ 	}
+ 
+ 	signal(SIGTERM, handle_signal);
+ 	signal(SIGINT, handle_signal);
+ 	signal(SIGQUIT, handle_signal);
+ 
+-	while (1) {
++	while (!done) {
+ 		struct pollfd pfd = {
+-			.fd = fd,
+-			.events = POLLIN | POLLHUP | POLLERR,
++			.fd = in_fd,
++			.events = POLLIN,
+ 		};
+ 		uint32_t len;
+-		int r;
+-
+-		if (done)
+-			break;
++		int rc;
+ 
+ 		poll(&pfd, 1, -1);
+ 
+-		r = read_retry(fd, &len, sizeof(len));
+-		if (r < 0)
++		rc = read_retry(in_fd, &len, sizeof(len));
++		if (rc < 0) {
++			if (!done) {
++				fprintf(stderr, "Failed to read relay file.\n");
++				ret = -1;
++			}
+ 			break;
+-
+-		if (!r)
++		}
++		if (!rc)
+ 			continue;
+ 
+-		if (len > BUF_SIZE) {
+-			fprintf(stderr, "Length error: %d > %d\n", len, BUF_SIZE);
+-			ret = 1;
++		if (len > FWLOG_BUF_SIZE) {
++			fprintf(stderr, "Log size was too large: %u bytes\n", len);
++			ret = -ENOMEM;
+ 			break;
+ 		}
+ 
+-		if (done)
++		rc = read_retry(in_fd, buf, len);
++		if (rc < 0) {
++			if (!done) {
++				fprintf(stderr, "Failed to read relay file.\n");
++				ret = -1;
++			}
+ 			break;
+-
+-		r = read_retry(fd, buf, len);
+-		if (done)
++		}
++		if (rc != len) {
++			fprintf(stderr, "Expected log size: %u bytes\n", len);
++			fprintf(stderr, "Read log size: %u bytes\n", rc);
++			ret = -EIO;
+ 			break;
++		}
+ 
+-		if (r != len) {
+-			fprintf(stderr, "Short read: %d < %d\n", r, len);
+-			ret = 1;
++		if (remote)
++			rc = sendto(out_fd, buf, len, 0, (struct sockaddr *)remote, sizeof(*remote));
++		else
++			rc = write(out_fd, buf, len);
++		if (rc < 0) {
++			perror("sendto/write");
++			ret = -1;
+ 			break;
+ 		}
++	}
++
++	free(buf);
++
++	return ret;
++}
++
++int mt76_fwlog(const char *phyname, int argc, char **argv)
++{
++	struct sockaddr_in remote;
++	int in_fd, out_fd, ret;
++
++	if (argc < 1) {
++		fprintf(stderr, "need destination address\n");
++		return -EINVAL;
++	}
++
++	out_fd = mt76_log_socket(&remote, argv[0]);
++	if (out_fd < 0)
++		return out_fd;
++
++	ret = mt76_set_fwlog_en(phyname, true, argv[1]);
++	if (ret)
++		goto close;
+ 
+-		/* send buf */
+-		sendto(s, buf, len, 0, (struct sockaddr *)&remote, sizeof(remote));
++	in_fd = open(debugfs_path(phyname, "fwlog_data"), O_RDONLY);
++	if (in_fd < 0) {
++		perror("open");
++		goto disable;
+ 	}
+ 
+-	close(fd);
++	if (mt76_log_relay(in_fd, out_fd, &remote))
++		fprintf(stderr, "Failed to relay FW log.\n");
+ 
+-out:
+-	mt76_set_fwlog_en(phyname, false, NULL);
++	close(in_fd);
++disable:
++	ret = mt76_set_fwlog_en(phyname, false, NULL);
++close:
++	close(out_fd);
++
++	return ret;
++}
++
++int mt76_idxlog(const char *phyname, int argc, char **argv)
++{
++#define IDXLOG_FILE_PATH	"/tmp/log/WIFI_FW.clog"
++	struct sockaddr_in remote;
++	int in_fd, out_fd, ret;
++
++	if (argc) {
++		out_fd = mt76_log_socket(&remote, argv[0]);
++		if (out_fd < 0)
++			return out_fd;
++	} else {
++		out_fd = open(IDXLOG_FILE_PATH, O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR);
++		if (out_fd < 0) {
++			perror("open");
++			return -1;
++		}
++	}
++
++	ret = mt76_set_idxlog_enable(phyname, true);
++	if (ret)
++		goto close;
++
++	in_fd = open(debugfs_path(phyname, "idxlog_data"), O_RDONLY);
++	if (in_fd < 0) {
++		perror("open");
++		goto disable;
++	}
++
++	if (mt76_log_relay(in_fd, out_fd, argc ? &remote : NULL))
++		fprintf(stderr, "Failed to relay index log.\n");
++
++	close(in_fd);
++disable:
++	ret = mt76_set_idxlog_enable(phyname, false);
++close:
++	close(out_fd);
++
++	if (argc)
++		system("timestamp=$(date +\"%y%m%d_%H%M%S\");"
++		       "clog_dir=/tmp/log/clog_${timestamp};"
++		       "mkdir ${clog_dir};"
++		       "dmesg > ${clog_dir}/WIFI_KERNEL_${timestamp}.clog");
++	else
++		system("timestamp=$(date +\"%y%m%d_%H%M%S\");"
++		       "clog_dir=/tmp/log/clog_${timestamp};"
++		       "mkdir ${clog_dir};"
++		       "mv /tmp/log/WIFI_FW.clog ${clog_dir}/WIFI_FW_${timestamp}.clog;"
++		       "dmesg > ${clog_dir}/WIFI_KERNEL_${timestamp}.clog");
+ 
+ 	return ret;
+ }
+diff --git a/tools/main.c b/tools/main.c
+index 699a9eea..e9e25567 100644
+--- a/tools/main.c
++++ b/tools/main.c
+@@ -198,6 +198,8 @@ int main(int argc, char **argv)
+ 		ret = mt76_eeprom(phy, argc, argv);
+ 	else if (!strcmp(cmd, "fwlog"))
+ 		ret = mt76_fwlog(phyname, argc, argv);
++	else if (!strcmp(cmd, "idxlog"))
++		ret = mt76_idxlog(phyname, argc, argv);
+ 	else
+ 		usage();
+ 
+diff --git a/tools/mt76-test.h b/tools/mt76-test.h
+index d2fafa86..b9d508c5 100644
+--- a/tools/mt76-test.h
++++ b/tools/mt76-test.h
+@@ -22,6 +22,8 @@
+ #define EEPROM_FILE_PATH_FMT	"/tmp/mt76-test-%s"
+ #define EEPROM_PART_SIZE	20480
+ 
++#define FWLOG_BUF_SIZE	1504
++
+ struct nl_msg;
+ struct nlattr;
+ 
+@@ -61,5 +63,6 @@ extern unsigned char *eeprom_data;
+ void usage(void);
+ int mt76_eeprom(int phy, int argc, char **argv);
+ int mt76_fwlog(const char *phyname, int argc, char **argv);
++int mt76_idxlog(const char *phyname, int argc, char **argv);
+ 
+ #endif
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index f98488a..38d3c2c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -4,17 +4,19 @@
     file://0002-mtk-wifi-mt76-connac-use-peer-address-for-station-BM.patch \
     file://0003-mtk-wifi-mt76-mt7996-disable-rx-header-translation-f.patch \
     file://0004-mtk-wifi-mt76-mt7996-set-RCPI-value-in-rate-control-.patch \
-    file://0005-mtk-wifi-mt76-mt7996-enable-ser-query.patch \
-    file://0006-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch \
-    file://0007-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch \
-    file://0008-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch \
-    file://0009-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch \
-    file://0010-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch \
-    file://0011-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch \
-    file://0012-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch \
-    file://0013-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch \
-    file://0014-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch \
-    file://0015-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch \
+    file://0005-mtk-wifi-mt76-mt7996-enable-hw-cso-module.patch \
+    file://0006-mtk-wifi-mt76-mt7996-fix-non-main-BSS-no-beacon-issu.patch \
+    file://0007-mtk-wifi-mt76-mt7996-initialize-variable-to-avoid-un.patch \
+    file://0008-mtk-wifi-mt76-mt7996-enable-ser-query.patch \
+    file://0009-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch \
+    file://0010-mtk-wifi-mt76-mt7996-add-eagle-default-bin-of-differ.patch \
+    file://0011-mtk-wifi-mt76-mt7996-add-kite-fw-default-bin-for-dif.patch \
+    file://0012-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch \
+    file://0013-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch \
+    file://0014-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch \
+    file://0015-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch \
+    file://0016-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch \
+    file://0017-mtk-wifi-mt76-mt7996-add-sanity-check-for-NAPI-sched.patch \
     file://0999-mtk-wifi-mt76-mt7996-for-build-pass.patch \
     file://1000-mtk-wifi-mt76-mt7996-add-debug-tool.patch \
     file://1001-mtk-wifi-mt76-mt7996-support-record-muru-algo-log-wh.patch \
@@ -83,4 +85,10 @@
     file://2019-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch \
     file://2020-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch \
     file://2021-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch \
+    file://2022-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch \
+    file://2023-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch \
+    file://2024-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch \
+    file://2025-mtk-wifi-mt76-mt7996-Porting-wifi6-txpower-fix-to-ea.patch \
+    file://2026-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch \
+    file://2027-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
index b5f59cb..044cc34 100644
--- a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
@@ -1,7 +1,7 @@
-From 7904ac14dffdafe54e8007899140c01915e3acfe Mon Sep 17 00:00:00 2001
+From 48ae9fbcbbe56203f050344916ca04ee85c07de4 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Thu, 18 May 2023 18:11:37 +0800
-Subject: [PATCH 01/13] wifi: mt76: fix incorrect HE TX GI report
+Subject: [PATCH 01/14] wifi: mt76: fix incorrect HE TX GI report
 
 Change GI reporting source from static capability to rate-tuning module.
 
@@ -17,7 +17,7 @@
  7 files changed, 282 insertions(+), 22 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 1f24958..6282cb6 100644
+index 294e379a..619d50df 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -277,12 +277,16 @@ struct mt76_queue_ops {
@@ -38,7 +38,7 @@
  	MT_PHY_TYPE_HE_EXT_SU,
  	MT_PHY_TYPE_HE_TB,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 11c4621..ea96d8d 100644
+index 7b6168cf..541b8032 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -673,6 +673,8 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
@@ -50,7 +50,7 @@
  	INIT_DELAYED_WORK(&mphy->mac_work, mt7915_mac_work);
  
  	mt7915_eeprom_parse_hw_cap(dev, phy);
-@@ -1202,6 +1204,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1206,6 +1208,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->phy.dev = dev;
  	dev->phy.mt76 = &dev->mt76.phy;
  	dev->mt76.phy.priv = &dev->phy;
@@ -60,10 +60,10 @@
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7915_mac_work);
  	INIT_LIST_HEAD(&dev->sta_rc_list);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e453611..9e1cfa6 100644
+index 8008ce3f..b9152018 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -173,15 +173,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
+@@ -180,15 +180,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
  						       rx_cur);
  		}
  
@@ -79,7 +79,7 @@
  
  		switch (rate->bw) {
  		case RATE_INFO_BW_160:
-@@ -198,18 +190,6 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
+@@ -205,18 +197,6 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
  			break;
  		}
  
@@ -98,7 +98,7 @@
  		/* get signal strength of resp frames (CTS/BA/ACK) */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, idx, 30);
  		val = mt76_rr(dev, addr);
-@@ -911,6 +891,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -918,6 +898,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
@@ -106,7 +106,7 @@
  			u16 idx;
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
-@@ -920,11 +901,18 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -927,11 +908,18 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  				continue;
  
  			msta = container_of(wcid, struct mt7915_sta, wcid);
@@ -127,7 +127,7 @@
  			continue;
  		}
  
-@@ -1003,6 +991,7 @@ mt7915_mac_tx_free_v0(struct mt7915_dev *dev, void *data, int len)
+@@ -1010,6 +998,7 @@ mt7915_mac_tx_free_v0(struct mt7915_dev *dev, void *data, int len)
  static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  {
  	struct mt7915_sta *msta = NULL;
@@ -135,7 +135,7 @@
  	struct mt76_wcid *wcid;
  	__le32 *txs_data = data;
  	u16 wcidx;
-@@ -1038,6 +1027,11 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+@@ -1045,6 +1034,11 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  		list_add_tail(&msta->wcid.poll_list, &dev->mt76.sta_poll_list);
  	spin_unlock_bh(&dev->mt76.sta_poll_lock);
  
@@ -147,7 +147,7 @@
  out:
  	rcu_read_unlock();
  }
-@@ -1947,6 +1941,27 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -1952,6 +1946,27 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -175,7 +175,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2005,6 +2020,11 @@ void mt7915_mac_work(struct work_struct *work)
+@@ -2010,6 +2025,11 @@ void mt7915_mac_work(struct work_struct *work)
  			mt7915_mcu_muru_debug_get(phy);
  	}
  
@@ -188,10 +188,10 @@
  
  	mt76_tx_status_check(mphy->dev, false);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3709d18..3182fac 100644
+index b16a6336..e61041d0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -751,6 +751,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -752,6 +752,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  
  	INIT_LIST_HEAD(&msta->rc_list);
  	INIT_LIST_HEAD(&msta->wcid.poll_list);
@@ -199,7 +199,7 @@
  	msta->vif = mvif;
  	msta->wcid.sta = 1;
  	msta->wcid.idx = idx;
-@@ -775,6 +776,7 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -779,6 +780,7 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  {
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
@@ -207,7 +207,7 @@
  	int i;
  
  	mt7915_mcu_add_sta(dev, vif, sta, false);
-@@ -791,6 +793,11 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -795,6 +797,11 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (!list_empty(&msta->rc_list))
  		list_del_init(&msta->rc_list);
  	spin_unlock_bh(&mdev->sta_poll_lock);
@@ -220,10 +220,10 @@
  
  static void mt7915_tx(struct ieee80211_hw *hw,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 09badb1..fce152c 100644
+index fe54a2f4..7df21621 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3723,6 +3723,167 @@ out:
+@@ -3793,6 +3793,167 @@ out:
  	return ret;
  }
  
@@ -392,7 +392,7 @@
  				struct cfg80211_he_bss_color *he_bss_color)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b41ac4a..8f36546 100644
+index b41ac4aa..8f365461 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -152,6 +152,61 @@ struct mt7915_mcu_eeprom_info {
@@ -466,7 +466,7 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6e79bc6..44950ab 100644
+index a30d08eb..aee30c73 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -137,6 +137,7 @@ struct mt7915_sta {
@@ -488,7 +488,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -495,6 +500,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
+@@ -499,6 +504,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
  int mt7915_mcu_get_temperature(struct mt7915_phy *phy);
  int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state);
  int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
index eb82beb..bbb456e 100644
--- a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-add-pc-stack-dump-for-WM-s-coredump.patch
@@ -1,7 +1,7 @@
-From b73a60b2d769526243aa640f63bd8c0d5774532a Mon Sep 17 00:00:00 2001
+From 5767bce45ee5ea588072389762af8b5aab9227a5 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 22 May 2023 13:49:37 +0800
-Subject: [PATCH 02/13] wifi: mt76: mt7915: add pc stack dump for WM's
+Subject: [PATCH 02/14] wifi: mt76: mt7915: add pc stack dump for WM's
  coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -16,7 +16,7 @@
  7 files changed, 207 insertions(+), 71 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 6282cb6..03116ff 100644
+index 619d50df..52a20868 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -27,6 +27,8 @@
@@ -52,7 +52,7 @@
  	struct net_device napi_dev;
  	struct net_device tx_napi_dev;
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 7602f97..fe5250c 100644
+index 368c5f46..4be806e2 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -2933,6 +2933,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
@@ -86,7 +86,7 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/coredump.c b/mt7915/coredump.c
-index 5daf225..298c1ca 100644
+index 5daf2258..298c1cad 100644
 --- a/mt7915/coredump.c
 +++ b/mt7915/coredump.c
 @@ -7,7 +7,7 @@
@@ -414,7 +414,7 @@
  }
  
 diff --git a/mt7915/coredump.h b/mt7915/coredump.h
-index 709f8e9..809ccbd 100644
+index 709f8e9c..809ccbdf 100644
 --- a/mt7915/coredump.h
 +++ b/mt7915/coredump.h
 @@ -4,6 +4,7 @@
@@ -514,10 +514,10 @@
  	return NULL;
  }
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9e1cfa6..3fe1cf1 100644
+index b9152018..0f6b8067 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1592,28 +1592,31 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1597,28 +1597,31 @@ void mt7915_mac_reset_work(struct work_struct *work)
  }
  
  /* firmware coredump */
@@ -555,7 +555,7 @@
  	if (!mem_region || !crash_data->memdump_buf_len) {
  		mutex_unlock(&dev->dump_mutex);
  		goto skip_memdump;
-@@ -1623,6 +1626,9 @@ void mt7915_mac_dump_work(struct work_struct *work)
+@@ -1628,6 +1631,9 @@ void mt7915_mac_dump_work(struct work_struct *work)
  	buf_len = crash_data->memdump_buf_len;
  
  	/* dumping memory content... */
@@ -565,7 +565,7 @@
  	memset(buf, 0, buf_len);
  	for (i = 0; i < num; i++) {
  		if (mem_region->len > buf_len) {
-@@ -1640,6 +1646,7 @@ void mt7915_mac_dump_work(struct work_struct *work)
+@@ -1645,6 +1651,7 @@ void mt7915_mac_dump_work(struct work_struct *work)
  		mt7915_memcpy_fromio(dev, buf, mem_region->start,
  				     mem_region->len);
  
@@ -573,7 +573,7 @@
  		hdr->start = mem_region->start;
  		hdr->len = mem_region->len;
  
-@@ -1656,8 +1663,18 @@ void mt7915_mac_dump_work(struct work_struct *work)
+@@ -1661,8 +1668,18 @@ void mt7915_mac_dump_work(struct work_struct *work)
  	mutex_unlock(&dev->dump_mutex);
  
  skip_memdump:
@@ -595,7 +595,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 44950ab..35458ec 100644
+index aee30c73..5cd2b334 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -286,7 +286,7 @@ struct mt7915_dev {
@@ -608,7 +608,7 @@
  #endif
  
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 89ac8e6..7515b23 100644
+index 89ac8e67..7515b23f 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -1219,4 +1219,24 @@ enum offs_rev {
diff --git a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
index 9c2726d..3fbcee8 100644
--- a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-move-temperature-margin-check-to-mt.patch
@@ -1,7 +1,7 @@
-From 32760539d43987c27b13a9e54c36c05749b6795e Mon Sep 17 00:00:00 2001
+From 22f2beb4947794299cbb9b726303d087dc42c13f Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 13 Jul 2023 15:50:00 +0800
-Subject: [PATCH 03/13] wifi: mt76: mt7915: move temperature margin check to
+Subject: [PATCH 03/14] wifi: mt76: mt7915: move temperature margin check to
  mt7915_thermal_temp_store()
 
 Originally, we would reduce the 10-degree margin to the restore
@@ -17,7 +17,7 @@
  2 files changed, 5 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index ea96d8d..d5d9cbf 100644
+index 541b8032..911ecdd3 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -83,12 +83,13 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev,
@@ -38,10 +38,10 @@
  		return -EINVAL;
  	}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fce152c..6cd6ad1 100644
+index 7df21621..6e9970c3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3156,8 +3156,7 @@ int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
+@@ -3226,8 +3226,7 @@ int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy)
  
  	/* set high-temperature trigger threshold */
  	req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE;
diff --git a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch
index 21ea48f..8c79361 100644
--- a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-txpower-issues.patch
@@ -1,7 +1,7 @@
-From ce03eceadfb532004d5343fd1d4c4a85350a51ca Mon Sep 17 00:00:00 2001
+From 723c1353c7d50c962285c22579770b6aeb37b3ca Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sat, 29 Jul 2023 04:53:47 +0800
-Subject: [PATCH 04/13] wifi: mt76: mt7915: fix txpower issues
+Subject: [PATCH 04/14] wifi: mt76: mt7915: fix txpower issues
 
 ---
  eeprom.c         |  2 +-
@@ -10,7 +10,7 @@
  3 files changed, 28 insertions(+), 23 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 0bc66cc..ecd09c0 100644
+index 0bc66cc1..ecd09c03 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -343,7 +343,7 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
@@ -23,7 +23,7 @@
  
  	if (!mcs_rates)
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 6c3696c..93e549c 100644
+index 6c3696c8..93e549c3 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -950,9 +950,9 @@ mt7915_xmit_queues_show(struct seq_file *file, void *data)
@@ -107,10 +107,10 @@
  	reg = is_mt7915(&dev->mt76) ? MT_WF_PHY_TPC_CTRL_STAT(band) :
  	      MT_WF_PHY_TPC_CTRL_STAT_MT7916(band);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3182fac..ed0f0cc 100644
+index e61041d0..1903db4f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1076,6 +1076,7 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+@@ -1080,6 +1080,7 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
  	mt76_set_stream_caps(phy->mt76, true);
  	mt7915_set_stream_vht_txbf_caps(phy);
  	mt7915_set_stream_he_caps(phy);
diff --git a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch
index ae27d38..435e1b4 100644
--- a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-Fixed-null-pointer-dereference-issu.patch
@@ -1,7 +1,7 @@
-From 0afe0c40fe92f282f72a66f85410b9d073b84494 Mon Sep 17 00:00:00 2001
+From f5553a51be55e84e4920327a7a47fd0459079f19 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 26 Oct 2023 21:11:05 +0800
-Subject: [PATCH 05/13] wifi: mt76: mt7915: Fixed null pointer dereference
+Subject: [PATCH 05/14] wifi: mt76: mt7915: Fixed null pointer dereference
  issue
 
 Without this patch, when the station is still in Authentication stage and
@@ -17,10 +17,10 @@
  1 file changed, 7 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index ed0f0cc..f363a30 100644
+index 1903db4f..61a1dbb0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1166,9 +1166,16 @@ static void mt7915_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1170,9 +1170,16 @@ static void mt7915_sta_rc_update(struct ieee80211_hw *hw,
  				 struct ieee80211_sta *sta,
  				 u32 changed)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch
index 93e73af..4763769 100644
--- a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-ACS-channel-time-too-long-on-duty-channel.patch
@@ -1,7 +1,7 @@
-From 9621cc0577f957c422cd8960bab5541d069b0fe1 Mon Sep 17 00:00:00 2001
+From d1b51bf135c41c3773bd4cae5be59a4a9f6f9c67 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sat, 18 Nov 2023 07:36:45 +0800
-Subject: [PATCH 06/13] wifi: mt76: ACS channel time too long on duty channel
+Subject: [PATCH 06/14] wifi: mt76: ACS channel time too long on duty channel
 
 Issue:
 There's a chance that the channel time for duty channel is zero in ACS
@@ -26,7 +26,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index b603d40..6e8ac6f 100644
+index b603d40c..6e8ac6f4 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -928,6 +928,7 @@ void mt76_set_channel(struct mt76_phy *phy)
diff --git a/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch b/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch
index 360c308..593e1b6 100644
--- a/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0007-wifi-mt76-mt7915-add-post-channel-switch-for-DFS-cha.patch
@@ -1,7 +1,7 @@
-From d66d0f22529ac2b2f63f67a4251759f18e12ba83 Mon Sep 17 00:00:00 2001
+From b77ddf219b289e76985dd4cd7795e75eda12c195 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 16 Nov 2023 14:41:54 +0800
-Subject: [PATCH 07/13] wifi: mt76: mt7915: add post channel switch for DFS
+Subject: [PATCH 07/14] wifi: mt76: mt7915: add post channel switch for DFS
  channel switching
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 22 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f363a30..dfaee4c 100644
+index 61a1dbb0..71e0d55f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -736,6 +736,27 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -41,7 +41,7 @@
  int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta)
  {
-@@ -1697,6 +1718,7 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1701,6 +1722,7 @@ const struct ieee80211_ops mt7915_ops = {
  	.get_txpower = mt76_get_txpower,
  	.set_sar_specs = mt7915_set_sar_specs,
  	.channel_switch_beacon = mt7915_channel_switch_beacon,
diff --git a/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-add-support-for-realtime-Rx-rate-up.patch b/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-add-support-for-realtime-Rx-rate-up.patch
index 6943e39..24c059b 100644
--- a/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-add-support-for-realtime-Rx-rate-up.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0008-wifi-mt76-mt7915-add-support-for-realtime-Rx-rate-up.patch
@@ -1,7 +1,7 @@
-From 81b15b74393bddb1f453300f85c37668ff98f8c7 Mon Sep 17 00:00:00 2001
+From fa1147593b9426ed989e9b3db5275ea815feda4f Mon Sep 17 00:00:00 2001
 From: "Henry.Yen" <henry.yen@mediatek.com>
 Date: Mon, 8 Jan 2024 17:19:01 +0800
-Subject: [PATCH 08/13] wifi: mt76: mt7915: add support for realtime Rx rate
+Subject: [PATCH 08/14] wifi: mt76: mt7915: add support for realtime Rx rate
  updates
 
 Add support for realtime Rx rate updates.
@@ -19,7 +19,7 @@
  2 files changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 98d64d3..1be41d6 100644
+index 98d64d3d..1be41d66 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -255,6 +255,12 @@ static inline bool is_connac_v1(struct mt76_dev *dev)
@@ -36,10 +36,10 @@
  {
  	switch (mt76_chip(dev)) {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index dfaee4c..b84c666 100644
+index 71e0d55f..5d31f5af 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1114,7 +1114,7 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1118,7 +1118,7 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  	struct rate_info *txrate = &msta->wcid.rate;
  	struct rate_info rxrate = {};
  
diff --git a/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-remove-redundant-argument-in-add_be.patch b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-remove-redundant-argument-in-add_be.patch
index 0e98ed0..c3b8086 100644
--- a/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-remove-redundant-argument-in-add_be.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-remove-redundant-argument-in-add_be.patch
@@ -1,7 +1,7 @@
-From 3795a4938098deac1399d5ebc91cd57350c6260c Mon Sep 17 00:00:00 2001
+From 3209719d17e76d3e8c76e4cd5e44d1ad099b9b1a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 Date: Wed, 24 Jan 2024 15:04:33 +0800
-Subject: [PATCH 09/13] wifi: mt76: mt7915: remove redundant argument in
+Subject: [PATCH 09/14] wifi: mt76: mt7915: remove redundant argument in
  add_beacon function
 
 Remove redundant argument "changed".
@@ -15,10 +15,10 @@
  4 files changed, 5 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3fe1cf1..3736853 100644
+index 0f6b8067..ada3a7f4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1278,8 +1278,7 @@ mt7915_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1285,8 +1285,7 @@ mt7915_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	case NL80211_IFTYPE_MESH_POINT:
  	case NL80211_IFTYPE_ADHOC:
  	case NL80211_IFTYPE_AP:
@@ -29,7 +29,7 @@
  	default:
  		break;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b84c666..1548c1f 100644
+index 5d31f5af..9eeca394 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -659,7 +659,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
@@ -51,10 +51,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6cd6ad1..7a2a537 100644
+index 6e9970c3..84ffe07c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1971,8 +1971,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1970,8 +1970,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
  }
  
@@ -65,10 +65,10 @@
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 35458ec..1b79733 100644
+index 5cd2b334..e1801d5b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -457,7 +457,7 @@ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -461,7 +461,7 @@ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vi
  int mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  				 u32 changed);
  int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
diff --git a/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-support-for-WMM-PBC-configurati.patch b/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-support-for-WMM-PBC-configurati.patch
index 5703972..29d36da 100644
--- a/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-support-for-WMM-PBC-configurati.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0010-wifi-mt76-mt7915-add-support-for-WMM-PBC-configurati.patch
@@ -1,7 +1,7 @@
-From 70f2286427614e2da9e0caf6b90813d38bfadc63 Mon Sep 17 00:00:00 2001
+From 7742ed6bdf7ee5aa8c3b9a57a346f2c4b0e51f2d Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Mon, 29 Jan 2024 11:28:41 +0800
-Subject: [PATCH 10/13] wifi: mt76: mt7915: add support for WMM PBC
+Subject: [PATCH 10/14] wifi: mt76: mt7915: add support for WMM PBC
  configuration
 
 ---
@@ -14,7 +14,7 @@
  6 files changed, 127 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 2a4aa79..8d516e4 100644
+index 2a4aa796..8d516e40 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1018,6 +1018,7 @@ enum {
@@ -34,10 +34,10 @@
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
  	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index d5d9cbf..2fc1f3c 100644
+index 911ecdd3..4f1e6e71 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1217,6 +1217,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1221,6 +1221,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	INIT_WORK(&dev->dump_work, mt7915_mac_dump_work);
  	mutex_init(&dev->dump_mutex);
  
@@ -47,10 +47,10 @@
  
  	phy2 = mt7915_alloc_ext_phy(dev);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3736853..762159b 100644
+index ada3a7f4..e167e7b6 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -2027,6 +2027,8 @@ void mt7915_mac_work(struct work_struct *work)
+@@ -2032,6 +2032,8 @@ void mt7915_mac_work(struct work_struct *work)
  
  	mt76_update_survey(mphy);
  	if (++mphy->mac_work_count == 5) {
@@ -59,7 +59,7 @@
  		mphy->mac_work_count = 0;
  
  		mt7915_mac_update_stats(phy);
-@@ -2034,6 +2036,18 @@ void mt7915_mac_work(struct work_struct *work)
+@@ -2039,6 +2041,18 @@ void mt7915_mac_work(struct work_struct *work)
  
  		if (phy->dev->muru_debug)
  			mt7915_mcu_muru_debug_get(phy);
@@ -79,7 +79,7 @@
  
  	if (++phy->stats_work_count == 10) {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7a2a537..d101cbf 100644
+index 84ffe07c..446c512b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -354,6 +354,93 @@ mt7915_mcu_rx_bcc_notify(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -187,7 +187,7 @@
  		break;
  	}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 8f36546..fa0847d 100644
+index 8f365461..fa0847d5 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -329,10 +329,25 @@ enum {
@@ -217,10 +217,10 @@
  };
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1b79733..874d531 100644
+index e1801d5b..89156f35 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -322,6 +322,9 @@ struct mt7915_dev {
+@@ -326,6 +326,9 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -230,7 +230,7 @@
  };
  
  enum {
-@@ -512,6 +515,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -516,6 +519,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
diff --git a/recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch b/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch
rename to recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch
index e7b587a..77c82fb 100644
--- a/recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch
@@ -1,7 +1,7 @@
-From 430c4efd2a2ebc4fa486bdec220d3a9449192106 Mon Sep 17 00:00:00 2001
+From 9c9741829ac9bbf43e11b3c033ce9bf82b7ed1ad Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 29 Jan 2024 11:02:06 +0800
-Subject: [PATCH 12/13] wifi: mt76: fix tx statistics about tx retry and tx
+Subject: [PATCH 11/14] wifi: mt76: fix tx statistics about tx retry and tx
  fail
 
 The tx retry and tx failed are reported by PPDU TxS.
@@ -13,7 +13,7 @@
  2 files changed, 1 insertion(+), 4 deletions(-)
 
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index b841bf6..630c640 100644
+index b841bf62..630c6402 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -716,9 +716,6 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
@@ -27,10 +27,10 @@
  	skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
  	if (skb) {
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 762159b..e819815 100644
+index e167e7b6..a5d0b096 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1014,7 +1014,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+@@ -1021,7 +1021,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  
  	msta = container_of(wcid, struct mt7915_sta, wcid);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-mt7915-fix-mcu-command-format-for-mt7915-t.patch b/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-mt7915-fix-mcu-command-format-for-mt7915-t.patch
deleted file mode 100644
index d93eeb9..0000000
--- a/recipes-wifi/linux-mt76/files/patches/0011-wifi-mt76-mt7915-fix-mcu-command-format-for-mt7915-t.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 1b31fe5bd4d40dece68860263bb2cfb0817cb8a7 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 29 Jan 2024 10:38:35 +0800
-Subject: [PATCH 11/13] wifi: mt76: mt7915: fix mcu command format for mt7915
- tx stats
-
-The mcu command format are different for mt7915 and mt7986.
-Fix the mt7915_mcu_wed_wa_tx_stats to support mt7915 and mt7986.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/mcu.c | 42 ++++++++++++++++++++++++++++++------------
- 1 file changed, 30 insertions(+), 12 deletions(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d101cbf..d443d50 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -4050,30 +4050,46 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
- {
- 	struct {
- 		__le32 cmd;
--		__le32 num;
--		__le32 __rsv;
--		__le16 wlan_idx;
--	} req = {
-+		__le32 arg0;
-+		__le32 arg1;
-+		__le16 arg2;
-+	} __packed req = {
- 		.cmd = cpu_to_le32(0x15),
--		.num = cpu_to_le32(1),
--		.wlan_idx = cpu_to_le16(wlan_idx),
- 	};
- 	struct mt7915_mcu_wa_tx_stat {
--		__le16 wlan_idx;
--		u8 __rsv[2];
-+		union {
-+			struct {
-+				u8 wcid;
-+				u8 __rsv[3];
-+			} __packed mt7915_hdr;
-+			struct {
-+				u16 wcid;
-+				u8 __rsv2[2];
-+			} __packed mt7986_hdr;
-+		} u;
- 
- 		/* tx_bytes is deprecated since WA byte counter uses u32,
- 		 * which easily leads to overflow.
- 		 */
- 		__le32 tx_bytes;
- 		__le32 tx_packets;
--	} *res;
-+	} __packed *res;
- 	struct mt76_wcid *wcid;
- 	struct sk_buff *skb;
--	int ret;
-+	int ret, len;
-+	u16 ret_wcid;
-+
-+	if (is_mt7915(&dev->mt76)) {
-+		req.arg0 = cpu_to_le32(wlan_idx);
-+		len = sizeof(req) - sizeof(req.arg2);
-+	} else {
-+		req.arg0 = cpu_to_le32(1);
-+		req.arg2 = cpu_to_le16(wlan_idx);
-+		len = sizeof(req);
-+	}
- 
- 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WA_PARAM_CMD(QUERY),
--					&req, sizeof(req), true, &skb);
-+					&req, len, true, &skb);
- 	if (ret)
- 		return ret;
- 
-@@ -4082,7 +4098,9 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
- 
- 	res = (struct mt7915_mcu_wa_tx_stat *)skb->data;
- 
--	if (le16_to_cpu(res->wlan_idx) != wlan_idx) {
-+	ret_wcid = is_mt7915(&dev->mt76) ? res->u.mt7915_hdr.wcid :
-+					   le16_to_cpu(res->u.mt7986_hdr.wcid);
-+	if (ret_wcid != wlan_idx) {
- 		ret = -EINVAL;
- 		goto out;
- 	}
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch b/recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
rename to recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
index 01f3496..cebcb18 100644
--- a/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0012-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
@@ -1,7 +1,7 @@
-From 0cf61c8ee2d3cd4bd7c96b3ee09c968c01fcff35 Mon Sep 17 00:00:00 2001
+From 8c5ba6c32357e4de7183db027141167555856996 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 29 Jan 2024 15:33:24 +0800
-Subject: [PATCH 13/13] wifi: mt76: add sanity check to prevent kernel crash
+Subject: [PATCH 12/14] wifi: mt76: add sanity check to prevent kernel crash
 
 wcid may not be initialized when mac80211 calls mt76.tx and it would lead to
 kernel crash.
@@ -12,7 +12,7 @@
  1 file changed, 8 insertions(+)
 
 diff --git a/tx.c b/tx.c
-index 1809b03..4596b36 100644
+index 5cf6edee..ab42f69b 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -345,6 +345,14 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
diff --git a/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-limit-per-band-token-count.patch b/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-limit-per-band-token-count.patch
new file mode 100644
index 0000000..64dcad9
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-limit-per-band-token-count.patch
@@ -0,0 +1,228 @@
+From 0c5bff805c1692b90a8f5935876b76dff903f8c4 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 29 Jan 2024 15:33:24 +0800
+Subject: [PATCH 13/14] wifi: mt76: mt7915: limit per-band token count
+
+Add a threshold for per-band token count to prevent a band from interfering
+with the other band.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt76.h           |  8 +++++++-
+ mt7915/init.c    |  3 +++
+ mt7915/mac.c     |  3 ++-
+ mt7921/pci_mac.c |  2 +-
+ mt7925/pci_mac.c |  2 +-
+ mt7996/init.c    |  5 +++++
+ mt7996/mac.c     |  3 ++-
+ tx.c             | 20 ++++++++++++++++++--
+ 8 files changed, 39 insertions(+), 7 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index 52a20868..9ad4f8e1 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -402,6 +402,8 @@ struct mt76_txwi_cache {
+ 	struct list_head list;
+ 	dma_addr_t dma_addr;
+ 
++	u8 phy_idx;
++
+ 	union {
+ 		struct sk_buff *skb;
+ 		void *ptr;
+@@ -814,6 +816,7 @@ struct mt76_phy {
+ 		bool al;
+ 		u8 pin;
+ 	} leds;
++	int tokens;
+ };
+ 
+ struct mt76_dev {
+@@ -867,6 +870,8 @@ struct mt76_dev {
+ 	u16 wed_token_count;
+ 	u16 token_count;
+ 	u16 token_size;
++	u16 token_threshold;
++	u8 num_phy;
+ 
+ 	spinlock_t rx_token_lock;
+ 	struct idr rx_token;
+@@ -1657,7 +1662,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
+ 
+ struct mt76_txwi_cache *
+ mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
+-int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
++int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi,
++		       u8 phy_idx);
+ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+ struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
+ int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 4f1e6e71..d6bcc6f5 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -1225,6 +1225,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+ 
+ 	dev->dbdc_support = mt7915_band_config(dev);
+ 
++	dev->mt76.num_phy = 1 + !!dev->dbdc_support;
++
+ 	phy2 = mt7915_alloc_ext_phy(dev);
+ 	if (IS_ERR(phy2))
+ 		return PTR_ERR(phy2);
+@@ -1257,6 +1259,7 @@ int mt7915_register_device(struct mt7915_dev *dev)
+ 	}
+ 
+ 	dev->recovery.hw_init_done = true;
++	dev->mt76.token_threshold = dev->mt76.token_size / dev->mt76.num_phy;
+ 
+ 	ret = mt7915_init_debugfs(&dev->phy);
+ 	if (ret)
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index a5d0b096..4604a682 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -738,6 +738,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	struct mt76_connac_fw_txp *txp;
+ 	struct mt76_txwi_cache *t;
+ 	int id, i, nbuf = tx_info->nbuf - 1;
++	u8 phy_idx = (info->hw_queue & MT_TX_HW_QUEUE_PHY) >> 2;
+ 	u8 *txwi = (u8 *)txwi_ptr;
+ 	int pid;
+ 
+@@ -761,7 +762,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
+ 	t->skb = tx_info->skb;
+ 
+-	id = mt76_token_consume(mdev, &t);
++	id = mt76_token_consume(mdev, &t, phy_idx);
+ 	if (id < 0)
+ 		return id;
+ 
+diff --git a/mt7921/pci_mac.c b/mt7921/pci_mac.c
+index c866144f..3282507a 100644
+--- a/mt7921/pci_mac.c
++++ b/mt7921/pci_mac.c
+@@ -27,7 +27,7 @@ int mt7921e_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
+ 	t->skb = tx_info->skb;
+ 
+-	id = mt76_token_consume(mdev, &t);
++	id = mt76_token_consume(mdev, &t, 0);
+ 	if (id < 0)
+ 		return id;
+ 
+diff --git a/mt7925/pci_mac.c b/mt7925/pci_mac.c
+index 9fca8879..f1d615c0 100644
+--- a/mt7925/pci_mac.c
++++ b/mt7925/pci_mac.c
+@@ -27,7 +27,7 @@ int mt7925e_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
+ 	t->skb = tx_info->skb;
+ 
+-	id = mt76_token_consume(mdev, &t);
++	id = mt76_token_consume(mdev, &t, 0);
+ 	if (id < 0)
+ 		return id;
+ 
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 9aa97e4a..7549a108 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -634,6 +634,8 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+ 		mtk_wed_device_start(&dev->mt76.mmio.wed_hif2, irq_mask);
+ 	}
+ 
++	dev->mt76.num_phy++;
++
+ 	return 0;
+ 
+ error:
+@@ -1330,6 +1332,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	dev->mt76.num_phy = 1;
++
+ 	ret = mt7996_register_phy(dev, mt7996_phy2(dev), MT_BAND1);
+ 	if (ret)
+ 		return ret;
+@@ -1342,6 +1346,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
+ 
+ 	dev->recovery.hw_init_done = true;
+ 
++	dev->mt76.token_threshold = dev->mt76.token_size / dev->mt76.num_phy;
+ 	ret = mt7996_init_debugfs(&dev->phy);
+ 	if (ret)
+ 		goto error;
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index bc7111a7..aa19120b 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -922,6 +922,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	struct mt76_txwi_cache *t;
+ 	int id, i, pid, nbuf = tx_info->nbuf - 1;
+ 	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
++	u8 phy_idx = (info->hw_queue & MT_TX_HW_QUEUE_PHY) >> 2;
+ 	u8 *txwi = (u8 *)txwi_ptr;
+ 
+ 	if (unlikely(tx_info->skb->len <= ETH_HLEN))
+@@ -933,7 +934,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
+ 	t->skb = tx_info->skb;
+ 
+-	id = mt76_token_consume(mdev, &t);
++	id = mt76_token_consume(mdev, &t, phy_idx);
+ 	if (id < 0)
+ 		return id;
+ 
+diff --git a/tx.c b/tx.c
+index ab42f69b..0fdf7d83 100644
+--- a/tx.c
++++ b/tx.c
+@@ -825,16 +825,30 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
+ }
+ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
+ 
+-int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
++int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi,
++		       u8 phy_idx)
+ {
++	struct mt76_phy *phy = phy_idx < __MT_MAX_BAND ? dev->phys[phy_idx] : NULL;
+ 	int token;
+ 
+ 	spin_lock_bh(&dev->token_lock);
+ 
++	if (dev->num_phy > 1 && phy && phy->tokens > dev->token_threshold) {
++		spin_unlock_bh(&dev->token_lock);
++
++		return -EINVAL;
++	}
++
+ 	token = idr_alloc(&dev->token, *ptxwi, 0, dev->token_size, GFP_ATOMIC);
+-	if (token >= 0)
++	if (token >= 0) {
+ 		dev->token_count++;
+ 
++		if (dev->num_phy > 1 && phy) {
++			(*ptxwi)->phy_idx = phy_idx;
++			phy->tokens++;
++		}
++	}
++
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ 	if (mtk_wed_device_active(&dev->mmio.wed) &&
+ 	    token >= dev->mmio.wed.wlan.token_start)
+@@ -878,6 +892,8 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+ 	txwi = idr_remove(&dev->token, token);
+ 	if (txwi) {
+ 		dev->token_count--;
++		if (dev->num_phy > 1 && dev->phys[txwi->phy_idx])
++			dev->phys[txwi->phy_idx]->tokens--;
+ 
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ 		if (mtk_wed_device_active(&dev->mmio.wed) &&
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0014-wifi-mt76-mt7915-update-power-on-sequence.patch b/recipes-wifi/linux-mt76/files/patches/0014-wifi-mt76-mt7915-update-power-on-sequence.patch
new file mode 100644
index 0000000..6aecbc3
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0014-wifi-mt76-mt7915-update-power-on-sequence.patch
@@ -0,0 +1,147 @@
+From 824415d99868fb03533e0575555c4b4a7a41bd76 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Thu, 14 Mar 2024 17:55:12 +0800
+Subject: [PATCH 14/14] wifi: mt76: mt7915: update power on sequence
+
+Update power on sequence to prevent unexpected behavior.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/mt7915.h |  1 +
+ mt7915/regs.h   |  2 ++
+ mt7915/soc.c    | 47 +++++++++++++++++++++++++++++++++++++++++++++--
+ 3 files changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 89156f35..74cd8caf 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -329,6 +329,7 @@ struct mt7915_dev {
+ 
+ 	bool wmm_pbc_enable;
+ 	struct work_struct wmm_pbc_work;
++	u32 adie_type;
+ };
+ 
+ enum {
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 7515b23f..3452a7e9 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -775,6 +775,7 @@ enum offs_rev {
+ #define MT_TOP_RGU_SYSRAM_PDN		(MT_TOP_RGU_BASE + 0x050)
+ #define MT_TOP_RGU_SYSRAM_SLP		(MT_TOP_RGU_BASE + 0x054)
+ #define MT_TOP_WFSYS_PWR		(MT_TOP_RGU_BASE + 0x010)
++#define MT_TOP_BGFYS_PWR		(MT_TOP_RGU_BASE + 0x020)
+ #define MT_TOP_PWR_EN_MASK		BIT(7)
+ #define MT_TOP_PWR_ACK_MASK		BIT(6)
+ #define MT_TOP_PWR_KEY_MASK		GENMASK(31, 16)
+@@ -886,6 +887,7 @@ enum offs_rev {
+ #define MT_ADIE_SLP_CTRL(_band, ofs)	(MT_ADIE_SLP_CTRL_BASE(_band) + (ofs))
+ 
+ #define MT_ADIE_SLP_CTRL_CK0(_band)	MT_ADIE_SLP_CTRL(_band, 0x120)
++#define MT_ADIE_SLP_CTRL_CK1(_band)	MT_ADIE_SLP_CTRL(_band, 0x124)
+ 
+ /* ADIE */
+ #define MT_ADIE_CHIP_ID			0x02c
+diff --git a/mt7915/soc.c b/mt7915/soc.c
+index b2916b02..210b4f16 100644
+--- a/mt7915/soc.c
++++ b/mt7915/soc.c
+@@ -261,6 +261,7 @@ static int mt7986_wmac_consys_lockup(struct mt7915_dev *dev, bool enable)
+ 		      MT_INFRACFG_TX_EN_MASK,
+ 		      FIELD_PREP(MT_INFRACFG_TX_EN_MASK, enable));
+ 
++	usleep_range(1000, 2000);
+ 	return 0;
+ }
+ 
+@@ -845,6 +846,10 @@ static void mt7986_wmac_subsys_setting(struct mt7915_dev *dev)
+ 		 MT_CONN_INFRA_OSC_STB_TIME_MASK, 0x80706);
+ 
+ 	/* prevent subsys from power on/of in a short time interval */
++	mt76_rmw(dev, MT_TOP_BGFYS_PWR,
++		 MT_TOP_PWR_ACK_MASK | MT_TOP_PWR_KEY_MASK,
++		 (0x42540000));
++
+ 	mt76_rmw(dev, MT_TOP_WFSYS_PWR,
+ 		 MT_TOP_PWR_ACK_MASK | MT_TOP_PWR_KEY_MASK,
+ 		 MT_TOP_PWR_KEY);
+@@ -915,7 +920,7 @@ static void mt7986_wmac_clock_enable(struct mt7915_dev *dev, u32 adie_type)
+ 
+ 		read_poll_timeout(mt76_rr, cur, !(cur & MT_SLP_CTRL_BSY_MASK),
+ 				  USEC_PER_MSEC, 50 * USEC_PER_MSEC, false,
+-				  dev, MT_ADIE_SLP_CTRL_CK0(0));
++				  dev, MT_ADIE_SLP_CTRL_CK0(1));
+ 	}
+ 	mt76_wmac_spi_unlock(dev);
+ 
+@@ -1155,12 +1160,14 @@ int mt7986_wmac_enable(struct mt7915_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	dev->adie_type = adie_type;
++
+ 	return mt7986_wmac_sku_update(dev, adie_type);
+ }
+ 
+ void mt7986_wmac_disable(struct mt7915_dev *dev)
+ {
+-	u32 cur;
++	u32 cur, i;
+ 
+ 	mt7986_wmac_top_wfsys_wakeup(dev, true);
+ 
+@@ -1179,6 +1186,20 @@ void mt7986_wmac_disable(struct mt7915_dev *dev)
+ 	mt76_rmw_field(dev, MT_AFE_DIG_EN_02(0), MT_AFE_MCU_BPLL_CFG_MASK, 0x2);
+ 	mt76_rmw_field(dev, MT_AFE_DIG_EN_02(0), MT_AFE_WPLL_CFG_MASK, 0x2);
+ 
++	/* Disable adie top clock */
++	mt76_wmac_spi_lock(dev);
++	for (i = 0; i < 2; i++) {
++		if (is_7975(dev, i, dev->adie_type) || is_7976(dev, i, dev->adie_type)) {
++			mt76_rmw_field(dev, MT_ADIE_SLP_CTRL_CK1(i),
++				       MT_SLP_CTRL_EN_MASK, 0x0);
++
++			read_poll_timeout(mt76_rr, cur, !(cur & MT_SLP_CTRL_BSY_MASK),
++					  USEC_PER_MSEC, 50 * USEC_PER_MSEC,
++					  false, dev, MT_ADIE_SLP_CTRL_CK1(i));
++		}
++	}
++	mt76_wmac_spi_unlock(dev);
++
+ 	/* Reset EMI */
+ 	mt76_rmw_field(dev, MT_CONN_INFRA_EMI_REQ,
+ 		       MT_CONN_INFRA_EMI_REQ_MASK, 0x1);
+@@ -1190,6 +1211,28 @@ void mt7986_wmac_disable(struct mt7915_dev *dev)
+ 		       MT_CONN_INFRA_INFRA_REQ_MASK, 0x0);
+ 
+ 	mt7986_wmac_top_wfsys_wakeup(dev, false);
++
++	mt76_rmw(dev, MT_TOP_CONN_INFRA_WAKEUP,
++		 MT_TOP_CONN_INFRA_WAKEUP_MASK, 0x1);
++
++	usleep_range(1000, 1100);
++
++	mt76_wmac_spi_lock(dev);
++	for (i = 0; i < 2; i++) {
++		if (is_7975(dev, i, dev->adie_type) || is_7976(dev, i, dev->adie_type)) {
++			mt76_rmw_field(dev, MT_ADIE_SLP_CTRL_CK0(i),
++				       MT_SLP_CTRL_EN_MASK, 0x0);
++
++			read_poll_timeout(mt76_rr, cur, !(cur & MT_SLP_CTRL_BSY_MASK),
++					  USEC_PER_MSEC, 50 * USEC_PER_MSEC,
++					  false, dev, MT_ADIE_SLP_CTRL_CK0(i));
++		}
++	}
++	mt76_wmac_spi_unlock(dev);
++
++	mt76_rmw(dev, MT_TOP_CONN_INFRA_WAKEUP,
++		 MT_TOP_CONN_INFRA_WAKEUP_MASK, 0x0);
++
+ 	mt7986_wmac_consys_lockup(dev, true);
+ 	mt7986_wmac_consys_reset(dev, false);
+ }
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch b/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
index 5b84f2d..848c547 100644
--- a/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
@@ -1,7 +1,7 @@
-From 1ee5da0c9bab77e2659c62bad6458458e5b7e079 Mon Sep 17 00:00:00 2001
+From f78b88037989c5a1d41e26c1d966166554dd605e Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sat, 1 Apr 2023 08:18:17 +0800
-Subject: [PATCH 0999/1048] wifi: mt76: mt7915: build pass for Linux Kernel 5.4
+Subject: [PATCH 0999/1051] wifi: mt76: mt7915: build pass for Linux Kernel 5.4
  fixes
 
 ---
@@ -23,7 +23,7 @@
  15 files changed, 123 insertions(+), 228 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
-index c4649ba..1c8328d 100644
+index c4649ba0..1c8328d5 100644
 --- a/debugfs.c
 +++ b/debugfs.c
 @@ -33,8 +33,10 @@ mt76_napi_threaded_set(void *data, u64 val)
@@ -38,7 +38,7 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 72a7bd5..8240691 100644
+index f4f88c44..ccdd5646 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -178,7 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
@@ -76,7 +76,7 @@
  	}
  
  done:
-@@ -630,11 +630,11 @@ free_skb:
+@@ -631,11 +631,11 @@ free_skb:
  	return ret;
  }
  
@@ -91,7 +91,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -642,30 +642,30 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -643,30 +643,30 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  	spin_lock_bh(&q->lock);
  
  	while (q->queued < q->ndesc - 1) {
@@ -134,7 +134,7 @@
  		}
  		frames++;
  	}
-@@ -718,10 +718,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -719,10 +719,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -145,7 +145,7 @@
  	ret = mt76_wed_dma_setup(dev, q, false);
  	if (ret)
  		return ret;
-@@ -740,6 +736,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -741,6 +737,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -153,7 +153,7 @@
  	void *buf;
  	bool more;
  
-@@ -755,7 +752,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -756,7 +753,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  			break;
  
  		if (!mt76_queue_is_wed_rro(q))
@@ -162,7 +162,7 @@
  	} while (1);
  
  	spin_lock_bh(&q->lock);
-@@ -765,6 +762,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -766,6 +763,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	}
  
  	spin_unlock_bh(&q->lock);
@@ -176,7 +176,7 @@
  }
  
  static void
-@@ -795,7 +799,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -796,7 +800,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  		return;
  
  	mt76_dma_sync_idx(dev, q);
@@ -185,7 +185,7 @@
  }
  
  static void
-@@ -812,7 +816,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -813,7 +817,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
  	} else {
@@ -194,7 +194,7 @@
  	}
  
  	if (more)
-@@ -882,12 +886,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -883,12 +887,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		    !(dev->drv->rx_check(dev, data, len)))
  			goto free_frag;
  
@@ -208,7 +208,7 @@
  
  		*(u32 *)skb->cb = info;
  
-@@ -903,10 +906,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -904,10 +907,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		continue;
  
  free_frag:
@@ -221,7 +221,7 @@
  	return done;
  }
  
-@@ -951,7 +954,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -952,7 +955,7 @@ mt76_dma_init(struct mt76_dev *dev,
  
  	mt76_for_each_q_rx(dev, i) {
  		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
@@ -230,7 +230,7 @@
  		napi_enable(&dev->napi[i]);
  	}
  
-@@ -1006,8 +1009,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -1007,8 +1010,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  		netif_napi_del(&dev->napi[i]);
  		mt76_dma_rx_cleanup(dev, q);
@@ -240,7 +240,7 @@
  
  	if (mtk_wed_device_active(&dev->mmio.wed))
 diff --git a/dma.h b/dma.h
-index 1de5a2b..619dc0f 100644
+index 1de5a2b2..619dc0fe 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -79,8 +79,7 @@ enum mt76_dma_wed_ind_reason {
@@ -254,7 +254,7 @@
  			    bool reset_idx);
  void mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q);
 diff --git a/eeprom.c b/eeprom.c
-index ecd09c0..a267397 100644
+index ecd09c03..a2673978 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -163,9 +163,15 @@ void
@@ -275,7 +275,7 @@
  	if (!is_valid_ether_addr(phy->macaddr)) {
  		eth_random_addr(phy->macaddr);
 diff --git a/mac80211.c b/mac80211.c
-index 6e8ac6f..b30a74e 100644
+index 6e8ac6f4..b30a74e8 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -357,7 +357,7 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mcu.c b/mcu.c
-index a8cafa3..fa4b054 100644
+index a8cafa39..fa4b0544 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -369,7 +369,7 @@
  struct sk_buff *
  __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt76.h b/mt76.h
-index 03116ff..1c37031 100644
+index 9ad4f8e1..a07c7df9 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -233,7 +233,7 @@ struct mt76_queue {
@@ -381,7 +381,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1517,7 +1517,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1522,7 +1522,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -389,7 +389,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1662,25 +1661,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1668,25 +1667,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
@@ -416,7 +416,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index ae34d01..c9444c6 100644
+index ae34d019..c9444c6d 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -10,6 +10,7 @@
@@ -428,7 +428,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 1be41d6..e23a41c 100644
+index 1be41d66..e23a41cb 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -56,7 +56,6 @@ enum {
@@ -448,7 +448,7 @@
  
  	if (chandef->width >= ARRAY_SIZE(width_to_bw))
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index fe5250c..7692423 100644
+index 4be806e2..3433adb2 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -520,7 +520,7 @@
  #define DEFAULT_HE_DURATION_RTS_THRES	1023
  static void
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 8d516e4..ea71d53 100644
+index 8d516e40..ea71d533 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1976,12 +1976,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val);
@@ -537,10 +537,10 @@
  int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			    struct mt76_connac_sta_key_conf *sta_key_conf,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1548c1f..4e9a509 100644
+index 9eeca394..407da078 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1434,22 +1434,20 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1438,22 +1438,20 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
@@ -569,7 +569,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1477,7 +1475,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1481,7 +1479,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		.idx = mvif->mt76.idx,
  	};
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -578,7 +578,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1589,12 +1587,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1593,12 +1591,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -595,7 +595,7 @@
  
  static void
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d443d50..32b6096 100644
+index 446c512b..8f6bc6e6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -607,7 +607,7 @@
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
 diff --git a/usb.c b/usb.c
-index 1b25f2e..46831a2 100644
+index dc690d1c..058f2d12 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
@@ -741,7 +741,7 @@
  
  static void mt76u_free_rx(struct mt76_dev *dev)
 diff --git a/wed.c b/wed.c
-index f89e453..f7a3f1b 100644
+index f89e4537..f7a3f1b3 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -9,8 +9,12 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
index 25907fe..fed3103 100644
--- a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
@@ -1,7 +1,7 @@
-From f1c639c9af8a46987ccdbb96c6327d801983101a Mon Sep 17 00:00:00 2001
+From b131fb83dc9f08152409560dd44fbaf0ad444341 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1000/1048] wifi: mt76: mt7915: add mtk internal debug tools
+Subject: [PATCH 1000/1051] wifi: mt76: mt7915: add mtk internal debug tools
  for mt76
 
 ---
@@ -12,18 +12,19 @@
  mt7915/main.c         |    5 +
  mt7915/mcu.c          |   48 +-
  mt7915/mcu.h          |    4 +
- mt7915/mt7915.h       |   43 +
+ mt7915/mt7915.h       |   56 +
  mt7915/mt7915_debug.h | 1442 ++++++++++++++++
- mt7915/mtk_debugfs.c  | 3743 +++++++++++++++++++++++++++++++++++++++++
+ mt7915/mtk_debugfs.c  | 3750 +++++++++++++++++++++++++++++++++++++++++
  mt7915/mtk_mcu.c      |   51 +
+ mt7915/soc.c          |    7 +
  tools/fwlog.c         |   44 +-
- 12 files changed, 5472 insertions(+), 19 deletions(-)
+ 13 files changed, 5499 insertions(+), 19 deletions(-)
  create mode 100644 mt7915/mt7915_debug.h
  create mode 100644 mt7915/mtk_debugfs.c
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ea71d53..ae5bbc0 100644
+index ea71d533..ae5bbc03 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1188,6 +1188,7 @@ enum {
@@ -47,7 +48,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index c4dca9c..fd71141 100644
+index c4dca9c1..fd711416 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -4,7 +4,7 @@ EXTRA_CFLAGS += -DCONFIG_MT76_LEDS
@@ -60,7 +61,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT798X_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 93e549c..f181377 100644
+index 93e549c3..f1813776 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -232,10 +233,10 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e819815..734d6ba 100644
+index 4604a682..d99864f0 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -275,6 +275,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -282,6 +282,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	__le16 fc = 0;
  	int idx;
  
@@ -246,7 +247,7 @@
  	memset(status, 0, sizeof(*status));
  
  	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->mt76->band_idx) {
-@@ -459,6 +463,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -466,6 +470,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	}
  
  	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
@@ -257,7 +258,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		struct ieee80211_vif *vif;
  		int err;
-@@ -796,6 +804,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -804,6 +812,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -271,7 +272,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4e9a509..6e362fc 100644
+index 407da078..e7166c6c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -295,7 +296,7 @@
  	mt7915_mac_wtbl_update(dev, idx,
  			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 32b6096..6d704f7 100644
+index 8f6bc6e6..321a839b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -205,6 +205,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -310,7 +311,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -2386,7 +2391,10 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
+@@ -2385,7 +2390,10 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
  				 sizeof(req), false);
  }
  
@@ -322,7 +323,7 @@
  {
  #define RED_DISABLE		0
  #define RED_BY_WA_ENABLE	2
-@@ -3449,6 +3457,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3519,6 +3527,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -331,7 +332,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -4121,6 +4131,23 @@ out:
+@@ -4185,6 +4195,23 @@ out:
  	return ret;
  }
  
@@ -355,7 +356,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -4149,3 +4176,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -4213,3 +4240,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -379,7 +380,7 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index fa0847d..9ae0f07 100644
+index fa0847d5..9ae0f07a 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -347,6 +347,10 @@ enum {
@@ -394,7 +395,7 @@
  	MCU_WA_PARAM_RED_SETTING = 0x40,
  };
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 874d531..1418d19 100644
+index 74cd8caf..58c0bf99 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -405,7 +406,22 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -323,6 +324,28 @@ struct mt7915_dev {
+@@ -244,6 +245,14 @@ struct mt7915_phy {
+ #endif
+ };
+ 
++#ifdef MTK_DEBUG
++enum {
++	ADIE0,
++	ADIE1,
++	ADIE_MAX_CNT,
++};
++#endif
++
+ struct mt7915_dev {
+ 	union { /* must be first */
+ 		struct mt76_dev mt76;
+@@ -327,6 +336,33 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -429,12 +445,17 @@
 +		u8 sku_disable;
 +	} dbg;
 +	const struct mt7915_dbg_reg_desc *dbg_reg;
++
++	struct {
++		u16 id;
++		u16 version;
++	} adie[ADIE_MAX_CNT];
 +#endif
 +
  	bool wmm_pbc_enable;
  	struct work_struct wmm_pbc_work;
- };
-@@ -605,4 +628,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	u32 adie_type;
+@@ -610,4 +646,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -461,7 +482,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 0000000..1ec8de9
+index 00000000..1ec8de99
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1442 @@
@@ -1909,10 +1930,10 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..e626119
+index 00000000..6f71dede
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
-@@ -0,0 +1,3743 @@
+@@ -0,0 +1,3750 @@
 +#include<linux/inet.h>
 +#include "mt7915.h"
 +#include "mt7915_debug.h"
@@ -4837,7 +4858,9 @@
 +{
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	struct mt76_dev *mdev = NULL;
-+	seq_printf(s, "Version: 2.2.16.0\n");
++	int i;
++
++	seq_printf(s, "Version: 2.2.24.2\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
@@ -4846,6 +4869,11 @@
 +	seq_printf(s, "Rom Patch Build Time: %.16s\n", mdev->patch_hdr->build_date);
 +	seq_printf(s, "WM Patch Build Time: %.16s\n", mdev->wm_hdr->build_date);
 +	seq_printf(s, "WA Patch Build Time: %.16s\n", mdev->wa_hdr->build_date);
++
++	for (i = 0; i < ADIE_MAX_CNT; i++) {
++		seq_printf(s, "adie[%d]: id=0x%04x version=0x%04x\n",
++			   i, dev->adie[i].id, dev->adie[i].version);
++	}
 +	return 0;
 +}
 +
@@ -5658,7 +5686,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 0000000..143dae2
+index 00000000..143dae26
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -5713,8 +5741,26 @@
 +				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
 +				 sizeof(req), true);
 +}
+diff --git a/mt7915/soc.c b/mt7915/soc.c
+index 210b4f16..a73db659 100644
+--- a/mt7915/soc.c
++++ b/mt7915/soc.c
+@@ -361,6 +361,13 @@ static int mt798x_wmac_sku_setup(struct mt7915_dev *dev, u32 *adie_type)
+ 	*adie_type = FIELD_GET(MT_ADIE_CHIP_ID_MASK, adie_main) |
+ 		     (MT_ADIE_CHIP_ID_MASK & adie_ext);
+ 
++#ifdef MTK_DEBUG
++	dev->adie[ADIE0].id = FIELD_GET(MT_ADIE_CHIP_ID_MASK, adie_main);
++	dev->adie[ADIE0].version = FIELD_GET(MT_ADIE_VERSION_MASK, adie_main);
++	dev->adie[ADIE1].id = FIELD_GET(MT_ADIE_CHIP_ID_MASK, adie_ext);
++	dev->adie[ADIE1].version = FIELD_GET(MT_ADIE_VERSION_MASK, adie_ext);
++#endif
++
+ out:
+ 	mt76_wmac_spi_unlock(dev);
+ 
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a10..3d51d9e 100644
+index e5d4a105..3d51d9ec 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
index a30130d..0afca69 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,7 +1,7 @@
-From 9f9d74f327383dc5fb45b48274b64c6b44fdf306 Mon Sep 17 00:00:00 2001
+From 44b667aae311f9f099a3d28dd511381ca1a46e78 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 1001/1048] wifi: mt76: mt7915: csi: implement csi support
+Subject: [PATCH 1001/1051] wifi: mt76: mt7915: csi: implement csi support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -18,7 +18,7 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ae5bbc0..81af870 100644
+index ae5bbc03..81af8709 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1022,6 +1022,7 @@ enum {
@@ -38,7 +38,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index fd71141..65129b4 100644
+index fd711416..65129b4f 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,10 +1,10 @@
@@ -55,7 +55,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT798X_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 2fc1f3c..ac9354e 100644
+index d6bcc6f5..dfca8ae7 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -696,6 +696,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
@@ -71,7 +71,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1173,6 +1179,24 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1177,6 +1183,24 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -96,7 +96,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1181,6 +1205,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1185,6 +1209,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -107,7 +107,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1193,6 +1221,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1197,6 +1225,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->mt76.irq_tasklet);
  
@@ -118,7 +118,7 @@
  	if (is_mt798x(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1235,6 +1267,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1241,6 +1273,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,10 +132,10 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 6e362fc..6790e98 100644
+index e7166c6c..4aa1b6d4 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -805,6 +805,10 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -809,6 +809,10 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy = msta->vif->phy;
  	int i;
  
@@ -147,7 +147,7 @@
  
  	mt7915_mac_wtbl_update(dev, msta->wcid.idx,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6d704f7..c6c40ca 100644
+index 321a839b..9baf52b4 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -40,6 +40,10 @@ static bool sr_scene_detect = true;
@@ -173,7 +173,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -4131,6 +4140,200 @@ out:
+@@ -4195,6 +4204,200 @@ out:
  	return ret;
  }
  
@@ -375,7 +375,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9ae0f07..f32d525 100644
+index 9ae0f07a..f32d5256 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -604,4 +604,78 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
@@ -458,7 +458,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1418d19..e4689d0 100644
+index 58c0bf99..4617c59a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -195,6 +195,45 @@ struct mt7915_hif {
@@ -528,8 +528,8 @@
 +#endif
  };
  
- struct mt7915_dev {
-@@ -628,6 +682,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ #ifdef MTK_DEBUG
+@@ -646,6 +700,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -544,7 +544,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
 new file mode 100644
-index 0000000..55da60a
+index 00000000..55da60a1
 --- /dev/null
 +++ b/mt7915/vendor.c
 @@ -0,0 +1,470 @@
@@ -1020,7 +1020,7 @@
 +}
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
 new file mode 100644
-index 0000000..e1f5fd3
+index 00000000..e1f5fd36
 --- /dev/null
 +++ b/mt7915/vendor.h
 @@ -0,0 +1,63 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
index a910d36..56239d1 100644
--- a/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
@@ -1,7 +1,7 @@
-From 538bdc90a9e58e64b20719a2ef0d0cf1817a26c8 Mon Sep 17 00:00:00 2001
+From 55b1554b868da2e8d5385bbad655dc746ce64384 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1002/1048] wifi: mt76: mt7915: air monitor support
+Subject: [PATCH 1002/1051] wifi: mt76: mt7915: air monitor support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -13,7 +13,7 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 81af870..4569113 100644
+index 81af8709..4569113a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1235,6 +1235,8 @@ enum {
@@ -26,10 +26,10 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 734d6ba..5969e2e 100644
+index d99864f0..e38905aa 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -524,6 +524,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -531,6 +531,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
  			qos_ctl = *ieee80211_get_qos_ctl(hdr);
  		}
@@ -41,12 +41,12 @@
  		status->flag |= RX_FLAG_8023;
  		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 6790e98..2c7287d 100644
+index 4aa1b6d4..19719b3f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -794,6 +794,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	if (ret)
- 		return ret;
+@@ -798,6 +798,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 30);
+ 	mt76_rmw_field(dev, addr, GENMASK(7, 0), 0xa0);
  
 +#ifdef CONFIG_MTK_VENDOR
 +	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
@@ -55,7 +55,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e4689d0..18a6899 100644
+index 4617c59a..35ccfa37 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -232,6 +232,33 @@ struct csi_data {
@@ -101,7 +101,7 @@
  #endif
  };
  
-@@ -686,6 +715,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -704,6 +733,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr, u32 sta_interval);
@@ -112,7 +112,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 55da60a..c964b14 100644
+index 55da60a1..c964b143 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -448,6 +448,355 @@ out:
@@ -491,7 +491,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index e1f5fd3..1863eee 100644
+index e1f5fd36..1863eee5 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -5,6 +5,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch b/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
index 0ddb540..5a51c15 100644
--- a/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
@@ -1,7 +1,7 @@
-From fda54b36ad78d5aeee5a1fb19463bfb9afd367e3 Mon Sep 17 00:00:00 2001
+From 5d90eb67164818be692bbd995a7576e5ef8d5a1c Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 4 Apr 2023 02:23:57 +0800
-Subject: [PATCH 1003/1048] wifi: mt76: mt7915: add support for muru_onoff via
+Subject: [PATCH 1003/1051] wifi: mt76: mt7915: add support for muru_onoff via
 
 ---
  mt7915/init.c        |  1 +
@@ -12,7 +12,7 @@
  5 files changed, 50 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index ac9354e..132be2e 100644
+index dfca8ae7..2ef1bb02 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -363,6 +363,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
@@ -24,7 +24,7 @@
  	hw->sta_data_size = sizeof(struct mt7915_sta);
  	hw->vif_data_size = sizeof(struct mt7915_vif);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index c6c40ca..8b48604 100644
+index 9baf52b4..6f73a7b4 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -965,6 +965,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -57,7 +57,7 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f32d525..f44146e 100644
+index f32d5256..f44146ed 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -678,4 +678,10 @@ enum CSI_CHAIN_TYPE {
@@ -72,7 +72,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 18a6899..fc845f4 100644
+index 35ccfa37..e21a101c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -289,6 +289,8 @@ struct mt7915_phy {
@@ -85,7 +85,7 @@
  	struct mt76_channel_state state_ts;
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e626119..9e6ea86 100644
+index 6f71dede..5d4a3b42 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2554,6 +2554,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
@@ -127,7 +127,7 @@
  static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -3673,6 +3705,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3680,6 +3712,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
index b72e0a5..9a7ba64 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From 3762477275edee40bf82914235756597a7978166 Mon Sep 17 00:00:00 2001
+From 8e5b09c4ac15591b5153d33a1d5ca0d33bb9ae91 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1004/1048] wifi: mt76: mt7915: certification patches
+Subject: [PATCH 1004/1051] wifi: mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -16,7 +16,7 @@
  9 files changed, 955 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4569113..36054bd 100644
+index 4569113a..36054bd9 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1237,6 +1237,7 @@ enum {
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5969e2e..a5e9ce4 100644
+index e38905aa..43cff275 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -1996,6 +1997,21 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+@@ -2002,6 +2003,21 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
  	spin_unlock_bh(&phy->stats_lock);
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2018,6 +2034,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -2024,6 +2040,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,7 +76,7 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2c7287d..1e9a3a6 100644
+index 19719b3f..f698b240 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -769,6 +769,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -87,9 +87,9 @@
 +	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
 +#endif
  	int ret, idx;
+ 	u32 addr;
  
- 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -797,7 +800,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -801,7 +804,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -107,10 +107,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8b48604..a9bba17 100644
+index 6f73a7b4..cd533aef 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4338,6 +4338,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -4402,6 +4402,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -584,7 +584,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f44146e..eef2fc0 100644
+index f44146ed..eef2fc00 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -486,10 +486,14 @@ enum {
@@ -818,10 +818,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index fc845f4..eee4df8 100644
+index e21a101c..0eca0403 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -714,6 +714,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -732,6 +732,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -842,7 +842,7 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr, u32 sta_interval);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9e6ea86..e3f4508 100644
+index 5d4a3b42..2298c0c6 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2560,7 +2560,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
@@ -867,7 +867,7 @@
  	}
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c964b14..7a71894 100644
+index c964b143..7a718944 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -23,6 +23,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1080,7 +1080,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1863eee..1a18cae 100644
+index 1863eee5..1a18cae7 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -7,6 +7,48 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
rename to recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 9def78b..01c3aa9 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,7 +1,7 @@
-From c060ba823d8a6a0a749957c4559f36c91d26c8df Mon Sep 17 00:00:00 2001
+From 9a66d0f9e8b5b04ddab7b485ff968c8c9129fb38 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 4 Apr 2023 02:27:44 +0800
-Subject: [PATCH 1006/1048] wifi: mt76: mt7915: add mt76 vendor muru onoff
+Subject: [PATCH 1005/1051] wifi: mt76: mt7915: add mt76 vendor muru onoff
  command
 
 ---
@@ -12,10 +12,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 65d11f1..9c07b14 100644
+index cd533aef..63fb8269 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4357,6 +4357,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -4422,6 +4422,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			phy->muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -30,7 +30,7 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index eef2fc0..8650053 100644
+index eef2fc00..86500536 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -493,6 +493,7 @@ enum {
@@ -42,7 +42,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7a71894..a8b1fa8 100644
+index 7a718944..a8b1fa84 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -35,6 +35,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -110,7 +110,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1a18cae..a4a9180 100644
+index 1a18cae7..a4a91804 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch b/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
deleted file mode 100644
index 78ce5f3..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From d159cf9fff522805c40e0f30842e23b4f4f9b431 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Thu, 23 Mar 2023 09:55:50 +0800
-Subject: [PATCH 1005/1048] wifi: mt76: mt7915: add support for runtime set
- in-band discovery
-
-Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
----
- mt7915/mcu.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a9bba17..65d11f1 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2030,8 +2030,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 	bcn = (struct bss_info_bcn *)tlv;
- 	bcn->enable = true;
- 
--	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
--	    vif->bss_conf.fils_discovery.max_interval) {
-+	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
- 		interval = vif->bss_conf.fils_discovery.max_interval;
- 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
- 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2068,7 +2067,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
- 	discov->tx_interval = interval;
- 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
--	discov->enable = true;
-+	discov->enable = !!(interval);
- 
- 	buf = (u8 *)sub_tlv + sizeof(*discov);
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-drop-undefined-action-frame.patch
similarity index 73%
rename from recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
rename to recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-drop-undefined-action-frame.patch
index 521006d..a923e65 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,17 +1,17 @@
-From c0b3af610482837dfaa04dddeb8beb099d797a7f Mon Sep 17 00:00:00 2001
+From 2cdc3cd08f1333a4d39187b1de67ce496b411d19 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 1007/1048] wifi: mt76: mt7915: drop undefined action frame
+Subject: [PATCH 1006/1051] wifi: mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a5e9ce4..b9fcc10 100644
+index 43cff275..6b994379 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -737,6 +737,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -744,6 +744,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info)
  {
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
@@ -20,7 +20,7 @@
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -767,6 +769,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -775,6 +777,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
@@ -28,7 +28,7 @@
 +	    mgmt->u.action.category == 0xff)
 +		return -1;
 +
- 	id = mt76_token_consume(mdev, &t);
+ 	id = mt76_token_consume(mdev, &t, phy_idx);
  	if (id < 0)
  		return id;
 -- 
diff --git a/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-testmode-rework-testmode-init-registers.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
rename to recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-testmode-rework-testmode-init-registers.patch
index dcf7276..fba82f4 100644
--- a/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-testmode-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 89869c9c04ad990c56074b22311d49a5a57862b1 Mon Sep 17 00:00:00 2001
+From 34d198b481815a46cff3e5634f59906c3f59923d Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1008/1048] wifi: mt76: testmode: rework testmode init
+Subject: [PATCH 1007/1051] wifi: mt76: testmode: rework testmode init
  registers
 
 ---
@@ -18,7 +18,7 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index b30a74e..3f5c2ed 100644
+index b30a74e8..3f5c2ed5 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -804,7 +804,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -32,10 +32,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 1c37031..9fe1716 100644
+index a07c7df9..fe5b136f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -707,6 +707,8 @@ struct mt76_testmode_ops {
+@@ -709,6 +709,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -44,7 +44,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -738,6 +740,8 @@ struct mt76_testmode_data {
+@@ -740,6 +742,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -53,7 +53,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -745,6 +749,7 @@ struct mt76_testmode_data {
+@@ -747,6 +751,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -62,7 +62,7 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 36054bd..edc9e12 100644
+index 36054bd9..edc9e124 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1231,6 +1231,7 @@ enum {
@@ -74,7 +74,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 8650053..7653b5e 100644
+index 86500536..7653b5e2 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -86,7 +86,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6004d64..694fc1b 100644
+index 6004d64f..694fc1bc 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -120,6 +120,7 @@ static const u32 mt7986_reg[] = {
@@ -106,7 +106,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 7515b23..2a9e50b 100644
+index 3452a7e9..8bb6a9f2 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -48,6 +48,7 @@ enum reg_rev {
@@ -154,7 +154,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0d76ae3..4693919 100644
+index 0d76ae31..46939191 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -379,7 +379,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac3..a1c54c8 100644
+index 5573ac30..a1c54c89 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -430,7 +430,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 4644dac..1b37392 100644
+index ca4feccf..9e05b862 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -448,8 +448,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -454,7 +454,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d..8961326 100644
+index 5e2792d8..89613266 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
diff --git a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-additional-supports.patch
similarity index 98%
rename from recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
rename to recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-additional-supports.patch
index a731e9f..ed6c26e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 01f1c8b87246849ea6cec5dbcab4b6d35d93b5e6 Mon Sep 17 00:00:00 2001
+From 1cebca515b82e405e37ac420f97a78d59d0fa3d4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1009/1048] wifi: mt76: testmode: additional supports
+Subject: [PATCH 1008/1051] wifi: mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -29,10 +29,10 @@
  20 files changed, 2064 insertions(+), 169 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 8240691..bbae84f 100644
+index ccdd5646..bc8afcff 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -613,8 +613,7 @@ free:
+@@ -614,8 +614,7 @@ free:
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -43,7 +43,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index 3f5c2ed..305cae7 100644
+index 3f5c2ed5..305cae78 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -73,10 +73,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 9fe1716..f8cf809 100644
+index fe5b136f..3fe18cd1 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -705,6 +705,21 @@ struct mt76_testmode_ops {
+@@ -707,6 +707,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -98,7 +98,7 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -713,16 +728,13 @@ struct mt76_testmode_data {
+@@ -715,16 +730,13 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
@@ -117,7 +117,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -738,10 +750,37 @@ struct mt76_testmode_data {
+@@ -740,10 +752,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -156,7 +156,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1343,6 +1382,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1348,6 +1387,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -216,7 +216,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1353,7 +1445,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1358,7 +1450,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -226,7 +226,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1455,7 +1548,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1460,7 +1553,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -237,7 +237,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 7692423..2b322b0 100644
+index 3433adb2..d449f4a6 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -400,6 +400,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
@@ -259,7 +259,7 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index edc9e12..49a3406 100644
+index edc9e124..49a3406d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1016,6 +1016,7 @@ enum {
@@ -279,10 +279,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 3bb2643..0441d91 100644
+index bfdbc15a..f4876fe9 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -136,7 +136,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -142,7 +142,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  		/* read eeprom data from efuse */
  		block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
  		for (i = 0; i < block_num; i++) {
@@ -292,7 +292,7 @@
  				return ret;
  		}
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 132be2e..9613e1d 100644
+index 2ef1bb02..83748da6 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -726,7 +726,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -305,10 +305,10 @@
  	mt7915_txbf_init(dev);
  }
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index b9fcc10..8c9be7e 100644
+index 6b994379..7d3397e2 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -579,6 +579,7 @@ mt7915_mac_fill_rx_vector(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -586,6 +586,7 @@ mt7915_mac_fill_rx_vector(struct mt7915_dev *dev, struct sk_buff *skb)
  			wb_rssi = le32_to_cpu(rxv[9]);
  
  		phy->test.last_rcpi[i] = rcpi & 0xff;
@@ -316,7 +316,7 @@
  		phy->test.last_ib_rssi[i] = ib_rssi & 0xff;
  		phy->test.last_wb_rssi[i] = wb_rssi & 0xff;
  	}
-@@ -604,16 +605,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -611,16 +612,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  {
  #ifdef CONFIG_NL80211_TESTMODE
  	struct mt76_testmode_data *td = &phy->mt76->test;
@@ -358,7 +358,7 @@
  
  	switch (td->tx_rate_mode) {
  	case MT76_TM_TX_MODE_HT:
-@@ -644,7 +667,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -651,7 +674,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  			rate_idx += 4;
  
  		r = &phy->mt76->hw->wiphy->bands[band]->bitrates[rate_idx];
@@ -367,7 +367,7 @@
  
  		mode = val >> 8;
  		rate_idx = val & 0xff;
-@@ -703,13 +726,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -710,13 +733,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  	if (mode >= MT_PHY_TYPE_HE_SU)
  		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
  
@@ -385,7 +385,7 @@
  #endif
  }
  
-@@ -1414,7 +1438,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+@@ -1420,7 +1444,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
  		goto out;
  
  	/* set the necessary init items */
@@ -395,7 +395,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1e9a3a6..2a7ad8b 100644
+index f698b240..6415e844 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -408,7 +408,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9c07b14..8094c9a 100644
+index 63fb8269..233411ca 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -478,6 +478,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -489,7 +489,7 @@
  
  	return 0;
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 7653b5e..c791c7f 100644
+index 7653b5e2..c791c7fa 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -547,7 +547,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 694fc1b..222e2cf 100644
+index 694fc1bc..222e2cfd 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -134,6 +134,7 @@ static const u32 mt7915_offs[] = {
@@ -567,7 +567,7 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index eee4df8..03a8930 100644
+index 0eca0403..1846e2f9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -304,11 +304,15 @@ struct mt7915_phy {
@@ -586,7 +586,7 @@
  	} test;
  #endif
  
-@@ -409,6 +413,14 @@ struct mt7915_dev {
+@@ -421,6 +425,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -601,7 +601,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -583,8 +595,8 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -601,8 +613,8 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -612,7 +612,7 @@
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
-@@ -623,6 +635,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -641,6 +653,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -621,7 +621,7 @@
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 2a9e50b..6783797 100644
+index 8bb6a9f2..1236da91 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -642,7 +642,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4693919..32dc85c 100644
+index 46939191..32dc85cd 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,10 @@
@@ -2102,7 +2102,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c8..eb0e043 100644
+index a1c54c89..eb0e0432 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2417,7 +2417,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1b37392..bc7f0b5 100644
+index 9e05b862..75870478 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -8,6 +8,7 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2910,7 +2910,7 @@
  
  	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
 diff --git a/testmode.h b/testmode.h
-index 8961326..7a68625 100644
+index 89613266..7a686250 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -3047,7 +3047,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f6908..406ba77 100644
+index e3f69089..406ba77c 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -3226,7 +3226,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 4596b36..d9731e5 100644
+index 0fdf7d83..db0d4df5 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -259,8 +259,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
diff --git a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-add-pre-cal-support.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-add-pre-cal-support.patch
index ebc3062..811d441 100644
--- a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-add-pre-cal-support.patch
@@ -1,25 +1,24 @@
-From f632c95552340e4fee0bb78f128a5fdb14d09219 Mon Sep 17 00:00:00 2001
+From 4ce9209f811922ef634475db68a446803d822ab0 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1010/1048] wifi: mt76: testmode: add pre-cal support
+Subject: [PATCH 1009/1051] wifi: mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  eeprom.c          |   6 +-
  mt76.h            |   1 +
  mt76_connac_mcu.h |   1 +
- mt7915/eeprom.h   |  34 +++-
- mt7915/mcu.c      |  27 ++-
- mt7915/mt7915.h   |   5 +
+ mt7915/mcu.c      |   3 +
+ mt7915/mt7915.h   |   1 +
  mt7915/testmode.c | 425 +++++++++++++++++++++++++++++++++++++++++++++-
  mt7915/testmode.h |  36 ++++
  testmode.c        |  15 +-
  testmode.h        |  17 ++
  tools/fields.c    |   8 +
- 11 files changed, 562 insertions(+), 13 deletions(-)
+ 10 files changed, 506 insertions(+), 7 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index a267397..3625b16 100644
+index a2673978..3625b169 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -94,8 +94,10 @@ int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int l
@@ -36,10 +35,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index f8cf809..9c69cfb 100644
+index 3fe18cd1..22d76bb1 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -706,6 +706,7 @@ struct mt76_testmode_ops {
+@@ -708,6 +708,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -48,7 +47,7 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 49a3406..1a32268 100644
+index 49a3406d..1a32268b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1012,6 +1012,7 @@ enum {
@@ -59,61 +58,8 @@
  	MCU_EXT_EVENT_PS_SYNC = 0x5,
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
-diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index adc26a2..25f0b32 100644
---- a/mt7915/eeprom.h
-+++ b/mt7915/eeprom.h
-@@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
- };
- 
- #define MT_EE_WIFI_CAL_GROUP			BIT(0)
--#define MT_EE_WIFI_CAL_DPD			GENMASK(2, 1)
-+#define MT_EE_WIFI_CAL_DPD_2G			BIT(2)
-+#define MT_EE_WIFI_CAL_DPD_5G			BIT(1)
-+#define MT_EE_WIFI_CAL_DPD_6G			BIT(3)
-+#define MT_EE_WIFI_CAL_DPD			GENMASK(3, 1)
- #define MT_EE_CAL_UNIT				1024
--#define MT_EE_CAL_GROUP_SIZE			(49 * MT_EE_CAL_UNIT + 16)
--#define MT_EE_CAL_DPD_SIZE			(54 * MT_EE_CAL_UNIT)
-+#define MT_EE_CAL_GROUP_SIZE_7915		(49 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7916		(54 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7975		(54 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7976		(94 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7916_6G		(94 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
-+#define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
- 
- #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
- #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
-@@ -156,6 +164,26 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
- 		return val & MT_EE_WIFI_CONF7_TSSI0_5G;
- }
- 
-+static inline u32
-+mt7915_get_cal_group_size(struct mt7915_dev *dev)
-+{
-+	u8 *eep = dev->mt76.eeprom.data;
-+	u32 val;
-+
-+	if (is_mt7915(&dev->mt76)) {
-+		return MT_EE_CAL_GROUP_SIZE_7915;
-+	} else if (is_mt7916(&dev->mt76)) {
-+		val = eep[MT_EE_WIFI_CONF + 1];
-+		val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
-+		return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
-+							 MT_EE_CAL_GROUP_SIZE_7916;
-+	} else if (mt7915_check_adie(dev, false)) {
-+		return MT_EE_CAL_GROUP_SIZE_7976;
-+	} else {
-+		return MT_EE_CAL_GROUP_SIZE_7975;
-+	}
-+}
-+
- extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
- 
- #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8094c9a..d983432 100644
+index 233411ca..ad58e3b6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -482,6 +482,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -126,63 +72,11 @@
  #endif
  	case MCU_EXT_EVENT_BSS_ACQ_PKT_CNT:
  		mt7915_mcu_rx_bss_acq_pkt_cnt(dev, skb);
-@@ -3028,7 +3031,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
- 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
- 	u32 total = MT_EE_CAL_GROUP_SIZE;
- 
--	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_GROUP))
-+	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
- 		return 0;
- 
- 	/*
-@@ -3108,11 +3111,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
- {
- 	struct mt7915_dev *dev = phy->dev;
- 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
--	u16 total = 2, center_freq = chandef->center_freq1;
-+	enum nl80211_band band = chandef->chan->band;
-+	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
-+	u16 center_freq = chandef->center_freq1;
- 	u8 *cal = dev->cal, *eep = dev->mt76.eeprom.data;
-+	u8 dpd_mask, cal_num = is_mt7915(&dev->mt76) ? 2 : 3;
- 	int idx;
- 
--	if (1 || !(eep[MT_EE_DO_PRE_CAL] & MT_EE_WIFI_CAL_DPD))
-+	switch (band) {
-+	case NL80211_BAND_2GHZ:
-+		dpd_mask = MT_EE_WIFI_CAL_DPD_2G;
-+		break;
-+	case NL80211_BAND_5GHZ:
-+		dpd_mask = MT_EE_WIFI_CAL_DPD_5G;
-+		break;
-+	case NL80211_BAND_6GHZ:
-+		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
-+		break;
-+	default:
-+		dpd_mask = 0;
-+		break;
-+	}
-+
-+	if (!(eep[offs] & dpd_mask))
- 		return 0;
- 
- 	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 03a8930..d77a5f0 100644
+index 1846e2f9..dd2e80b8 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -397,6 +397,10 @@ struct mt7915_dev {
- 	struct rchan *relay_fwlog;
- 
- 	void *cal;
-+	u32 cur_prek_offset;
-+	u8 dpd_chan_num_2g;
-+	u8 dpd_chan_num_5g;
-+	u8 dpd_chan_num_6g;
- 
- 	struct {
- 		u8 debug_wm;
-@@ -636,6 +640,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -654,6 +654,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -191,7 +85,7 @@
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 32dc85c..4b34430 100644
+index 32dc85cd..4b344303 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -666,7 +560,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index eb0e043..7569826 100644
+index eb0e0432..75698261 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -734,7 +628,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index bc7f0b5..3f108e4 100644
+index 75870478..070b296d 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -771,6 +771,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -767,7 +661,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 7a68625..e4c1b52 100644
+index 7a686250..e4c1b521 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -823,7 +717,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 406ba77..27801db 100644
+index 406ba77c..27801dbe 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-iBF-command-mode-support.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-iBF-command-mode-support.patch
index 6b7aeb5..ffd31a4 100644
--- a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 97b952fe3531f8cbdcd0ac0612d04547e254a0c4 Mon Sep 17 00:00:00 2001
+From 234318953b36685074c9a3b435ff7295ef005a58 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1011/1048] wifi: mt76: testmode: add iBF command mode support
+Subject: [PATCH 1010/1051] wifi: mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4b34430..453319e 100644
+index 4b344303..453319e1 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -722,6 +722,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -104,7 +104,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index 3f108e4..898ef3a 100644
+index 070b296d..b1986ad6 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -535,6 +535,42 @@ out:
@@ -163,7 +163,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index e4c1b52..1d7aef8 100644
+index e4c1b521..1d7aef86 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -285,8 +285,10 @@ enum mt76_testmode_txbf_act {
@@ -178,7 +178,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 27801db..b0ee84d 100644
+index 27801dbe..b0ee84d2 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
similarity index 97%
rename from recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
index b0bb62b..6e69604 100644
--- a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From 9ae13bf78d979afa68e8586bfbe8aab5e8f64183 Mon Sep 17 00:00:00 2001
+From e7ff04400a7f5ef553332c4513fd0164bf31c5a6 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1012/1048] wifi: mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1011/1051] wifi: mt76: testmode: add ZWDFS test mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -18,10 +18,10 @@
  10 files changed, 508 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 9c69cfb..1234da6 100644
+index 22d76bb1..9320c526 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -791,6 +791,15 @@ struct mt76_testmode_data {
+@@ -793,6 +793,15 @@ struct mt76_testmode_data {
  		u64 fcs_error[__MT_RXQ_MAX];
  		u64 len_mismatch;
  	} rx_stats;
@@ -38,7 +38,7 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 1a32268..4d85d32 100644
+index 1a32268b..4d85d323 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1233,6 +1233,7 @@ enum {
@@ -58,7 +58,7 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d983432..61cf60e 100644
+index ad58e3b6..573f1e88 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2759,6 +2759,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
@@ -69,7 +69,7 @@
  		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4907,3 +4908,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4954,3 +4955,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -139,7 +139,7 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c791c7f..066246b 100644
+index c791c7fa..066246bb 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -698,6 +698,52 @@ enum CSI_CHAIN_TYPE {
@@ -196,7 +196,7 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d77a5f0..827ee29 100644
+index dd2e80b8..1644a467 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -293,6 +293,7 @@ struct mt7915_phy {
@@ -207,7 +207,7 @@
  
  	u8 stats_work_count;
  	struct list_head stats_list;
-@@ -753,6 +754,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -767,6 +768,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -218,10 +218,10 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 6783797..44863e8 100644
+index 1236da91..7e9b76b0 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -1209,6 +1209,8 @@ enum offs_rev {
+@@ -1211,6 +1211,8 @@ enum offs_rev {
  #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
  #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
  
@@ -231,7 +231,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 453319e..caa3590 100644
+index 453319e1..caa35906 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -14,6 +14,12 @@ enum {
@@ -558,7 +558,7 @@
  
  static int
 diff --git a/testmode.c b/testmode.c
-index 898ef3a..dc972e3 100644
+index b1986ad6..b369826e 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -26,6 +26,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -622,7 +622,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index 1d7aef8..b39cf51 100644
+index 1d7aef86..b39cf511 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -64,6 +64,20 @@
@@ -690,7 +690,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index b0ee84d..e2cf4b9 100644
+index b0ee84d2..e2cf4b92 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -46,6 +46,14 @@ static const char * const testmode_txbf_act[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
similarity index 97%
rename from recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
rename to recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
index 8c703ca..76c585a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
@@ -1,7 +1,7 @@
-From 011707341e4bff752b9c4c3d6e4d553bdefae9a2 Mon Sep 17 00:00:00 2001
+From b52a453b4c3e2dd8399575e2091e1d63306ea2c5 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH 1013/1048] wifi: mt76: testmode: add iBF/eBF cal and cert
+Subject: [PATCH 1012/1051] wifi: mt76: testmode: add iBF/eBF cal and cert
  commands with golden
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -25,10 +25,10 @@
  16 files changed, 859 insertions(+), 325 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 1234da6..25b7cee 100644
+index 9320c526..8025e043 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -753,6 +753,7 @@ struct mt76_testmode_data {
+@@ -755,6 +755,7 @@ struct mt76_testmode_data {
  
  	struct list_head tm_entry_list;
  	struct mt76_wcid *cur_entry;
@@ -36,7 +36,7 @@
  	u8 entry_num;
  	union {
  		struct mt76_testmode_entry_data ed;
-@@ -781,6 +782,9 @@ struct mt76_testmode_data {
+@@ -783,6 +784,9 @@ struct mt76_testmode_data {
  
  	u8 txbf_act;
  	u16 txbf_param[8];
@@ -47,7 +47,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 2b322b0..e23dd77 100644
+index d449f4a6..774f5754 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -2680,6 +2680,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
@@ -68,10 +68,10 @@
  		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 8c9be7e..37183ca 100644
+index 7d3397e2..d94a0d55 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -730,8 +730,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -737,8 +737,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  		val |= MT_TXD6_LDPC;
  
  	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
@@ -84,7 +84,7 @@
  	txwi[6] |= cpu_to_le32(val);
  #endif
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2a7ad8b..d4d5a93 100644
+index 6415e844..c6eca6fe 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
@@ -175,7 +175,7 @@
  
  	return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 61cf60e..1707aaf 100644
+index 573f1e88..9dd4b775 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -227,7 +227,7 @@
  
  	if (enable) {
  		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
-@@ -3529,6 +3543,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3582,6 +3596,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  
  int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  {
@@ -235,7 +235,7 @@
  	struct {
  		u8 action;
  		union {
-@@ -3555,7 +3570,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+@@ -3608,7 +3623,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  		.action = action,
  	};
  
@@ -243,7 +243,7 @@
  	switch (action) {
  	case MT_BF_SOUNDING_ON:
  		req.snd.snd_mode = MT_BF_PROCESSING;
-@@ -4800,6 +4814,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
+@@ -4847,6 +4861,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
  		req.he_opt = v2;
  		req.glo_opt = v3;
  		break;
@@ -254,7 +254,7 @@
  		return -EINVAL;
  	}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 066246b..de17c57 100644
+index 066246bb..de17c579 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -546,10 +546,12 @@ enum {
@@ -448,7 +448,7 @@
  	MURU_SET_ARB_OP_MODE = 14,
  	MURU_SET_PLATFORM_TYPE = 25,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 222e2cf..ddf1b72 100644
+index 222e2cfd..ddf1b72a 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -133,6 +133,7 @@ static const u32 mt7915_offs[] = {
@@ -468,7 +468,7 @@
  	[AGG_AALCR0]		= 0x028,
  	[AGG_AWSCR0]		= 0x030,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 827ee29..42710e7 100644
+index 1644a467..b06e5ca9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -312,7 +312,6 @@ struct mt7915_phy {
@@ -479,7 +479,7 @@
  		bool bf_ever_en;
  	} test;
  #endif
-@@ -418,7 +417,7 @@ struct mt7915_dev {
+@@ -426,7 +425,7 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -488,7 +488,7 @@
  	struct {
  		void *txbf_phase_cal;
  		void *txbf_pfmu_data;
-@@ -560,6 +559,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+@@ -574,6 +573,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int mt7915_dma_start(struct mt7915_dev *dev, bool reset, bool wed_reset);
  int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
@@ -496,7 +496,7 @@
  void mt7915_reset(struct mt7915_dev *dev);
  int mt7915_run(struct ieee80211_hw *hw);
  int mt7915_mcu_init(struct mt7915_dev *dev);
-@@ -640,10 +640,12 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -654,10 +654,12 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -511,7 +511,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
  	return is_mt7915(&dev->mt76) ? MT7915_WTBL_SIZE : MT7916_WTBL_SIZE;
-@@ -777,4 +779,10 @@ enum {
+@@ -791,4 +793,10 @@ enum {
  
  #endif
  
@@ -523,7 +523,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e3f4508..0975682 100644
+index 2298c0c6..717c7763 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2888,6 +2888,36 @@ mt7915_txpower_level_set(void *data, u64 val)
@@ -563,7 +563,7 @@
  /* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
  static int
  mt7915_wa_set(void *data, u64 val)
-@@ -3770,6 +3800,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3777,6 +3807,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_file("txpower_level", 0400, dir, dev,
  			    &fops_txpower_level);
  
@@ -576,7 +576,7 @@
  
  	return 0;
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
-index 143dae2..7a2d28c 100644
+index 143dae26..7a2d28c7 100644
 --- a/mt7915/mtk_mcu.c
 +++ b/mt7915/mtk_mcu.c
 @@ -1,9 +1,10 @@
@@ -840,7 +840,7 @@
 +}
 +#endif
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 44863e8..1f1f8b9 100644
+index 7e9b76b0..4d05e391 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -61,6 +61,7 @@ enum offs_rev {
@@ -862,7 +862,7 @@
  #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
  #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index caa3590..faf6014 100644
+index caa35906..faf60146 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -55,6 +55,8 @@ struct reg_band {
@@ -1706,7 +1706,7 @@
  	rateval =  mode << 6 | rate_idx;
  	tx_cont->rateval = cpu_to_le16(rateval);
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 7569826..5aba13c 100644
+index 75698261..5aba13cf 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -311,137 +311,7 @@ struct mt7915_tm_muru {
@@ -1850,7 +1850,7 @@
  
  #endif
 diff --git a/testmode.c b/testmode.c
-index dc972e3..0dfed1e 100644
+index b369826e..a3e6d4ad 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -196,6 +196,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
@@ -1862,7 +1862,7 @@
  	memcpy(hdr->addr2, addr[1], ETH_ALEN);
  	memcpy(hdr->addr3, addr[2], ETH_ALEN);
 diff --git a/testmode.h b/testmode.h
-index b39cf51..20fab3e 100644
+index b39cf511..20fab3ec 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -303,7 +303,10 @@ enum mt76_testmode_cfg {
@@ -1890,7 +1890,7 @@
  	/* keep last */
  	NUM_MT76_TM_TXBF_ACT,
 diff --git a/tools/fields.c b/tools/fields.c
-index e2cf4b9..027b8cd 100644
+index e2cf4b92..027b8cdb 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -33,7 +33,10 @@ static const char * const testmode_tx_mode[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
similarity index 79%
rename from recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
rename to recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
index 85d7351..5e0fc98 100644
--- a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
@@ -1,7 +1,7 @@
-From 24d530077d09c7269397499bfbd040a73d4a579d Mon Sep 17 00:00:00 2001
+From cef4899673f363b224e3c1b8cc74d4a2c9e63ddd Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1015/1048] wifi: mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1013/1051] wifi: mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 305cae7..f9dfdf8 100644
+index 305cae78..f9dfdf8c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -451,7 +451,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
diff --git a/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
rename to recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
index bebf551..c8fcc07 100644
--- a/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From baef207d73aaa18b2b4de40417ca5da7a3ac601e Mon Sep 17 00:00:00 2001
+From 20455d572c06be4ac08bc38e0b07aeb4a9e16029 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1017/1048] wifi: mt76: mt7915: add phy capability vendor
+Subject: [PATCH 1014/1051] wifi: mt76: mt7915: add phy capability vendor
  command
 
 ---
@@ -11,7 +11,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 42710e7..87a63ec 100644
+index b06e5ca9..d21b843e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -23,7 +23,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index a8b1fa8..757aecb 100644
+index a8b1fa84..757aecb6 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -51,6 +51,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -100,7 +100,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a4a9180..34dd7d0 100644
+index a4a91804..34dd7d02 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -10,6 +10,7 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
deleted file mode 100644
index 07d3c69..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 58e8fc82df44c6debbafcb5237315aac0d131549 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1014/1048] wifi: mt76: mt7915: init rssi in WTBL when add
- station
-
----
- mt7915/main.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/mt7915/main.c b/mt7915/main.c
-index d4d5a93..0a3e8e0 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -783,6 +783,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
- #endif
- 	int ret, idx;
-+	u32 addr;
- 
- 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
- 	if (idx < 0)
-@@ -807,6 +808,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	if (ret)
- 		return ret;
- 
-+	addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 30);
-+	mt76_rmw_field(dev, addr, GENMASK(7, 0), 0xa0);
-+
- #ifdef CONFIG_MTK_VENDOR
- 	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
- #endif
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
rename to recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
index 33bce1e..9b30104 100644
--- a/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
@@ -1,7 +1,7 @@
-From a6f57135acd192daa23860751e6f52fe5bc3657e Mon Sep 17 00:00:00 2001
+From 112f472d3c2b14437899d42e26bb844fbc7ff020 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1018/1048] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1015/1051] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 ---
@@ -15,7 +15,7 @@
  7 files changed, 265 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4d85d32..8dba184 100644
+index 4d85d323..8dba184d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1243,6 +1243,7 @@ enum {
@@ -27,7 +27,7 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0a3e8e0..3f07183 100644
+index c6eca6fe..9fafa162 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -479,6 +479,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -41,10 +41,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b21d888..697e964 100644
+index 9dd4b775..1e84236d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5026,3 +5026,76 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -5037,3 +5037,76 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -122,7 +122,7 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index de17c57..1682c11 100644
+index de17c579..1682c117 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -1128,6 +1128,27 @@ enum {
@@ -154,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 87a63ec..03df15e 100644
+index d21b843e..000751bd 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -756,7 +756,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -770,7 +770,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -168,7 +168,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 757aecb..3a58684 100644
+index 757aecb6..3a586846 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -63,6 +63,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -325,7 +325,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 34dd7d0..284994a 100644
+index 34dd7d02..284994a2 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -3,6 +3,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch b/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
deleted file mode 100644
index 8110dac..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
+++ /dev/null
@@ -1,210 +0,0 @@
-From 6e0308590a7f6301a9d80ae8b523417b614a0c6b Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 13 Dec 2023 09:55:27 +0800
-Subject: [PATCH 1016/1048] wifi: mt76: mt7915: add mt7986 and mt7916
- pre-calibration
-
-Add pre-calibration for mt7986 and mt7916. It has different data size
-with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
-respectively. DPD cal needs 300k.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7915/eeprom.c | 17 ++++++------
- mt7915/eeprom.h |  1 +
- mt7915/mcu.c    | 72 ++++++++++++++++++++++++++++++++++++-------------
- 3 files changed, 63 insertions(+), 27 deletions(-)
-
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 0441d91..5e74b5f 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -9,28 +9,27 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
- {
- 	struct mt76_dev *mdev = &dev->mt76;
- 	u8 *eeprom = mdev->eeprom.data;
--	u32 val = eeprom[MT_EE_DO_PRE_CAL];
--	u32 offs;
-+	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
-+	u32 size, val = eeprom[offs];
- 	int ret;
- 
--	if (!dev->flash_mode)
-+	if (!dev->flash_mode || !val)
- 		return 0;
- 
--	if (val != (MT_EE_WIFI_CAL_DPD | MT_EE_WIFI_CAL_GROUP))
--		return 0;
-+	size = mt7915_get_cal_group_size(dev) +
-+	       (is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2);
- 
--	val = MT_EE_CAL_GROUP_SIZE + MT_EE_CAL_DPD_SIZE;
--	dev->cal = devm_kzalloc(mdev->dev, val, GFP_KERNEL);
-+	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
- 	if (!dev->cal)
- 		return -ENOMEM;
- 
- 	offs = is_mt7915(&dev->mt76) ? MT_EE_PRECAL : MT_EE_PRECAL_V2;
- 
--	ret = mt76_get_of_data_from_mtd(mdev, dev->cal, offs, val);
-+	ret = mt76_get_of_data_from_mtd(mdev, dev->cal, offs, size);
- 	if (!ret)
- 		return ret;
- 
--	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", val);
-+	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
- }
- 
- static int mt7915_check_eeprom(struct mt7915_dev *dev)
-diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 25f0b32..4a31375 100644
---- a/mt7915/eeprom.h
-+++ b/mt7915/eeprom.h
-@@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
- 	MT_EE_DDIE_FT_VERSION =	0x050,
- 	MT_EE_DO_PRE_CAL =	0x062,
- 	MT_EE_WIFI_CONF =	0x190,
-+	MT_EE_DO_PRE_CAL_V2 =	0x19a,
- 	MT_EE_RATE_DELTA_2G =	0x252,
- 	MT_EE_RATE_DELTA_5G =	0x29d,
- 	MT_EE_TX0_POWER_2G =	0x2fc,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1707aaf..b21d888 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3044,7 +3044,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
- int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
- {
- 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
--	u32 total = MT_EE_CAL_GROUP_SIZE;
-+	u32 total = mt7915_get_cal_group_size(dev);
-+	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
- 
- 	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
- 		return 0;
-@@ -3082,9 +3083,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
- 	return -1;
- }
- 
--static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
-+static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
- {
--	static const u16 freq_list[] = {
-+	const u16 freq_list_v1[] = {
- 		5180, 5200, 5220, 5240,
- 		5260, 5280, 5300, 5320,
- 		5500, 5520, 5540, 5560,
-@@ -3092,34 +3093,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
- 		5660, 5680, 5700, 5745,
- 		5765, 5785, 5805, 5825
- 	};
--	int offset_2g = ARRAY_SIZE(freq_list);
-+	const u16 freq_list_v2[] = {
-+		/* 6G BW20*/
-+		5955, 5975, 5995, 6015,
-+		6035, 6055, 6075, 6095,
-+		6115, 6135, 6155, 6175,
-+		6195, 6215, 6235, 6255,
-+		6275, 6295, 6315, 6335,
-+		6355, 6375, 6395, 6415,
-+		6435, 6455, 6475, 6495,
-+		6515, 6535, 6555, 6575,
-+		6595, 6615, 6635, 6655,
-+		6675, 6695, 6715, 6735,
-+		6755, 6775, 6795, 6815,
-+		6835, 6855, 6875, 6895,
-+		6915, 6935, 6955, 6975,
-+		6995, 7015, 7035, 7055,
-+		7075, 7095, 7115,
-+		/* 6G BW160 */
-+		6025, 6185, 6345, 6505,
-+		6665, 6825, 6985,
-+		/* 5G BW20 */
-+		5180, 5200, 5220, 5240,
-+		5260, 5280, 5300, 5320,
-+		5500, 5520, 5540, 5560,
-+		5580, 5600, 5620, 5640,
-+		5660, 5680, 5700, 5720,
-+		5745, 5765, 5785, 5805,
-+		5825, 5845, 5865, 5885,
-+		/* 5G BW160 */
-+		5250, 5570, 5815
-+	};
-+	const u16 *freq_list = freq_list_v1;
-+	int n_freqs = ARRAY_SIZE(freq_list_v1);
- 	int idx;
- 
-+	if (!is_mt7915(&dev->mt76)) {
-+		freq_list = freq_list_v2;
-+		n_freqs = ARRAY_SIZE(freq_list_v2);
-+	}
-+
- 	if (freq < 4000) {
- 		if (freq < 2432)
--			return offset_2g;
-+			return n_freqs;
- 		if (freq < 2457)
--			return offset_2g + 1;
-+			return n_freqs + 1;
- 
--		return offset_2g + 2;
-+		return n_freqs + 2;
- 	}
- 
--	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
-+	if (bw == NL80211_CHAN_WIDTH_80P80)
- 		return -1;
- 
- 	if (bw != NL80211_CHAN_WIDTH_20) {
--		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
--					   freq + 10);
-+		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq + 10);
- 		if (idx >= 0)
- 			return idx;
- 
--		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
--					   freq - 10);
-+		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq - 10);
- 		if (idx >= 0)
- 			return idx;
- 	}
- 
--	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
-+	return mt7915_find_freq_idx(freq_list, n_freqs, freq);
- }
- 
- int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3151,24 +3187,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
- 	if (!(eep[offs] & dpd_mask))
- 		return 0;
- 
--	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
-+	idx = mt7915_dpd_freq_idx(dev, center_freq, chandef->width);
- 	if (idx < 0)
- 		return -EINVAL;
- 
- 	/* Items: Tx DPD, Tx Flatness */
--	idx = idx * 2;
--	cal += MT_EE_CAL_GROUP_SIZE;
-+	idx = idx * cal_num;
-+	cal += mt7915_get_cal_group_size(dev) + (idx * MT_EE_CAL_UNIT);
- 
--	while (total--) {
-+	while (cal_num--) {
- 		int ret;
- 
--		cal += (idx * MT_EE_CAL_UNIT);
- 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
- 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
- 		if (ret)
- 			return ret;
- 
- 		idx++;
-+		cal += MT_EE_CAL_UNIT;
- 	}
- 
- 	return 0;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-implement-bin-file-mode.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
rename to recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-implement-bin-file-mode.patch
index e26dc91..90a7319 100644
--- a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From e380f090bfe90d7f41293326e9f830e138a17a96 Mon Sep 17 00:00:00 2001
+From 94c84707ae8140a4a9bda8d86d24e43bc299147a Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1019/1048] wifi: mt76: mt7915: implement bin file mode
+Subject: [PATCH 1016/1051] wifi: mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -16,7 +16,7 @@
  7 files changed, 144 insertions(+), 4 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 3625b16..9d029c0 100644
+index 3625b169..9d029c04 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -161,6 +161,31 @@ static int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int len)
@@ -52,10 +52,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 25b7cee..412ef33 100644
+index 8025e043..48e98a3a 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -978,6 +978,9 @@ struct mt76_dev {
+@@ -983,6 +983,9 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -65,7 +65,7 @@
  };
  
  /* per-phy stats.  */
-@@ -1241,6 +1244,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
+@@ -1246,6 +1249,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int len);
  int mt76_get_of_data_from_nvmem(struct mt76_dev *dev, void *eep,
  				const char *cell_name, int len);
@@ -74,7 +74,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 5e74b5f..3c99b4d 100644
+index f4876fe9..c8b1c18e 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -5,6 +5,30 @@
@@ -108,7 +108,7 @@
  static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
  {
  	struct mt76_dev *mdev = &dev->mt76;
-@@ -25,6 +49,9 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+@@ -24,6 +48,9 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
  
  	offs = is_mt7915(&dev->mt76) ? MT_EE_PRECAL : MT_EE_PRECAL_V2;
  
@@ -118,7 +118,7 @@
  	ret = mt76_get_of_data_from_mtd(mdev, dev->cal, offs, size);
  	if (!ret)
  		return ret;
-@@ -52,8 +79,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+@@ -59,8 +86,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
  	}
  }
  
@@ -131,7 +131,7 @@
  	switch (mt76_chip(&dev->mt76)) {
  	case 0x7915:
  		return dev->dbdc_support ?
-@@ -94,7 +124,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
+@@ -101,7 +131,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
  		return ret;
  
  	if (!fw || !fw->data) {
@@ -143,7 +143,7 @@
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -119,6 +152,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -126,6 +159,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  
  	if (ret) {
  		dev->flash_mode = true;
@@ -151,7 +151,7 @@
  	} else {
  		u8 free_block_num;
  		u32 block_num, i;
-@@ -139,6 +173,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -146,6 +180,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  			if (ret < 0)
  				return ret;
  		}
@@ -160,7 +160,7 @@
  	}
  
  	return mt7915_check_eeprom(dev);
-@@ -244,12 +280,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -251,12 +287,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
  
@@ -196,10 +196,10 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 4a31375..a1ab05a 100644
+index 509fb43d..99101f91 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
-@@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
+@@ -109,6 +109,13 @@ enum mt7915_sku_rate_group {
  	MAX_SKU_RATE_GROUP_NUM,
  };
  
@@ -214,10 +214,10 @@
  mt7915_get_channel_group_5g(int channel, bool is_7976)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 03df15e..f3e38bc 100644
+index 000751bd..a06a46e0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -389,6 +389,8 @@ struct mt7915_dev {
+@@ -397,6 +397,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -226,7 +226,7 @@
  	bool muru_debug;
  	bool ibf;
  
-@@ -769,6 +771,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
+@@ -783,6 +785,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
  int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
@@ -235,7 +235,7 @@
  #define PKT_BIN_DEBUG_MAGIC	0xc8763123
  enum {
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 0975682..f51f3ce 100644
+index 717c7763..9270a5e5 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
@@ -246,7 +246,7 @@
  
  #ifdef MTK_DEBUG
  #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
-@@ -3721,6 +3722,47 @@ static int mt7915_fw_wm_info_read(struct seq_file *s, void *data)
+@@ -3728,6 +3729,47 @@ static int mt7915_fw_wm_info_read(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -294,7 +294,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3807,6 +3849,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3814,6 +3856,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
@@ -304,7 +304,7 @@
  }
  #endif
 diff --git a/testmode.h b/testmode.h
-index 20fab3e..91d1e86 100644
+index 20fab3ec..91d1e867 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -17,7 +17,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-Add-mu-dump-support.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-Add-mu-dump-support.patch
index 467158a..e08d9e8 100644
--- a/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-Add-mu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-Add-mu-dump-support.patch
@@ -1,7 +1,7 @@
-From 910b19ddc72c72ebd6920ebd616f9be4e01a8de2 Mon Sep 17 00:00:00 2001
+From d49a9821782e9301cb60400fd0a1fe0126cae897 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1020/1048] wifi: mt76: mt7915: Add mu dump support
+Subject: [PATCH 1017/1051] wifi: mt76: mt7915: Add mu dump support
 
 ---
  mt7915/vendor.c | 24 ++++++++++++++++++++++++
@@ -9,7 +9,7 @@
  2 files changed, 25 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 3a58684..ac6f637 100644
+index 3a586846..ac6f6371 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -38,6 +38,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -58,7 +58,7 @@
  		.maxattr = MTK_VENDOR_ATTR_MU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 284994a..8c2a996 100644
+index 284994a2..8c2a996d 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -73,6 +73,7 @@ enum mtk_vendor_attr_mu_ctrl {
diff --git a/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch b/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
rename to recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
index 2bb3866..f4a190b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
@@ -1,7 +1,7 @@
-From 8b25fabf3bbe6c6337b7e8a4ff192562fcc8bbf3 Mon Sep 17 00:00:00 2001
+From 3a63048fa0c3dd8e0f00a0ba36cd644cbcc8592d Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1021/1048] wifi: mt76: mt7915: add vendor subcmd three wire
+Subject: [PATCH 1018/1051] wifi: mt76: mt7915: add vendor subcmd three wire
  (PTA) ctrl
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 8dba184..6f6a889 100644
+index 8dba184d..6f6a889b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1242,7 +1242,7 @@ enum {
@@ -28,10 +28,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 697e964..f793a95 100644
+index 1e84236d..072185fd 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4725,37 +4725,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4736,37 +4736,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -93,7 +93,7 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1682c11..1b0bd06 100644
+index 1682c117..1b0bd06b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -916,6 +916,35 @@ struct mt7915_mcu_rdd_ipi_scan {
@@ -133,10 +133,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f3e38bc..e01afea 100644
+index a06a46e0..00d2b356 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -750,6 +750,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -764,6 +764,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -145,7 +145,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index ac6f637..eeac18d 100644
+index ac6f6371..eeac18d2 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -41,6 +41,11 @@ mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
@@ -228,7 +228,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 8c2a996..e61a6aa 100644
+index 8c2a996d..e61a6aaa 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
rename to recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 50e3241..17293e0 100644
--- a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 10e13da2412e3d13da998a0860eb1ff521931678 Mon Sep 17 00:00:00 2001
+From f8e4daf72450f62353b72b6229a15bc9a7a28d9e Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1022/1048] wifi: mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1019/1051] wifi: mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index eeac18d..a21cbce 100644
+index eeac18d2..a21cbce2 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -87,6 +87,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
@@ -100,7 +100,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index e61a6aa..876edf3 100644
+index e61a6aaa..876edf34 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch b/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch
index ae6a565..449f8f8 100644
--- a/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch
@@ -1,7 +1,7 @@
-From 9b79716f5ef23fae2ef839e620ec25e92cae6a82 Mon Sep 17 00:00:00 2001
+From 30844a3ca673f10b487d7c2e373a91004126727b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 30 Mar 2023 15:12:37 +0800
-Subject: [PATCH 1023/1048] wifi: mt76: mt7915: add cal free data merge support
+Subject: [PATCH 1020/1051] wifi: mt76: mt7915: add cal free data merge support
 
 1. add basic cal free data support
 2. add E3 low yield rate workaround for panther E3 with 7976 adie
@@ -11,15 +11,15 @@
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7915/debugfs.c |  41 +++++++++++
- mt7915/eeprom.c  | 187 +++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/debugfs.c |  41 ++++++++++
+ mt7915/eeprom.c  | 199 ++++++++++++++++++++++++++++++++++++++++++++++-
  mt7915/eeprom.h  |   2 +
  mt7915/mcu.c     |  13 +++-
  mt7915/mt7915.h  |   1 +
- 5 files changed, 240 insertions(+), 4 deletions(-)
+ 5 files changed, 250 insertions(+), 6 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f181377..40a126f 100644
+index f1813776..40a126fa 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1240,6 +1240,46 @@ mt7915_rf_regval_set(void *data, u64 val)
@@ -78,10 +78,34 @@
  	if (!ext_phy)
  		dev->debugfs_dir = dir;
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 3c99b4d..e11ae5e 100644
+index c8b1c18e..6133c200 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -276,6 +276,189 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+@@ -48,8 +48,13 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ 
+ 	offs = is_mt7915(&dev->mt76) ? MT_EE_PRECAL : MT_EE_PRECAL_V2;
+ 
+-	if (dev->bin_file_mode)
+-		return mt7915_eeprom_load_precal_binfile(dev, offs, size);
++	if (dev->bin_file_mode) {
++		ret = mt7915_eeprom_load_precal_binfile(dev, offs, size);
++		if (ret)
++			goto out;
++
++		return 0;
++	}
+ 
+ 	ret = mt76_get_of_data_from_mtd(mdev, dev->cal, offs, size);
+ 	if (!ret)
+@@ -59,6 +64,7 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ 	if (!ret)
+ 		return ret;
+ 
++out:
+ 	dev_warn(mdev->dev, "missing precal data, size=%d\n", size);
+ 	devm_kfree(mdev->dev, dev->cal);
+ 	dev->cal = NULL;
+@@ -283,6 +289,191 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  	dev->chainshift = hweight8(dev->mphy.chainmask);
  }
  
@@ -143,7 +167,9 @@
 +	case 0x7915:
 +		ddie_offs = ddie_offs_list[DDIE_7915];
 +		ret = mt7915_mcu_get_eeprom(dev, MT_EE_ADIE_FT_VERSION, buf);
-+		if (ret)
++		if (ret == -EINVAL)
++			return 0;
++		else if (ret)
 +			return ret;
 +		adie_id = buf[MT_EE_ADIE_FT_VERSION % MT7915_EEPROM_BLOCK_SIZE] - 1;
 +		adie_offs[0] = adie_offs_list[ADIE_7975];
@@ -271,10 +297,10 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
-@@ -316,6 +499,10 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
- 	if (ret)
- 		return ret;
+@@ -320,6 +511,10 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+ 	}
  
+ 	mt7915_eeprom_load_precal(dev);
 +	ret = mt7915_apply_cal_free_data(dev);
 +	if (ret)
 +		return ret;
@@ -283,10 +309,10 @@
  	memcpy(dev->mphy.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
  	       ETH_ALEN);
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index a1ab05a..dd450aa 100644
+index 99101f91..70fca0b3 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
-@@ -67,6 +67,8 @@ enum mt7915_eeprom_field {
+@@ -68,6 +68,8 @@ enum mt7915_eeprom_field {
  #define MT_EE_RATE_DELTA_SIGN			BIT(6)
  #define MT_EE_RATE_DELTA_EN			BIT(7)
  
@@ -296,7 +322,7 @@
  	MT7976_ONE_ADIE_DBDC = 0x7,
  	MT7975_ONE_ADIE	= 0x8,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f793a95..0694c9a 100644
+index 072185fd..12622068 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2968,6 +2968,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
@@ -327,10 +353,10 @@
  	dev_kfree_skb(skb);
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e01afea..a74a4eb 100644
+index 00d2b356..1e5cd941 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -548,6 +548,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -562,6 +562,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
diff --git a/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch b/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
rename to recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
index 3a8f018..3d5a3e7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
@@ -1,7 +1,7 @@
-From 5658f47a201a3cfc585e10292ecd3202ed882ef1 Mon Sep 17 00:00:00 2001
+From e769bcee5b7268643d5be9fab858ec46c8bc7584 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1024/1048] wifi: mt76: mt7915: support on off SW ACI through
+Subject: [PATCH 1021/1051] wifi: mt76: mt7915: support on off SW ACI through
  debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
@@ -11,7 +11,7 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6f6a889..1265401 100644
+index 6f6a889b..12654017 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1244,6 +1244,7 @@ enum {
@@ -23,10 +23,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f51f3ce..2e1a145 100644
+index 9270a5e5..e8296476 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3763,6 +3763,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -3770,6 +3770,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -52,7 +52,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3851,6 +3870,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3858,6 +3877,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
diff --git a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index 6120b94..7130ba5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,7 +1,7 @@
-From c9b6bb691e58656f520262ec544f37f00aaf4ec2 Mon Sep 17 00:00:00 2001
+From e5b0035623fe1ae0e770dcff3c0c97fc6379249e Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1025/1048] wifi: mt76: mt7915: add bf backoff limit table
+Subject: [PATCH 1022/1051] wifi: mt76: mt7915: add bf backoff limit table
  support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -18,7 +18,7 @@
  9 files changed, 279 insertions(+), 55 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
-index 1c8328d..a626f7c 100644
+index 1c8328d5..a626f7cf 100644
 --- a/debugfs.c
 +++ b/debugfs.c
 @@ -95,9 +95,9 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
@@ -34,7 +34,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_seq_puts_array);
 diff --git a/eeprom.c b/eeprom.c
-index 9d029c0..4213e44 100644
+index 9d029c04..4213e444 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -336,9 +336,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
@@ -121,10 +121,10 @@
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
  
 diff --git a/mt76.h b/mt76.h
-index 412ef33..781be50 100644
+index 48e98a3a..5c267154 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1084,6 +1084,14 @@ struct mt76_power_limits {
+@@ -1089,6 +1089,14 @@ struct mt76_power_limits {
  	s8 mcs[4][10];
  	s8 ru[7][12];
  	s8 eht[16][16];
@@ -140,7 +140,7 @@
  
  struct mt76_ethtool_worker_info {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 40a126f..c7002ee 100644
+index 40a126fa..c7002ee0 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1019,7 +1019,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -252,7 +252,7 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 9613e1d..9d05d12 100644
+index 83748da6..33e030f5 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -284,6 +284,8 @@ static void __mt7915_init_txpower(struct mt7915_phy *phy,
@@ -277,7 +277,7 @@
  		target_power = DIV_ROUND_UP(target_power, 2);
  		chan->max_power = min_t(int, chan->max_reg_power,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3f07183..6192c20 100644
+index 9fafa162..da7a87bf 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,11 +73,7 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -294,10 +294,10 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0694c9a..3e41abd 100644
+index 12622068..eb7638b5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3405,7 +3405,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3422,7 +3422,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	int ret;
  	s8 txpower_sku[MT7915_SKU_RATE_NUM];
  
@@ -307,7 +307,7 @@
  	if (ret)
  		return ret;
  
-@@ -3445,53 +3446,139 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3462,53 +3463,139 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  				 sizeof(req), true);
  }
  
@@ -474,7 +474,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3500,10 +3587,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3517,10 +3604,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -486,7 +486,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3513,9 +3599,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3530,9 +3616,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -505,7 +505,7 @@
  
  	dev_kfree_skb(skb);
  
-@@ -3544,7 +3636,7 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+@@ -3561,7 +3653,7 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  				 sizeof(req), false);
  }
  
@@ -514,7 +514,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct mt7915_sku {
-@@ -3555,10 +3647,24 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3572,10 +3664,24 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_ENABLE,
  		.band_idx = phy->mt76->band_idx,
@@ -542,7 +542,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1b0bd06..94eff26 100644
+index 1b0bd06b..94eff268 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -517,12 +517,18 @@ enum {
@@ -565,7 +565,7 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a74a4eb..bb4ef00 100644
+index 1e5cd941..826682be 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -72,6 +72,7 @@
@@ -586,7 +586,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -612,9 +616,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -626,9 +630,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
diff --git a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch b/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
rename to recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
index cffb3bc..ec91527 100644
--- a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
@@ -1,7 +1,7 @@
-From 4beaa0cd97bf405c0101f1410656f2641a802cad Mon Sep 17 00:00:00 2001
+From 976d5b10d0ce0c450117994c27d8aa17cf4b8e61 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH 1026/1048] wifi: mt76: mt7915: amsdu set and get control
+Subject: [PATCH 1023/1051] wifi: mt76: mt7915: amsdu set and get control
 
 ---
  mt7915/mac.c    |  7 +++++++
@@ -11,10 +11,10 @@
  4 files changed, 50 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 37183ca..f214bca 100644
+index d94a0d55..1e39ad25 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -2029,6 +2029,13 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+@@ -2035,6 +2035,13 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
  	spin_unlock_bh(&phy->stats_lock);
  }
  
@@ -29,10 +29,10 @@
  void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index bb4ef00..36b583e 100644
+index 826682be..fe7c2114 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -744,6 +744,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -758,6 +758,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -41,7 +41,7 @@
  void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index a21cbce..e25a0ce 100644
+index a21cbce2..e25a0ce4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -31,10 +31,16 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -105,7 +105,7 @@
  		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 876edf3..7c4e914 100644
+index 876edf34..7c4e9148 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -75,6 +75,7 @@ enum mtk_vendor_attr_wireless_ctrl {
diff --git a/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch b/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
rename to recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
index 48216fc..e17d6d0 100644
--- a/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
@@ -1,7 +1,7 @@
-From ca2ec1ed8d8a31e897518a8225f3efb298bc102d Mon Sep 17 00:00:00 2001
+From 5f1ee41ad1ddfd6077d53031c8fa2705b403045a Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 14:32:08 +0800
-Subject: [PATCH 1027/1048] wifi: mt76: mt7915: Add vendor command attribute
+Subject: [PATCH 1024/1051] wifi: mt76: mt7915: Add vendor command attribute
  for RTS BW signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -13,10 +13,10 @@
  4 files changed, 20 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3e41abd..6a3ffe8 100644
+index eb7638b5..8e9b801d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4852,6 +4852,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
+@@ -4863,6 +4863,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
  		req.cert.length = cpu_to_le16(tlv_len);
  		req.cert.cert_program = type;
  		break;
@@ -30,7 +30,7 @@
  		tlv_len = sizeof(struct three_wire_cfg);
  		req.three_wire.tag = cpu_to_le16(cfg_info);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 94eff26..6ebcce0 100644
+index 94eff268..6ebcce0d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -936,6 +936,13 @@ struct three_wire_cfg {
@@ -62,7 +62,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index e25a0ce..8370216 100644
+index e25a0ce4..8370216f 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -84,7 +84,7 @@
  
  	return 0;
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 7c4e914..3672420 100644
+index 7c4e9148..3672420c 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -77,6 +77,7 @@ enum mtk_vendor_attr_wireless_ctrl {
diff --git a/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
rename to recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
index 0585a08..867f9e9 100644
--- a/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
@@ -1,7 +1,7 @@
-From a7ddef79ef2ae20ebb5a590cf7f5b33a4a0c6096 Mon Sep 17 00:00:00 2001
+From 31c27f15252ce23f0c1ce1e258b42e9eaf6fb245 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Thu, 26 Jan 2023 08:50:47 +0800
-Subject: [PATCH 1028/1048] wifi: mt76: mt7915: add vendor cmd to get available
+Subject: [PATCH 1025/1051] wifi: mt76: mt7915: add vendor cmd to get available
  color bitmap
 
 Add a vendor cmd to notify user space available color bitmap.
@@ -14,7 +14,7 @@
  2 files changed, 48 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 8370216..9a26f7f 100644
+index 8370216f..9a26f7f4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -99,6 +99,11 @@ ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
@@ -76,7 +76,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 3672420..bd1c617 100644
+index 3672420c..bd1c6170 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -15,6 +15,7 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
rename to recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
index 3e20e1a..8883b56 100644
--- a/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
@@ -1,7 +1,7 @@
-From 438b482b41ab41e0dc2e5bdf9843af8c0bbb0f4d Mon Sep 17 00:00:00 2001
+From 145642daca06798b99e849ae6c8781b95bbb7bde Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Feb 2023 16:29:42 +0800
-Subject: [PATCH 1029/1048] wifi: mt76: mt7915: disable SW-ACI by default
+Subject: [PATCH 1026/1051] wifi: mt76: mt7915: disable SW-ACI by default
 
 Support to enable/disable SW-ACI by module parameter "sw_aci_enable".
 SW-ACI feature is disable by default.
@@ -13,7 +13,7 @@
  4 files changed, 29 insertions(+), 9 deletions(-)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 6192c20..acb4f44 100644
+index da7a87bf..69c4a41d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -8,6 +8,10 @@
@@ -39,10 +39,10 @@
  
  	if (phy != &dev->phy) {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6a3ffe8..0401637 100644
+index 8e9b801d..45b09072 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5212,3 +5212,18 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
+@@ -5223,3 +5223,18 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
  
  	return 0;
  }
@@ -62,10 +62,10 @@
 +				 sizeof(req), NULL);
 +}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 36b583e..1910060 100644
+index fe7c2114..44dd0f41 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -768,6 +768,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -782,6 +782,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
@@ -74,10 +74,10 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 2e1a145..629b2ac 100644
+index e8296476..2953eb58 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3766,16 +3766,12 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -3773,16 +3773,12 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  static int
  mt7915_sw_aci_set(void *data, u64 val)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch b/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
rename to recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
index ca2c6d7..3e07882 100644
--- a/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
@@ -1,7 +1,7 @@
-From d0b8ce415cacbc2aed254d5a0d86adfe0381ad0b Mon Sep 17 00:00:00 2001
+From c0062791f1191e1f1772d85fb2accd3fc13ea4fd Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 27 Apr 2023 15:37:33 +0800
-Subject: [PATCH 1030/1048] wifi: mt76: mt7915: add muru user number debug
+Subject: [PATCH 1027/1051] wifi: mt76: mt7915: add muru user number debug
  command
 
 ---
@@ -11,10 +11,10 @@
  3 files changed, 17 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1910060..34a671f 100644
+index 44dd0f41..e5a201c9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -631,6 +631,7 @@ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
+@@ -645,6 +645,7 @@ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
  int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
  			    const struct mt7915_dfs_pattern *pattern);
  int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val);
@@ -23,7 +23,7 @@
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy);
  int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 9a26f7f..432d750 100644
+index 9a26f7f4..432d7506 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -46,6 +46,8 @@ static const struct nla_policy
@@ -65,7 +65,7 @@
  
  	return 0;
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index bd1c617..03d1660 100644
+index bd1c6170..03d1660c 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -103,6 +103,8 @@ enum mtk_vendor_attr_mu_ctrl {
diff --git a/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch b/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
rename to recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
index a0aedcc..17a9df6 100644
--- a/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch
@@ -1,7 +1,7 @@
-From c741601223d1f5f27371ecbf2497d76b0465f1cc Mon Sep 17 00:00:00 2001
+From 85b74a49351465649530d874aacbd851c8a43a79 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 22 May 2023 15:30:21 +0800
-Subject: [PATCH 1031/1048] wifi: mt76: mt7915: add debugfs for fw coredump.
+Subject: [PATCH 1028/1051] wifi: mt76: mt7915: add debugfs for fw coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 58 insertions(+), 9 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index c7002ee..4c48b19 100644
+index c7002ee0..4c48b197 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -82,8 +82,10 @@ mt7915_sys_recovery_set(struct file *file, const char __user *user_buf,
@@ -67,10 +67,10 @@
  	/* SER statistics */
  	desc += scnprintf(buff + desc, bufsz - desc,
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f214bca..e775f61 100644
+index 1e39ad25..14367fd7 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1722,10 +1722,34 @@ void mt7915_mac_dump_work(struct work_struct *work)
+@@ -1728,10 +1728,34 @@ void mt7915_mac_dump_work(struct work_struct *work)
  
  	dev = container_of(work, struct mt7915_dev, dump_work);
  
@@ -107,7 +107,7 @@
  }
  
  void mt7915_reset(struct mt7915_dev *dev)
-@@ -1744,7 +1768,7 @@ void mt7915_reset(struct mt7915_dev *dev)
+@@ -1750,7 +1774,7 @@ void mt7915_reset(struct mt7915_dev *dev)
  			 wiphy_name(dev->mt76.hw->wiphy));
  
  		mt7915_irq_disable(dev, MT_INT_MCU_CMD);
@@ -117,7 +117,7 @@
  	}
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 6ebcce0..035ad97 100644
+index 6ebcce0d..035ad97d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -760,8 +760,12 @@ enum {
@@ -135,7 +135,7 @@
  	SER_ENABLE = 2,
  	SER_RECOVER
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 34a671f..e21a7a6 100644
+index e5a201c9..ea91611d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -91,6 +91,13 @@ struct mt7915_sta;
@@ -152,7 +152,7 @@
  enum mt7915_txq_id {
  	MT7915_TXQ_FWDL = 16,
  	MT7915_TXQ_MCU_WM,
-@@ -379,6 +386,7 @@ struct mt7915_dev {
+@@ -387,6 +394,7 @@ struct mt7915_dev {
  
  	/* protects coredump data */
  	struct mutex dump_mutex;
@@ -160,7 +160,7 @@
  #ifdef CONFIG_DEV_COREDUMP
  	struct {
  		struct mt7915_crash_data *crash_data[__MT76_RAM_TYPE_MAX];
-@@ -569,6 +577,7 @@ int mt7915_txbf_init(struct mt7915_dev *dev);
+@@ -583,6 +591,7 @@ int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
  int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en);
  void mt7915_reset(struct mt7915_dev *dev);
diff --git a/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch b/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-remove-BW160-support.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-remove-BW160-support.patch
index 679446b..2f38f7b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-remove-BW160-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-remove-BW160-support.patch
@@ -1,7 +1,7 @@
-From 89645512f06c5bf9be13f774acda12341f22784c Mon Sep 17 00:00:00 2001
+From 80138d89e617eefcd40c22fc9cc47c35e65409b5 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 24 May 2023 22:35:54 +0800
-Subject: [PATCH 1032/1048] wifi: mt76: mt7915: remove BW160 support
+Subject: [PATCH 1029/1051] wifi: mt76: mt7915: remove BW160 support
 
 Remove BW160 capability in mt7915.
 ---
@@ -9,7 +9,7 @@
  1 file changed, 6 insertions(+), 20 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 9d05d12..5a3a61c 100644
+index 33e030f5..5764e0c0 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -439,11 +439,6 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
@@ -41,7 +41,7 @@
  
  #ifdef CONFIG_MAC80211_MESH
  	if (vif == NL80211_IFTYPE_MESH_POINT)
-@@ -985,15 +976,10 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -989,15 +980,10 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  	int i, idx = 0, nss = hweight8(phy->mt76->antenna_mask);
  	u16 mcs_map = 0;
  	u16 mcs_map_160 = 0;
diff --git a/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
index d1e5d8d..8c716f1 100644
--- a/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-txpower-info-dump-support.patch
@@ -1,7 +1,7 @@
-From 22e5c44a754b22649a56616f932a8dbf3242ec54 Mon Sep 17 00:00:00 2001
+From 270d9e1edd8d2627612d3deaf59c6a630592fb46 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 11 Jul 2023 17:06:04 +0800
-Subject: [PATCH 1033/1048] wifi: mt76: mt7915: add txpower info dump support
+Subject: [PATCH 1030/1051] wifi: mt76: mt7915: add txpower info dump support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -11,7 +11,7 @@
  3 files changed, 91 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 4c48b19..86cbef3 100644
+index 4c48b197..86cbef33 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1258,6 +1258,91 @@ mt7915_txpower_path_show(struct seq_file *file, void *data)
@@ -116,10 +116,10 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0401637..609eb5b 100644
+index 45b09072..b9beb4f6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3607,6 +3607,8 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
+@@ -3624,6 +3624,8 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
  			txpower[i] = res[i][req.band_idx];
  	} else if (category == TX_POWER_INFO_PATH) {
  		memcpy(txpower, skb->data + 4, len);
@@ -129,7 +129,7 @@
  
  	dev_kfree_skb(skb);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 035ad97..3089fb6 100644
+index 035ad97d..3089fb64 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -525,7 +525,8 @@ enum {
diff --git a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch b/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
rename to recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
index 0b5953c..39a7cdf 100644
--- a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch
@@ -1,7 +1,7 @@
-From cacd1e6028a0446d400666fc92c982ebe3794c3e Mon Sep 17 00:00:00 2001
+From 517ac9b79c668a68109f1c3d861a6506dd59b3c7 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Fri, 23 Jun 2023 06:06:21 +0800
-Subject: [PATCH 1034/1048] wifi: mt76: mt7915: report tx and rx byte to
+Subject: [PATCH 1031/1051] wifi: mt76: mt7915: report tx and rx byte to
  tpt_led when wed is enabled
 
 Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
@@ -11,7 +11,7 @@
  2 files changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 630c640..949df63 100644
+index 630c6402..949df63f 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -597,9 +597,15 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
@@ -42,7 +42,7 @@
  			sband = &mphy->sband_5g.sband;
  		else if (mphy->chandef.chan->band == NL80211_BAND_6GHZ)
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index ddf1b72..437a9b0 100644
+index ddf1b72a..437a9b0e 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -588,6 +588,7 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
diff --git a/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch b/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
rename to recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
index c5c7c7c..4c5fc6b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch
@@ -1,14 +1,14 @@
-From 050c56f749c6830eaf496d1016017296b0ef415e Mon Sep 17 00:00:00 2001
+From 868e63b60b3be248445e53c3301a7de74bfbcf49 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 8 Aug 2023 11:20:58 +0800
-Subject: [PATCH 1035/1048] wifi: mt76: mt7915: Establish BA in VO queue
+Subject: [PATCH 1032/1051] wifi: mt76: mt7915: Establish BA in VO queue
 
 ---
  mt76_connac_mac.c | 2 --
  1 file changed, 2 deletions(-)
 
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 949df63..d036047 100644
+index 949df63f..d036047a 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -1115,8 +1115,6 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
diff --git a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch b/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
rename to recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
index b7b8d9e..18cea8b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
@@ -1,7 +1,7 @@
-From cd794505e5448ab747d6e915a6fc756c52c237b7 Mon Sep 17 00:00:00 2001
+From 9eefd073f680ff53160851a22e2ed4b9551bd60b Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Fri, 11 Aug 2023 16:46:53 +0800
-Subject: [PATCH 1036/1048] wifi: mt76: mt7915: Disable RegDB when enable
+Subject: [PATCH 1033/1051] wifi: mt76: mt7915: Disable RegDB when enable
  single sku
 
 ---
@@ -11,7 +11,7 @@
  3 files changed, 57 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 86cbef3..ead0f98 100644
+index 86cbef33..ead0f985 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1019,10 +1019,16 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -103,7 +103,7 @@
  	return ret;
  }
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 5a3a61c..cdcf63e 100644
+index 5764e0c0..e90e8d8c 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -283,9 +283,11 @@ static void __mt7915_init_txpower(struct mt7915_phy *phy,
@@ -135,10 +135,10 @@
  	}
  }
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 1f1f8b9..3c2fd2d 100644
+index 4d05e391..ca355d14 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -1213,6 +1213,10 @@ enum offs_rev {
+@@ -1215,6 +1215,10 @@ enum offs_rev {
  #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
  #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
  
@@ -149,7 +149,7 @@
  #define MT_WF_IPI_RESET			0x831a3008
  
  /* PHY */
-@@ -1229,10 +1233,6 @@ enum offs_rev {
+@@ -1231,10 +1235,6 @@ enum offs_rev {
  #define MT_WF_PHY_RXTD12_IRPI_SW_CLR_ONLY	BIT(18)
  #define MT_WF_PHY_RXTD12_IRPI_SW_CLR		BIT(29)
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch b/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
rename to recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
index 7e41ba3..6ffdcf1 100644
--- a/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
@@ -1,7 +1,7 @@
-From 08574495af80035ea6e68da0432538be348cc566 Mon Sep 17 00:00:00 2001
+From 933737c44366ec6ffc39e6dabe5da2057b6a9e78 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Thu, 24 Aug 2023 03:01:27 +0800
-Subject: [PATCH 1037/1048] wifi: mt76: mt7915: enable the mac80211 hw bmc ps
+Subject: [PATCH 1034/1051] wifi: mt76: mt7915: enable the mac80211 hw bmc ps
  buffer function.
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index cdcf63e..247d552 100644
+index e90e8d8c..88b914e4 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -413,6 +413,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
diff --git a/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-update-debugfs-knob-for-tx-tokens.patch b/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-update-debugfs-knob-for-tx-tokens.patch
new file mode 100644
index 0000000..8f37b00
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1035-wifi-mt76-update-debugfs-knob-for-tx-tokens.patch
@@ -0,0 +1,84 @@
+From cd98785cf20f1cd99ae5bcb84915171fd8323f64 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Thu, 24 Aug 2023 03:01:27 +0800
+Subject: [PATCH 1035/1051] wifi: mt76: update debugfs knob for tx tokens
+
+1. dump token pending time
+2. dump per-band token counts
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt76.h               |  1 +
+ mt7915/mac.c         |  2 ++
+ mt7915/mtk_debugfs.c | 24 +++++++++++++++++++-----
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index 5c267154..6f78c07c 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -403,6 +403,7 @@ struct mt76_txwi_cache {
+ 	dma_addr_t dma_addr;
+ 
+ 	u8 phy_idx;
++	unsigned long jiffies;
+ 
+ 	union {
+ 		struct sk_buff *skb;
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 14367fd7..71b4e2d7 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -811,6 +811,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	if (id < 0)
+ 		return id;
+ 
++	t->jiffies = jiffies;
++
+ 	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
+ 	mt7915_mac_write_txwi(mdev, txwi_ptr, tx_info->skb, wcid, pid, key,
+ 			      qid, 0);
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 2953eb58..e7be3d6c 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2203,17 +2203,31 @@ static int mt7915_mibinfo_band1(struct seq_file *s, void *data)
+ static int mt7915_token_read(struct seq_file *s, void *data)
+ {
+ 	struct mt7915_dev *dev = dev_get_drvdata(s->private);
+-	int id, count = 0;
++	struct mt76_dev *mdev = &dev->mt76;
++	int id, i;
+ 	struct mt76_txwi_cache *txwi;
+ 
+ 	seq_printf(s, "Cut through token:\n");
+ 	spin_lock_bh(&dev->mt76.token_lock);
+ 	idr_for_each_entry(&dev->mt76.token, txwi, id) {
+-		seq_printf(s, "%4d ", id);
+-		count++;
+-		if (count % 8 == 0)
+-			seq_printf(s, "\n");
++		seq_printf(s, "%4d (token pending %u ms)\n", id,
++			   jiffies_to_msecs(jiffies - txwi->jiffies));
++	}
++
++	if (!dev->dbdc_support)
++		goto out;
++
++	for (i = 0; i < MT_BAND2; i++) {
++		struct mt76_phy *mphy = mdev->phys[i];
++
++		if (!mphy)
++			continue;
++
++		seq_printf(s, "Band%d consume: %d, free:%d total: %d\n",
++			   i, mphy->tokens, mdev->token_threshold - mphy->tokens,
++			   mdev->token_threshold);
+ 	}
++out:
+ 	spin_unlock_bh(&dev->mt76.token_lock);
+ 	seq_printf(s, "\n");
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
similarity index 81%
rename from recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
rename to recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
index 7404dae..df8255f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch
@@ -1,7 +1,7 @@
-From 725c52a07bd4b79ad25be2d63c83277da15b6cc7 Mon Sep 17 00:00:00 2001
+From b27e931f19dd74515c6082b494d263becc852377 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 5 Sep 2023 20:17:19 +0800
-Subject: [PATCH 1039/1048] wifi: mt76: mt7915: support enable/disable spatial
+Subject: [PATCH 1036/1051] wifi: mt76: mt7915: support enable/disable spatial
  reuse through debugfs
 
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
@@ -12,10 +12,10 @@
  3 files changed, 14 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 609eb5b..1eb19ba 100644
+index b9beb4f6..4b5fb53a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3739,8 +3739,7 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+@@ -3756,8 +3756,7 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  				 sizeof(req), true);
  }
  
@@ -26,10 +26,10 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct mt7915_mcu_sr_ctrl req = {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e21a7a6..ffc2e0b 100644
+index ea91611d..bfd87bc3 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -781,6 +781,7 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
+@@ -795,6 +795,7 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
  int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val);
  int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
@@ -38,10 +38,10 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 594989f..e706f64 100644
+index e7be3d6c..6405aa32 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3776,6 +3776,17 @@ mt7915_sw_aci_set(void *data, u64 val)
+@@ -3799,6 +3799,17 @@ mt7915_sw_aci_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_sw_aci, NULL,
  			 mt7915_sw_aci_set, "%llx\n");
  
@@ -59,7 +59,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3866,6 +3877,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3889,6 +3900,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  				    mt7915_show_eeprom_mode);
  	debugfs_create_file("sw_aci", 0600, dir, dev,
  			    &fops_sw_aci);
diff --git a/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch b/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
similarity index 75%
rename from recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
rename to recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
index 7930078..01c2d7b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1037-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch
@@ -1,7 +1,7 @@
-From bc7b5c61e1793abba3ef32261fc56f3b2d9885ce Mon Sep 17 00:00:00 2001
+From 0e186daaf7fef0650ca64a7d8e58498cae5c929b Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 11 Sep 2023 17:11:24 +0800
-Subject: [PATCH 1040/1048] wifi: mt76: mt7915: add debug log for SER flow.
+Subject: [PATCH 1037/1051] wifi: mt76: mt7915: add debug log for SER flow.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 9 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e1ecefe..4b2c957 100644
+index 71b4e2d7..b0ddb106 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1570,6 +1570,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1572,6 +1572,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -22,7 +22,7 @@
  	ieee80211_stop_queues(mt76_hw(dev));
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
-@@ -1645,6 +1648,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1647,6 +1650,9 @@ void mt7915_mac_reset_work(struct work_struct *work)
  		ieee80211_queue_delayed_work(ext_phy->hw,
  					     &phy2->mt76->mac_work,
  					     MT7915_WATCHDOG_TIME);
@@ -32,7 +32,7 @@
  }
  
  /* firmware coredump */
-@@ -1760,6 +1766,9 @@ void mt7915_coredump(struct mt7915_dev *dev, u8 state)
+@@ -1762,6 +1768,9 @@ void mt7915_coredump(struct mt7915_dev *dev, u8 state)
  
  void mt7915_reset(struct mt7915_dev *dev)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch b/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
similarity index 76%
rename from recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
rename to recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
index b7f3425..54b094e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch
@@ -1,7 +1,7 @@
-From 6c4e275e886f41bb06fe0f49fcbe3343f0660abd Mon Sep 17 00:00:00 2001
+From 84313ebde8920d6c6f2e2ecce133acd8b7b13805 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 20 Sep 2023 11:10:57 +0800
-Subject: [PATCH 1041/1048] wifi: mt76: mt7915: add additional chain signal
+Subject: [PATCH 1038/1051] wifi: mt76: mt7915: add additional chain signal
  info to station dump
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 4b2c957..1691e6d 100644
+index b0ddb106..9a49375c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -435,7 +435,7 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -442,7 +442,7 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  		if (v0 & MT_PRXV_HT_AD_CODE)
  			status->enc_flags |= RX_ENC_FLAG_LDPC;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch b/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch
deleted file mode 100644
index 7586a2a..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From d214b1fa6a20455d911bbaecd13292d2a6774d27 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Tue, 29 Aug 2023 09:22:18 +0800
-Subject: [PATCH 1038/1048] wifi: mt76: update debugfs knob to dump token
- pending time
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt76.h               | 2 ++
- mt7915/mac.c         | 6 ++++++
- mt7915/mtk_debugfs.c | 6 ++----
- 3 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index 781be50..aed47c8 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -402,6 +402,8 @@ struct mt76_txwi_cache {
- 	struct list_head list;
- 	dma_addr_t dma_addr;
- 
-+	unsigned long jiffies;
-+
- 	union {
- 		struct sk_buff *skb;
- 		void *ptr;
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e775f61..e1ecefe 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -803,6 +803,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	if (id < 0)
- 		return id;
- 
-+	t->jiffies = jiffies;
-+
- 	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
- 	mt7915_mac_write_txwi(mdev, txwi_ptr, tx_info->skb, wcid, pid, key,
- 			      qid, 0);
-@@ -1001,6 +1003,8 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
- 			if (!txwi)
- 				continue;
- 
-+			txwi->jiffies = 0;
-+
- 			mt76_connac2_txwi_free(mdev, txwi, sta, &free_list);
- 		}
- 	}
-@@ -1033,6 +1037,8 @@ mt7915_mac_tx_free_v0(struct mt7915_dev *dev, void *data, int len)
- 		if (!txwi)
- 			continue;
- 
-+		txwi->jiffies = 0;
-+
- 		mt76_connac2_txwi_free(mdev, txwi, NULL, &free_list);
- 	}
- 
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 629b2ac..594989f 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -2209,10 +2209,8 @@ static int mt7915_token_read(struct seq_file *s, void *data)
- 	seq_printf(s, "Cut through token:\n");
- 	spin_lock_bh(&dev->mt76.token_lock);
- 	idr_for_each_entry(&dev->mt76.token, txwi, id) {
--		seq_printf(s, "%4d ", id);
--		count++;
--		if (count % 8 == 0)
--			seq_printf(s, "\n");
-+		seq_printf(s, "%4d (token pending %u ms)\n", id,
-+			   jiffies_to_msecs(jiffies - txwi->jiffies));
- 	}
- 	spin_unlock_bh(&dev->mt76.token_lock);
- 	seq_printf(s, "\n");
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch b/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch
rename to recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch
index 9f44506..fa84a97 100644
--- a/recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1039-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch
@@ -1,7 +1,7 @@
-From 186c70f993d72481e3b1e20379f389291f455d56 Mon Sep 17 00:00:00 2001
+From aaa3ac581bed0ed0cca6b6e219a4f75125de563b Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 2 Oct 2023 14:00:13 +0800
-Subject: [PATCH 1042/1048] wifi: mt76: mt7915: add debuffs knob for protect
+Subject: [PATCH 1039/1051] wifi: mt76: mt7915: add debuffs knob for protect
  threshold
 
 ---
@@ -10,10 +10,10 @@
  2 files changed, 12 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ffc2e0b..f3d9ee5 100644
+index bfd87bc3..1b43c548 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -761,6 +761,7 @@ void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
+@@ -775,6 +775,7 @@ void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
  		       struct ieee80211_vif *vif, struct ieee80211_sta *sta);
  int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig_type);
  int mt7915_mcu_set_mu_dl_ack_policy(struct mt7915_phy *phy, u8 policy_num);
@@ -22,10 +22,10 @@
  void mt7915_mcu_set_nusers_ofdma(struct mt7915_phy *phy, u8 type, u8 ofdma_user_cnt);
  void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e706f64..3802de8 100644
+index 6405aa32..59d89b60 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2836,6 +2836,16 @@ static int mt7915_sta_tx_amsdu_set(void *data, u64 tx_amsdu)
+@@ -2852,6 +2852,16 @@ static int mt7915_sta_tx_amsdu_set(void *data, u64 tx_amsdu)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_tx_amsdu, NULL,
  			 mt7915_sta_tx_amsdu_set, "%llx\n");
  
@@ -42,7 +42,7 @@
  static int mt7915_red_enable_set(void *data, u64 en)
  {
  	struct mt7915_dev *dev = data;
-@@ -3856,6 +3866,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3879,6 +3889,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_wm_info", dir,
  				    mt7915_fw_wm_info_read);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch b/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch
similarity index 80%
rename from recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch
index 7238522..ca81739 100644
--- a/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1040-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch
@@ -1,7 +1,7 @@
-From 2d4f946641ceeac9fa1bd7d23124e590bec8233d Mon Sep 17 00:00:00 2001
+From c13b516a10be9e859fb5335324f3792020a5cc23 Mon Sep 17 00:00:00 2001
 From: "Henry.Yen" <henry.yen@mediatek.com>
 Date: Mon, 11 Dec 2023 16:01:55 +0800
-Subject: [PATCH 1044/1048] wifi: mt76: mt7915 add mt7981 efuse variants
+Subject: [PATCH 1040/1051] wifi: mt76: mt7915 add mt7981 efuse variants
  support
 
 ---
@@ -10,10 +10,10 @@
  2 files changed, 28 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 96b1ea3..79d6fe9 100644
+index 6133c200..df5e396c 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -179,6 +179,21 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -193,6 +193,21 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  	return mt7915_check_eeprom(dev);
  }
  
@@ -35,7 +35,7 @@
  static void mt7915_eeprom_parse_band_config(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -229,6 +244,13 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+@@ -243,6 +258,13 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  	u8 path, nss, nss_max = 4, *eeprom = dev->mt76.eeprom.data;
  	struct mt76_phy *mphy = phy->mt76;
  	u8 band = phy->mt76->band_idx;
@@ -50,10 +50,10 @@
  	mt7915_eeprom_parse_band_config(phy);
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f3d9ee5..45e04af 100644
+index 1b43c548..c6150c8a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -399,6 +399,7 @@ struct mt7915_dev {
+@@ -407,6 +407,7 @@ struct mt7915_dev {
  
  	u32 hw_pattern;
  
@@ -61,7 +61,7 @@
  	bool dbdc_support;
  	bool flash_mode;
  	bool bin_file_mode;
-@@ -667,7 +668,11 @@ void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
+@@ -681,7 +682,11 @@ void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-support-scs-feature.patch b/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-support-scs-feature.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-support-scs-feature.patch
rename to recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-support-scs-feature.patch
index 550a3f3..f446132 100644
--- a/recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-support-scs-feature.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1041-wifi-mt76-mt7915-support-scs-feature.patch
@@ -1,7 +1,7 @@
-From fd47d976d0dc1c2bc11bfabcb6f7c7a6920a46be Mon Sep 17 00:00:00 2001
+From 08084eaccb5811f27a979c8c44cd3321c69f1829 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Wed, 6 Dec 2023 08:53:03 +0800
-Subject: [PATCH 1045/1048] wifi: mt76: mt7915: support scs feature
+Subject: [PATCH 1041/1051] wifi: mt76: mt7915: support scs feature
 
 Add support scs feature for connac2 codebase. This commit includes three
 parts.
@@ -29,7 +29,7 @@
  9 files changed, 188 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index aed47c8..1aa266f 100644
+index 6f78c07c..c011812e 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -311,6 +311,7 @@ struct mt76_sta_stats {
@@ -49,7 +49,7 @@
  
  enum mt76_wcid_flags {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 1265401..5be93f6 100644
+index 12654017..5be93f6a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1228,6 +1228,7 @@ enum {
@@ -61,10 +61,10 @@
  	MCU_EXT_CMD_FW_DBG_CTRL = 0x95,
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 247d552..1a41282 100644
+index 88b914e4..84b183f7 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1243,6 +1243,7 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1247,6 +1247,7 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	spin_lock_init(&dev->phy.stats_lock);
  	INIT_WORK(&dev->rc_work, mt7915_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7915_mac_work);
@@ -73,10 +73,10 @@
  	INIT_LIST_HEAD(&dev->twt_list);
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 1691e6d..db25b2f 100644
+index 9a49375c..2e4a8f84 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1502,6 +1502,8 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
+@@ -1504,6 +1504,8 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
  	if (ext_phy)
  		cancel_delayed_work_sync(&ext_phy->mac_work);
  
@@ -85,7 +85,7 @@
  	mutex_lock(&dev->mt76.mutex);
  	for (i = 0; i < 10; i++) {
  		if (!mt7915_mac_restart(dev))
-@@ -1527,6 +1529,10 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
+@@ -1529,6 +1531,10 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
  		ieee80211_queue_delayed_work(ext_phy->hw,
  					     &ext_phy->mac_work,
  					     MT7915_WATCHDOG_TIME);
@@ -96,7 +96,7 @@
  }
  
  /* system error recovery */
-@@ -1585,6 +1591,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1587,6 +1593,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
  		set_bit(MT76_RESET, &phy2->mt76->state);
  		cancel_delayed_work_sync(&phy2->mt76->mac_work);
  	}
@@ -104,7 +104,7 @@
  	mt76_worker_disable(&dev->mt76.tx_worker);
  	mt76_for_each_q_rx(&dev->mt76, i)
  		napi_disable(&dev->mt76.napi[i]);
-@@ -1649,6 +1656,10 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1651,6 +1658,10 @@ void mt7915_mac_reset_work(struct work_struct *work)
  					     &phy2->mt76->mac_work,
  					     MT7915_WATCHDOG_TIME);
  
@@ -116,7 +116,7 @@
  		 wiphy_name(dev->mt76.hw->wiphy));
  }
 diff --git a/mt7915/main.c b/mt7915/main.c
-index acb4f44..5316225 100644
+index 69c4a41d..69fcf4c0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -89,12 +89,24 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -153,10 +153,10 @@
  		mt7915_mcu_set_mac(dev, dev->phy.mt76->band_idx, false, false);
  	}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6cee6b6..5672e44 100644
+index 4b5fb53a..5e1fd3be 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5245,3 +5245,121 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val)
+@@ -5239,3 +5239,121 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SWLNA_ACI_CTRL), &req,
  				 sizeof(req), NULL);
  }
@@ -279,7 +279,7 @@
 +		ieee80211_queue_delayed_work(mt76_hw(dev), &dev->scs_work, HZ);
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 3089fb6..742a785 100644
+index 3089fb64..742a7855 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -1200,4 +1200,8 @@ struct mt7915_mcu_edcca_info {
@@ -292,7 +292,7 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 45e04af..05a3bd5 100644
+index c6150c8a..3c049364 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -270,6 +270,15 @@ struct mt7915_air_monitor_ctrl {
@@ -318,17 +318,17 @@
 +	struct mt7915_scs_ctrl scs_ctrl;
  };
  
- struct mt7915_dev {
-@@ -463,6 +473,8 @@ struct mt7915_dev {
- 	const struct mt7915_dbg_reg_desc *dbg_reg;
+ #ifdef MTK_DEBUG
+@@ -476,6 +486,8 @@ struct mt7915_dev {
+ 	} adie[ADIE_MAX_CNT];
  #endif
  
 +	struct delayed_work scs_work;
 +
  	bool wmm_pbc_enable;
  	struct work_struct wmm_pbc_work;
- };
-@@ -788,6 +800,8 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val);
+ 	u32 adie_type;
+@@ -802,6 +814,8 @@ int mt7915_mcu_sw_aci_set(struct mt7915_dev *dev, bool val);
  int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  int mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val);
@@ -338,10 +338,10 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 3802de8..64e9d59 100644
+index 59d89b60..4210ecb8 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3797,6 +3797,29 @@ mt7915_sr_enable_set(void *data, u64 val)
+@@ -3820,6 +3820,29 @@ mt7915_sr_enable_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_sr_enable, NULL,
  			 mt7915_sr_enable_set, "%llx\n");
  
@@ -371,7 +371,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3889,6 +3912,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3912,6 +3935,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_file("sw_aci", 0600, dir, dev,
  			    &fops_sw_aci);
  	debugfs_create_file("sr_enable", 0200, dir, phy, &fops_sr_enable);
diff --git a/recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch b/recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
rename to recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
index 1a35c56..c28e05f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1042-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch
@@ -1,7 +1,7 @@
-From 290608dad38eb923465018470bb587153db96b8d Mon Sep 17 00:00:00 2001
+From 9ce78c0a20ff2448496bc7a670df617c7441c011 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 21 Dec 2023 20:35:36 +0800
-Subject: [PATCH 1046/1048] wifi: mt76: mt7915: support thermal recal debug
+Subject: [PATCH 1042/1051] wifi: mt76: mt7915: support thermal recal debug
  commnad
 
 Add thermal recal debug command:
@@ -21,7 +21,7 @@
  4 files changed, 35 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5be93f6..4e1006d 100644
+index 5be93f6a..4e1006db 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1224,6 +1224,7 @@ enum {
@@ -33,10 +33,10 @@
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
  	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5672e44..7e0e277 100644
+index 5e1fd3be..c5f60c07 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5363,3 +5363,18 @@ void mt7915_mcu_scs_sta_poll(struct work_struct *work)
+@@ -5357,3 +5357,18 @@ void mt7915_mcu_scs_sta_poll(struct work_struct *work)
  	if (scs_enable_flag)
  		ieee80211_queue_delayed_work(mt76_hw(dev), &dev->scs_work, HZ);
  }
@@ -56,10 +56,10 @@
 +				 sizeof(req), true);
 +}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 05a3bd5..38a9db4 100644
+index 3c049364..1b2f584f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -802,6 +802,7 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -816,6 +816,7 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  int mt7915_mcu_enable_obss_spr(struct mt7915_phy *phy, u8 action, u8 val);
  int mt7915_mcu_set_scs_en(struct mt7915_phy *phy, u8 enable);
  void mt7915_mcu_scs_sta_poll(struct work_struct *work);
@@ -68,10 +68,10 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 64e9d59..9da6328 100644
+index 4210ecb8..677266ee 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3820,6 +3820,22 @@ mt7915_scs_enable_set(void *data, u64 val)
+@@ -3843,6 +3843,22 @@ mt7915_scs_enable_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_scs_enable, NULL,
  			 mt7915_scs_enable_set, "%lld\n");
  
@@ -94,7 +94,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3913,6 +3929,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3936,6 +3952,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  			    &fops_sw_aci);
  	debugfs_create_file("sr_enable", 0200, dir, phy, &fops_sr_enable);
  	debugfs_create_file("scs_enable", 0200, dir, phy, &fops_scs_enable);
diff --git a/recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch b/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch
rename to recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch
index d965749..f6d5d7f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch
@@ -1,7 +1,7 @@
-From 14733d632430b788c7323b038bd679045a9dba95 Mon Sep 17 00:00:00 2001
+From 8025cf5bac9a977fc49c10896c8a8ab0daa83bec Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Fri, 15 Dec 2023 14:03:11 +0800
-Subject: [PATCH 1047/1048] wifi: mt76: mt7915: Add support for lpi and
+Subject: [PATCH 1043/1051] wifi: mt76: mt7915: Add support for lpi and
  duplicate mode
 
 Add support lpi and duplicate mode.
@@ -31,7 +31,7 @@
  12 files changed, 210 insertions(+), 17 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 4213e44..2ee262a 100644
+index 4213e444..2ee262a0 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -224,8 +224,9 @@ static bool mt76_string_prop_find(struct property *prop, const char *str)
@@ -95,10 +95,10 @@
  		return target_power;
  
 diff --git a/mt76.h b/mt76.h
-index 1aa266f..4291acd 100644
+index c011812e..b023f38d 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -852,6 +852,9 @@ struct mt76_phy {
+@@ -853,6 +853,9 @@ struct mt76_phy {
  	u8 macaddr[ETH_ALEN];
  
  	int txpower_cur;
@@ -108,7 +108,7 @@
  	u8 antenna_mask;
  	u16 chainmask;
  
-@@ -1740,7 +1743,7 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
+@@ -1744,7 +1747,7 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
  void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr, u32 clear, u32 set);
  
  struct device_node *
@@ -118,7 +118,7 @@
  mt76_find_channel_node(struct device_node *np, struct ieee80211_channel *chan);
  
 diff --git a/mt76_connac2_mac.h b/mt76_connac2_mac.h
-index 5f13211..c49a330 100644
+index 5f132115..c49a3300 100644
 --- a/mt76_connac2_mac.h
 +++ b/mt76_connac2_mac.h
 @@ -355,4 +355,11 @@ enum tx_port_idx {
@@ -134,7 +134,7 @@
 +
  #endif /* __MT76_CONNAC2_MAC_H */
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index d036047..d41f004 100644
+index d036047a..d41f0040 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -564,7 +564,8 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
@@ -159,7 +159,7 @@
  
  		txwi[7] &= ~cpu_to_le32(MT_TXD7_HW_AMSDU);
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4e1006d..e581084 100644
+index 4e1006db..e581084e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1249,6 +1249,7 @@ enum {
@@ -171,7 +171,7 @@
  
  enum {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index ead0f98..017d43d 100644
+index ead0f985..017d43d7 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1296,7 +1296,6 @@ mt7915_txpower_info_show(struct seq_file *file, void *data)
@@ -192,7 +192,7 @@
  
  out:
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 1a41282..32bbd6c 100644
+index 84b183f7..c052b927 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -287,7 +287,7 @@ static void __mt7915_init_txpower(struct mt7915_phy *phy,
@@ -217,7 +217,7 @@
  
  static void
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7e0e277..ba47d0d 100644
+index c5f60c07..e17c61d5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1522,7 +1522,8 @@ mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
@@ -353,10 +353,10 @@
  			      u8 en)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 38a9db4..23ee118 100644
+index 1b2f584f..ff08d252 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -793,6 +793,7 @@ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
+@@ -807,6 +807,7 @@ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
@@ -365,10 +365,10 @@
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9da6328..50e7b6c 100644
+index 677266ee..e7588434 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3922,6 +3922,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3945,6 +3945,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  			    &fops_txbf_sta_rec);
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
@@ -377,7 +377,7 @@
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 432d750..566fec0 100644
+index 432d7506..566fec01 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -106,6 +106,13 @@ bss_color_ctrl_policy[NUM_MTK_VENDOR_ATTRS_BSS_COLOR_CTRL] = {
@@ -477,7 +477,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 03d1660..5b8a1fb 100644
+index 03d1660c..5b8a1fb3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -16,6 +16,7 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-testmode-add-cheetah-support.patch b/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-testmode-add-cheetah-support.patch
deleted file mode 100644
index 992ee1d..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-testmode-add-cheetah-support.patch
+++ /dev/null
@@ -1,142 +0,0 @@
-From ceb70263bbea4b354207f9011670944b79868910 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Tue, 31 Oct 2023 16:29:13 +0800
-Subject: [PATCH 1043/1048] wifi: mt76: testmode: add cheetah support
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7915/eeprom.c   |  3 +--
- mt7915/eeprom.h   | 12 ++++++++++++
- mt7915/mcu.c      | 21 +++++++++++++++++++--
- mt7915/testmode.c |  9 +++++----
- 4 files changed, 37 insertions(+), 8 deletions(-)
-
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index e11ae5e..96b1ea3 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -40,8 +40,7 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
- 	if (!dev->flash_mode || !val)
- 		return 0;
- 
--	size = mt7915_get_cal_group_size(dev) +
--	       (is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2);
-+	size = mt7915_get_cal_group_size(dev) + mt7915_get_cal_dpd_size(dev);
- 
- 	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
- 	if (!dev->cal)
-diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index dd450aa..70fca0b 100644
---- a/mt7915/eeprom.h
-+++ b/mt7915/eeprom.h
-@@ -52,6 +52,7 @@ enum mt7915_eeprom_field {
- #define MT_EE_CAL_GROUP_SIZE_7916_6G		(94 * MT_EE_CAL_UNIT + 16)
- #define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
- #define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
-+#define MT_EE_CAL_DPD_SIZE_V2_7981		(102 * MT_EE_CAL_UNIT)	/* no 6g dpd data */
- 
- #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
- #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
-@@ -194,6 +195,17 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
- 	}
- }
- 
-+static inline u32
-+mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
-+{
-+	if (is_mt7915(&dev->mt76))
-+		return MT_EE_CAL_DPD_SIZE_V1;
-+	else if (is_mt7981(&dev->mt76))
-+		return MT_EE_CAL_DPD_SIZE_V2_7981;
-+	else
-+		return MT_EE_CAL_DPD_SIZE_V2;
-+}
-+
- extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
- 
- #endif
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1eb19ba..6cee6b6 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3129,13 +3129,30 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
- 		/* 5G BW160 */
- 		5250, 5570, 5815
- 	};
-+	const u16 freq_list_v2_7981[] = {
-+		/* 5G BW20 */
-+		5180, 5200, 5220, 5240,
-+		5260, 5280, 5300, 5320,
-+		5500, 5520, 5540, 5560,
-+		5580, 5600, 5620, 5640,
-+		5660, 5680, 5700, 5720,
-+		5745, 5765, 5785, 5805,
-+		5825, 5845, 5865, 5885,
-+		/* 5G BW160 */
-+		5250, 5570, 5815
-+	};
- 	const u16 *freq_list = freq_list_v1;
- 	int n_freqs = ARRAY_SIZE(freq_list_v1);
- 	int idx;
- 
- 	if (!is_mt7915(&dev->mt76)) {
--		freq_list = freq_list_v2;
--		n_freqs = ARRAY_SIZE(freq_list_v2);
-+		if (is_mt7981(&dev->mt76)) {
-+			freq_list = freq_list_v2_7981;
-+			n_freqs = ARRAY_SIZE(freq_list_v2_7981);
-+		} else {
-+			freq_list = freq_list_v2;
-+			n_freqs = ARRAY_SIZE(freq_list_v2);
-+		}
- 	}
- 
- 	if (freq < 4000) {
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index faf6014..ecd6271 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -2151,7 +2151,7 @@ mt7915_tm_group_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
- 	eeprom = mdev->eeprom.data;
- 	dev->cur_prek_offset = 0;
- 	group_size = mt7915_get_cal_group_size(dev);
--	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
-+	dpd_size = mt7915_get_cal_dpd_size(dev);
- 	size = group_size + dpd_size;
- 	offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
- 
-@@ -2233,11 +2233,11 @@ mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
- 	eeprom = mdev->eeprom.data;
- 	dev->cur_prek_offset = 0;
- 	group_size = mt7915_get_cal_group_size(dev);
-+	dpd_size = mt7915_get_cal_dpd_size(dev);
- 	dev->dpd_chan_num_2g = hweight32(DPD_2G_CH_BW20_BITMAP_0);
- 	if (is_mt7915(&dev->mt76)) {
- 		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_7915_0);
- 		dev->dpd_chan_num_6g = 0;
--		dpd_size = MT_EE_CAL_DPD_SIZE_V1;
- 		offs = MT_EE_DO_PRE_CAL;
- 	} else {
- 		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_0) +
-@@ -2246,7 +2246,8 @@ mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
- 		dev->dpd_chan_num_6g = hweight32(DPD_6G_CH_BW20_BITMAP_0) +
- 				       hweight32(DPD_6G_CH_BW20_BITMAP_1) +
- 				       ARRAY_SIZE(bw160_6g_freq);
--		dpd_size = MT_EE_CAL_DPD_SIZE_V2;
-+		if (is_mt7981(&dev->mt76))
-+			dev->dpd_chan_num_6g = 0;
- 		offs = MT_EE_DO_PRE_CAL_V2;
- 	}
- 	size = group_size + dpd_size;
-@@ -2711,7 +2712,7 @@ mt7915_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int
- 	}
- 
- 	group_size = mt7915_get_cal_group_size(dev);
--	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
-+	dpd_size = mt7915_get_cal_dpd_size(dev);
- 	dpd_per_chan_size = is_mt7915(&dev->mt76) ? 2 : 3;
- 	total_size = group_size + dpd_size;
- 	pre_cal = dev->cal;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-testmode-add-cheetah-support.patch b/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-testmode-add-cheetah-support.patch
new file mode 100644
index 0000000..d1ef4f9
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-testmode-add-cheetah-support.patch
@@ -0,0 +1,58 @@
+From e7e65b6c3742760ff15770e525e0a4e9438ac7a2 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 31 Oct 2023 16:29:13 +0800
+Subject: [PATCH 1044/1051] wifi: mt76: testmode: add cheetah support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/testmode.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index faf60146..ecd62712 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -2151,7 +2151,7 @@ mt7915_tm_group_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
+ 	eeprom = mdev->eeprom.data;
+ 	dev->cur_prek_offset = 0;
+ 	group_size = mt7915_get_cal_group_size(dev);
+-	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++	dpd_size = mt7915_get_cal_dpd_size(dev);
+ 	size = group_size + dpd_size;
+ 	offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
+ 
+@@ -2233,11 +2233,11 @@ mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
+ 	eeprom = mdev->eeprom.data;
+ 	dev->cur_prek_offset = 0;
+ 	group_size = mt7915_get_cal_group_size(dev);
++	dpd_size = mt7915_get_cal_dpd_size(dev);
+ 	dev->dpd_chan_num_2g = hweight32(DPD_2G_CH_BW20_BITMAP_0);
+ 	if (is_mt7915(&dev->mt76)) {
+ 		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_7915_0);
+ 		dev->dpd_chan_num_6g = 0;
+-		dpd_size = MT_EE_CAL_DPD_SIZE_V1;
+ 		offs = MT_EE_DO_PRE_CAL;
+ 	} else {
+ 		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_0) +
+@@ -2246,7 +2246,8 @@ mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
+ 		dev->dpd_chan_num_6g = hweight32(DPD_6G_CH_BW20_BITMAP_0) +
+ 				       hweight32(DPD_6G_CH_BW20_BITMAP_1) +
+ 				       ARRAY_SIZE(bw160_6g_freq);
+-		dpd_size = MT_EE_CAL_DPD_SIZE_V2;
++		if (is_mt7981(&dev->mt76))
++			dev->dpd_chan_num_6g = 0;
+ 		offs = MT_EE_DO_PRE_CAL_V2;
+ 	}
+ 	size = group_size + dpd_size;
+@@ -2711,7 +2712,7 @@ mt7915_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int
+ 	}
+ 
+ 	group_size = mt7915_get_cal_group_size(dev);
+-	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++	dpd_size = mt7915_get_cal_dpd_size(dev);
+ 	dpd_per_chan_size = is_mt7915(&dev->mt76) ? 2 : 3;
+ 	total_size = group_size + dpd_size;
+ 	pre_cal = dev->cal;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1048-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch b/recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1048-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch
rename to recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch
index 1ab6d29..aa7dba8 100644
--- a/recipes-wifi/linux-mt76/files/patches/1048-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1045-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch
@@ -1,7 +1,7 @@
-From 4ad662df4310858461f31ad26d26e3043d43eb60 Mon Sep 17 00:00:00 2001
+From 9fab447128e7da7a0732c66b8f3922a6f30625de Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 Date: Wed, 24 Jan 2024 14:39:14 +0800
-Subject: [PATCH 1048/1048] wifi: mt76: mt7915: add no_beacon vendor command
+Subject: [PATCH 1045/1051] wifi: mt76: mt7915: add no_beacon vendor command
  for cert
 
 Add the vendor command to disable/enable beacon
@@ -21,10 +21,10 @@
  4 files changed, 65 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ba47d0d..3b214a2 100644
+index e17c61d5..ddb738cf 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -5107,6 +5107,17 @@ int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig
+@@ -5101,6 +5101,17 @@ int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig
  		return 0;
  	}
  }
@@ -43,10 +43,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 23ee118..3a596da 100644
+index ff08d252..34f1a358 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -794,6 +794,7 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -808,6 +808,7 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  int mt7915_mcu_set_lpi(struct mt7915_phy *phy, bool en);
@@ -55,7 +55,7 @@
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 566fec0..6154d1a 100644
+index 566fec01..6154d1a0 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -113,6 +113,11 @@ txpower_ctrl_policy[NUM_MTK_VENDOR_ATTRS_TXPOWER_CTRL] = {
@@ -122,7 +122,7 @@
  
  void mt7915_vendor_register(struct mt7915_phy *phy)
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 5b8a1fb..661d636 100644
+index 5b8a1fb3..661d636f 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -16,6 +16,7 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/recipes-wifi/linux-mt76/files/patches/1049-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch b/recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/1049-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch
rename to recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch
index 628f2c2..61c67c3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1049-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1046-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch
@@ -1,7 +1,8 @@
-From 771b77a2b49f7b4cfd4181cea48391e549a046b1 Mon Sep 17 00:00:00 2001
+From 22c29063354694a3f0626be8cc3a8b83f35aa1ea Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 15 Feb 2024 11:16:16 +0800
-Subject: [PATCH] wifi: mt76: mt7915: support spatial reuse debug commands
+Subject: [PATCH 1046/1051] wifi: mt76: mt7915: support spatial reuse debug
+ commands
 
 Support 3 spatial reuse debug commands:
 1. sr_enable: enable/disable spatial reuse
@@ -18,7 +19,7 @@
  5 files changed, 190 insertions(+), 4 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e581084..791dc1d 100644
+index e581084e..791dc1d4 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1024,6 +1024,7 @@ enum {
@@ -30,7 +31,7 @@
  };
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3b214a2..4bd7a3b 100644
+index ddb738cf..c099c1d3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -452,6 +452,90 @@ mt7915_mcu_rx_bss_acq_pkt_cnt(struct mt7915_dev *dev, struct sk_buff * skb)
@@ -156,7 +157,7 @@
  		return 0;
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 742a785..f476767 100644
+index 742a7855..f4767671 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -42,6 +42,45 @@ struct mt7915_mcu_thermal_notify {
@@ -231,7 +232,7 @@
  	THERMAL_PROTECT_PARAMETER_CTRL,
  	THERMAL_PROTECT_BASIC_INFO,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3a596da..2ec2c77 100644
+index 34f1a358..47f7d163 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -354,6 +354,9 @@ struct mt7915_phy {
@@ -243,12 +244,12 @@
 +#endif
  };
  
- struct mt7915_dev {
+ #ifdef MTK_DEBUG
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 1017ee7..9f8b408 100644
+index e7588434..bf419265 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3786,16 +3786,34 @@ mt7915_sw_aci_set(void *data, u64 val)
+@@ -3809,16 +3809,34 @@ mt7915_sw_aci_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_sw_aci, NULL,
  			 mt7915_sw_aci_set, "%llx\n");
  
@@ -286,7 +287,7 @@
  
  static int
  mt7915_scs_enable_set(void *data, u64 val)
-@@ -3836,6 +3854,26 @@ mt7915_thermal_recal_set(void *data, u64 val)
+@@ -3859,6 +3877,26 @@ mt7915_thermal_recal_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_recal, NULL,
  			 mt7915_thermal_recal_set, "%llu\n");
  
@@ -313,7 +314,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3928,9 +3966,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3951,9 +3989,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  				    mt7915_show_eeprom_mode);
  	debugfs_create_file("sw_aci", 0600, dir, dev,
  			    &fops_sw_aci);
diff --git a/recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-try-more-times-when-send-message-timeout.patch b/recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-try-more-times-when-send-message-timeout.patch
new file mode 100644
index 0000000..1891c20
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1047-wifi-mt76-try-more-times-when-send-message-timeout.patch
@@ -0,0 +1,231 @@
+From cdaf90d85058a2383225ad657be6fe7c331088b4 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Thu, 7 Mar 2024 11:13:45 +0800
+Subject: [PATCH 1047/1051] wifi: mt76: try more times when send message
+ timeout.
+
+CR-Id: WCNCR00334773
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ dma.c        |  7 ++++--
+ mcu.c        | 66 ++++++++++++++++++++++++++++++++++++----------------
+ mt7915/mac.c | 43 +++++++++++-----------------------
+ 3 files changed, 64 insertions(+), 52 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index bc8afcff..133a50dc 100644
+--- a/dma.c
++++ b/dma.c
+@@ -504,9 +504,12 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+ {
+ 	struct mt76_queue_buf buf = {};
+ 	dma_addr_t addr;
++	int ret = -ENOMEM;
+ 
+-	if (test_bit(MT76_MCU_RESET, &dev->phy.state))
++	if (test_bit(MT76_MCU_RESET, &dev->phy.state)) {
++		ret = -EAGAIN;
+ 		goto error;
++	}
+ 
+ 	if (q->queued + 1 >= q->ndesc - 1)
+ 		goto error;
+@@ -528,7 +531,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+ 
+ error:
+ 	dev_kfree_skb(skb);
+-	return -ENOMEM;
++	return ret;
+ }
+ 
+ static int
+diff --git a/mcu.c b/mcu.c
+index fa4b0544..de185cc9 100644
+--- a/mcu.c
++++ b/mcu.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include "mt76.h"
++#include "mt76_connac.h"
+ #include <linux/moduleparam.h>
+ 
+ struct sk_buff *
+@@ -74,35 +75,60 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
+ 				  int cmd, bool wait_resp,
+ 				  struct sk_buff **ret_skb)
+ {
++#define MT76_MSG_MAX_RETRY_CNT 3
+ 	unsigned long expires;
+-	int ret, seq;
++	int ret, seq, retry_cnt;
++	struct sk_buff *skb_tmp;
++	bool retry = wait_resp && is_connac_v2(dev);
+ 
+ 	if (ret_skb)
+ 		*ret_skb = NULL;
+ 
+ 	mutex_lock(&dev->mcu.mutex);
+-
+-	ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb, cmd, &seq);
+-	if (ret < 0)
+-		goto out;
+-
+-	if (!wait_resp) {
+-		ret = 0;
+-		goto out;
++	retry_cnt = retry ? MT76_MSG_MAX_RETRY_CNT : 1;
++	while (retry_cnt) {
++		skb_tmp = mt76_mcu_msg_alloc(dev, skb->data, skb->len);
++		if (!skb_tmp)
++			goto out;
++
++		if (retry && retry_cnt < MT76_MSG_MAX_RETRY_CNT) {
++			if (test_bit(MT76_MCU_RESET, &dev->phy.state))
++				usleep_range(200000, 500000);
++			dev_err(dev->dev, "send message %08x timeout, try again(%d).\n",
++				cmd, (MT76_MSG_MAX_RETRY_CNT - retry_cnt));
++		}
++
++		ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb_tmp, cmd, &seq);
++		if (ret < 0 && ret != -EAGAIN)
++			goto out;
++
++		if (!wait_resp) {
++			ret = 0;
++			goto out;
++		}
++
++		expires = jiffies + dev->mcu.timeout;
++
++		do {
++			skb_tmp = mt76_mcu_get_response(dev, expires);
++			ret = dev->mcu_ops->mcu_parse_response(dev, cmd, skb_tmp, seq);
++			if (ret == -ETIMEDOUT)
++				break;
++
++			if (!ret && ret_skb)
++				*ret_skb = skb_tmp;
++			else
++				dev_kfree_skb(skb_tmp);
++
++			if (ret != -EAGAIN)
++				goto out;
++		} while (ret == -EAGAIN);
++
++		retry_cnt--;
+ 	}
+ 
+-	expires = jiffies + dev->mcu.timeout;
+-
+-	do {
+-		skb = mt76_mcu_get_response(dev, expires);
+-		ret = dev->mcu_ops->mcu_parse_response(dev, cmd, skb, seq);
+-		if (!ret && ret_skb)
+-			*ret_skb = skb;
+-		else
+-			dev_kfree_skb(skb);
+-	} while (ret == -EAGAIN);
+-
+ out:
++	dev_kfree_skb(skb);
+ 	mutex_unlock(&dev->mcu.mutex);
+ 
+ 	return ret;
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 2e4a8f84..dbc1095c 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1389,12 +1389,6 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+ 		}
+ 	}
+ 
+-	set_bit(MT76_RESET, &dev->mphy.state);
+-	set_bit(MT76_MCU_RESET, &dev->mphy.state);
+-	wake_up(&dev->mt76.mcu.wait);
+-	if (ext_phy)
+-		set_bit(MT76_RESET, &ext_phy->state);
+-
+ 	/* lock/unlock all queues to ensure that no tx is pending */
+ 	mt76_txq_schedule_all(&dev->mphy);
+ 	if (ext_phy)
+@@ -1495,11 +1489,18 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
+ 
+ 	dev->recovery.hw_full_reset = true;
+ 
+-	wake_up(&dev->mt76.mcu.wait);
+ 	ieee80211_stop_queues(mt76_hw(dev));
+ 	if (ext_phy)
+ 		ieee80211_stop_queues(ext_phy->hw);
+ 
++	set_bit(MT76_RESET, &dev->mphy.state);
++	set_bit(MT76_MCU_RESET, &dev->mphy.state);
++	wake_up(&dev->mt76.mcu.wait);
++	if (ext_phy) {
++		set_bit(MT76_RESET, &ext_phy->state);
++		set_bit(MT76_MCU_RESET, &ext_phy->state);
++	}
++
+ 	cancel_delayed_work_sync(&dev->mphy.mac_work);
+ 	if (ext_phy)
+ 		cancel_delayed_work_sync(&ext_phy->mac_work);
+@@ -1587,20 +1588,15 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 
+ 	set_bit(MT76_RESET, &dev->mphy.state);
+ 	set_bit(MT76_MCU_RESET, &dev->mphy.state);
++	if (ext_phy)
++		set_bit(MT76_RESET, &ext_phy->state);
+ 	wake_up(&dev->mt76.mcu.wait);
+-	cancel_delayed_work_sync(&dev->mphy.mac_work);
+-	if (phy2) {
+-		set_bit(MT76_RESET, &phy2->mt76->state);
+-		cancel_delayed_work_sync(&phy2->mt76->mac_work);
+-	}
+-	cancel_delayed_work_sync(&dev->scs_work);
++
+ 	mt76_worker_disable(&dev->mt76.tx_worker);
+ 	mt76_for_each_q_rx(&dev->mt76, i)
+ 		napi_disable(&dev->mt76.napi[i]);
+ 	napi_disable(&dev->mt76.tx_napi);
+ 
+-	mutex_lock(&dev->mt76.mutex);
+-
+ 	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
+ 		mtk_wed_device_stop(&dev->mt76.mmio.wed);
+ 
+@@ -1624,8 +1620,8 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 
+ 	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
+ 	clear_bit(MT76_RESET, &dev->mphy.state);
+-	if (phy2)
+-		clear_bit(MT76_RESET, &phy2->mt76->state);
++	if (ext_phy)
++		clear_bit(MT76_RESET, &ext_phy->state);
+ 
+ 	local_bh_disable();
+ 	mt76_for_each_q_rx(&dev->mt76, i) {
+@@ -1647,21 +1643,8 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 	if (ext_phy)
+ 		ieee80211_wake_queues(ext_phy->hw);
+ 
+-	mutex_unlock(&dev->mt76.mutex);
+-
+ 	mt7915_update_beacons(dev);
+ 
+-	ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work,
+-				     MT7915_WATCHDOG_TIME);
+-	if (phy2)
+-		ieee80211_queue_delayed_work(ext_phy->hw,
+-					     &phy2->mt76->mac_work,
+-					     MT7915_WATCHDOG_TIME);
+-
+-	if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
+-	    mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
+-		ieee80211_queue_delayed_work(mt76_hw(dev), &dev->scs_work, HZ);
+-
+ 	dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
+ 		 wiphy_name(dev->mt76.hw->wiphy));
+ }
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1048-wifi-mt76-mt7915-add-SER-overlap-handle.patch b/recipes-wifi/linux-mt76/files/patches/1048-wifi-mt76-mt7915-add-SER-overlap-handle.patch
new file mode 100644
index 0000000..0e84232
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1048-wifi-mt76-mt7915-add-SER-overlap-handle.patch
@@ -0,0 +1,138 @@
+From 37da0074c6570badb26e2fd527b55621bc571aca Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Tue, 6 Feb 2024 14:46:59 +0800
+Subject: [PATCH 1048/1051] wifi: mt76: mt7915: add SER overlap handle
+
+CR-ID: WCNCR00355921
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ dma.c        |  3 ++-
+ mcu.c        |  7 +++++--
+ mt76.h       |  9 +++++++++
+ mt7915/mac.c | 11 +++++++++++
+ mt7915/mcu.c |  7 +++++++
+ 5 files changed, 34 insertions(+), 3 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index 133a50dc..100d2aff 100644
+--- a/dma.c
++++ b/dma.c
+@@ -506,7 +506,8 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+ 	dma_addr_t addr;
+ 	int ret = -ENOMEM;
+ 
+-	if (test_bit(MT76_MCU_RESET, &dev->phy.state)) {
++	if (test_bit(MT76_MCU_RESET, &dev->phy.state) ||
++	    dev->recovery_state == MT76_RECOVERY_TRIGGERED) {
+ 		ret = -EAGAIN;
+ 		goto error;
+ 	}
+diff --git a/mcu.c b/mcu.c
+index de185cc9..1bc94e85 100644
+--- a/mcu.c
++++ b/mcu.c
+@@ -42,7 +42,9 @@ struct sk_buff *mt76_mcu_get_response(struct mt76_dev *dev,
+ 	timeout = expires - jiffies;
+ 	wait_event_timeout(dev->mcu.wait,
+ 			   (!skb_queue_empty(&dev->mcu.res_q) ||
+-			    test_bit(MT76_MCU_RESET, &dev->phy.state)),
++			    test_bit(MT76_MCU_RESET, &dev->phy.state) ||
++			    dev->recovery_state == MT76_RECOVERY_TRIGGERED ||
++			    dev->recovery_state == MT76_RECOVERY_OVERLAP_TRIGGERED),
+ 			   timeout);
+ 	return skb_dequeue(&dev->mcu.res_q);
+ }
+@@ -92,7 +94,8 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
+ 			goto out;
+ 
+ 		if (retry && retry_cnt < MT76_MSG_MAX_RETRY_CNT) {
+-			if (test_bit(MT76_MCU_RESET, &dev->phy.state))
++			if (test_bit(MT76_MCU_RESET, &dev->phy.state) ||
++			    dev->recovery_state == MT76_RECOVERY_TRIGGERED)
+ 				usleep_range(200000, 500000);
+ 			dev_err(dev->dev, "send message %08x timeout, try again(%d).\n",
+ 				cmd, (MT76_MSG_MAX_RETRY_CNT - retry_cnt));
+diff --git a/mt76.h b/mt76.h
+index b023f38d..fb50d88b 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -478,6 +478,14 @@ enum {
+ 	MT76_STATE_WED_RESET,
+ };
+ 
++enum {
++	MT76_RECOVERY_INIT,
++	MT76_RECOVERY_TRIGGERED,
++	MT76_RECOVERY_OVERLAP_TRIGGERED,
++	MT76_RECOVERY_PROCESS,
++	MT76_RECOVERY_DONE = MT76_RECOVERY_INIT,
++};
++
+ struct mt76_hw_cap {
+ 	bool has_2ghz;
+ 	bool has_5ghz;
+@@ -944,6 +952,7 @@ struct mt76_dev {
+ 	wait_queue_head_t tx_wait;
+ 	/* spinclock used to protect wcid pktid linked list */
+ 	spinlock_t status_lock;
++	u16 recovery_state;
+ 
+ 	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+ 	u32 wcid_phy_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index dbc1095c..e9f50a38 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1579,6 +1579,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
+ 		return;
+ 
++	dev->mt76.recovery_state = MT76_RECOVERY_PROCESS;
+ 	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
+ 		 wiphy_name(dev->mt76.hw->wiphy));
+ 
+@@ -1645,6 +1646,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 
+ 	mt7915_update_beacons(dev);
+ 
++	dev->mt76.recovery_state = MT76_RECOVERY_DONE;
+ 	dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
+ 		 wiphy_name(dev->mt76.hw->wiphy));
+ }
+@@ -1783,6 +1785,15 @@ void mt7915_reset(struct mt7915_dev *dev)
+ 		return;
+ 	}
+ 
++	if ((READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA)) {
++		if (dev->mt76.recovery_state != MT76_RECOVERY_DONE)
++			dev->mt76.recovery_state = MT76_RECOVERY_OVERLAP_TRIGGERED;
++		else
++			dev->mt76.recovery_state = MT76_RECOVERY_TRIGGERED;
++
++		wake_up(&dev->mt76.mcu.wait);
++	}
++
+ 	queue_work(dev->mt76.wq, &dev->reset_work);
+ 	wake_up(&dev->reset_wait);
+ }
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index c099c1d3..e6c2c3dc 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -198,6 +198,13 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 	enum mt76_mcuq_id qid;
+ 	int ret;
+ 
++	if (mdev->recovery_state == MT76_RECOVERY_OVERLAP_TRIGGERED) {
++		dev_info(dev->mt76.dev,"\n%s L1 SER recovery overlap, drop message %08x.",
++			 wiphy_name(dev->mt76.hw->wiphy), cmd);
++		dev_kfree_skb(skb);
++		return -EPERM;
++	}
++
+ 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
+ 
+ 	if (ret)
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1049-wifi-mt76-mt7915-add-background-radar-hw-cap-check.patch b/recipes-wifi/linux-mt76/files/patches/1049-wifi-mt76-mt7915-add-background-radar-hw-cap-check.patch
new file mode 100644
index 0000000..6c348a4
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1049-wifi-mt76-mt7915-add-background-radar-hw-cap-check.patch
@@ -0,0 +1,98 @@
+From fcad28acd81313d08e6c187a5cfe689345e40c2e Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 4 Mar 2024 11:29:06 +0800
+Subject: [PATCH 1049/1051] wifi: mt76: mt7915: add background radar hw cap
+ check
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/debugfs.c |  5 +++++
+ mt7915/eeprom.h  | 30 ++++++++++++++++++++++++++++++
+ mt7915/init.c    |  7 ++++---
+ 3 files changed, 39 insertions(+), 3 deletions(-)
+
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index 017d43d7..599a794c 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -459,6 +459,11 @@ mt7915_rdd_monitor(struct seq_file *s, void *data)
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
++	if (!mt7915_get_background_radar_cap(dev)) {
++		seq_puts(s, "no background radar capability\n");
++		goto out;
++	}
++
+ 	if (!cfg80211_chandef_valid(chandef)) {
+ 		ret = -EINVAL;
+ 		goto out;
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index 70fca0b3..adeee104 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -55,6 +55,7 @@ enum mt7915_eeprom_field {
+ #define MT_EE_CAL_DPD_SIZE_V2_7981		(102 * MT_EE_CAL_UNIT)	/* no 6g dpd data */
+ 
+ #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
++#define MT_EE_WIFI_CONF0_RX_PATH		GENMASK(5, 3)
+ #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
+ #define MT_EE_WIFI_CONF1_BAND_SEL		GENMASK(7, 6)
+ #define MT_EE_WIFI_CONF_STREAM_NUM		GENMASK(7, 5)
+@@ -206,6 +207,35 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
+ 		return MT_EE_CAL_DPD_SIZE_V2;
+ }
+ 
++static inline bool
++mt7915_get_background_radar_cap(struct mt7915_dev *dev)
++{
++	u8 buf[MT7915_EEPROM_BLOCK_SIZE];
++	int val, band_sel, tx_path, rx_path, offs = MT_EE_WIFI_CONF + 1;
++
++	switch (mt76_chip(&dev->mt76)) {
++	case 0x7915:
++		return 1;
++	case 0x7906:
++		if (!mt7915_mcu_get_eeprom(dev, offs, buf)) {
++			val = buf[offs % MT7915_EEPROM_BLOCK_SIZE];
++			band_sel = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
++			rx_path = FIELD_GET(MT_EE_WIFI_CONF0_RX_PATH, val);
++			tx_path = FIELD_GET(MT_EE_WIFI_CONF0_TX_PATH, val);
++
++			return (band_sel == MT_EE_V2_BAND_SEL_5GHZ &&
++				tx_path == rx_path && rx_path == 2);
++		}
++		break;
++	case 0x7981:
++	case 0x7986:
++	default:
++		break;
++	}
++
++	return 0;
++}
++
+ extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
+ 
+ #endif
+diff --git a/mt7915/init.c b/mt7915/init.c
+index c052b927..f5daf024 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -404,9 +404,10 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+ 	if (!is_mt7915(&dev->mt76))
+ 		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STA_TX_PWR);
+ 
+-	if (!mdev->dev->of_node ||
+-	    !of_property_read_bool(mdev->dev->of_node,
+-				   "mediatek,disable-radar-background"))
++	if (mt7915_get_background_radar_cap(phy->dev) &&
++	    (!mdev->dev->of_node ||
++	     !of_property_read_bool(mdev->dev->of_node,
++				    "mediatek,disable-radar-background")))
+ 		wiphy_ext_feature_set(wiphy,
+ 				      NL80211_EXT_FEATURE_RADAR_BACKGROUND);
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1050-wifi-mt76-mt7915-remove-unnecessary-register-setting.patch b/recipes-wifi/linux-mt76/files/patches/1050-wifi-mt76-mt7915-remove-unnecessary-register-setting.patch
new file mode 100644
index 0000000..db12d30
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1050-wifi-mt76-mt7915-remove-unnecessary-register-setting.patch
@@ -0,0 +1,144 @@
+From bd6543b475fd9b98c45a486d242c6915a846aef2 Mon Sep 17 00:00:00 2001
+From: Henry Yen <henry.yen@mediatek.com>
+Date: Wed, 6 Mar 2024 12:42:06 +0800
+Subject: [PATCH 1050/1051] wifi: mt76: mt7915: remove unnecessary register
+ settings
+
+Remove unnecessary register settings from the driver layer,
+and let firmware take over the configuration control.
+
+Signed-off-by: Henry.Yen <henry.yen@mediatek.com>
+---
+ mt7915/init.c | 35 -----------------------------------
+ mt7915/mac.c  | 43 +------------------------------------------
+ 2 files changed, 1 insertion(+), 77 deletions(-)
+
+diff --git a/mt7915/init.c b/mt7915/init.c
+index f5daf024..b299eccc 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -488,30 +488,6 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+ {
+ 	u32 mask, set;
+ 
+-	mt76_rmw_field(dev, MT_TMAC_CTCR0(band),
+-		       MT_TMAC_CTCR0_INS_DDLMT_REFTIME, 0x3f);
+-	mt76_set(dev, MT_TMAC_CTCR0(band),
+-		 MT_TMAC_CTCR0_INS_DDLMT_VHT_SMPDU_EN |
+-		 MT_TMAC_CTCR0_INS_DDLMT_EN);
+-
+-	mask = MT_MDP_RCFR0_MCU_RX_MGMT |
+-	       MT_MDP_RCFR0_MCU_RX_CTL_NON_BAR |
+-	       MT_MDP_RCFR0_MCU_RX_CTL_BAR;
+-	set = FIELD_PREP(MT_MDP_RCFR0_MCU_RX_MGMT, MT_MDP_TO_HIF) |
+-	      FIELD_PREP(MT_MDP_RCFR0_MCU_RX_CTL_NON_BAR, MT_MDP_TO_HIF) |
+-	      FIELD_PREP(MT_MDP_RCFR0_MCU_RX_CTL_BAR, MT_MDP_TO_HIF);
+-	mt76_rmw(dev, MT_MDP_BNRCFR0(band), mask, set);
+-
+-	mask = MT_MDP_RCFR1_MCU_RX_BYPASS |
+-	       MT_MDP_RCFR1_RX_DROPPED_UCAST |
+-	       MT_MDP_RCFR1_RX_DROPPED_MCAST;
+-	set = FIELD_PREP(MT_MDP_RCFR1_MCU_RX_BYPASS, MT_MDP_TO_HIF) |
+-	      FIELD_PREP(MT_MDP_RCFR1_RX_DROPPED_UCAST, MT_MDP_TO_HIF) |
+-	      FIELD_PREP(MT_MDP_RCFR1_RX_DROPPED_MCAST, MT_MDP_TO_HIF);
+-	mt76_rmw(dev, MT_MDP_BNRCFR1(band), mask, set);
+-
+-	mt76_rmw_field(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_MAX_RX_LEN, 0x680);
+-
+ 	/* mt7915: disable rx rate report by default due to hw issues */
+ 	mt76_clear(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN);
+ 
+@@ -614,23 +590,12 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+ void mt7915_mac_init(struct mt7915_dev *dev)
+ {
+ 	int i;
+-	u32 rx_len = is_mt7915(&dev->mt76) ? 0x400 : 0x680;
+-
+-	/* config pse qid6 wfdma port selection */
+-	if (!is_mt7915(&dev->mt76) && dev->hif2)
+-		mt76_rmw(dev, MT_WF_PP_TOP_RXQ_WFDMA_CF_5, 0,
+-			 MT_WF_PP_TOP_RXQ_QID6_WFDMA_HIF_SEL_MASK);
+-
+-	mt76_rmw_field(dev, MT_MDP_DCR1, MT_MDP_DCR1_MAX_RX_LEN, rx_len);
+ 
+ 	if (!is_mt7915(&dev->mt76))
+ 		mt76_clear(dev, MT_MDP_DCR2, MT_MDP_DCR2_RX_TRANS_SHORT);
+ 	else
+ 		mt76_clear(dev, MT_PLE_HOST_RPT0, MT_PLE_HOST_RPT0_TX_LATENCY);
+ 
+-	/* enable hardware de-agg */
+-	mt76_set(dev, MT_MDP_DCR0, MT_MDP_DCR0_DAMSDU_EN);
+-
+ 	for (i = 0; i < mt7915_wtbl_size(dev); i++)
+ 		mt7915_mac_wtbl_update(dev, i,
+ 				       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index e9f50a38..c84b9573 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1202,61 +1202,20 @@ void mt7915_mac_reset_counters(struct mt7915_phy *phy)
+ 
+ void mt7915_mac_set_timing(struct mt7915_phy *phy)
+ {
+-	s16 coverage_class = phy->coverage_class;
+ 	struct mt7915_dev *dev = phy->dev;
+-	struct mt7915_phy *ext_phy = mt7915_ext_phy(dev);
+-	u32 val, reg_offset;
+-	u32 cck = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 231) |
+-		  FIELD_PREP(MT_TIMEOUT_VAL_CCA, 48);
+-	u32 ofdm = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 60) |
+-		   FIELD_PREP(MT_TIMEOUT_VAL_CCA, 28);
++	u32 val;
+ 	u8 band = phy->mt76->band_idx;
+-	int eifs_ofdm = 360, sifs = 10, offset;
+ 	bool a_band = !(phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ);
+ 
+ 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
+ 		return;
+ 
+-	if (ext_phy)
+-		coverage_class = max_t(s16, dev->phy.coverage_class,
+-				       ext_phy->coverage_class);
+-
+-	mt76_set(dev, MT_ARB_SCR(band),
+-		 MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
+-	udelay(1);
+-
+-	offset = 3 * coverage_class;
+-	reg_offset = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, offset) |
+-		     FIELD_PREP(MT_TIMEOUT_VAL_CCA, offset);
+-
+-	if (!is_mt7915(&dev->mt76)) {
+-		if (!a_band) {
+-			mt76_wr(dev, MT_TMAC_ICR1(band),
+-				FIELD_PREP(MT_IFS_EIFS_CCK, 314));
+-			eifs_ofdm = 78;
+-		} else {
+-			eifs_ofdm = 84;
+-		}
+-	} else if (a_band) {
+-		sifs = 16;
+-	}
+-
+-	mt76_wr(dev, MT_TMAC_CDTR(band), cck + reg_offset);
+-	mt76_wr(dev, MT_TMAC_ODTR(band), ofdm + reg_offset);
+-	mt76_wr(dev, MT_TMAC_ICR0(band),
+-		FIELD_PREP(MT_IFS_EIFS_OFDM, eifs_ofdm) |
+-		FIELD_PREP(MT_IFS_RIFS, 2) |
+-		FIELD_PREP(MT_IFS_SIFS, sifs) |
+-		FIELD_PREP(MT_IFS_SLOT, phy->slottime));
+-
+ 	if (phy->slottime < 20 || a_band)
+ 		val = MT7915_CFEND_RATE_DEFAULT;
+ 	else
+ 		val = MT7915_CFEND_RATE_11B;
+ 
+ 	mt76_rmw_field(dev, MT_AGG_ACR0(band), MT_AGG_ACR_CFEND_RATE, val);
+-	mt76_clear(dev, MT_ARB_SCR(band),
+-		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
+ }
+ 
+ void mt7915_mac_enable_nf(struct mt7915_dev *dev, bool band)
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1051-wifi-mt76-mt7915-add-foolproof-mechanism-for-ZWDFS-d.patch b/recipes-wifi/linux-mt76/files/patches/1051-wifi-mt76-mt7915-add-foolproof-mechanism-for-ZWDFS-d.patch
new file mode 100644
index 0000000..5257b0d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1051-wifi-mt76-mt7915-add-foolproof-mechanism-for-ZWDFS-d.patch
@@ -0,0 +1,45 @@
+From e3c3d9829b27c167bb9a502e2e532d1cf349ec7b Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 6 Mar 2024 11:30:34 +0800
+Subject: [PATCH 1051/1051] wifi: mt76: mt7915: add foolproof mechanism for
+ ZWDFS during radar detected & triggered
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/debugfs.c | 5 +++++
+ mt7915/mcu.c     | 3 +++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index 599a794c..e43bcabb 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -231,6 +231,11 @@ mt7915_radar_trigger(void *data, u64 val)
+ 	if (val > MT_RX_SEL2)
+ 		return -EINVAL;
+ 
++	if (val == MT_RX_SEL2 && !dev->rdd2_phy) {
++		dev_err(dev->mt76.dev, "Background radar is not enabled\n");
++		return -EINVAL;
++	}
++
+ 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_RADAR_EMULATE,
+ 				       val, 0, 0);
+ }
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index e6c2c3dc..2f57b1d8 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -302,6 +302,9 @@ mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	if (r->band_idx > MT_RX_SEL2)
+ 		return;
+ 
++	if (r->band_idx == MT_RX_SEL2 && !dev->rdd2_phy)
++		return;
++
+ 	if ((r->band_idx && !dev->phy.mt76->band_idx) &&
+ 	    dev->mt76.phys[MT_BAND1])
+ 		mphy = dev->mt76.phys[MT_BAND1];
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1054-wifi-mt76-mt7915-assign-DEAUTH-to-ALTX-queue-for.patch b/recipes-wifi/linux-mt76/files/patches/1054-wifi-mt76-mt7915-assign-DEAUTH-to-ALTX-queue-for.patch
new file mode 100644
index 0000000..83c76c0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1054-wifi-mt76-mt7915-assign-DEAUTH-to-ALTX-queue-for.patch
@@ -0,0 +1,41 @@
+From a8a291acfb296d02ea780e466e080d789f70af21 Mon Sep 17 00:00:00 2001
+From: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Date: Tue, 19 Mar 2024 08:35:26 +0800
+Subject: [PATCH] mtk: wifi: mt76: mt7915: assign DEAUTH to ALTX queue for CERT
+
+Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+---
+ mt76_connac_mac.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index abb95b3..edeb618 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -385,6 +385,8 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
+ 				  struct sk_buff *skb,
+ 				  struct ieee80211_key_conf *key)
+ {
++	struct mt76_phy *mphy =
++		mt76_dev_phy(dev, le32_get_bits(txwi[1], MT_TXD1_TGID));
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+@@ -394,6 +396,14 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
+ 	u8 fc_type, fc_stype;
+ 	u32 val;
+ 
++	if (ieee80211_is_cert_mode(mphy->hw) && ieee80211_is_deauth(fc)) {
++		/* In WPA3 cert TC-4.8.1, the deauth must be transmitted without
++		 * considering PSM bit
++		 */
++		txwi[0] &= ~cpu_to_le32(MT_TXD0_Q_IDX);
++		txwi[0] |= cpu_to_le32(FIELD_PREP(MT_TXD0_Q_IDX, MT_LMAC_ALTX0));
++	}
++
+ 	if (ieee80211_is_action(fc) &&
+ 	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
+ 	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
+-- 
+2.25.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1055-wifi-mt76-mt7915-set-channel-after-sta-is-associated.patch b/recipes-wifi/linux-mt76/files/patches/1055-wifi-mt76-mt7915-set-channel-after-sta-is-associated.patch
new file mode 100644
index 0000000..6153cdf
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1055-wifi-mt76-mt7915-set-channel-after-sta-is-associated.patch
@@ -0,0 +1,64 @@
+From be32df6be97cc2ffdbaa304d37c2a1f169c756e0 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 21 Mar 2024 16:52:34 +0800
+Subject: [PATCH] wifi: mt76: mt7915: set channel after sta is associated to
+ adjust switch reason
+
+when sta is associated to AP operating in DFS channel, a channel
+setting operation is required to change the channel switch reason
+from CH_SWTICH_DFS to CH_SWITCH_NORMAL.
+Note that the switch reason for DFS channel during authentication is
+CH_SWITCH_DFS since the DFS state is still USABLE at that point
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/main.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 69fcf4c..41fa450 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -792,6 +792,31 @@ out:
+ 	return ret;
+ }
+ 
++static void
++mt7915_event_callback(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++		      const struct ieee80211_event *event)
++{
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	int ret;
++
++	switch (event->type) {
++	case MLME_EVENT:
++		if (event->u.mlme.data == ASSOC_EVENT &&
++		    event->u.mlme.status == MLME_SUCCESS) {
++			ieee80211_stop_queues(hw);
++			ret = mt7915_set_channel(phy);
++			if (ret)
++				return;
++			ieee80211_wake_queues(hw);
++		}
++		break;
++	default:
++		break;
++	}
++
++	return;
++}
++
+ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 		       struct ieee80211_sta *sta)
+ {
+@@ -1771,6 +1796,7 @@ const struct ieee80211_ops mt7915_ops = {
+ 	.set_sar_specs = mt7915_set_sar_specs,
+ 	.channel_switch_beacon = mt7915_channel_switch_beacon,
+ 	.post_channel_switch = mt7915_post_channel_switch,
++	.event_callback = mt7915_event_callback,
+ 	.get_stats = mt7915_get_stats,
+ 	.get_et_sset_count = mt7915_get_et_sset_count,
+ 	.get_et_stats = mt7915_get_et_stats,
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
index efab9b7..bd9c692 100644
--- a/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,4 +1,4 @@
-From 48e4b327150a9b9480911af9fe654420d545013c Mon Sep 17 00:00:00 2001
+From 284cc70f0a5bda348744d7288b0dd3b6c3fd18eb Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
 Subject: [PATCH 2000/2012] wifi: mt76: mt7915: wed: add wed tx support
@@ -14,7 +14,7 @@
  6 files changed, 14 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index e23a41c..58421e5 100644
+index e23a41cb..58421e51 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -130,6 +130,7 @@ struct mt76_connac_sta_key_conf {
@@ -26,10 +26,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index db25b2f..53a8f97 100644
+index c84b9573..1c8b8732 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -870,9 +870,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -878,9 +878,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -41,7 +41,7 @@
  }
  
  static void
-@@ -921,6 +921,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -929,6 +929,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -49,16 +49,14 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1002,6 +1003,8 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1010,12 +1011,15 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
 +			else
 +				with_txwi = false;
  
- 			txwi->jiffies = 0;
- 
-@@ -1009,7 +1012,8 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 			mt76_connac2_txwi_free(mdev, txwi, sta, &free_list);
  		}
  	}
  
@@ -69,7 +67,7 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 5316225..9037fa9 100644
+index 69fcf4c0..2ad95f43 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1728,14 +1728,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -90,7 +88,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 437a9b0..91100f1 100644
+index 437a9b0e..91100f15 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -13,7 +13,7 @@
@@ -111,7 +109,7 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3a596da..8967a97 100644
+index 47f7d163..1d0188d1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,7 +62,7 @@
@@ -124,7 +122,7 @@
  
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
 diff --git a/wed.c b/wed.c
-index f7a3f1b..47c81a2 100644
+index f7a3f1b3..47c81a28 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -187,7 +187,7 @@ void mt76_wed_offload_disable(struct mtk_wed_device *wed)
diff --git a/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch b/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
index 5cd362e..97d6e3e 100644
--- a/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
@@ -1,4 +1,4 @@
-From 4e2aa09d90a1574c3baa3242d1d4dc8dda3f9c97 Mon Sep 17 00:00:00 2001
+From a6b57c4e7197d09fb0e546e057e96c0a94634d2d Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 17:51:26 +0800
 Subject: [PATCH 2001/2012] wifi: mt76: mt7915: wed: add wds support when wed
@@ -15,7 +15,7 @@
  6 files changed, 82 insertions(+), 10 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 4291acd..fd8e2ff 100644
+index fb50d88b..d3c6ac0f 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -78,6 +78,12 @@ enum mt76_wed_type {
@@ -32,7 +32,7 @@
  	u32 (*rr)(struct mt76_dev *dev, u32 offset);
  	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 9037fa9..c92f580 100644
+index 2ad95f43..1a259bd0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -804,8 +804,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -81,10 +81,10 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3b214a2..465ab26 100644
+index 2f57b1d8..c92d6d9c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2487,10 +2487,18 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2587,10 +2587,18 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -108,10 +108,10 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 742a785..683b22c 100644
+index f4767671..52baaa73 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -353,6 +353,7 @@ enum {
+@@ -392,6 +392,7 @@ enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
  	MCU_WA_PARAM_RED = 0x0e,
@@ -120,7 +120,7 @@
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 diff --git a/util.c b/util.c
-index fc76c66..61b2d30 100644
+index fc76c66f..61b2d30a 100644
 --- a/util.c
 +++ b/util.c
 @@ -42,9 +42,14 @@ bool ____mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
@@ -188,7 +188,7 @@
  int mt76_get_min_avg_rssi(struct mt76_dev *dev, bool ext_phy)
  {
 diff --git a/util.h b/util.h
-index 260965d..99b7263 100644
+index 260965dd..99b7263c 100644
 --- a/util.h
 +++ b/util.h
 @@ -27,7 +27,12 @@ enum {
diff --git a/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch b/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
index 27a4e8a..e8e12ca 100644
--- a/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
@@ -1,4 +1,4 @@
-From dcc4acde168f6971da961f8ac22c21a62f7876c9 Mon Sep 17 00:00:00 2001
+From b1ad8583eead42f3784f1bf718f6ebb2c1d01d32 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 19 May 2023 07:05:22 +0800
 Subject: [PATCH 2002/2012] wifi: mt76: mt7915: wed: add fill receive path to
@@ -10,7 +10,7 @@
  1 file changed, 18 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c92f580..e495e29 100644
+index 1a259bd0..c1dcda11 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1760,6 +1760,23 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
diff --git a/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch b/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
index 6223e45..035119b 100644
--- a/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
@@ -1,4 +1,4 @@
-From 76b4963531910a40ec153e9d383cae8167347f0b Mon Sep 17 00:00:00 2001
+From d3d5ab6d6989272f28ebd5f5958371dc15c2864d Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
 Subject: [PATCH 2003/2012] wifi: mt76: mt7915: wed: find rx token by physical
@@ -13,7 +13,7 @@
  1 file changed, 24 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index bbae84f..fbf97ae 100644
+index 100d2aff..185c6f12 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -444,9 +444,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
diff --git a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 3b2ebdf..874394d 100644
--- a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,4 +1,4 @@
-From c11eefaf75f2b0a6ad64c16d5b5d8071b1c8d8b4 Mon Sep 17 00:00:00 2001
+From 26be0e657475d78affd162e5fffd29a12f41d197 Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
 Subject: [PATCH 2004/2012] wifi: mt76: mt7915: wed: HW ATF support for mt7986
@@ -16,10 +16,10 @@
  7 files changed, 796 insertions(+), 3 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e581084..7b61427 100644
+index 791dc1d4..f8f4eed6 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1201,6 +1201,7 @@ enum {
+@@ -1202,6 +1202,7 @@ enum {
  	MCU_EXT_CMD_THERMAL_CTRL = 0x2c,
  	MCU_EXT_CMD_WTBL_UPDATE = 0x32,
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
@@ -27,7 +27,7 @@
  	MCU_EXT_CMD_SET_RDD_CTRL = 0x3a,
  	MCU_EXT_CMD_ATE_CTRL = 0x3d,
  	MCU_EXT_CMD_PROTECT_CTRL = 0x3e,
-@@ -1210,6 +1211,7 @@ enum {
+@@ -1211,6 +1212,7 @@ enum {
  	MCU_EXT_CMD_MUAR_UPDATE = 0x48,
  	MCU_EXT_CMD_BCN_OFFLOAD = 0x49,
  	MCU_EXT_CMD_RX_AIRTIME_CTRL = 0x4a,
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 017d43d..d1e33ef 100644
+index e43bcabb..6dc07ff5 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -409,7 +409,7 @@
  static int
  mt7915_radar_trigger(void *data, u64 val)
  {
-@@ -1515,6 +1871,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1525,6 +1881,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
@@ -418,10 +418,10 @@
  	if (!dev->dbdc_support || phy->mt76->band_idx) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 32bbd6c..b62521f 100644
+index b299eccc..bf6b8631 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -610,10 +610,65 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -587,9 +587,64 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  	}
  }
  
@@ -482,12 +482,11 @@
  void mt7915_mac_init(struct mt7915_dev *dev)
  {
  	int i;
- 	u32 rx_len = is_mt7915(&dev->mt76) ? 0x400 : 0x680;
 +	struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
  
- 	/* config pse qid6 wfdma port selection */
- 	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -637,6 +692,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+ 	if (!is_mt7915(&dev->mt76))
+ 		mt76_clear(dev, MT_MDP_DCR2, MT_MDP_DCR2_RX_TRANS_SHORT);
+@@ -603,6 +658,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		mt7915_mac_init_band(dev, i);
  
  	mt7915_init_led_mux(dev);
@@ -498,7 +497,7 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index e495e29..374526b 100644
+index c1dcda11..4bbced00 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -226,6 +226,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
@@ -544,10 +543,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 465ab26..94c5c2e 100644
+index c92d6d9c..484d9869 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1765,7 +1765,7 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1865,7 +1865,7 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  {
  #define MT_STA_BSS_GROUP		1
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -556,7 +555,7 @@
  	struct {
  		__le32 action;
  		u8 wlan_idx_lo;
-@@ -1776,10 +1776,9 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1876,10 +1876,9 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		u8 rsv1[8];
  	} __packed req = {
  		.action = cpu_to_le32(MT_STA_BSS_GROUP),
@@ -568,7 +567,7 @@
  	req.wlan_idx_lo = to_wcid_lo(msta->wcid.idx);
  	req.wlan_idx_hi = to_wcid_hi(msta->wcid.idx);
  
-@@ -1837,6 +1836,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1937,6 +1936,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		mt7915_mcu_sta_bfee_tlv(dev, skb, vif, sta);
  	}
  
@@ -576,7 +575,7 @@
  	ret = mt7915_mcu_add_group(dev, vif, sta);
  	if (ret) {
  		dev_kfree_skb(skb);
-@@ -3796,6 +3796,169 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3896,6 +3896,169 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -747,7 +746,7 @@
  {
  #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8967a97..662d14e 100644
+index 1d0188d1..d779488a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -141,6 +141,58 @@ struct mt7915_twt_flow {
@@ -817,7 +816,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -474,6 +527,8 @@ struct mt7915_dev {
+@@ -490,6 +543,8 @@ struct mt7915_dev {
  #endif
  
  	struct delayed_work scs_work;
@@ -826,7 +825,7 @@
  
  	bool wmm_pbc_enable;
  	struct work_struct wmm_pbc_work;
-@@ -509,6 +564,15 @@ enum mt7915_rdd_cmd {
+@@ -526,6 +581,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -842,7 +841,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -638,6 +702,11 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -655,6 +719,11 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -855,7 +854,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 50e7b6c..c67448b 100644
+index bf419265..1d2699de 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1518,6 +1518,136 @@ static void chip_get_sta_pause(struct mt7915_dev *dev, u32 *sta_pause)
diff --git a/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch b/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
index 552939a..fa18615 100644
--- a/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
@@ -1,4 +1,4 @@
-From e31e574cddc41d2ea34a0097c7798579eccf14b0 Mon Sep 17 00:00:00 2001
+From b5642050026168aa74a868186c1ef5d8d1e45f1a Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 6 Jan 2023 18:18:50 +0800
 Subject: [PATCH 2005/2012] wifi: mt76: mt7915: wed: add rxwi for further in
@@ -17,7 +17,7 @@
  8 files changed, 87 insertions(+), 80 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index fbf97ae..53597b5 100644
+index 185c6f12..9cd97d24 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -64,17 +64,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -226,7 +226,7 @@
  		if (drop)
  			*drop |= !!(buf1 & MT_DMA_CTL_WO_DROP);
  	} else {
-@@ -543,7 +544,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -547,7 +548,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
  	buf.len = skb->len;
  
  	spin_lock_bh(&q->lock);
@@ -235,7 +235,7 @@
  	mt76_dma_kick_queue(dev, q);
  	spin_unlock_bh(&q->lock);
  
-@@ -623,7 +624,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -628,7 +629,7 @@ mt76_dma_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
  		goto unmap;
  
  	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
@@ -245,7 +245,7 @@
  unmap:
  	for (n--; n > 0; n--)
 diff --git a/mac80211.c b/mac80211.c
-index f9dfdf8..225b290 100644
+index f9dfdf8c..225b290c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -618,7 +618,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -265,7 +265,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index fd8e2ff..5485719 100644
+index d3c6ac0f..2e7585a8 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -193,6 +193,7 @@ struct mt76_queue_entry {
@@ -276,8 +276,8 @@
  		struct urb *urb;
  		int buf_sz;
  	};
-@@ -412,10 +413,15 @@ struct mt76_txwi_cache {
- 
+@@ -413,10 +414,15 @@ struct mt76_txwi_cache {
+ 	u8 phy_idx;
  	unsigned long jiffies;
  
 -	union {
@@ -296,7 +296,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -502,6 +508,7 @@ struct mt76_driver_ops {
+@@ -511,6 +517,7 @@ struct mt76_driver_ops {
  	u16 txwi_size;
  	u16 token_size;
  	u8 mcs_rates;
@@ -304,7 +304,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  
-@@ -893,7 +900,6 @@ struct mt76_dev {
+@@ -903,7 +910,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -312,7 +312,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1617,8 +1623,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1630,8 +1636,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -323,9 +323,9 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1796,9 +1802,9 @@ struct mt76_txwi_cache *
- mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
- int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
+@@ -1810,9 +1816,9 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
+ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi,
+ 		       u8 phy_idx);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
 -struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
 +struct mt76_rxwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
@@ -336,7 +336,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 0baa82c..552410a 100644
+index 0baa82c8..552410aa 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -512,7 +512,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -356,7 +356,7 @@
  		}
  
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 91100f1..3391a94 100644
+index 91100f15..3391a949 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -725,7 +725,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
@@ -377,7 +377,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 662d14e..410d47a 100644
+index d779488a..e41c7ad2 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -64,6 +64,7 @@
@@ -389,10 +389,10 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index d9731e5..ba7c13c 100644
+index db0d4df5..92afbf5d 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -850,16 +850,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+@@ -864,16 +864,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi,
  EXPORT_SYMBOL_GPL(mt76_token_consume);
  
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
@@ -413,7 +413,7 @@
  	}
  	spin_unlock_bh(&dev->rx_token_lock);
  
-@@ -896,15 +896,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+@@ -912,15 +912,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
  }
  EXPORT_SYMBOL_GPL(mt76_token_release);
  
@@ -434,7 +434,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 diff --git a/wed.c b/wed.c
-index 47c81a2..c03b52f 100644
+index 47c81a28..c03b52f9 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -16,18 +16,18 @@ void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
diff --git a/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch b/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch
index c5ed7a0..298c46f 100644
--- a/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2006-wifi-mt76-add-debugfs-knob-to-show-packet-error-rate.patch
@@ -1,7 +1,8 @@
-From 3fb67d2375966060b879d6435d089258a5f987b0 Mon Sep 17 00:00:00 2001
+From 1c795d48bb53932a89eb0b26bca07c5e2116c5a8 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 11 Jan 2023 10:56:27 +0800
-Subject: [PATCH] wifi: mt76: add debugfs knob to show packet error rate
+Subject: [PATCH 2006/2012] wifi: mt76: add debugfs knob to show packet error
+ rate
 
 Get tx count and tx failed from mcu command
 ---
@@ -14,7 +15,7 @@
  6 files changed, 194 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 5485719..3844e3b 100644
+index 2e7585a8..29e0b19d 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -321,8 +321,10 @@ struct mt76_sta_stats {
@@ -29,7 +30,7 @@
  	u64 rx_bytes;
  	u32 rx_packets;
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f8f4eed..438e87f 100644
+index f8f4eed6..438e87fe 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1200,6 +1200,7 @@ enum {
@@ -41,10 +42,10 @@
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
  	MCU_EXT_CMD_SET_FEATURE_CTRL = 0x38,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 579c431..d5216b8 100644
+index 484d9869..74d78559 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4550,6 +4550,114 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx)
+@@ -4564,6 +4564,114 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx)
  		return mt7915_mcu_get_tx_rate_v2(phy, wcidx);
  }
  
@@ -160,7 +161,7 @@
  				struct cfg80211_he_bss_color *he_bss_color)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 52baaa7..ec7ad7d 100644
+index 52baaa73..ec7ad7db 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -854,7 +854,8 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
@@ -199,10 +200,10 @@
     CAPI_SU,
     CAPI_MU,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f61aea2..929da03 100644
+index e41c7ad2..38d39c82 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -739,6 +739,7 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -753,6 +753,7 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
  				     struct cfg80211_chan_def *chandef);
  int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wcid);
@@ -211,10 +212,10 @@
  int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
  int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 4936c4b..6327ab8 100644
+index 1d2699de..e6130460 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -4008,6 +4008,66 @@ mt7915_sr_scene_cond_show(struct seq_file *file, void *data)
+@@ -4027,6 +4027,66 @@ mt7915_sr_scene_cond_show(struct seq_file *file, void *data)
  
  DEFINE_SHOW_ATTRIBUTE(mt7915_sr_scene_cond);
  
@@ -281,7 +282,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -4105,6 +4165,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -4124,6 +4184,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_file("thermal_recal", 0200, dir, dev, &fops_thermal_recal);
  	debugfs_create_file("sr_stats", 0400, dir, phy, &mt7915_sr_stats_fops);
  	debugfs_create_file("sr_scene_cond", 0400, dir, phy, &mt7915_sr_scene_cond_fops);
diff --git a/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch b/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
index b46568b..3715058 100644
--- a/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2007-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
@@ -1,4 +1,4 @@
-From 121430ff1e7bbfb0a4b5763275530a5cc8939634 Mon Sep 17 00:00:00 2001
+From 282185fa26949dced4c6bd06a6d6f729170d0348 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 6 Apr 2023 17:50:52 +0800
 Subject: [PATCH 2007/2012] wifi: mt76: mt7915: add ctxd support for mt7916
@@ -10,7 +10,7 @@
  2 files changed, 35 insertions(+)
 
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 552410a..4f9f5a3 100644
+index 552410aa..4f9f5a38 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -435,6 +435,26 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -41,7 +41,7 @@
  	} else {
  		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 3c2fd2d..32d1f1e 100644
+index ca355d14..d4acefca 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -607,6 +607,7 @@ enum offs_rev {
@@ -79,7 +79,7 @@
  #define MT_WFDMA_EXT_CSR_HIF_MISC	MT_WFDMA_EXT_CSR_PHYS(0x44)
  #define MT_WFDMA_EXT_CSR_HIF_MISC_BUSY	BIT(0)
  
-@@ -1187,6 +1201,7 @@ enum offs_rev {
+@@ -1189,6 +1203,7 @@ enum offs_rev {
  
  #define MT_HW_BOUND			0x70010020
  #define MT_HW_REV			0x70010204
diff --git a/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
index 47564fc..44d5b83 100644
--- a/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2008-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,4 +1,4 @@
-From 7873df2f26b6b5b22f8f6f696f4830a5282f6621 Mon Sep 17 00:00:00 2001
+From 8db2652823341170081e41f0fc118e92d39cc918 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sun, 4 Feb 2024 17:52:44 +0800
 Subject: [PATCH 2008/2012] wifi: mt76: connac: wed: add wed rx copy skb
@@ -10,7 +10,7 @@
  2 files changed, 80 insertions(+), 28 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 53597b5..2f108de 100644
+index 9cd97d24..d17fc88c 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -225,10 +225,10 @@ void mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
@@ -108,7 +108,7 @@
  }
  
  static int
-@@ -685,7 +720,7 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -690,7 +725,7 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  done:
  		qbuf.len = len - offset;
  		qbuf.skip_unmap = false;
@@ -117,7 +117,7 @@
  			dma_unmap_single(dev->dma_dev, addr, len,
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
-@@ -786,12 +821,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -791,12 +826,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	spin_unlock_bh(&q->lock);
  
@@ -138,7 +138,7 @@
  
  static void
 diff --git a/wed.c b/wed.c
-index c03b52f..70e4057 100644
+index c03b52f9..70e40575 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -9,12 +9,9 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch b/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch
index 257facf..c197e0a 100644
--- a/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch
@@ -1,4 +1,4 @@
-From ad0972dfe60c53c93dab73fd139e149a2e0ca66a Mon Sep 17 00:00:00 2001
+From 882d2d7237ee8da3198774b4dd794eec13709e48 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 8 Sep 2023 18:26:21 +0800
 Subject: [PATCH 2009/2012] wifi: mt76: mt7915: enable wa log to uart
@@ -9,10 +9,10 @@
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index d1e33ef..df110b0 100644
+index 6dc07ff5..05e9f60f 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
-@@ -940,7 +940,11 @@ mt7915_fw_debug_wa_set(void *data, u64 val)
+@@ -950,7 +950,11 @@ mt7915_fw_debug_wa_set(void *data, u64 val)
  	struct mt7915_dev *dev = data;
  	int ret;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch b/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch
index 942738c..cd76ab3 100644
--- a/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch
@@ -1,4 +1,4 @@
-From c93ac32c9f173fae7d662f7ff8d51667e4aff89b Mon Sep 17 00:00:00 2001
+From 0bb284eee7e9fc01d534c2222f8c5263f64d57ff Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 8 Sep 2023 18:29:32 +0800
 Subject: [PATCH 2010/2012] wifi: mt76: mt7915: add error message when driver
@@ -10,10 +10,10 @@
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 53a8f97..882d812 100644
+index 1c8b8732..3f907e61 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -999,6 +999,12 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1007,6 +1007,12 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			} else {
  				msdu = FIELD_GET(MT_TX_FREE_MSDU_ID, info);
  			}
diff --git a/recipes-wifi/linux-mt76/files/patches/2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch b/recipes-wifi/linux-mt76/files/patches/2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch
index 12322c8..ff56aba 100644
--- a/recipes-wifi/linux-mt76/files/patches/2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch
@@ -1,4 +1,4 @@
-From cea4cefe43864504c91e9c0e699237fb55b62208 Mon Sep 17 00:00:00 2001
+From 8cdf0951f353ce7d4c5b67e3d4cab4694334c612 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Mon, 11 Sep 2023 17:57:32 +0800
 Subject: [PATCH 2011/2012] wifi: mt76: mt7915: wed: change wed token init size
@@ -11,12 +11,12 @@
  mt7915/mcu.c    |  7 +++++--
  mt7915/mmio.c   |  9 ++++++---
  mt7915/mt7915.h |  4 +++-
- tx.c            | 26 ++++++++------------------
+ tx.c            | 23 +++++++----------------
  wed.c           |  4 ++--
- 7 files changed, 34 insertions(+), 28 deletions(-)
+ 7 files changed, 33 insertions(+), 26 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 3844e3b..2adfa94 100644
+index 29e0b19d..b6292e37 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -29,6 +29,8 @@
@@ -29,10 +29,10 @@
  #define MT_QFLAG_WED_TYPE	GENMASK(4, 2)
  #define MT_QFLAG_WED		BIT(5)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 882d812..51e2f24 100644
+index 3f907e61..02f794d4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -932,7 +932,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -940,7 +940,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	v3 = (FIELD_GET(MT_TX_FREE_VER, txd) == 0x4);
  
  	for (cur_info = tx_info; count < total; cur_info++) {
@@ -41,7 +41,7 @@
  		u8 i;
  
  		if (WARN_ON_ONCE((void *)cur_info >= end))
-@@ -988,6 +988,12 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -996,6 +996,12 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			wcid->stats.tx_failed += tx_failed;
  		}
  
@@ -54,7 +54,7 @@
  		if (v3 && (info & MT_TX_FREE_MPDU_HEADER_V3))
  			continue;
  
-@@ -1001,7 +1007,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1009,7 +1015,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			}
  
  			/* Todo: check if msdu is sw token */
@@ -64,10 +64,10 @@
  					msdu);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3e0acc0..c052774 100644
+index 74d78559..6a119ba3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2408,6 +2408,9 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2508,6 +2508,9 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  static int mt7915_red_set_watermark(struct mt7915_dev *dev)
  {
  #define RED_GLOBAL_TOKEN_WATERMARK 2
@@ -77,7 +77,7 @@
  	struct {
  		__le32 args[3];
  		u8 cmd;
-@@ -2421,8 +2424,8 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
+@@ -2521,8 +2524,8 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
  		.args[0] = cpu_to_le32(MCU_WA_PARAM_RED_SETTING),
  		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
  		.len = cpu_to_le16(sizeof(req) - sizeof(req.args)),
@@ -89,7 +89,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 3391a94..6309dd9 100644
+index 3391a949..6309dd91 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -695,11 +695,14 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
@@ -119,7 +119,7 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0c1ada2..f95ed89 100644
+index 38d39c82..c5bacf8b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,7 +62,9 @@
@@ -134,28 +134,37 @@
  #define MT7915_RX_TOKEN_SIZE		4096
  
 diff --git a/tx.c b/tx.c
-index ba7c13c..b1d8b32 100644
+index 92afbf5d..df2bb07d 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -826,20 +826,18 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
- 
- int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+@@ -828,7 +828,7 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi,
+ 		       u8 phy_idx)
  {
+ 	struct mt76_phy *phy = phy_idx < __MT_MAX_BAND ? dev->phys[phy_idx] : NULL;
 -	int token;
 +	int token, start = 0;
-+
-+	if (mtk_wed_device_active(&dev->mmio.wed))
-+		start = dev->mmio.wed.wlan.nbuf;
  
  	spin_lock_bh(&dev->token_lock);
  
+@@ -838,8 +838,12 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi,
+ 		return -EINVAL;
+ 	}
+ 
 -	token = idr_alloc(&dev->token, *ptxwi, 0, dev->token_size, GFP_ATOMIC);
--	if (token >= 0)
+-	if (token >= 0) {
++	if (mtk_wed_device_active(&dev->mmio.wed))
++		start = dev->mmio.wed.wlan.nbuf;
++
 +	token = idr_alloc(&dev->token, *ptxwi, start, start + dev->token_size,
 +			  GFP_ATOMIC);
-+	if (token >= start)
++	if (token >= start) {
  		dev->token_count++;
  
+ 		if (dev->num_phy > 1 && phy) {
+@@ -848,12 +852,6 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi,
+ 		}
+ 	}
+ 
 -#ifdef CONFIG_NET_MEDIATEK_SOC_WED
 -	if (mtk_wed_device_active(&dev->mmio.wed) &&
 -	    token >= dev->mmio.wed.wlan.token_start)
@@ -165,27 +174,22 @@
  	if (dev->token_count >= dev->token_size - MT76_TOKEN_FREE_THR)
  		__mt76_set_tx_blocked(dev, true);
  
-@@ -875,17 +873,9 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
- 	spin_lock_bh(&dev->token_lock);
- 
- 	txwi = idr_remove(&dev->token, token);
--	if (txwi) {
-+	if (txwi)
+@@ -893,13 +891,6 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
  		dev->token_count--;
- 
+ 		if (dev->num_phy > 1 && dev->phys[txwi->phy_idx])
+ 			dev->phys[txwi->phy_idx]->tokens--;
+-
 -#ifdef CONFIG_NET_MEDIATEK_SOC_WED
 -		if (mtk_wed_device_active(&dev->mmio.wed) &&
 -		    token >= dev->mmio.wed.wlan.token_start &&
 -		    --dev->wed_token_count == 0)
 -			wake_up(&dev->tx_wait);
 -#endif
--	}
--
+ 	}
+ 
  	if (dev->token_count < dev->token_size - MT76_TOKEN_FREE_THR &&
- 	    dev->phy.q_tx[0]->blocked)
- 		*wake = true;
 diff --git a/wed.c b/wed.c
-index 70e4057..5ed681e 100644
+index 70e40575..5ed681ed 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -118,7 +118,7 @@ int mt76_wed_offload_enable(struct mtk_wed_device *wed)
diff --git a/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch b/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
index afb19e1..3a38056 100644
--- a/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
@@ -1,4 +1,4 @@
-From 7eabaa784be431f18204f1e2a10ed6e7c851149d Mon Sep 17 00:00:00 2001
+From ca35a66efa9c8b98343afd5036453a0e33488d87 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 1 Nov 2023 07:50:08 +0800
 Subject: [PATCH 2012/2012] wifi: mt76: mt7915: wed: add per bss statistic info
@@ -14,7 +14,7 @@
  7 files changed, 78 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index b62521f..9ab6752 100644
+index bf6b8631..b463de8d 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -400,6 +400,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
@@ -26,10 +26,10 @@
  	if (!is_mt7915(&dev->mt76))
  		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STA_TX_PWR);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 51e2f24..7b3963f 100644
+index 02f794d4..0c121700 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1067,6 +1067,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+@@ -1071,6 +1071,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  	struct mt7915_phy *phy;
  	struct mt76_wcid *wcid;
  	__le32 *txs_data = data;
@@ -37,7 +37,7 @@
  	u16 wcidx;
  	u8 pid;
  
-@@ -1085,6 +1086,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+@@ -1089,6 +1090,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  	if (!wcid)
  		goto out;
  
@@ -45,7 +45,7 @@
  	msta = container_of(wcid, struct mt7915_sta, wcid);
  
  	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == MT_TXS_PPDU_FMT)
-@@ -1095,6 +1097,24 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+@@ -1099,6 +1101,24 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  	if (!wcid->sta)
  		goto out;
  
@@ -70,7 +70,7 @@
  	spin_lock_bh(&dev->mt76.sta_poll_lock);
  	if (list_empty(&msta->wcid.poll_list))
  		list_add_tail(&msta->wcid.poll_list, &dev->mt76.sta_poll_list);
-@@ -2088,6 +2108,7 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+@@ -2043,6 +2063,7 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
  		spin_unlock_bh(&phy->stats_lock);
  
  		mt7915_mcu_get_tx_rate(phy, sta->wcid.idx);
@@ -79,7 +79,7 @@
  		spin_lock_bh(&phy->stats_lock);
  	}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 374526b..c4e0dbc 100644
+index 4bbced00..70771ee5 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1220,7 +1220,7 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
@@ -92,10 +92,10 @@
  			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
  		}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index c052774..50db7f2 100644
+index 6a119ba3..d852f4a1 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4645,7 +4645,8 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -4749,7 +4749,8 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -105,7 +105,7 @@
  {
  	struct {
  		__le32 cmd;
-@@ -4707,11 +4708,34 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
+@@ -4805,11 +4806,34 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
  	rcu_read_lock();
  
  	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
@@ -143,7 +143,7 @@
  out:
  	dev_kfree_skb(skb);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6309dd9..142f308 100644
+index 6309dd91..142f3085 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -592,7 +592,7 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
@@ -189,10 +189,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f95ed89..aa02b26 100644
+index c5bacf8b..696b64e7 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -737,7 +737,8 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -754,7 +754,8 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta, struct rate_info *rate);
  int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
  				     struct cfg80211_chan_def *chandef);
@@ -203,10 +203,10 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
  int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f551149..7078da2 100644
+index e6130460..692ad153 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3973,7 +3973,7 @@ static int mt7915_reset_counter(void *data, u64 val)
+@@ -4034,7 +4034,7 @@ static int mt7915_reset_counter(void *data, u64 val)
  	struct mt76_wcid *wcid;
  
  	/* Clear the firmware counters */
diff --git a/recipes-wifi/linux-mt76/files/patches/2999-wifi-mt76-mt7915-support-backaward-compatiable.patch b/recipes-wifi/linux-mt76/files/patches/2999-wifi-mt76-mt7915-support-backaward-compatiable.patch
index a63471d..7b292e3 100644
--- a/recipes-wifi/linux-mt76/files/patches/2999-wifi-mt76-mt7915-support-backaward-compatiable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2999-wifi-mt76-mt7915-support-backaward-compatiable.patch
@@ -1,52 +1,48 @@
-From 8e71bf60aeb05d38f45e680d55ffdb894f8af4bc Mon Sep 17 00:00:00 2001
+From d84a40f891ab0dd733ab8d4652c81900809ced85 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Mon, 11 Dec 2023 19:21:16 +0800
 Subject: [PATCH] wifi: mt76: mt7915: support backaward compatiable
 
 ---
- wed.c | 22 +---------------------
- 1 file changed, 1 insertion(+), 21 deletions(-)
+ mt7915/mmio.c | 4 ++--
+ wed.c         | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
 
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 142f3085..11db3eda 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -697,7 +697,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 					 MT_RXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_rx_glo = pci_resource_start(pci_dev, 0) +
+ 					 MT_WPDMA_GLO_CFG;
+-		wed->wlan.wpdma_rx = pci_resource_start(pci_dev, 0) +
++		wed->wlan.wpdma_rx[0] = pci_resource_start(pci_dev, 0) +
+ 				     MT_RXQ_WED_DATA_RING_BASE;
+ 	} else {
+ 		struct platform_device *plat_dev = pdev_ptr;
+@@ -717,7 +717,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
+-		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
++		wed->wlan.wpdma_rx[0] = res->start + MT_RXQ_WED_DATA_RING_BASE;
+ 	}
+ 
+ 	wed->wlan.nbuf = is_mt7915(&dev->mt76) ?
 diff --git a/wed.c b/wed.c
-index 5ed681e..2d6a944 100644
+index 5ed681ed..652f59e1 100644
 --- a/wed.c
 +++ b/wed.c
-@@ -55,7 +55,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_release_rx_buf);
- u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
- {
- 	struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
--	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
-+	struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
- 	u32 length;
- 	int i;
- 
-@@ -166,26 +166,6 @@ int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
- 		if (!ret)
- 			q->wed_regs = q->wed->rx_ring[ring].reg_base;
+@@ -175,7 +175,7 @@ int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  		break;
--	case MT76_WED_RRO_Q_DATA:
--		q->flags &= ~MT_QFLAG_WED;
--		__mt76_dma_queue_reset(dev, q, false);
--		mtk_wed_device_rro_rx_ring_setup(q->wed, ring, q->regs);
--		q->head = q->ndesc - 1;
--		q->queued = q->head;
--		break;
--	case MT76_WED_RRO_Q_MSDU_PG:
--		q->flags &= ~MT_QFLAG_WED;
+ 	case MT76_WED_RRO_Q_MSDU_PG:
+ 		q->flags &= ~MT_QFLAG_WED;
 -		__mt76_dma_queue_reset(dev, q);
--		mtk_wed_device_msdu_pg_rx_ring_setup(q->wed, ring, q->regs);
--		q->head = q->ndesc - 1;
--		q->queued = q->head;
--		break;
--	case MT76_WED_RRO_Q_IND:
--		q->flags &= ~MT_QFLAG_WED;
--		mt76_dma_queue_reset(dev, q);
--		mt76_dma_rx_fill(dev, q);
--		mtk_wed_device_ind_rx_ring_setup(q->wed, q->regs);
--		break;
- 	default:
- 		ret = -EINVAL;
- 		break;
++		__mt76_dma_queue_reset(dev, q, false);
+ 		mtk_wed_device_msdu_pg_rx_ring_setup(q->wed, ring, q->regs);
+ 		q->head = q->ndesc - 1;
+ 		q->queued = q->head;
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
index 29d5c81..2fbab67 100644
--- a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,4 +1,4 @@
-From 9457a43b37b21a14e19fbfc2833f891cb3456c60 Mon Sep 17 00:00:00 2001
+From b0c3c110928125de65c3386c3d7a600727da6aeb Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 5 Apr 2023 08:29:19 +0800
 Subject: [PATCH] mt76: revert for backports-5.15 wireless stack
@@ -24,10 +24,10 @@
  16 files changed, 259 insertions(+), 225 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 2f108de..6ec0715 100644
+index d17fc88c..f838d835 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -1013,7 +1013,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -1018,7 +1018,7 @@ mt76_dma_init(struct mt76_dev *dev,
  	init_completion(&dev->mmio.wed_reset_complete);
  
  	mt76_for_each_q_rx(dev, i) {
@@ -37,7 +37,7 @@
  		napi_enable(&dev->napi[i]);
  	}
 diff --git a/mac80211.c b/mac80211.c
-index 225b290..54e0c8a 100644
+index 225b290c..54e0c8a4 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1058,14 +1058,9 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
@@ -77,7 +77,7 @@
  
  	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
 diff --git a/mt7615/dma.c b/mt7615/dma.c
-index e7135b2..6767c39 100644
+index e7135b2f..6767c39d 100644
 --- a/mt7615/dma.c
 +++ b/mt7615/dma.c
 @@ -282,8 +282,8 @@ int mt7615_dma_init(struct mt7615_dev *dev)
@@ -92,7 +92,7 @@
  
  	mt76_poll(dev, MT_WPDMA_GLO_CFG,
 diff --git a/mt7615/main.c b/mt7615/main.c
-index dab16b5..d32a752 100644
+index dab16b5f..d32a7520 100644
 --- a/mt7615/main.c
 +++ b/mt7615/main.c
 @@ -473,7 +473,7 @@ static int mt7615_config(struct ieee80211_hw *hw, u32 changed)
@@ -123,7 +123,7 @@
  	if (changed & BSS_CHANGED_MU_GROUPS)
  		 mt7615_update_mu_group(hw, vif, info);
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index c9444c6..466f38e 100644
+index c9444c6d..466f38e9 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -353,7 +353,7 @@ out:
@@ -163,7 +163,7 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index d41f004..abb95b3 100644
+index d41f0040..abb95b38 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -1114,7 +1114,7 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
@@ -176,7 +176,7 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index e23dd77..e6c0f51 100644
+index 774f5754..98e5ecd9 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -199,7 +199,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
@@ -550,7 +550,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
  }
 diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-index d5db6ff..fec3d10 100644
+index d5db6ffd..fec3d10d 100644
 --- a/mt76x02_mac.c
 +++ b/mt76x02_mac.c
 @@ -404,7 +404,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
@@ -575,10 +575,10 @@
  		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
  			ba_size = 0;
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index df110b0..49756ea 100644
+index 05e9f60f..6b66c92f 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
-@@ -2041,8 +2041,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
+@@ -2051,8 +2051,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
  
  	phy.ldpc = (phy.bw || phy.ldpc) * GENMASK(2, 0);
  	for (i = 0; i <= phy.bw; i++) {
@@ -590,7 +590,7 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 4f9f5a3..fde6a38 100644
+index 4f9f5a38..fde6a385 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -596,8 +596,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -605,10 +605,10 @@
  
  	mt7915_dma_enable(dev, false);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 9ab6752..bb6b746 100644
+index b463de8d..127530ba 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1184,8 +1184,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -1154,8 +1154,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  			mt76_connac_gen_ppe_thresh(he_cap->ppe_thres, nss);
  		} else {
  			he_cap_elem->phy_cap_info[9] |=
@@ -619,7 +619,7 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c4e0dbc..8b6a4df 100644
+index 70771ee5..27025743 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -547,7 +547,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -711,7 +711,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 50db7f2..04cc72e 100644
+index d852f4a1..df1d0281 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -67,7 +67,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
@@ -765,7 +765,7 @@
  }
  
  static int
-@@ -236,7 +236,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+@@ -243,7 +243,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
  static void
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -774,7 +774,7 @@
  		return;
  
  	ieee80211_csa_finish(vif);
-@@ -339,7 +339,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -349,7 +349,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
  static void
  mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -783,7 +783,7 @@
  		return;
  
  	ieee80211_color_change_finish(vif);
-@@ -844,13 +844,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -944,13 +944,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  		      struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -799,7 +799,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -936,8 +936,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -1036,8 +1036,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -810,7 +810,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -987,7 +987,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1087,7 +1087,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -819,7 +819,7 @@
  	struct mt7915_phy *phy = mvif->phy;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
-@@ -1012,11 +1012,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1112,11 +1112,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
  
@@ -834,7 +834,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -1052,13 +1052,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1152,13 +1152,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_ht *ht;
  	struct tlv *tlv;
  
@@ -850,7 +850,7 @@
  }
  
  static void
-@@ -1067,15 +1067,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1167,15 +1167,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
  
@@ -870,7 +870,7 @@
  }
  
  static void
-@@ -1090,7 +1090,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1190,7 +1190,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -879,7 +879,7 @@
  	    return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -1099,7 +1099,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1199,7 +1199,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	amsdu->amsdu_en = true;
  	msta->wcid.amsdu = true;
  
@@ -888,7 +888,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		if (!is_mt7915(&dev->mt76)) {
  			amsdu->max_mpdu_size =
-@@ -1162,8 +1162,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1262,8 +1262,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	if (!bfee && sts < 2)
  		return false;
  
@@ -899,7 +899,7 @@
  
  		if (bfee)
  			return mvif->cap.he_su_ebfee &&
-@@ -1173,8 +1173,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1273,8 +1273,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -910,7 +910,7 @@
  
  		if (bfee)
  			return mvif->cap.vht_su_ebfee &&
-@@ -1200,7 +1200,7 @@ static void
+@@ -1300,7 +1300,7 @@ static void
  mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		       struct sta_rec_bf *bf)
  {
@@ -919,7 +919,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1225,7 +1225,7 @@ static void
+@@ -1325,7 +1325,7 @@ static void
  mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  			struct sta_rec_bf *bf, bool explicit)
  {
@@ -928,7 +928,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1246,14 +1246,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
+@@ -1346,14 +1346,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -945,7 +945,7 @@
  			bf->ibf_nrow = 1;
  	}
  }
-@@ -1262,7 +1262,7 @@ static void
+@@ -1362,7 +1362,7 @@ static void
  mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
  {
@@ -954,7 +954,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1287,7 +1287,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1387,7 +1387,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -963,7 +963,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1335,7 +1335,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1435,7 +1435,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -972,7 +972,7 @@
  		return;
  
  	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1349,21 +1349,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1449,21 +1449,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -1000,7 +1000,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1373,7 +1373,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1473,7 +1473,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -1009,7 +1009,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1398,7 +1398,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1498,7 +1498,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -1018,7 +1018,7 @@
  		return;
  
  	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1407,13 +1407,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1507,13 +1507,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
  	bfee = (struct sta_rec_bfee *)tlv;
  
@@ -1036,7 +1036,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1469,7 +1469,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -1569,7 +1569,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -1045,7 +1045,7 @@
  		break;
  	case RATE_PARAM_SPE_UPDATE:
  		ra->spe_idx = *(u8 *)data;
-@@ -1545,7 +1545,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1645,7 +1645,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  	do {									\
  		u8 i, gi = mask->control[band]._gi;				\
  		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
@@ -1054,7 +1054,7 @@
  			phy.sgi |= gi << (i << (_he));				\
  			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
  		}								\
-@@ -1559,11 +1559,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1659,11 +1659,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		}								\
  	} while (0)
  
@@ -1069,7 +1069,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -1597,7 +1597,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1697,7 +1697,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		 * actual txrate hardware sends out.
  		 */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
@@ -1078,7 +1078,7 @@
  			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1630,7 +1630,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1730,7 +1730,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra *ra;
  	struct tlv *tlv;
@@ -1087,7 +1087,7 @@
  	u32 cap = sta->wme ? STA_CAP_WMM : 0;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1640,9 +1640,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1740,9 +1740,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	ra->auto_rate = true;
  	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
  	ra->channel = chandef->chan->hw_value;
@@ -1100,7 +1100,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -1662,22 +1662,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1762,22 +1762,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		}
  	}
  
@@ -1131,7 +1131,7 @@
  			cap |= STA_CAP_LDPC;
  
  		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1685,37 +1685,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1785,37 +1785,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
  	}
  
@@ -1179,7 +1179,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  
-@@ -1924,7 +1924,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -2024,7 +2024,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1188,7 +1188,7 @@
  	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
  					   &bcn->sub_ntlv, &bcn->len);
  	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -2009,9 +2009,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -2109,9 +2109,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1200,7 +1200,7 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -2021,6 +2021,85 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -2121,6 +2121,85 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
  }
  
@@ -1286,7 +1286,7 @@
  int
  mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  			     u32 changed)
-@@ -2133,7 +2212,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif, in
+@@ -2233,7 +2312,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif, in
  	if (!en)
  		goto out;
  
@@ -1295,7 +1295,7 @@
  	if (!skb) {
  		dev_kfree_skb(rskb);
  		return -EINVAL;
-@@ -2149,6 +2228,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif, in
+@@ -2249,6 +2328,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif, in
  	info = IEEE80211_SKB_CB(skb);
  	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
  
@@ -1303,7 +1303,7 @@
  	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
  	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
  	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
-@@ -3446,17 +3526,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3546,17 +3626,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1325,7 +1325,7 @@
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index ecd6271..b2c442b 100644
+index ecd62712..b2c442b0 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -418,12 +418,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
@@ -1346,7 +1346,7 @@
  	sta->wme = 1;
  
 diff --git a/tx.c b/tx.c
-index b1d8b32..1442050 100644
+index df2bb07d..45567ea2 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
@@ -1402,7 +1402,7 @@
  		ieee80211_tx_status_ext(hw, &status);
  		spin_unlock_bh(&dev->rx_lock);
 diff --git a/wed.c b/wed.c
-index 2d6a944..5b3da09 100644
+index 652f59e1..1c2ad302 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -80,6 +80,7 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index c51416d..a4736a8 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -10,60 +10,65 @@
     file://0008-wifi-mt76-mt7915-add-support-for-realtime-Rx-rate-up.patch \
     file://0009-wifi-mt76-mt7915-remove-redundant-argument-in-add_be.patch \
     file://0010-wifi-mt76-mt7915-add-support-for-WMM-PBC-configurati.patch \
-    file://0011-wifi-mt76-mt7915-fix-mcu-command-format-for-mt7915-t.patch \
-    file://0012-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch \
-    file://0013-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch \
+    file://0011-wifi-mt76-fix-tx-statistics-about-tx-retry-and-tx-fa.patch \
+    file://0012-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch \
+    file://0013-wifi-mt76-mt7915-limit-per-band-token-count.patch \
+    file://0014-wifi-mt76-mt7915-update-power-on-sequence.patch \
     file://0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch \
     file://1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch \
     file://1001-wifi-mt76-mt7915-csi-implement-csi-support.patch \
     file://1002-wifi-mt76-mt7915-air-monitor-support.patch \
     file://1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch \
     file://1004-wifi-mt76-mt7915-certification-patches.patch \
-    file://1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch \
-    file://1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
-    file://1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch \
-    file://1008-wifi-mt76-testmode-rework-testmode-init-registers.patch \
-    file://1009-wifi-mt76-testmode-additional-supports.patch \
-    file://1010-wifi-mt76-testmode-add-pre-cal-support.patch \
-    file://1011-wifi-mt76-testmode-add-iBF-command-mode-support.patch \
-    file://1012-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch \
-    file://1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch \
-    file://1014-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1015-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch \
-    file://1016-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch \
-    file://1017-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch \
-    file://1018-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch \
-    file://1019-wifi-mt76-mt7915-implement-bin-file-mode.patch \
-    file://1020-wifi-mt76-mt7915-Add-mu-dump-support.patch \
-    file://1021-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch \
-    file://1022-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
-    file://1023-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch \
-    file://1024-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch \
-    file://1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
-    file://1026-wifi-mt76-mt7915-amsdu-set-and-get-control.patch \
-    file://1027-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch \
-    file://1028-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch \
-    file://1029-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch \
-    file://1030-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch \
-    file://1031-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch \
-    file://1032-wifi-mt76-mt7915-remove-BW160-support.patch \
-    file://1033-wifi-mt76-mt7915-add-txpower-info-dump-support.patch \
-    file://1034-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch \
-    file://1035-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch \
-    file://1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch \
-    file://1037-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch \
-    file://1038-wifi-mt76-update-debugfs-knob-to-dump-token-pending-.patch \
-    file://1039-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch \
-    file://1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch \
-    file://1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch \
-    file://1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch \
-    file://1043-wifi-mt76-testmode-add-cheetah-support.patch \
-    file://1044-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch \
-    file://1045-wifi-mt76-mt7915-support-scs-feature.patch \
-    file://1046-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch \
-    file://1047-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch \
-    file://1048-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch \
-    file://1049-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch \
+    file://1005-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
+    file://1006-wifi-mt76-mt7915-drop-undefined-action-frame.patch \
+    file://1007-wifi-mt76-testmode-rework-testmode-init-registers.patch \
+    file://1008-wifi-mt76-testmode-additional-supports.patch \
+    file://1009-wifi-mt76-testmode-add-pre-cal-support.patch \
+    file://1010-wifi-mt76-testmode-add-iBF-command-mode-support.patch \
+    file://1011-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch \
+    file://1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch \
+    file://1013-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch \
+    file://1014-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch \
+    file://1015-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch \
+    file://1016-wifi-mt76-mt7915-implement-bin-file-mode.patch \
+    file://1017-wifi-mt76-mt7915-Add-mu-dump-support.patch \
+    file://1018-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch \
+    file://1019-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
+    file://1020-wifi-mt76-mt7915-add-cal-free-data-merge-support.patch \
+    file://1021-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch \
+    file://1022-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
+    file://1023-wifi-mt76-mt7915-amsdu-set-and-get-control.patch \
+    file://1024-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch \
+    file://1025-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch \
+    file://1026-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch \
+    file://1027-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch \
+    file://1028-wifi-mt76-mt7915-add-debugfs-for-fw-coredump.patch \
+    file://1029-wifi-mt76-mt7915-remove-BW160-support.patch \
+    file://1030-wifi-mt76-mt7915-add-txpower-info-dump-support.patch \
+    file://1031-wifi-mt76-mt7915-report-tx-and-rx-byte-to-tpt_led-wh.patch \
+    file://1032-wifi-mt76-mt7915-Establish-BA-in-VO-queue.patch \
+    file://1033-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch \
+    file://1034-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch \
+    file://1035-wifi-mt76-update-debugfs-knob-for-tx-tokens.patch \
+    file://1036-wifi-mt76-mt7915-support-enable-disable-spatial-reus.patch \
+    file://1037-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch \
+    file://1038-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch \
+    file://1039-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch \
+    file://1040-wifi-mt76-mt7915-add-mt7981-efuse-variants-support.patch \
+    file://1041-wifi-mt76-mt7915-support-scs-feature.patch \
+    file://1042-wifi-mt76-mt7915-support-thermal-recal-debug-commnad.patch \
+    file://1043-wifi-mt76-mt7915-Add-support-for-lpi-and-duplicate-m.patch \
+    file://1044-wifi-mt76-testmode-add-cheetah-support.patch \
+    file://1045-wifi-mt76-mt7915-add-no_beacon-vendor-command-for-ce.patch \
+    file://1046-wifi-mt76-mt7915-support-spatial-reuse-debug-command.patch \
+    file://1047-wifi-mt76-try-more-times-when-send-message-timeout.patch \
+    file://1048-wifi-mt76-mt7915-add-SER-overlap-handle.patch \
+    file://1049-wifi-mt76-mt7915-add-background-radar-hw-cap-check.patch \
+    file://1050-wifi-mt76-mt7915-remove-unnecessary-register-setting.patch \
+    file://1051-wifi-mt76-mt7915-add-foolproof-mechanism-for-ZWDFS-d.patch \
+    file://1054-wifi-mt76-mt7915-assign-DEAUTH-to-ALTX-queue-for.patch \
+    file://1055-wifi-mt76-mt7915-set-channel-after-sta-is-associated.patch \
     file://2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch \
     file://2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch \
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_eeprom_tm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_eeprom_tm.bin
deleted file mode 100755
index 0ff5567..0000000
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_eeprom_tm.bin
+++ /dev/null
Binary files differ