diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0000-wifi-mt76-api_update.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0000-wifi-mt76-api_update.patch
deleted file mode 100644
index 7105734..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0000-wifi-mt76-api_update.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 44d055ff8225e0d6110048d8c02de526bf5152b2 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 31 Mar 2023 14:38:44 +0800
-Subject: [PATCH] wifi: mt76: api_update
-
----
- tx.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tx.c b/tx.c
-index 1f309d0..3ad9742 100644
---- a/tx.c
-+++ b/tx.c
-@@ -330,7 +330,7 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
- 	if ((dev->drv->drv_flags & MT_DRV_HW_MGMT_TXQ) &&
- 	    !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
- 	    !ieee80211_is_data(hdr->frame_control) &&
--	    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
-+	    !ieee80211_is_bufferable_mmpdu(skb)) {
- 		qid = MT_TXQ_PSD;
- 	}
- 
--- 
-2.39.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0000-wifi-mt76-ignore-key-disable-commands.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0000-wifi-mt76-ignore-key-disable-commands.patch
deleted file mode 100644
index 78b70d7..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0000-wifi-mt76-ignore-key-disable-commands.patch
+++ /dev/null
@@ -1,326 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 22 Mar 2023 10:17:49 +0100
-Subject: [PATCH] wifi: mt76: ignore key disable commands
-
-This helps avoid cleartext leakage of already queued or powersave buffered
-packets, when a reassoc triggers the key deletion.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/mt7603/main.c
-+++ b/mt7603/main.c
-@@ -512,15 +512,15 @@ mt7603_set_key(struct ieee80211_hw *hw,
- 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
- 		return -EOPNOTSUPP;
- 
--	if (cmd == SET_KEY) {
--		key->hw_key_idx = wcid->idx;
--		wcid->hw_key_idx = idx;
--	} else {
-+	if (cmd != SET_KEY) {
- 		if (idx == wcid->hw_key_idx)
- 			wcid->hw_key_idx = -1;
- 
--		key = NULL;
-+		return 0;
- 	}
-+
-+	key->hw_key_idx = wcid->idx;
-+	wcid->hw_key_idx = idx;
- 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 
- 	return mt7603_wtbl_set_key(dev, wcid->idx, key);
---- a/mt7615/mac.c
-+++ b/mt7615/mac.c
-@@ -1193,8 +1193,7 @@ EXPORT_SYMBOL_GPL(mt7615_mac_enable_rtsc
- static int
- mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
- 			   struct ieee80211_key_conf *key,
--			   enum mt76_cipher_type cipher, u16 cipher_mask,
--			   enum set_key_cmd cmd)
-+			   enum mt76_cipher_type cipher, u16 cipher_mask)
- {
- 	u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx) + 30 * 4;
- 	u8 data[32] = {};
-@@ -1203,27 +1202,18 @@ mt7615_mac_wtbl_update_key(struct mt7615
- 		return -EINVAL;
- 
- 	mt76_rr_copy(dev, addr, data, sizeof(data));
--	if (cmd == SET_KEY) {
--		if (cipher == MT_CIPHER_TKIP) {
--			/* Rx/Tx MIC keys are swapped */
--			memcpy(data, key->key, 16);
--			memcpy(data + 16, key->key + 24, 8);
--			memcpy(data + 24, key->key + 16, 8);
--		} else {
--			if (cipher_mask == BIT(cipher))
--				memcpy(data, key->key, key->keylen);
--			else if (cipher != MT_CIPHER_BIP_CMAC_128)
--				memcpy(data, key->key, 16);
--			if (cipher == MT_CIPHER_BIP_CMAC_128)
--				memcpy(data + 16, key->key, 16);
--		}
-+	if (cipher == MT_CIPHER_TKIP) {
-+		/* Rx/Tx MIC keys are swapped */
-+		memcpy(data, key->key, 16);
-+		memcpy(data + 16, key->key + 24, 8);
-+		memcpy(data + 24, key->key + 16, 8);
- 	} else {
-+		if (cipher_mask == BIT(cipher))
-+			memcpy(data, key->key, key->keylen);
-+		else if (cipher != MT_CIPHER_BIP_CMAC_128)
-+			memcpy(data, key->key, 16);
- 		if (cipher == MT_CIPHER_BIP_CMAC_128)
--			memset(data + 16, 0, 16);
--		else if (cipher_mask)
--			memset(data, 0, 16);
--		if (!cipher_mask)
--			memset(data, 0, sizeof(data));
-+			memcpy(data + 16, key->key, 16);
- 	}
- 
- 	mt76_wr_copy(dev, addr, data, sizeof(data));
-@@ -1234,7 +1224,7 @@ mt7615_mac_wtbl_update_key(struct mt7615
- static int
- mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid,
- 			  enum mt76_cipher_type cipher, u16 cipher_mask,
--			  int keyidx, enum set_key_cmd cmd)
-+			  int keyidx)
- {
- 	u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx), w0, w1;
- 
-@@ -1253,9 +1243,7 @@ mt7615_mac_wtbl_update_pk(struct mt7615_
- 	else
- 		w0 &= ~MT_WTBL_W0_RX_IK_VALID;
- 
--	if (cmd == SET_KEY &&
--	    (cipher != MT_CIPHER_BIP_CMAC_128 ||
--	     cipher_mask == BIT(cipher))) {
-+	if (cipher != MT_CIPHER_BIP_CMAC_128 || cipher_mask == BIT(cipher)) {
- 		w0 &= ~MT_WTBL_W0_KEY_IDX;
- 		w0 |= FIELD_PREP(MT_WTBL_W0_KEY_IDX, keyidx);
- 	}
-@@ -1272,19 +1260,10 @@ mt7615_mac_wtbl_update_pk(struct mt7615_
- 
- static void
- mt7615_mac_wtbl_update_cipher(struct mt7615_dev *dev, struct mt76_wcid *wcid,
--			      enum mt76_cipher_type cipher, u16 cipher_mask,
--			      enum set_key_cmd cmd)
-+			      enum mt76_cipher_type cipher, u16 cipher_mask)
- {
- 	u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx);
- 
--	if (!cipher_mask) {
--		mt76_clear(dev, addr + 2 * 4, MT_WTBL_W2_KEY_TYPE);
--		return;
--	}
--
--	if (cmd != SET_KEY)
--		return;
--
- 	if (cipher == MT_CIPHER_BIP_CMAC_128 &&
- 	    cipher_mask & ~BIT(MT_CIPHER_BIP_CMAC_128))
- 		return;
-@@ -1295,8 +1274,7 @@ mt7615_mac_wtbl_update_cipher(struct mt7
- 
- int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
- 			      struct mt76_wcid *wcid,
--			      struct ieee80211_key_conf *key,
--			      enum set_key_cmd cmd)
-+			      struct ieee80211_key_conf *key)
- {
- 	enum mt76_cipher_type cipher;
- 	u16 cipher_mask = wcid->cipher;
-@@ -1306,19 +1284,14 @@ int __mt7615_mac_wtbl_set_key(struct mt7
- 	if (cipher == MT_CIPHER_NONE)
- 		return -EOPNOTSUPP;
- 
--	if (cmd == SET_KEY)
--		cipher_mask |= BIT(cipher);
--	else
--		cipher_mask &= ~BIT(cipher);
--
--	mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask, cmd);
--	err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask,
--					 cmd);
-+	cipher_mask |= BIT(cipher);
-+	mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask);
-+	err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask);
- 	if (err < 0)
- 		return err;
- 
- 	err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, cipher_mask,
--					key->keyidx, cmd);
-+					key->keyidx);
- 	if (err < 0)
- 		return err;
- 
-@@ -1329,13 +1302,12 @@ int __mt7615_mac_wtbl_set_key(struct mt7
- 
- int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
- 			    struct mt76_wcid *wcid,
--			    struct ieee80211_key_conf *key,
--			    enum set_key_cmd cmd)
-+			    struct ieee80211_key_conf *key)
- {
- 	int err;
- 
- 	spin_lock_bh(&dev->mt76.lock);
--	err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
-+	err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
- 	spin_unlock_bh(&dev->mt76.lock);
- 
- 	return err;
---- a/mt7615/main.c
-+++ b/mt7615/main.c
-@@ -391,18 +391,17 @@ static int mt7615_set_key(struct ieee802
- 
- 	if (cmd == SET_KEY)
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	if (mt76_is_mmio(&dev->mt76))
--		err = mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
-+		err = mt7615_mac_wtbl_set_key(dev, wcid, key);
- 	else
--		err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
-+		err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
- 
- out:
- 	mt7615_mutex_release(dev);
---- a/mt7615/mt7615.h
-+++ b/mt7615/mt7615.h
-@@ -491,11 +491,9 @@ int mt7615_mac_write_txwi(struct mt7615_
- void mt7615_mac_set_timing(struct mt7615_phy *phy);
- int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
- 			      struct mt76_wcid *wcid,
--			      struct ieee80211_key_conf *key,
--			      enum set_key_cmd cmd);
-+			      struct ieee80211_key_conf *key);
- int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
--			    struct ieee80211_key_conf *key,
--			    enum set_key_cmd cmd);
-+			    struct ieee80211_key_conf *key);
- void mt7615_mac_reset_work(struct work_struct *work);
- u32 mt7615_mac_get_sta_tid_sn(struct mt7615_dev *dev, int wcid, u8 tid);
- 
---- a/mt76x02_util.c
-+++ b/mt76x02_util.c
-@@ -454,20 +454,20 @@ int mt76x02_set_key(struct ieee80211_hw
- 	msta = sta ? (struct mt76x02_sta *)sta->drv_priv : NULL;
- 	wcid = msta ? &msta->wcid : &mvif->group_wcid;
- 
--	if (cmd == SET_KEY) {
--		key->hw_key_idx = wcid->idx;
--		wcid->hw_key_idx = idx;
--		if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
--			key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
--			wcid->sw_iv = true;
--		}
--	} else {
-+	if (cmd != SET_KEY) {
- 		if (idx == wcid->hw_key_idx) {
- 			wcid->hw_key_idx = -1;
- 			wcid->sw_iv = false;
- 		}
- 
--		key = NULL;
-+		return 0;
-+	}
-+
-+	key->hw_key_idx = wcid->idx;
-+	wcid->hw_key_idx = idx;
-+	if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
-+		key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
-+		wcid->sw_iv = true;
- 	}
- 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -410,16 +410,15 @@ static int mt7915_set_key(struct ieee802
- 		mt7915_mcu_add_bss_info(phy, vif, true);
- 	}
- 
--	if (cmd == SET_KEY)
-+	if (cmd == SET_KEY) {
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	} else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
- 				      key, MCU_EXT_CMD(STA_REC_UPDATE),
- 				      &msta->wcid, cmd);
---- a/mt7921/main.c
-+++ b/mt7921/main.c
-@@ -569,16 +569,15 @@ static int mt7921_set_key(struct ieee802
- 
- 	mt7921_mutex_acquire(dev);
- 
--	if (cmd == SET_KEY)
-+	if (cmd == SET_KEY) {
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	} else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
- 				      key, MCU_UNI_CMD(STA_REC_UPDATE),
- 				      &msta->wcid, cmd);
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -351,16 +351,15 @@ static int mt7996_set_key(struct ieee802
- 		mt7996_mcu_add_bss_info(phy, vif, true);
- 	}
- 
--	if (cmd == SET_KEY)
-+	if (cmd == SET_KEY) {
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	} else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	err = mt7996_mcu_add_key(&dev->mt76, vif, &msta->bip,
- 				 key, MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
- 				 &msta->wcid, cmd);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
index c92c676..c927e1a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
@@ -1,7 +1,7 @@
-From 8537ca664de3e26b266e4b11f5b113f76371507c Mon Sep 17 00:00:00 2001
+From 31a7471ec1e183deafd9b28fd62cca3c25f79633 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 10 Feb 2023 17:39:23 +0800
-Subject: [PATCH 01/29] wifi: mt76: mt7996: add eht rx rate support
+Subject: [PATCH 01/22] wifi: mt76: mt7996: add eht rx rate support
 
 Add support to report eht rx rate.
 
@@ -14,7 +14,7 @@
  3 files changed, 27 insertions(+), 11 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 87902f4..e53166f 100644
+index 2c4a5290..467afef9 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1067,9 +1067,14 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
@@ -36,7 +36,7 @@
  	status->nss = mstat.nss;
  	status->band = mstat.band;
 diff --git a/mt76.h b/mt76.h
-index 183b0fc..c3d1313 100644
+index 8b4635e9..6b07b8fa 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -621,12 +621,22 @@ struct mt76_rx_status {
@@ -67,10 +67,10 @@
  	u8 chains;
  	s8 chain_signal[IEEE80211_MAX_CHAINS];
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 3c3506c..d811b4e 100644
+index 0d51090d..23cbfdde 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -572,11 +572,12 @@ mt7996_mac_fill_rx_rate(struct mt7996_dev *dev,
+@@ -580,11 +580,12 @@ mt7996_mac_fill_rx_rate(struct mt7996_dev *dev,
  	case MT_PHY_TYPE_EHT_SU:
  	case MT_PHY_TYPE_EHT_TRIG:
  	case MT_PHY_TYPE_EHT_MU:
@@ -88,5 +88,5 @@
  	default:
  		return -EINVAL;
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
deleted file mode 100644
index e0e8c2f..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 296ef8f0ca10c825358d82f539289c2201243240 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 16 Feb 2023 10:52:22 +0800
-Subject: [PATCH 02/29] wifi: mt76: mt7996: let non-bufferable MMPDUs use
- correct hw queue
-
-non-bufferable MMPDUs are expected to use ALTX hw queue, but current
-condition in mt7996_mac_write_txwi() won't let their tx descriptor
-be filled with correct q_idx. Fix this by passing qid parameter into
-the funciton.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I18bd1a5ea698912c7aa8f4d4317d4a428d4ac440
----
- mt7996/mac.c    | 9 +++++----
- mt7996/mcu.c    | 4 ++--
- mt7996/mt7996.h | 3 ++-
- 3 files changed, 9 insertions(+), 7 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d811b4e..198eb71 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -982,7 +982,8 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
- }
- 
- void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
--			   struct sk_buff *skb, struct mt76_wcid *wcid, int pid,
-+			   struct sk_buff *skb, struct mt76_wcid *wcid,
-+			   enum mt76_txq_id qid, int pid,
- 			   struct ieee80211_key_conf *key, u32 changed)
- {
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-@@ -1014,7 +1015,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
- 	} else if (beacon) {
- 		p_fmt = MT_TX_TYPE_FW;
- 		q_idx = MT_LMAC_BCN0;
--	} else if (skb_get_queue_mapping(skb) >= MT_TXQ_PSD) {
-+	} else if (qid >= MT_TXQ_PSD) {
- 		p_fmt = MT_TX_TYPE_CT;
- 		q_idx = MT_LMAC_ALTX0;
- 	} else {
-@@ -1123,8 +1124,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	memset(txwi_ptr, 0, MT_TXD_SIZE);
- 	/* Transmit non qos data by 802.11 header and need to fill txd by host*/
- 	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
--		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid,
--				      key, 0);
-+		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
-+				      pid, key, 0);
- 
- 	txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
- 	for (i = 0; i < nbuf; i++) {
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8ad51cb..dbe1057 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1906,7 +1906,7 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 	}
- 
- 	buf = (u8 *)bcn + sizeof(*bcn) - MAX_BEACON_SIZE;
--	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
-+	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, 0, NULL,
- 			      BSS_CHANGED_BEACON);
- 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
- }
-@@ -2115,7 +2115,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
- 
- 	buf = (u8 *)tlv + sizeof(*discov) - MAX_INBAND_FRAME_SIZE;
- 
--	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
-+	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, 0, NULL,
- 			      changed);
- 
- 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 018dfd2..d20aa5f 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -487,7 +487,8 @@ void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
- void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
- 			      struct ieee80211_vif *vif, bool enable);
- void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
--			   struct sk_buff *skb, struct mt76_wcid *wcid, int pid,
-+			   struct sk_buff *skb, struct mt76_wcid *wcid,
-+			   enum mt76_txq_id qid, int pid,
- 			   struct ieee80211_key_conf *key, u32 changed);
- void mt7996_mac_set_timing(struct mt7996_phy *phy);
- int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
index 3d4a8cf..50f83e7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
@@ -1,7 +1,7 @@
-From 9d3d2b00d0f24547e3951f3186fd2a0f47e23ea9 Mon Sep 17 00:00:00 2001
+From 1a55033a534847f9c10ffd52e277378c1ba3e45a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 00:39:01 +0800
-Subject: [PATCH 07/29] wifi: mt76: mt7996: reduce repeated bss_info and
+Subject: [PATCH 02/22] wifi: mt76: mt7996: reduce repeated bss_info and
  sta_rec commands
 
 Refine the flow of setting bss_info and sta_rec commands to prevent from
@@ -14,10 +14,10 @@
  1 file changed, 6 insertions(+), 15 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f13f67b..ab28ebe 100644
+index f306e9c5..136a0c28 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -233,8 +233,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+@@ -246,8 +246,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	int idx = msta->wcid.idx;
  
@@ -27,7 +27,7 @@
  
  	if (vif == phy->monitor_vif)
  		phy->monitor_vif = NULL;
-@@ -502,17 +502,13 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -544,17 +544,13 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  	/* station mode uses BSSID to map the wlan entry to a peer,
  	 * and then peer references bss_info_rfch to set bandwidth cap.
  	 */
@@ -50,9 +50,9 @@
  	if (changed & BSS_CHANGED_ERP_CTS_PROT)
  		mt7996_mac_enable_rtscts(dev, vif, info->use_cts_prot);
  
-@@ -525,11 +521,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
- 		}
- 	}
+@@ -575,11 +571,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 		mvif->basic_rates_idx =
+ 			mt7996_get_rates_table(hw, vif, false, false);
  
 -	if (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon) {
 -		mt7996_mcu_add_bss_info(phy, vif, true);
@@ -63,5 +63,5 @@
  	if (changed & (BSS_CHANGED_QOS | BSS_CHANGED_BEACON_ENABLED))
  		mt7996_mcu_set_tx(dev, vif);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
deleted file mode 100644
index 2174447..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From e505146b00960b7f04426f953e0b061d973354fd Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 13 Feb 2023 14:48:10 +0800
-Subject: [PATCH 03/29] wifi: mt76: mt7996: fix pointer calculation in ie
- countdown event
-
-Fix the tail and data pointers. The rxd->len in mt7996_mcu_rxd does not
-include the length of general rxd. It only includes the length of
-firmware event rxd. Use the skb->length to get the correct length.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I832194559e63e6b49b7ee00dc9c606b6106d8669
----
- mt7996/mcu.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index dbe1057..2e25572 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -422,7 +422,8 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
- 	if (hdr->band && dev->mt76.phys[hdr->band])
- 		mphy = dev->mt76.phys[hdr->band];
- 
--	tail = skb->data + le16_to_cpu(rxd->len);
-+	tail = skb->data + skb->len;
-+	data += sizeof(struct header);
- 	while (data + sizeof(struct tlv) < tail && le16_to_cpu(tlv->len)) {
- 		switch (le16_to_cpu(tlv->tag)) {
- 		case UNI_EVENT_IE_COUNTDOWN_CSA:
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
similarity index 75%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
index ac3766e..d723e62 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
@@ -1,7 +1,7 @@
-From 5ade85e2bad5f7b8736dae47a77fb76591b5c645 Mon Sep 17 00:00:00 2001
+From 61c13ad2aacdc077bc3729090702821d4777530a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 15 Feb 2023 18:38:04 +0800
-Subject: [PATCH 08/29] wifi: mt76: mt7996: move radio enable command to
+Subject: [PATCH 03/22] wifi: mt76: mt7996: move radio enable command to
  mt7996_start()
 
 The radio enable and disable commands are used for per-phy radio, so
@@ -14,10 +14,10 @@
  1 file changed, 6 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index ab28ebe..44d23e1 100644
+index 136a0c28..28b63d44 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -46,6 +46,10 @@ static int mt7996_start(struct ieee80211_hw *hw)
+@@ -43,6 +43,10 @@ int mt7996_run(struct ieee80211_hw *hw)
  	if (ret)
  		goto out;
  
@@ -28,7 +28,7 @@
  	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
  	if (ret)
  		goto out;
-@@ -73,6 +77,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -82,6 +86,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -37,7 +37,7 @@
  	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  
  	mutex_unlock(&dev->mt76.mutex);
-@@ -181,10 +187,6 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+@@ -190,10 +196,6 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  	if (ret)
  		goto out;
  
@@ -48,7 +48,7 @@
  	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
  	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
  
-@@ -240,7 +242,6 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+@@ -253,7 +255,6 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
  		phy->monitor_vif = NULL;
  
  	mt7996_mcu_add_dev_info(phy, vif, false);
@@ -57,5 +57,5 @@
  	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
similarity index 81%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
index f3251b2..3f55f11 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
@@ -1,7 +1,7 @@
-From 73923332230ef57e0d4ff6f6436d4133a1256a6f Mon Sep 17 00:00:00 2001
+From fb2659a8aa12346cdda4010737f63178040fa513 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 13:53:14 +0800
-Subject: [PATCH 09/29] wifi: mt76: connac: set correct muar_idx for connac3
+Subject: [PATCH 04/22] wifi: mt76: connac: set correct muar_idx for connac3
  chipset
 
 Set the muar_idx to 0xe for the hw bcast/mcast station entry of connac3
@@ -15,10 +15,10 @@
  2 files changed, 8 insertions(+)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index b339c50..c8b91e8 100644
+index 77ca8f05..02acac64 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
-@@ -216,6 +216,11 @@ static inline bool is_connac_v1(struct mt76_dev *dev)
+@@ -240,6 +240,11 @@ static inline bool is_connac_v1(struct mt76_dev *dev)
  	return is_mt7615(dev) || is_mt7663(dev) || is_mt7622(dev);
  }
  
@@ -31,7 +31,7 @@
  {
  	switch (mt76_chip(dev)) {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index efb9bfa..4e4f6b3 100644
+index 46f69aa8..5fab6772 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -281,6 +281,9 @@ __mt76_connac_mcu_alloc_sta_req(struct mt76_dev *dev, struct mt76_vif *mvif,
@@ -45,5 +45,5 @@
  				     &hdr.wlan_idx_hi);
  	skb = mt76_mcu_msg_alloc(dev, NULL, len);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-init-mpdu-density.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-init-mpdu-density.patch
deleted file mode 100644
index dab6e5b..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-init-mpdu-density.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From b76cd7102b71458bb38868b8e0c2d2866aba1183 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 13 Feb 2023 09:46:40 +0800
-Subject: [PATCH 04/29] wifi: mt76: mt7996: init mpdu density
-
-Init mpdu density based on the hardware capability to
-prevent hardware drop.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/init.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 946da93..de94e15 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -196,10 +196,13 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
- 
- 	hw->max_tx_fragments = 4;
- 
--	if (phy->mt76->cap.has_2ghz)
-+	if (phy->mt76->cap.has_2ghz) {
- 		phy->mt76->sband_2g.sband.ht_cap.cap |=
- 			IEEE80211_HT_CAP_LDPC_CODING |
- 			IEEE80211_HT_CAP_MAX_AMSDU;
-+		phy->mt76->sband_2g.sband.ht_cap.ampdu_density =
-+			IEEE80211_HT_MPDU_DENSITY_2;
-+	}
- 
- 	if (phy->mt76->cap.has_5ghz) {
- 		phy->mt76->sband_5g.sband.ht_cap.cap |=
-@@ -211,6 +214,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
- 			IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK |
- 			IEEE80211_VHT_CAP_SHORT_GI_160 |
- 			IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
-+		phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
-+			IEEE80211_HT_MPDU_DENSITY_1;
- 	}
- 
- 	mt76_set_stream_caps(phy->mt76, true);
-@@ -689,7 +694,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
- 		u16 cap = IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
- 			  IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
- 
--		cap |= u16_encode_bits(IEEE80211_HT_MPDU_DENSITY_2,
-+		cap |= u16_encode_bits(IEEE80211_HT_MPDU_DENSITY_0_5,
- 				       IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START) |
- 		       u16_encode_bits(IEEE80211_VHT_MAX_AMPDU_1024K,
- 				       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP) |
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-muru-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-add-muru-support.patch
similarity index 61%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-muru-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-add-muru-support.patch
index ed47666..1854421 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-muru-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-add-muru-support.patch
@@ -1,7 +1,7 @@
-From 15078cb8bc36fb6194ecaf65887d899f9a9c5435 Mon Sep 17 00:00:00 2001
+From 85fb9bc9f85a5e64d88db85fbfdef968d037fada Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 Date: Mon, 28 Nov 2022 14:36:09 +0800
-Subject: [PATCH 10/29] wifi: mt76: mt7996: add muru support
+Subject: [PATCH 05/22] wifi: mt76: mt7996: add muru support
 
 Add sta_rec_muru() and related phy cap for MU and RU support.
 
@@ -10,12 +10,11 @@
 Change-Id: I2206a9bb6fd6e50f4bf1380a8bea19920f1b7bfd
 ---
  mt76_connac_mcu.h |  3 ++-
- mt7996/mcu.c      | 69 ++++++++++++++++++++++++++++++++++++++++++++++-
- mt7996/mt7996.h   |  3 +++
- 3 files changed, 73 insertions(+), 2 deletions(-)
+ mt7996/mcu.c      | 57 ++++++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 58 insertions(+), 2 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 40a99e0..6f30a0f 100644
+index 91d98eff..8580ca59 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -518,7 +518,8 @@ struct sta_rec_muru {
@@ -29,10 +28,10 @@
  
  	struct {
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f694743..b6bd36c 100644
+index 88e2f9d0..6812a47b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1050,6 +1050,63 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1050,6 +1050,60 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	}
  }
  
@@ -40,7 +39,6 @@
 +mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 +			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
 +{
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 +	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
 +	struct sta_rec_muru *muru;
 +	struct tlv *tlv;
@@ -53,12 +51,10 @@
 +
 +	muru = (struct sta_rec_muru *)tlv;
 +
-+	muru->cfg.mimo_dl_en = mvif->cap.eht_mu_ebfer_bw80 ||
-+			       mvif->cap.eht_mu_ebfer_bw160 ||
-+			       mvif->cap.eht_mu_ebfer_bw320 ||
-+			       mvif->cap.he_mu_ebfer ||
-+			       mvif->cap.vht_mu_ebfer ||
-+			       mvif->cap.vht_mu_ebfee;
++	muru->cfg.mimo_dl_en = vif->bss_conf.eht_mu_beamformer ||
++			       vif->bss_conf.he_mu_beamformer ||
++			       vif->bss_conf.vht_mu_beamformer ||
++			       vif->bss_conf.vht_mu_beamformee;
 +	muru->cfg.ofdma_dl_en = true;
 +
 +	if (sta->deflink.vht_cap.vht_supported)
@@ -96,7 +92,7 @@
  static inline bool
  mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  			struct ieee80211_sta *sta, bool bfee)
-@@ -1722,7 +1779,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -1727,7 +1781,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		mt7996_mcu_sta_he_6g_tlv(skb, sta);
  		/* starec eht */
  		mt7996_mcu_sta_eht_tlv(skb, sta);
@@ -106,36 +102,6 @@
  		/* starec bfee */
  		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
  		/* starec hdr trans */
-@@ -2005,6 +2063,15 @@ mt7996_mcu_beacon_check_caps(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		vc->eht_su_ebfee =
- 			EHT_PHY(CAP0_SU_BEAMFORMEE, eht->phy_cap_info[0]) &&
- 			EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
-+		vc->eht_mu_ebfer_bw80 =
-+			EHT_PHY(CAP7_MU_BEAMFORMER_80MHZ, eht->phy_cap_info[7]) &&
-+			EHT_PHY(CAP7_MU_BEAMFORMER_80MHZ, pe->phy_cap_info[7]);
-+		vc->eht_mu_ebfer_bw160 =
-+			EHT_PHY(CAP7_MU_BEAMFORMER_160MHZ, eht->phy_cap_info[7]) &&
-+			EHT_PHY(CAP7_MU_BEAMFORMER_160MHZ, pe->phy_cap_info[7]);
-+		vc->eht_mu_ebfer_bw320 =
-+			EHT_PHY(CAP7_MU_BEAMFORMER_320MHZ, eht->phy_cap_info[7]) &&
-+			EHT_PHY(CAP7_MU_BEAMFORMER_320MHZ, pe->phy_cap_info[7]);
- 	}
- }
- 
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f9d8fbf..997a0bf 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -125,6 +125,9 @@ struct mt7996_vif_cap {
- 	bool he_mu_ebfer:1;
- 	bool eht_su_ebfer:1;
- 	bool eht_su_ebfee:1;
-+	bool eht_mu_ebfer_bw80:1;
-+	bool eht_mu_ebfer_bw160:1;
-+	bool eht_mu_ebfer_bw320:1;
- };
- 
- struct mt7996_vif {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
deleted file mode 100644
index e6132e2..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 1fea00cf3e5af0ae1d1b3de6d772b21b83ac7ef4 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Tue, 14 Feb 2023 18:35:43 +0800
-Subject: [PATCH 05/29] wifi: mt76: mt7996: remove mt7996_mcu_set_pm()
-
-Currently using BSS_INFO_PS command will sometimes cause packet drop in
-hw rx queue.
-Temporarily remove this function until finding the cause.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I863fc1edb18e4d7b5dac20140dd0904875e1323c
----
- mt7996/main.c   |  8 --------
- mt7996/mcu.c    | 26 --------------------------
- mt7996/mt7996.h |  1 -
- 3 files changed, 35 deletions(-)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 3e4da03..f13f67b 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -52,10 +52,6 @@ static int mt7996_start(struct ieee80211_hw *hw)
- 
- 	set_bit(MT76_STATE_RUNNING, &phy->mt76->state);
- 
--	ieee80211_iterate_interfaces(dev->mt76.hw,
--				     IEEE80211_IFACE_ITER_RESUME_ALL,
--				     mt7996_mcu_set_pm, dev->mt76.hw);
--
- 	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
- 				     MT7996_WATCHDOG_TIME);
- 
-@@ -79,10 +75,6 @@ static void mt7996_stop(struct ieee80211_hw *hw)
- 
- 	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
- 
--	ieee80211_iterate_interfaces(dev->mt76.hw,
--				     IEEE80211_IFACE_ITER_RESUME_ALL,
--				     mt7996_mcu_set_pm, dev->mt76.hw);
--
- 	mutex_unlock(&dev->mt76.mutex);
- }
- 
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2e25572..f694743 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -3577,32 +3577,6 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
- 				 &req, sizeof(req), true);
- }
- 
--void mt7996_mcu_set_pm(void *priv, u8 *mac, struct ieee80211_vif *vif)
--{
--#define EXIT_PM_STATE	0
--#define ENTER_PM_STATE	1
--	struct ieee80211_hw *hw = priv;
--	struct mt7996_dev *dev = mt7996_hw_dev(hw);
--	struct mt7996_phy *phy = mt7996_hw_phy(hw);
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct bss_power_save *ps;
--	struct sk_buff *skb;
--	struct tlv *tlv;
--	bool running = test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
--
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
--					 MT7996_BSS_UPDATE_MAX_SIZE);
--	if (IS_ERR(skb))
--		return;
--
--	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_PS, sizeof(*ps));
--	ps = (struct bss_power_save *)tlv;
--	ps->profile = running ? EXIT_PM_STATE : ENTER_PM_STATE;
--
--	mt76_mcu_skb_send_msg(&dev->mt76, skb,
--			      MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
--}
--
- int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
- {
- 	struct {
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d20aa5f..f9d8fbf 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -432,7 +432,6 @@ int mt7996_mcu_set_pulse_th(struct mt7996_dev *dev,
- int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
- 			    const struct mt7996_dfs_pattern *pattern);
- int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
--void mt7996_mcu_set_pm(void *priv, u8 *mac, struct ieee80211_vif *vif);
- int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
- int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
- int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
deleted file mode 100644
index 597ce5d..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 1e695bf2e52c4982331e0fac7f15b6ca60fb5584 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 23 Feb 2023 19:18:45 +0800
-Subject: [PATCH 06/29] wifi: mt76: mt7996: fix eeprom antenna bitfield mask
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/eeprom.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 8da599e..cfc4869 100644
---- a/mt7996/eeprom.h
-+++ b/mt7996/eeprom.h
-@@ -31,11 +31,11 @@ enum mt7996_eeprom_field {
- #define MT_EE_WIFI_CONF2_BAND_SEL		GENMASK(2, 0)
- 
- #define MT_EE_WIFI_CONF1_TX_PATH_BAND0		GENMASK(5, 3)
--#define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(5, 3)
--#define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(2, 0)
-+#define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
-+#define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(5, 3)
- #define MT_EE_WIFI_CONF4_STREAM_NUM_BAND0	GENMASK(5, 3)
--#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND1	GENMASK(5, 3)
--#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND2	GENMASK(2, 0)
-+#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND1	GENMASK(2, 0)
-+#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND2	GENMASK(5, 3)
- 
- #define MT_EE_RATE_DELTA_MASK			GENMASK(5, 0)
- #define MT_EE_RATE_DELTA_SIGN			BIT(6)
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-set-txd-v1.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-set-txd-v1.patch
similarity index 72%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-set-txd-v1.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-set-txd-v1.patch
index b71dbcc..f9cdd1a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-set-txd-v1.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-set-txd-v1.patch
@@ -1,7 +1,7 @@
-From 3c5f2f053c8115e1a0a818c9f8ba270b30d69c88 Mon Sep 17 00:00:00 2001
+From a25714fa7b610430f9aa3d4ec24647eaea505d35 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 10:40:33 +0800
-Subject: [PATCH 11/29] wifi: mt76: mt7996: set txd v1
+Subject: [PATCH 06/22] wifi: mt76: mt7996: set txd v1
 
 ---
  mt7996/mac.c | 3 +++
@@ -9,10 +9,10 @@
  2 files changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 198eb71..40ef5e4 100644
+index 23cbfdde..420c7403 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1096,6 +1096,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1110,6 +1110,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	struct mt76_txwi_cache *t;
  	int id, i, pid, nbuf = tx_info->nbuf - 1;
  	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
@@ -20,9 +20,9 @@
  	u8 *txwi = (u8 *)txwi_ptr;
  
  	if (unlikely(tx_info->skb->len <= ETH_HLEN))
-@@ -1127,6 +1128,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
- 				      pid, key, 0);
+@@ -1141,6 +1142,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
+ 				      pid, qid, 0);
  
 +	txd[0] |= le32_encode_bits(1, MT_TXD0_VER);
 +
@@ -30,10 +30,10 @@
  	for (i = 0; i < nbuf; i++) {
  		txp->fw.buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr);
 diff --git a/mt7996/mac.h b/mt7996/mac.h
-index 2cc218f..4914d3e 100644
+index bc4e6c55..9ab8e8d2 100644
 --- a/mt7996/mac.h
 +++ b/mt7996/mac.h
-@@ -183,7 +183,8 @@ enum tx_mgnt_type {
+@@ -173,7 +173,8 @@ enum tx_mgnt_type {
  
  #define MT_TXD0_Q_IDX			GENMASK(31, 25)
  #define MT_TXD0_PKT_FMT			GENMASK(24, 23)
@@ -44,5 +44,5 @@
  
  #define MT_TXD1_FIXED_RATE		BIT(31)
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-add-thermal-protection-support.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-add-thermal-protection-support.patch
index ee6db36..526edc7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-add-thermal-protection-support.patch
@@ -1,7 +1,7 @@
-From 198d3e931e8f24534b63314334454f3254db7892 Mon Sep 17 00:00:00 2001
+From 7d85212987815786ceff28379015a6bb23012dc3 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 21:20:31 +0800
-Subject: [PATCH 12/29] wifi: mt76: mt7996: add thermal protection support
+Subject: [PATCH 07/22] wifi: mt76: mt7996: add thermal protection support
 
 This commit includes the following changes:
 1. implement MTK thermal protection driver API
@@ -10,15 +10,15 @@
 Change-Id: I8fecc28f5b17ee50ae4644d1dd17d188dd694731
 ---
  mt76_connac_mcu.h |   1 +
- mt7996/init.c     | 105 +++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/init.c     | 103 ++++++++++++++++++++++++++++++++++++++++++++
  mt7996/main.c     |   8 ++++
  mt7996/mcu.c      | 106 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7996/mcu.h      |  44 +++++++++++++++++++
  mt7996/mt7996.h   |  15 +++++++
- 6 files changed, 279 insertions(+)
+ 6 files changed, 277 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6f30a0f..fa10d82 100644
+index 8580ca59..c5c48349 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1009,6 +1009,7 @@ enum {
@@ -30,10 +30,10 @@
  
  #define MCU_UNI_CMD_EVENT			BIT(1)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index de94e15..44165a3 100644
+index f1b48cdd..53852ffc 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -41,6 +41,98 @@ static const struct ieee80211_iface_combination if_comb[] = {
+@@ -42,6 +42,98 @@ static const struct ieee80211_iface_combination if_comb[] = {
  	}
  };
  
@@ -132,7 +132,7 @@
  static void mt7996_led_set_config(struct led_classdev *led_cdev,
  				  u8 delay_on, u8 delay_off)
  {
-@@ -372,6 +464,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -389,6 +481,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	if (ret)
  		goto error;
  
@@ -143,7 +143,7 @@
  	ret = mt7996_init_debugfs(phy);
  	if (ret)
  		goto error;
-@@ -392,6 +488,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
+@@ -409,6 +505,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
  	if (!phy)
  		return;
  
@@ -152,7 +152,7 @@
  	mphy = phy->dev->mt76.phys[band];
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -881,6 +979,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -879,6 +977,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -163,21 +163,19 @@
  	ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
  
  	ret = mt7996_register_phy(dev, mt7996_phy2(dev), MT_BAND1);
-@@ -898,6 +1000,9 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
+@@ -902,6 +1004,7 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
  {
  	mt7996_unregister_phy(mt7996_phy3(dev), MT_BAND2);
  	mt7996_unregister_phy(mt7996_phy2(dev), MT_BAND1);
-+
 +	mt7996_unregister_thermal(&dev->phy);
-+
+ 	mt7996_coredump_unregister(dev);
  	mt76_unregister_device(&dev->mt76);
  	mt7996_mcu_exit(dev);
- 	mt7996_tx_token_put(dev);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 44d23e1..d8d578c 100644
+index 28b63d44..fbb7270d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -54,6 +54,14 @@ static int mt7996_start(struct ieee80211_hw *hw)
+@@ -51,6 +51,14 @@ int mt7996_run(struct ieee80211_hw *hw)
  	if (ret)
  		goto out;
  
@@ -193,7 +191,7 @@
  
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b6bd36c..3820a63 100644
+index 6812a47b..325051bd 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -443,6 +443,34 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -241,7 +239,7 @@
  	default:
  		break;
  	}
-@@ -3277,6 +3308,81 @@ out:
+@@ -3178,6 +3209,81 @@ out:
  	return 0;
  }
  
@@ -324,7 +322,7 @@
  {
  	struct {
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index dd0c5ac..7fefc28 100644
+index d7075a4d..778deedf 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -30,6 +30,28 @@ struct mt7996_mcu_uni_event {
@@ -393,12 +391,12 @@
  	UNI_CMD_ACCESS_REG_BASIC = 0x0,
  	UNI_CMD_ACCESS_RF_REG_BASIC,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 997a0bf..25b20fa 100644
+index 4d7dcb95..36337808 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -43,6 +43,13 @@
- #define MT7996_MAX_STA_TWT_AGRT		8
- #define MT7996_MAX_QUEUE		(__MT_RXQ_MAX +	__MT_MCUQ_MAX + 3)
+@@ -47,6 +47,13 @@
+ #define MT7996_BASIC_RATES_TBL		11
+ #define MT7996_BEACON_RATES_TBL		25
  
 +#define MT7996_THERMAL_THROTTLE_MAX	100
 +#define MT7996_CDEV_THROTTLE_MAX	99
@@ -410,7 +408,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -211,6 +218,11 @@ struct mt7996_phy {
+@@ -209,6 +216,11 @@ struct mt7996_phy {
  
  	struct ieee80211_vif *monitor_vif;
  
@@ -422,7 +420,7 @@
  	u32 rxfilter;
  	u64 omac_mask;
  
-@@ -437,6 +449,9 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
+@@ -457,6 +469,9 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
  int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
@@ -433,5 +431,5 @@
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
index b680326..9e0668a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
@@ -1,7 +1,7 @@
-From a0190f9cb1bc65c5dced813fa1929de9bb714d9f Mon Sep 17 00:00:00 2001
+From 72f33a06b35ae981db88d12cd8db267ce68b9e08 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 20:53:42 +0800
-Subject: [PATCH 13/29] wifi: mt76: mt7996: add thermal sensor device support
+Subject: [PATCH 08/22] wifi: mt76: mt7996: add thermal sensor device support
 
 ---
  mt7996/init.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++
@@ -9,7 +9,7 @@
  2 files changed, 128 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 44165a3..7350194 100644
+index 53852ffc..9c5d20ad 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -4,6 +4,8 @@
@@ -21,7 +21,7 @@
  #include <linux/thermal.h>
  #include "mt7996.h"
  #include "mac.h"
-@@ -41,6 +43,81 @@ static const struct ieee80211_iface_combination if_comb[] = {
+@@ -42,6 +44,81 @@ static const struct ieee80211_iface_combination if_comb[] = {
  	}
  };
  
@@ -103,7 +103,7 @@
  static int
  mt7996_thermal_get_max_throttle_state(struct thermal_cooling_device *cdev,
  				      unsigned long *state)
-@@ -112,6 +189,7 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)
+@@ -113,6 +190,7 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)
  {
  	struct wiphy *wiphy = phy->mt76->hw->wiphy;
  	struct thermal_cooling_device *cdev;
@@ -111,7 +111,7 @@
  	const char *name;
  
  	name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7996_%s",
-@@ -130,6 +208,15 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)
+@@ -131,6 +209,15 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)
  	phy->throttle_temp[MT7996_CRIT_TEMP_IDX] = MT7996_CRIT_TEMP;
  	phy->throttle_temp[MT7996_MAX_TEMP_IDX] = MT7996_MAX_TEMP;
  
@@ -128,10 +128,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3820a63..b332658 100644
+index 325051bd..f3fd2fd4 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3308,6 +3308,47 @@ out:
+@@ -3209,6 +3209,47 @@ out:
  	return 0;
  }
  
@@ -180,5 +180,5 @@
  int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state)
  {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-add-dsp-firmware-download.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-add-dsp-firmware-download.patch
index 0301e1e..eb65330 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-add-dsp-firmware-download.patch
@@ -1,7 +1,7 @@
-From a23a49eb89ce2abc3370f452bc1915a061b864bd Mon Sep 17 00:00:00 2001
+From 9b6e04ff1ac32161c6aacb939b2ff51bdced9629 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 Feb 2023 14:13:38 +0800
-Subject: [PATCH 16/29] wifi: mt76: mt7996: add dsp firmware download
+Subject: [PATCH 09/22] wifi: mt76: mt7996: add dsp firmware download
 
 Add DSP firmware for phy related control. Without this patch,the
 firmware state would not be ready.
@@ -15,7 +15,7 @@
  4 files changed, 50 insertions(+), 53 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index fa10d82..79dde31 100644
+index c5c48349..fbb1206f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -22,6 +22,7 @@
@@ -27,10 +27,10 @@
  #define PATCH_SEC_NOT_SUPPORT		GENMASK(31, 0)
  #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a949ff7..09800ff 100644
+index f3fd2fd4..73d5dedf 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2353,7 +2353,7 @@ out:
+@@ -2241,7 +2241,7 @@ out:
  static int
  mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
  			     const struct mt7996_fw_trailer *hdr,
@@ -39,7 +39,7 @@
  {
  	int i, offset = 0;
  	u32 override = 0, option = 0;
-@@ -2365,8 +2365,10 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
+@@ -2253,8 +2253,10 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
  
  		region = (const struct mt7996_fw_region *)((const u8 *)hdr -
  			 (hdr->n_region - i) * sizeof(*region));
@@ -51,7 +51,7 @@
  		len = le32_to_cpu(region->len);
  		addr = le32_to_cpu(region->addr);
  
-@@ -2393,8 +2395,10 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
+@@ -2281,8 +2283,10 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
  	if (override)
  		option |= FW_START_OVERRIDE;
  
@@ -63,7 +63,7 @@
  
  	return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
  }
-@@ -2405,56 +2409,40 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2293,56 +2297,40 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  	const struct firmware *fw;
  	int ret;
  
@@ -155,7 +155,7 @@
  	return ret;
  }
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 923e6fc..c2f8900 100644
+index 36337808..ab4521a4 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -29,6 +29,7 @@
@@ -166,7 +166,7 @@
  #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
  
  #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
-@@ -55,6 +56,12 @@ struct mt7996_sta;
+@@ -59,6 +60,12 @@ struct mt7996_sta;
  struct mt7996_dfs_pulse;
  struct mt7996_dfs_pattern;
  
@@ -180,7 +180,7 @@
  	MT7996_TXQ_FWDL = 16,
  	MT7996_TXQ_MCU_WM,
 diff --git a/mt7996/pci.c b/mt7996/pci.c
-index 64aee3f..c530105 100644
+index 64aee3fb..c5301050 100644
 --- a/mt7996/pci.c
 +++ b/mt7996/pci.c
 @@ -219,4 +219,5 @@ MODULE_DEVICE_TABLE(pci, mt7996_pci_device_table);
@@ -190,5 +190,5 @@
 +MODULE_FIRMWARE(MT7996_FIRMWARE_DSP);
  MODULE_FIRMWARE(MT7996_ROM_PATCH);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
similarity index 76%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
index 2372387..caa9b1a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
@@ -1,7 +1,7 @@
-From 8f28593519b8a46b666d67e98112222377272f48 Mon Sep 17 00:00:00 2001
+From ee3a2aa33145d17d3be17af85583437f079e91fb Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 2 Mar 2023 15:44:52 +0800
-Subject: [PATCH 17/29] wifi: mt76: mt7996: fix icv error when enable AP and
+Subject: [PATCH 10/22] wifi: mt76: mt7996: fix icv error when enable AP and
  STA simultaneously
 
 Fix mcu command content to prevent ICV error
@@ -14,10 +14,10 @@
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 09800ff..07c521c 100644
+index 73d5dedf..6d11bc1a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -744,6 +744,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -743,6 +743,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	struct cfg80211_chan_def *chandef = &phy->chandef;
  	struct mt76_connac_bss_basic_tlv *bss;
  	u32 type = CONNECTION_INFRA_AP;
@@ -25,7 +25,7 @@
  	struct tlv *tlv;
  	int idx;
  
-@@ -763,7 +764,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -762,7 +763,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  				struct mt76_wcid *wcid;
  
  				wcid = (struct mt76_wcid *)sta->drv_priv;
@@ -34,7 +34,7 @@
  			}
  			rcu_read_unlock();
  		}
-@@ -783,7 +784,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -782,7 +783,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
  	bss->dtim_period = vif->bss_conf.dtim_period;
  	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
@@ -44,5 +44,5 @@
  	bss->omac_idx = mvif->omac_idx;
  	bss->band_idx = mvif->band_idx;
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-set-wcid-in-txp.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-set-wcid-in-txp.patch
index fa53759..d612bdf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-set-wcid-in-txp.patch
@@ -1,7 +1,7 @@
-From a3732513f3acab7c60cdfe39909850b43c1a0839 Mon Sep 17 00:00:00 2001
+From 952869c0b481651e9c125d5cd7c4ea2b255521c5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 6 Mar 2023 15:52:26 +0800
-Subject: [PATCH 18/29] wifi: mt76: mt7996: set wcid in txp
+Subject: [PATCH 11/22] wifi: mt76: mt7996: set wcid in txp
 
 Set correct wcid in txp for SDO to get wtbl.
 
@@ -11,10 +11,10 @@
  1 file changed, 5 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 4c0c8f1..bb23f53 100644
+index 420c7403..ca163969 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1168,10 +1168,12 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1169,10 +1169,12 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	}
  
  	txp->fw.token = cpu_to_le16(id);
@@ -31,5 +31,5 @@
  
  	/* pass partial skb header to fw */
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
similarity index 74%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
index e8a856b..f05fe30 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
@@ -1,7 +1,7 @@
-From 9db64ef2800ce8f6d0a1f37273ca2922d57326d0 Mon Sep 17 00:00:00 2001
+From 9af2057cec3d77aafb4f92b8d1542d88c8ac5efc Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 Mar 2023 11:08:04 +0800
-Subject: [PATCH 19/29] wifi: mt76: mt7996: init he and eht cap for AP_VLAN
+Subject: [PATCH 12/22] wifi: mt76: mt7996: init he and eht cap for AP_VLAN
 
 Add AP_VLAN types in __mt7996_set_stream_he_eht_caps to
 initialize the ht and eht caps. Without this patch, the
@@ -14,10 +14,10 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 479b2ce..381917a 100644
+index 9c5d20ad..d44e3ae9 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -996,6 +996,7 @@ __mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy,
+@@ -993,6 +993,7 @@ __mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy,
  		switch (i) {
  		case NL80211_IFTYPE_STATION:
  		case NL80211_IFTYPE_AP:
@@ -26,5 +26,5 @@
  		case NL80211_IFTYPE_MESH_POINT:
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
similarity index 75%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
index debf1a6..b2ed6a1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
@@ -1,7 +1,7 @@
-From e0d5636b28358017571697b1e2ee0a1ee5500647 Mon Sep 17 00:00:00 2001
+From 854db11781bd8f9fa7cb45ed529223a4784de9d9 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 16 Mar 2023 16:09:51 +0800
-Subject: [PATCH 20/29] wifi: mt76: mt7996: fix beamform mcu cmd configuration
+Subject: [PATCH 13/22] wifi: mt76: mt7996: fix beamform mcu cmd configuration
 
 bf_num means how many band can support beamform, so the value shall be 3.
 bf_bitmap represents which band can support beamform.
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 07c521c..ed1abe1 100644
+index 6d11bc1a..df1ae639 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3506,8 +3506,8 @@ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
+@@ -3394,8 +3394,8 @@ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
  
  		tlv = mt7996_mcu_add_uni_tlv(skb, action, sizeof(*req_mod_en));
  		req_mod_en = (struct bf_mod_en_ctrl *)tlv;
@@ -25,5 +25,5 @@
  	}
  	default:
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
new file mode 100644
index 0000000..461236e
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
@@ -0,0 +1,31 @@
+From b1296ffe7596adf514bc2b5397c946e276e30176 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 7 Mar 2023 17:05:01 +0800
+Subject: [PATCH 14/22] wifi: mt76: mt7996: Fix using the wrong phy for
+ background radar event
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/mcu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index df1ae639..cd86209b 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -339,7 +339,11 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
+ 		return;
+ 
+-	mphy = dev->mt76.phys[r->band_idx];
++	if (dev->rdd2_phy && r->band_idx == MT_RX_SEL2)
++		mphy = dev->rdd2_phy->mt76;
++	else
++		mphy = dev->mt76.phys[r->band_idx];
++
+ 	if (!mphy)
+ 		return;
+ 
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
deleted file mode 100644
index 5541738..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From d8f7b7ae8934a0107bf9f36c2c5199a767febad6 Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Mon, 6 Feb 2023 11:34:51 +0800
-Subject: [PATCH 14/29] wifi: mt76: mt7996: add 802.11s mesh amsdu/de-amsdu
- support
-
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
----
- mt7996/mac.c  | 15 ++++++++++++++-
- mt7996/mac.h  |  2 ++
- mt7996/mcu.c  |  9 ++++++++-
- mt7996/mcu.h  |  2 +-
- mt7996/mmio.c |  3 ++-
- 5 files changed, 27 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 40ef5e4..8dc3a62 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -633,6 +633,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
- 	u32 rxd4 = le32_to_cpu(rxd[4]);
- 	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
- 	u32 csum_status = *(u32 *)skb->cb;
-+	u32 mesh_mask = MT_RXD0_MESH | MT_RXD0_MHCP;
- 	bool unicast, insert_ccmp_hdr = false;
- 	u8 remove_pad, amsdu_info, band_idx;
- 	u8 mode = 0, qos_ctl = 0;
-@@ -825,6 +826,9 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
- 
- 		skb_pull(skb, hdr_gap);
- 		if (!hdr_trans && status->amsdu) {
-+		    if(ieee80211_has_a4(fc) && ((rxd0 & mesh_mask) == mesh_mask))
-+			pad_start = 0;
-+		    else
- 			pad_start = ieee80211_get_hdrlen_from_skb(skb);
- 		} else if (hdr_trans && (rxd2 & MT_RXD2_NORMAL_HDR_TRANS_ERROR)) {
- 			/* When header translation failure is indicated,
-@@ -857,8 +861,17 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
- 		hdr = mt76_skb_get_hdr(skb);
- 		fc = hdr->frame_control;
- 		if (ieee80211_is_data_qos(fc)) {
-+			u8 *p = ieee80211_get_qos_ctl(hdr);
-+
- 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
--			qos_ctl = *ieee80211_get_qos_ctl(hdr);
-+			qos_ctl = *p;
-+
-+			/* the hardware support mesh de-amsdu by default,
-+			 * so, clear amsdu present bit in the Qos Control field.
-+			 */
-+			if (ieee80211_has_a4(fc) && status->amsdu &&
-+			    ((rxd0 & mesh_mask) == mesh_mask))
-+				*p &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
- 		}
- 	} else {
- 		status->flag |= RX_FLAG_8023;
-diff --git a/mt7996/mac.h b/mt7996/mac.h
-index 4914d3e..e48cc68 100644
---- a/mt7996/mac.h
-+++ b/mt7996/mac.h
-@@ -12,6 +12,8 @@
- #define MT_RXD0_LENGTH			GENMASK(15, 0)
- #define MT_RXD0_PKT_TYPE		GENMASK(31, 27)
- 
-+#define MT_RXD0_MESH			BIT(18)
-+#define MT_RXD0_MHCP			BIT(19)
- #define MT_RXD0_NORMAL_ETH_TYPE_OFS	GENMASK(22, 16)
- #define MT_RXD0_NORMAL_IP_SUM		BIT(23)
- #define MT_RXD0_NORMAL_UDP_TCP_SUM	BIT(24)
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b332658..0dbe2e0 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1054,7 +1054,8 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	struct tlv *tlv;
- 
- 	if (vif->type != NL80211_IFTYPE_STATION &&
--	    vif->type != NL80211_IFTYPE_AP)
-+	    vif->type != NL80211_IFTYPE_AP &&
-+	    vif->type != NL80211_IFTYPE_MESH_POINT)
- 		return;
- 
- 	if (!sta->deflink.agg.max_amsdu_len)
-@@ -1560,6 +1561,12 @@ mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 		hdr_trans->to_ds = true;
- 		hdr_trans->from_ds = true;
- 	}
-+
-+	if (vif->type == NL80211_IFTYPE_MESH_POINT) {
-+		hdr_trans->to_ds = true;
-+		hdr_trans->from_ds = true;
-+		hdr_trans->mesh = true;
-+	}
- }
- 
- static enum mcu_mmps_mode
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 7fefc28..ad66a1f 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -434,7 +434,7 @@ struct sta_rec_hdr_trans {
- 	u8 from_ds;
- 	u8 to_ds;
- 	u8 dis_rx_hdr_tran;
--	u8 rsv;
-+	u8 mesh;
- } __packed;
- 
- struct hdr_trans_en {
-diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 902370a..6610cc4 100644
---- a/mt7996/mmio.c
-+++ b/mt7996/mmio.c
-@@ -320,7 +320,8 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
- 		/* txwi_size = txd size + txp size */
- 		.txwi_size = MT_TXD_SIZE + sizeof(struct mt76_connac_fw_txp),
- 		.drv_flags = MT_DRV_TXWI_NO_FREE |
--			     MT_DRV_HW_MGMT_TXQ,
-+			     MT_DRV_HW_MGMT_TXQ |
-+			     MT_DRV_AMSDU_OFFLOAD,
- 		.survey_flags = SURVEY_INFO_TIME_TX |
- 				SURVEY_INFO_TIME_RX |
- 				SURVEY_INFO_TIME_BSS_RX,
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
deleted file mode 100644
index 1751cb6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
+++ /dev/null
@@ -1,948 +0,0 @@
-From 0809af5eefeebb30854486e1e928c06ed0a667d6 Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Mon, 13 Feb 2023 18:00:25 +0800
-Subject: [PATCH 15/29] wifi: mt76: mt7996: add L0.5 system error recovery
- support
-
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
----
- mt7996/debugfs.c | 155 +++++++++++++++++++++++---
- mt7996/dma.c     |  65 +++++++++++
- mt7996/init.c    |   9 +-
- mt7996/mac.c     | 285 +++++++++++++++++++++++++++++++++++++++--------
- mt7996/main.c    |  18 ++-
- mt7996/mcu.c     |  22 ++--
- mt7996/mcu.h     |  28 +++--
- mt7996/mmio.c    |   7 +-
- mt7996/mt7996.h  |  17 ++-
- mt7996/regs.h    |  36 +++++-
- 10 files changed, 542 insertions(+), 100 deletions(-)
-
-diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 9c5e9ac..f2c46a5 100644
---- a/mt7996/debugfs.c
-+++ b/mt7996/debugfs.c
-@@ -48,12 +48,12 @@ DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7996_implicit_txbf_get,
- 
- /* test knob of system error recovery */
- static ssize_t
--mt7996_fw_ser_set(struct file *file, const char __user *user_buf,
--		  size_t count, loff_t *ppos)
-+mt7996_sys_recovery_set(struct file *file, const char __user *user_buf,
-+			size_t count, loff_t *ppos)
- {
- 	struct mt7996_phy *phy = file->private_data;
- 	struct mt7996_dev *dev = phy->dev;
--	u8 band_idx = phy->mt76->band_idx;
-+	bool band = phy->mt76->band_idx;
- 	char buf[16];
- 	int ret = 0;
- 	u16 val;
-@@ -73,17 +73,49 @@ mt7996_fw_ser_set(struct file *file, const char __user *user_buf,
- 		return -EINVAL;
- 
- 	switch (val) {
--	case SER_SET_RECOVER_L1:
--	case SER_SET_RECOVER_L2:
--	case SER_SET_RECOVER_L3_RX_ABORT:
--	case SER_SET_RECOVER_L3_TX_ABORT:
--	case SER_SET_RECOVER_L3_TX_DISABLE:
--	case SER_SET_RECOVER_L3_BF:
--		ret = mt7996_mcu_set_ser(dev, SER_ENABLE, BIT(val), band_idx);
-+	/*
-+	 * 0: grab firmware current SER state.
-+	 * 1: trigger & enable system error L1 recovery.
-+	 * 2: trigger & enable system error L2 recovery.
-+	 * 3: trigger & enable system error L3 rx abort.
-+	 * 4: trigger & enable system error L3 tx abort.
-+	 * 5: trigger & enable system error L3 tx disable.
-+	 * 6: trigger & enable system error L3 bf recovery.
-+	 * 7: trigger & enable system error L4 MDP recovery.
-+	 * 8: trigger & enable system error full recovery.
-+	 * 9: trigger firmware crash.
-+	 */
-+	case UNI_CMD_SER_QUERY:
-+		ret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_QUERY, 0, band);
-+		break;
-+	case UNI_CMD_SER_SET_RECOVER_L1:
-+	case UNI_CMD_SER_SET_RECOVER_L2:
-+	case UNI_CMD_SER_SET_RECOVER_L3_RX_ABORT:
-+	case UNI_CMD_SER_SET_RECOVER_L3_TX_ABORT:
-+	case UNI_CMD_SER_SET_RECOVER_L3_TX_DISABLE:
-+	case UNI_CMD_SER_SET_RECOVER_L3_BF:
-+	case UNI_CMD_SER_SET_RECOVER_L4_MDP:
-+		ret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_SET, BIT(val), band);
-+		if (ret)
-+			return ret;
-+
-+		ret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_TRIGGER, val, band);
-+		break;
-+
-+	/* enable full chip reset */
-+	case UNI_CMD_SER_SET_RECOVER_FULL:
-+		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, MT_MCU_CMD_WDT_MASK);
- 		if (ret)
- 			return ret;
- 
--		ret = mt7996_mcu_set_ser(dev, SER_RECOVER, val, band_idx);
-+		dev->recovery.state |= MT_MCU_CMD_WDT_MASK;
-+		mt7996_reset(dev);
-+		break;
-+
-+	/* WARNING: trigger firmware crash */
-+	case UNI_CMD_SER_SET_SYSTEM_ASSERT:
-+		mt76_wr(dev, MT_MCU_WM_CIRQ_EINT_MASK_CLR_ADDR, BIT(18));
-+		mt76_wr(dev, MT_MCU_WM_CIRQ_EINT_SOFT_ADDR, BIT(18));
- 		break;
- 	default:
- 		break;
-@@ -92,9 +124,101 @@ mt7996_fw_ser_set(struct file *file, const char __user *user_buf,
- 	return ret ? ret : count;
- }
- 
--static const struct file_operations mt7996_fw_ser_ops = {
--	.write = mt7996_fw_ser_set,
--	/* TODO: ser read */
-+static ssize_t
-+mt7996_sys_recovery_get(struct file *file, char __user *user_buf,
-+			size_t count, loff_t *ppos)
-+{
-+	struct mt7996_phy *phy = file->private_data;
-+	struct mt7996_dev *dev = phy->dev;
-+	char *buff;
-+	int desc = 0;
-+	ssize_t ret;
-+	static const size_t bufsz = 1024;
-+
-+	buff = kmalloc(bufsz, GFP_KERNEL);
-+	if (!buff)
-+		return -ENOMEM;
-+
-+	/* HELP */
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "Please echo the correct value ...\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "0: grab firmware transient SER state\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "1: trigger system error L1 recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "2: trigger system error L2 recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "3: trigger system error L3 rx abort\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "4: trigger system error L3 tx abort\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "5: trigger system error L3 tx disable\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "6: trigger system error L3 bf recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "7: trigger system error L4 MDP recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "8: trigger system error full recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "9: trigger firmware crash\n");
-+
-+	/* SER statistics */
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "\nlet's dump firmware SER statistics...\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_STATUS        = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_SER_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PLE_ERR       = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PLE_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PLE_ERR_1     = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PLE1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PLE_ERR_AMSDU = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PLE_AMSDU_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PSE_ERR       = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PSE_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PSE_ERR_1     = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PSE1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR6_B0 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN0_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR6_B1 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR6_B2 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN2_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR7_B0 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN0_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR7_B1 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR7_B2 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN2_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_WFDMA_ERR = 0x%08x\n",
-+			  mt76_rr(dev, WF_SWDEF_WFDMA_STATUS_ADDR));
-+
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "\nSYS_RESET_COUNT: WM %d, WA %d\n",
-+			  dev->recovery.wm_reset_count,
-+			  dev->recovery.wa_reset_count);
-+
-+	ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
-+	kfree(buff);
-+	return ret;
-+}
-+
-+static const struct file_operations mt7996_sys_recovery_ops = {
-+	.write = mt7996_sys_recovery_set,
-+	.read = mt7996_sys_recovery_get,
- 	.open = simple_open,
- 	.llseek = default_llseek,
- };
-@@ -674,6 +798,8 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
- 	debugfs_create_file("xmit-queues", 0400, dir, phy,
- 			    &mt7996_xmit_queues_fops);
- 	debugfs_create_file("tx_stats", 0400, dir, phy, &mt7996_tx_stats_fops);
-+	debugfs_create_file("sys_recovery", 0600, dir, phy,
-+			    &mt7996_sys_recovery_ops);
- 	debugfs_create_file("fw_debug_wm", 0600, dir, dev, &fops_fw_debug_wm);
- 	debugfs_create_file("fw_debug_wa", 0600, dir, dev, &fops_fw_debug_wa);
- 	debugfs_create_file("fw_debug_bin", 0600, dir, dev, &fops_fw_debug_bin);
-@@ -684,7 +810,6 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
- 			    &fops_implicit_txbf);
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
- 				    mt7996_twt_stats);
--	debugfs_create_file("fw_ser", 0600, dir, phy, &mt7996_fw_ser_ops);
- 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
- 
- 	if (phy->mt76->cap.has_5ghz) {
-diff --git a/mt7996/dma.c b/mt7996/dma.c
-index c09fe42..18ea758 100644
---- a/mt7996/dma.c
-+++ b/mt7996/dma.c
-@@ -352,6 +352,71 @@ int mt7996_dma_init(struct mt7996_dev *dev)
- 	return 0;
- }
- 
-+void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
-+{
-+	struct mt76_phy *phy2 = dev->mt76.phys[MT_BAND1];
-+	struct mt76_phy *phy3 = dev->mt76.phys[MT_BAND2];
-+	u32 hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
-+	int i;
-+
-+	mt76_clear(dev, MT_WFDMA0_GLO_CFG,
-+		   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
-+		   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+
-+	if (dev->hif2)
-+		mt76_clear(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
-+			   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
-+			   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+
-+	usleep_range(1000, 2000);
-+
-+	for (i = 0; i < __MT_TXQ_MAX; i++) {
-+		mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
-+		if (phy2)
-+			mt76_queue_tx_cleanup(dev, phy2->q_tx[i], true);
-+		if (phy3)
-+			mt76_queue_tx_cleanup(dev, phy3->q_tx[i], true);
-+	}
-+
-+	for (i = 0; i < __MT_MCUQ_MAX; i++)
-+		mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
-+
-+	mt76_for_each_q_rx(&dev->mt76, i)
-+		//mt76_queue_rx_reset(dev, i);
-+		mt76_queue_rx_cleanup(dev, &dev->mt76.q_rx[i]);
-+
-+	mt76_tx_status_check(&dev->mt76, true);
-+
-+	/* reset wfsys */
-+	if (force)
-+		mt7996_wfsys_reset(dev);
-+
-+	mt7996_dma_disable(dev, force);
-+
-+	/* reset hw queues */
-+	for (i = 0; i < __MT_TXQ_MAX; i++) {
-+		mt76_queue_reset(dev, dev->mphy.q_tx[i]);
-+		if (phy2)
-+			mt76_queue_reset(dev, phy2->q_tx[i]);
-+		if (phy3)
-+			mt76_queue_reset(dev, phy3->q_tx[i]);
-+	}
-+
-+	for (i = 0; i < __MT_MCUQ_MAX; i++)
-+		mt76_queue_reset(dev, dev->mt76.q_mcu[i]);
-+
-+	mt76_for_each_q_rx(&dev->mt76, i) {
-+		mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
-+	}
-+
-+	mt76_tx_status_check(&dev->mt76, true);
-+
-+	mt76_for_each_q_rx(&dev->mt76, i)
-+		mt76_queue_rx_reset(dev, i);
-+
-+	mt7996_dma_enable(dev);
-+}
-+
- void mt7996_dma_cleanup(struct mt7996_dev *dev)
- {
- 	mt7996_dma_disable(dev, true);
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 7350194..479b2ce 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -278,8 +278,7 @@ static void mt7996_led_set_brightness(struct led_classdev *led_cdev,
- 		mt7996_led_set_config(led_cdev, 0xff, 0);
- }
- 
--static void
--mt7996_init_txpower(struct mt7996_dev *dev,
-+void mt7996_init_txpower(struct mt7996_dev *dev,
- 		    struct ieee80211_supported_band *sband)
- {
- 	int i, nss = hweight8(dev->mphy.antenna_mask);
-@@ -434,7 +433,7 @@ mt7996_mac_init_band(struct mt7996_dev *dev, u8 band)
- 	mt76_rmw(dev, MT_WTBLOFF_RSCR(band), mask, set);
- }
- 
--static void mt7996_mac_init(struct mt7996_dev *dev)
-+void mt7996_mac_init(struct mt7996_dev *dev)
- {
- #define HIF_TXD_V2_1	4
- 	int i;
-@@ -468,7 +467,7 @@ static void mt7996_mac_init(struct mt7996_dev *dev)
- 		mt7996_mac_init_band(dev, i);
- }
- 
--static int mt7996_txbf_init(struct mt7996_dev *dev)
-+int mt7996_txbf_init(struct mt7996_dev *dev)
- {
- 	int ret;
- 
-@@ -1080,6 +1079,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
- 	if (ret)
- 		return ret;
- 
-+	dev->recovery.hw_init_done = true;
-+
- 	return mt7996_init_debugfs(&dev->phy);
- }
- 
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8dc3a62..4c0c8f1 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -1724,7 +1724,7 @@ mt7996_wait_reset_state(struct mt7996_dev *dev, u32 state)
- 	bool ret;
- 
- 	ret = wait_event_timeout(dev->reset_wait,
--				 (READ_ONCE(dev->reset_state) & state),
-+				 (READ_ONCE(dev->recovery.state) & state),
- 				 MT7996_RESET_TIMEOUT);
- 
- 	WARN(!ret, "Timeout waiting for MCU reset state %x\n", state);
-@@ -1773,68 +1773,208 @@ mt7996_update_beacons(struct mt7996_dev *dev)
- 					    mt7996_update_vif_beacon, phy3->hw);
- }
- 
--static void
--mt7996_dma_reset(struct mt7996_dev *dev)
-+void mt7996_tx_token_put(struct mt7996_dev *dev)
- {
--	struct mt76_phy *phy2 = dev->mt76.phys[MT_BAND1];
--	struct mt76_phy *phy3 = dev->mt76.phys[MT_BAND2];
--	u32 hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
--	int i;
-+	struct mt76_txwi_cache *txwi;
-+	int id;
- 
--	mt76_clear(dev, MT_WFDMA0_GLO_CFG,
--		   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
--		   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+	spin_lock_bh(&dev->mt76.token_lock);
-+	idr_for_each_entry(&dev->mt76.token, txwi, id) {
-+		mt7996_txwi_free(dev, txwi, NULL, NULL);
-+		dev->mt76.token_count--;
-+	}
-+	spin_unlock_bh(&dev->mt76.token_lock);
-+	idr_destroy(&dev->mt76.token);
-+}
- 
--	if (dev->hif2)
--		mt76_clear(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
--			   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
--			   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
- 
--	usleep_range(1000, 2000);
-+static int
-+mt7996_mac_restart(struct mt7996_dev *dev)
-+{
-+	struct mt7996_phy *phy2, *phy3;
-+	struct mt76_dev *mdev = &dev->mt76;
-+	int i, ret;
- 
--	for (i = 0; i < __MT_TXQ_MAX; i++) {
--		mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
--		if (phy2)
--			mt76_queue_tx_cleanup(dev, phy2->q_tx[i], true);
--		if (phy3)
--			mt76_queue_tx_cleanup(dev, phy3->q_tx[i], true);
-+	phy2 = mt7996_phy2(dev);
-+	phy3 = mt7996_phy3(dev);
-+
-+	if (dev->hif2) {
-+		mt76_wr(dev, MT_INT1_MASK_CSR, 0x0);
-+		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
- 	}
- 
--	for (i = 0; i < __MT_MCUQ_MAX; i++)
--		mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
-+	if (dev_is_pci(mdev->dev)) {
-+		mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0x0);
-+		if (dev->hif2)
-+			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
-+	}
- 
--	mt76_for_each_q_rx(&dev->mt76, i)
--		mt76_queue_rx_reset(dev, i);
-+	set_bit(MT76_RESET, &dev->mphy.state);
-+	set_bit(MT76_MCU_RESET, &dev->mphy.state);
-+	wake_up(&dev->mt76.mcu.wait);
-+	if (phy2) {
-+		set_bit(MT76_RESET, &phy2->mt76->state);
-+		set_bit(MT76_MCU_RESET, &phy2->mt76->state);
-+	}
-+	if (phy3) {
-+		set_bit(MT76_RESET, &phy3->mt76->state);
-+		set_bit(MT76_MCU_RESET, &phy3->mt76->state);
-+	}
- 
--	mt76_tx_status_check(&dev->mt76, true);
-+	/* lock/unlock all queues to ensure that no tx is pending */
-+	mt76_txq_schedule_all(&dev->mphy);
-+	if (phy2)
-+		mt76_txq_schedule_all(phy2->mt76);
-+	if (phy3)
-+		mt76_txq_schedule_all(phy3->mt76);
-+
-+	/* disable all tx/rx napi */
-+	mt76_worker_disable(&dev->mt76.tx_worker);
-+	mt76_for_each_q_rx(mdev, i) {
-+		if (mdev->q_rx[i].ndesc)
-+			napi_disable(&dev->mt76.napi[i]);
-+	}
-+	napi_disable(&dev->mt76.tx_napi);
- 
--	/* re-init prefetch settings after reset */
--	mt7996_dma_prefetch(dev);
-+	/* token reinit */
-+	mt7996_tx_token_put(dev);
-+	idr_init(&dev->mt76.token);
- 
--	mt76_set(dev, MT_WFDMA0_GLO_CFG,
--		 MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+	mt7996_dma_reset(dev, true);
- 
--	if (dev->hif2)
--		mt76_set(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
--			 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
--			 MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+	local_bh_disable();
-+	mt76_for_each_q_rx(mdev, i) {
-+		if (mdev->q_rx[i].ndesc) {
-+			napi_enable(&dev->mt76.napi[i]);
-+			napi_schedule(&dev->mt76.napi[i]);
-+		}
-+	}
-+	local_bh_enable();
-+	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
-+	clear_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
-+
-+	mt76_wr(dev, MT_INT_MASK_CSR, dev->mt76.mmio.irqmask);
-+	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
-+	if (dev->hif2) {
-+		mt76_wr(dev, MT_INT1_MASK_CSR, dev->mt76.mmio.irqmask);
-+		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
-+	}
-+	if (dev_is_pci(mdev->dev)) {
-+		mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
-+		if (dev->hif2)
-+			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0xff);
-+	}
-+
-+	/* load firmware */
-+	ret = mt7996_mcu_init_firmware(dev);
-+	if (ret)
-+		goto out;
-+
-+	/* set the necessary init items */
-+	ret = mt7996_mcu_set_eeprom(dev);
-+	if (ret)
-+		goto out;
-+
-+	mt7996_mac_init(dev);
-+	mt7996_init_txpower(dev, &dev->mphy.sband_2g.sband);
-+	mt7996_init_txpower(dev, &dev->mphy.sband_5g.sband);
-+	mt7996_init_txpower(dev, &dev->mphy.sband_6g.sband);
-+	ret = mt7996_txbf_init(dev);
-+
-+	if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
-+		ret = mt7996_run(dev->mphy.hw);
-+		if (ret)
-+			goto out;
-+	}
-+
-+	if (phy2 && test_bit(MT76_STATE_RUNNING, &phy2->mt76->state)) {
-+		ret = mt7996_run(phy2->mt76->hw);
-+		if (ret)
-+			goto out;
-+	}
-+
-+	if (phy3 && test_bit(MT76_STATE_RUNNING, &phy3->mt76->state)) {
-+		ret = mt7996_run(phy3->mt76->hw);
-+		if (ret)
-+			goto out;
-+	}
-+
-+out:
-+	/* reset done */
-+	clear_bit(MT76_RESET, &dev->mphy.state);
-+	if (phy2)
-+		clear_bit(MT76_RESET, &phy2->mt76->state);
-+	if (phy3)
-+		clear_bit(MT76_RESET, &phy3->mt76->state);
-+
-+	local_bh_disable();
-+	napi_enable(&dev->mt76.tx_napi);
-+	napi_schedule(&dev->mt76.tx_napi);
-+	local_bh_enable();
-+
-+	mt76_worker_enable(&dev->mt76.tx_worker);
-+	return ret;
- }
- 
--void mt7996_tx_token_put(struct mt7996_dev *dev)
-+static void
-+mt7996_mac_full_reset(struct mt7996_dev *dev)
- {
--	struct mt76_txwi_cache *txwi;
--	int id;
-+	struct mt7996_phy *phy2, *phy3;
-+	int i;
- 
--	spin_lock_bh(&dev->mt76.token_lock);
--	idr_for_each_entry(&dev->mt76.token, txwi, id) {
--		mt7996_txwi_free(dev, txwi, NULL, NULL);
--		dev->mt76.token_count--;
-+	phy2 = mt7996_phy2(dev);
-+	phy3 = mt7996_phy3(dev);
-+	dev->recovery.hw_full_reset = true;
-+
-+	wake_up(&dev->mt76.mcu.wait);
-+	ieee80211_stop_queues(mt76_hw(dev));
-+	if (phy2)
-+		ieee80211_stop_queues(phy2->mt76->hw);
-+	if (phy3)
-+		ieee80211_stop_queues(phy3->mt76->hw);
-+
-+	cancel_delayed_work_sync(&dev->mphy.mac_work);
-+	if (phy2)
-+		cancel_delayed_work_sync(&phy2->mt76->mac_work);
-+	if (phy3)
-+		cancel_delayed_work_sync(&phy3->mt76->mac_work);
-+
-+	mutex_lock(&dev->mt76.mutex);
-+	for (i = 0; i < 10; i++) {
-+		if (!mt7996_mac_restart(dev))
-+			break;
- 	}
--	spin_unlock_bh(&dev->mt76.token_lock);
--	idr_destroy(&dev->mt76.token);
-+	mutex_unlock(&dev->mt76.mutex);
-+
-+	if (i == 10)
-+		dev_err(dev->mt76.dev, "chip full reset failed\n");
-+
-+	ieee80211_restart_hw(mt76_hw(dev));
-+	if (phy2)
-+		ieee80211_restart_hw(phy2->mt76->hw);
-+	if (phy3)
-+		ieee80211_restart_hw(phy3->mt76->hw);
-+
-+	ieee80211_wake_queues(mt76_hw(dev));
-+	if (phy2)
-+		ieee80211_wake_queues(phy2->mt76->hw);
-+	if (phy3)
-+		ieee80211_wake_queues(phy3->mt76->hw);
-+
-+	dev->recovery.hw_full_reset = false;
-+	ieee80211_queue_delayed_work(mt76_hw(dev),
-+				     &dev->mphy.mac_work,
-+				     MT7996_WATCHDOG_TIME);
-+	if (phy2)
-+		ieee80211_queue_delayed_work(phy2->mt76->hw,
-+					     &phy2->mt76->mac_work,
-+					     MT7996_WATCHDOG_TIME);
-+	if (phy3)
-+		ieee80211_queue_delayed_work(phy3->mt76->hw,
-+					     &phy3->mt76->mac_work,
-+					     MT7996_WATCHDOG_TIME);
- }
- 
--/* system error recovery */
- void mt7996_mac_reset_work(struct work_struct *work)
- {
- 	struct mt7996_phy *phy2, *phy3;
-@@ -1845,9 +1985,36 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 	phy2 = mt7996_phy2(dev);
- 	phy3 = mt7996_phy3(dev);
- 
--	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
-+	/* chip full reset */
-+	if (dev->recovery.restart) {
-+		/* disable WA/WM WDT */
-+		mt76_clear(dev, MT_WFDMA0_MCU_HOST_INT_ENA,
-+			   MT_MCU_CMD_WDT_MASK);
-+
-+		if (READ_ONCE(dev->recovery.state) & MT_MCU_CMD_WA_WDT)
-+			dev->recovery.wa_reset_count++;
-+		else
-+			dev->recovery.wm_reset_count++;
-+
-+		mt7996_mac_full_reset(dev);
-+
-+		/* enable mcu irq */
-+		mt7996_irq_enable(dev, MT_INT_MCU_CMD);
-+		mt7996_irq_disable(dev, 0);
-+
-+		/* enable WA/WM WDT */
-+		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, MT_MCU_CMD_WDT_MASK);
-+
-+		dev->recovery.state = MT_MCU_CMD_NORMAL_STATE;
-+		dev->recovery.restart = false;
- 		return;
-+	}
- 
-+	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
-+		return;
-+
-+	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
-+		 wiphy_name(dev->mt76.hw->wiphy));
- 	ieee80211_stop_queues(mt76_hw(dev));
- 	if (phy2)
- 		ieee80211_stop_queues(phy2->mt76->hw);
-@@ -1876,7 +2043,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
- 
- 	if (mt7996_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
--		mt7996_dma_reset(dev);
-+		mt7996_dma_reset(dev, false);
- 
- 		mt7996_tx_token_put(dev);
- 		idr_init(&dev->mt76.token);
-@@ -1931,6 +2098,32 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 		ieee80211_queue_delayed_work(phy3->mt76->hw,
- 					     &phy3->mt76->mac_work,
- 					     MT7996_WATCHDOG_TIME);
-+	dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
-+		 wiphy_name(dev->mt76.hw->wiphy));
-+}
-+
-+void mt7996_reset(struct mt7996_dev *dev)
-+{
-+	if (!dev->recovery.hw_init_done)
-+		return;
-+
-+	if (dev->recovery.hw_full_reset)
-+		return;
-+
-+	/* wm/wa exception: do full recovery */
-+	if (READ_ONCE(dev->recovery.state) & MT_MCU_CMD_WDT_MASK) {
-+		dev->recovery.restart = true;
-+		dev_info(dev->mt76.dev,
-+			 "%s indicated firmware crash, attempting recovery\n",
-+			 wiphy_name(dev->mt76.hw->wiphy));
-+
-+		mt7996_irq_disable(dev, MT_INT_MCU_CMD);
-+		queue_work(dev->mt76.wq, &dev->reset_work);
-+		return;
-+	}
-+
-+	queue_work(dev->mt76.wq, &dev->reset_work);
-+	wake_up(&dev->reset_wait);
- }
- 
- void mt7996_mac_update_stats(struct mt7996_phy *phy)
-diff --git a/mt7996/main.c b/mt7996/main.c
-index d8d578c..cb0e0d3 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -22,17 +22,13 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
- 	return phy && test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
- }
- 
--static int mt7996_start(struct ieee80211_hw *hw)
-+int mt7996_run(struct ieee80211_hw *hw)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	bool running;
- 	int ret;
- 
--	flush_work(&dev->init_work);
--
--	mutex_lock(&dev->mt76.mutex);
--
- 	running = mt7996_dev_running(dev);
- 	if (!running) {
- 		ret = mt7996_mcu_set_hdr_trans(dev, true);
-@@ -71,6 +67,18 @@ static int mt7996_start(struct ieee80211_hw *hw)
- 		mt7996_mac_reset_counters(phy);
- 
- out:
-+	return ret;
-+}
-+
-+static int mt7996_start(struct ieee80211_hw *hw)
-+{
-+	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	int ret;
-+
-+	flush_work(&dev->init_work);
-+
-+	mutex_lock(&dev->mt76.mutex);
-+	ret = mt7996_run(hw);
- 	mutex_unlock(&dev->mt76.mutex);
- 
- 	return ret;
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0dbe2e0..a949ff7 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -2629,17 +2629,10 @@ mt7996_mcu_init_rx_airtime(struct mt7996_dev *dev)
- 				     MCU_WM_UNI_CMD(VOW), true);
- }
- 
--int mt7996_mcu_init(struct mt7996_dev *dev)
-+int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
- {
--	static const struct mt76_mcu_ops mt7996_mcu_ops = {
--		.headroom = sizeof(struct mt76_connac2_mcu_txd), /* reuse */
--		.mcu_skb_send_msg = mt7996_mcu_send_message,
--		.mcu_parse_response = mt7996_mcu_parse_response,
--	};
- 	int ret;
- 
--	dev->mt76.mcu_ops = &mt7996_mcu_ops;
--
- 	/* force firmware operation mode into normal state,
- 	 * which should be set before firmware download stage.
- 	 */
-@@ -2680,6 +2673,19 @@ int mt7996_mcu_init(struct mt7996_dev *dev)
- 				 MCU_WA_PARAM_RED, 0, 0);
- }
- 
-+int mt7996_mcu_init(struct mt7996_dev *dev)
-+{
-+	static const struct mt76_mcu_ops mt7996_mcu_ops = {
-+		.headroom = sizeof(struct mt76_connac2_mcu_txd), /* reuse */
-+		.mcu_skb_send_msg = mt7996_mcu_send_message,
-+		.mcu_parse_response = mt7996_mcu_parse_response,
-+	};
-+
-+	dev->mt76.mcu_ops = &mt7996_mcu_ops;
-+
-+	return mt7996_mcu_init_firmware(dev);
-+}
-+
- void mt7996_mcu_exit(struct mt7996_dev *dev)
- {
- 	mt7996_mcu_restart(&dev->mt76);
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index ad66a1f..778deed 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -692,23 +692,21 @@ enum {
- };
- 
- enum {
--	UNI_CMD_SER_QUERY = 0x0,
--	UNI_CMD_SER_SET = 0x2,
--	UNI_CMD_SER_TRIGGER = 0x3,
--};
--
--enum {
--	SER_QUERY,
-+	UNI_CMD_SER_QUERY,
- 	/* recovery */
--	SER_SET_RECOVER_L1,
--	SER_SET_RECOVER_L2,
--	SER_SET_RECOVER_L3_RX_ABORT,
--	SER_SET_RECOVER_L3_TX_ABORT,
--	SER_SET_RECOVER_L3_TX_DISABLE,
--	SER_SET_RECOVER_L3_BF,
-+	UNI_CMD_SER_SET_RECOVER_L1,
-+	UNI_CMD_SER_SET_RECOVER_L2,
-+	UNI_CMD_SER_SET_RECOVER_L3_RX_ABORT,
-+	UNI_CMD_SER_SET_RECOVER_L3_TX_ABORT,
-+	UNI_CMD_SER_SET_RECOVER_L3_TX_DISABLE,
-+	UNI_CMD_SER_SET_RECOVER_L3_BF,
-+	UNI_CMD_SER_SET_RECOVER_L4_MDP,
-+	UNI_CMD_SER_SET_RECOVER_FULL,
-+	UNI_CMD_SER_SET_SYSTEM_ASSERT,
- 	/* action */
--	SER_ENABLE = 2,
--	SER_RECOVER
-+	UNI_CMD_SER_ENABLE = 1,
-+	UNI_CMD_SER_SET,
-+	UNI_CMD_SER_TRIGGER
- };
- 
- enum {
-diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 6610cc4..0e11f39 100644
---- a/mt7996/mmio.c
-+++ b/mt7996/mmio.c
-@@ -289,10 +289,9 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
- 		u32 val = mt76_rr(dev, MT_MCU_CMD);
- 
- 		mt76_wr(dev, MT_MCU_CMD, val);
--		if (val & MT_MCU_CMD_ERROR_MASK) {
--			dev->reset_state = val;
--			ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
--			wake_up(&dev->reset_wait);
-+		if (val & (MT_MCU_CMD_ERROR_MASK | MT_MCU_CMD_WDT_MASK)) {
-+			dev->recovery.state = val;
-+			mt7996_reset(dev);
- 		}
- 	}
- }
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 25b20fa..923e6fc 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -268,7 +268,14 @@ struct mt7996_dev {
- 	struct work_struct rc_work;
- 	struct work_struct reset_work;
- 	wait_queue_head_t reset_wait;
--	u32 reset_state;
-+	struct {
-+		u32 state;
-+		u32 wa_reset_count;
-+		u32 wm_reset_count;
-+		bool hw_full_reset:1;
-+		bool hw_init_done:1;
-+		bool restart:1;
-+	} recovery;
- 
- 	struct list_head sta_rc_list;
- 	struct list_head sta_poll_list;
-@@ -401,9 +408,16 @@ int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
- 				   struct ieee80211_channel *chan);
- s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band);
- int mt7996_dma_init(struct mt7996_dev *dev);
-+void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
- void mt7996_dma_prefetch(struct mt7996_dev *dev);
- void mt7996_dma_cleanup(struct mt7996_dev *dev);
-+void mt7996_init_txpower(struct mt7996_dev *dev,
-+		    struct ieee80211_supported_band *sband);
-+int mt7996_txbf_init(struct mt7996_dev *dev);
-+void mt7996_reset(struct mt7996_dev *dev);
-+int mt7996_run(struct ieee80211_hw *hw);
- int mt7996_mcu_init(struct mt7996_dev *dev);
-+int mt7996_mcu_init_firmware(struct mt7996_dev *dev);
- int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
- 			       struct mt7996_vif *mvif,
- 			       struct mt7996_twt_flow *flow,
-@@ -496,6 +510,7 @@ static inline void mt7996_irq_disable(struct mt7996_dev *dev, u32 mask)
- 		mt76_set_irq_mask(&dev->mt76, MT_INT_MASK_CSR, mask, 0);
- }
- 
-+void mt7996_mac_init(struct mt7996_dev *dev);
- u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw);
- bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask);
- void mt7996_mac_reset_counters(struct mt7996_phy *phy);
-diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 7a28cae..0775ca5 100644
---- a/mt7996/regs.h
-+++ b/mt7996/regs.h
-@@ -317,6 +317,8 @@ enum base_rev {
- #define MT_WFDMA0_RX_INT_PCIE_SEL		MT_WFDMA0(0x154)
- #define MT_WFDMA0_RX_INT_SEL_RING3		BIT(3)
- 
-+#define MT_WFDMA0_MCU_HOST_INT_ENA		MT_WFDMA0(0x1f4)
-+
- #define MT_WFDMA0_GLO_CFG			MT_WFDMA0(0x208)
- #define MT_WFDMA0_GLO_CFG_TX_DMA_EN		BIT(0)
- #define MT_WFDMA0_GLO_CFG_RX_DMA_EN		BIT(2)
-@@ -444,6 +446,10 @@ enum base_rev {
- #define MT_MCU_CMD_NORMAL_STATE			BIT(5)
- #define MT_MCU_CMD_ERROR_MASK			GENMASK(5, 1)
- 
-+#define MT_MCU_CMD_WA_WDT			BIT(31)
-+#define MT_MCU_CMD_WM_WDT			BIT(30)
-+#define MT_MCU_CMD_WDT_MASK			GENMASK(31, 30)
-+
- /* l1/l2 remap */
- #define MT_HIF_REMAP_L1				0x155024
- #define MT_HIF_REMAP_L1_MASK			GENMASK(31, 16)
-@@ -468,8 +474,27 @@ enum base_rev {
- #define MT_INFRA_MCU_END			0x7c3fffff
- 
- /* FW MODE SYNC */
--#define MT_SWDEF_MODE				0x9143c
-+#define MT_SWDEF_BASE				0x00401400
-+
-+#define MT_SWDEF(ofs)				(MT_SWDEF_BASE + (ofs))
-+#define MT_SWDEF_MODE				MT_SWDEF(0x3c)
- #define MT_SWDEF_NORMAL_MODE			0
-+#define MT_SWDEF_ICAP_MODE			1
-+#define MT_SWDEF_SPECTRUM_MODE			2
-+
-+#define MT_SWDEF_SER_STATS			MT_SWDEF(0x040)
-+#define MT_SWDEF_PLE_STATS			MT_SWDEF(0x044)
-+#define MT_SWDEF_PLE1_STATS			MT_SWDEF(0x048)
-+#define MT_SWDEF_PLE_AMSDU_STATS		MT_SWDEF(0x04C)
-+#define MT_SWDEF_PSE_STATS			MT_SWDEF(0x050)
-+#define MT_SWDEF_PSE1_STATS			MT_SWDEF(0x054)
-+#define MT_SWDEF_LAMC_WISR6_BN0_STATS		MT_SWDEF(0x058)
-+#define MT_SWDEF_LAMC_WISR6_BN1_STATS		MT_SWDEF(0x05C)
-+#define MT_SWDEF_LAMC_WISR6_BN2_STATS		MT_SWDEF(0x060)
-+#define MT_SWDEF_LAMC_WISR7_BN0_STATS		MT_SWDEF(0x064)
-+#define MT_SWDEF_LAMC_WISR7_BN1_STATS		MT_SWDEF(0x068)
-+#define MT_SWDEF_LAMC_WISR7_BN2_STATS		MT_SWDEF(0x06C)
-+#define WF_SWDEF_WFDMA_STATUS_ADDR		MT_SWDEF(0x090)
- 
- /* LED */
- #define MT_LED_TOP_BASE				0x18013000
-@@ -506,7 +531,7 @@ enum base_rev {
- #define MT_TOP_MISC_FW_STATE			GENMASK(2, 0)
- 
- #define MT_HW_REV				0x70010204
--#define MT_WF_SUBSYS_RST			0x70002600
-+#define MT_WF_SUBSYS_RST			0x70028600
- 
- /* PCIE MAC */
- #define MT_PCIE_MAC_BASE			0x74030000
-@@ -539,4 +564,11 @@ enum base_rev {
- #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR_ONLY	BIT(18)
- #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
- 
-+#define MT_MCU_WM_CIRQ_BASE			0x89010000
-+#define MT_MCU_WM_CIRQ(ofs)			(MT_MCU_WM_CIRQ_BASE + (ofs))
-+#define MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR	MT_MCU_WM_CIRQ(0x80)
-+#define MT_MCU_WM_CIRQ_IRQ_SOFT_ADDR		MT_MCU_WM_CIRQ(0xc0)
-+#define MT_MCU_WM_CIRQ_EINT_MASK_CLR_ADDR	MT_MCU_WM_CIRQ(0x108)
-+#define MT_MCU_WM_CIRQ_EINT_SOFT_ADDR		MT_MCU_WM_CIRQ(0x118)
-+
- #endif
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
index 62909d1..1e2ec3b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
@@ -1,7 +1,7 @@
-From ee568eb941838f834f16bf65867a83935ff1ac83 Mon Sep 17 00:00:00 2001
+From c1d0d0a15d4cdafa1ed0a61606fd5fefa85a6bb7 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 20 Dec 2022 09:47:31 +0800
-Subject: [PATCH 22/29] wifi: mt76: mt7996: support more options in
+Subject: [PATCH 15/22] wifi: mt76: mt7996: support more options in
  .set_bitrate_mask()
 
 With this patch, driver can support runtime configuration for single
@@ -12,10 +12,10 @@
  1 file changed, 137 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index cc6c6a4..a0d468d 100644
+index cd86209b..8a7487ba 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1616,6 +1616,136 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+@@ -1610,6 +1610,136 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				     MCU_WM_UNI_CMD(RA), true);
  }
  
@@ -152,7 +152,7 @@
  static void
  mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-@@ -1725,6 +1855,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -1719,6 +1849,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct sk_buff *skb;
@@ -160,7 +160,7 @@
  
  	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
  					      &msta->wcid,
-@@ -1744,8 +1875,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -1738,8 +1869,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	 */
  	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
  
@@ -176,5 +176,5 @@
  
  static int
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
similarity index 68%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
index 0567253..c756ccd 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
@@ -1,7 +1,7 @@
-From 057869b174019d83f5ff3db97608e489f2808036 Mon Sep 17 00:00:00 2001
+From aa539aaae8a95f3e970ad8e1f5a7381bb249ad7e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 Mar 2023 11:16:44 +0800
-Subject: [PATCH 23/29] wifi: mt76: mt7996: fill txwi by SW temporarily
+Subject: [PATCH 16/22] wifi: mt76: mt7996: fill txwi by SW temporarily
 
 If use WA to fill TXD, it cannot ping pass.
 Remove this patch after bug fix.
@@ -12,22 +12,22 @@
  1 file changed, 3 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bb23f53..cddb1df 100644
+index ca163969..7059a4e1 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1137,9 +1137,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1138,9 +1138,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
  	memset(txwi_ptr, 0, MT_TXD_SIZE);
  	/* Transmit non qos data by 802.11 header and need to fill txd by host*/
 -	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
--		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
--				      pid, key, 0);
-+	mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
-+			      pid, key, 0);
+-		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
+-				      pid, qid, 0);
++	mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
++			      pid, qid, 0);
  
  	txd[0] |= le32_encode_bits(1, MT_TXD0_VER);
  
-@@ -1152,8 +1151,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1153,8 +1152,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  
  	txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
  
@@ -38,5 +38,5 @@
  	if (!key)
  		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
similarity index 80%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
index 4e4abd2..659e580 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
@@ -1,7 +1,7 @@
-From a2453d9011651714108a899aa791eb80925613c7 Mon Sep 17 00:00:00 2001
+From c3611ca1b4d8260dee8893cb922ad2ad0a8eb8d7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 20 Mar 2023 19:09:59 +0800
-Subject: [PATCH 24/29] wifi: mt76: mt7996: update wmm queue mapping
+Subject: [PATCH 17/22] wifi: mt76: mt7996: update wmm queue mapping
 
 The mac80211 use mac80211 queue (MQ) and the firmware
 use access class index (ACI) so convert the MQ to ACI
@@ -14,10 +14,10 @@
  2 files changed, 10 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index cb0e0d3..4e9536e 100644
+index fbb7270d..059cc420 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -197,7 +197,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+@@ -198,7 +198,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  	mvif->mt76.omac_idx = idx;
  	mvif->phy = phy;
  	mvif->mt76.band_idx = band_idx;
@@ -26,7 +26,7 @@
  
  	ret = mt7996_mcu_add_dev_info(phy, vif, true);
  	if (ret)
-@@ -419,9 +419,16 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -423,9 +423,16 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	       const struct ieee80211_tx_queue_params *params)
  {
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -45,10 +45,10 @@
  
  	return 0;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a0d468d..deb6e1e 100644
+index 8a7487ba..43a4f939 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2902,7 +2902,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+@@ -2789,7 +2789,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
  
  		e = (struct edca *)tlv;
  		e->set = WMM_PARAM_SET;
@@ -58,5 +58,5 @@
  		e->txop = cpu_to_le16(q->txop);
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-enable-IDS-debug-log.patch
similarity index 73%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-enable-IDS-debug-log.patch
index 38ac643..ca2e812 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-enable-IDS-debug-log.patch
@@ -1,17 +1,17 @@
-From ebe6fe9b526c946bc9639778ca51938746a27fd0 Mon Sep 17 00:00:00 2001
+From 6e972b77bd615df709c8ce4401ea6e120ccdf758 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 21 Mar 2023 15:04:45 +0800
-Subject: [PATCH 25/29] wifi: mt76: mt7996: enable IDS debug log
+Subject: [PATCH 18/22] wifi: mt76: mt7996: enable IDS debug log
 
 ---
  mt7996/debugfs.c | 10 ++++++++--
  1 file changed, 8 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index f2c46a5..34c30a5 100644
+index 513ab4ba..04220180 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -296,6 +296,12 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+@@ -290,6 +290,12 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
  		DEBUG_SPL,
  		DEBUG_RPT_RX,
  		DEBUG_RPT_RA = 68,
@@ -24,7 +24,7 @@
  	} debug;
  	bool tx, rx, en;
  	int ret;
-@@ -315,8 +321,8 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+@@ -309,8 +315,8 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
  	if (ret)
  		return ret;
  
@@ -36,5 +36,5 @@
  
  		if (debug == DEBUG_RPT_RX)
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0026-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0019-mt76-testmode-add-atenl-support-in-mt7996.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0026-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0019-mt76-testmode-add-atenl-support-in-mt7996.patch
index c779eb7..1cbaf0e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0026-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0019-mt76-testmode-add-atenl-support-in-mt7996.patch
@@ -1,7 +1,7 @@
-From c559ca2ba572ba59906c8c194330c3ae6dc99b48 Mon Sep 17 00:00:00 2001
+From e119dd8edebc8baa1e30945db3d0a7bc192bfc4b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 28 Dec 2022 22:24:25 +0800
-Subject: [PATCH 26/29] wifi: mt76: testmode: add atenl support in mt7996
+Subject: [PATCH 19/22] mt76: testmode: add atenl support in mt7996
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/testmode.c b/testmode.c
-index 0accc71..0d2bae9 100644
+index 0accc71a..0d2bae9f 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -612,7 +612,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -24,7 +24,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 5e2792d..a40cd74 100644
+index 5e2792d8..a40cd74b 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -17,6 +17,7 @@
@@ -44,5 +44,5 @@
  	MT76_TM_ATTR_TX_COUNT,
  	MT76_TM_ATTR_TX_LENGTH,
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0027-wifi-mt76-testmode-add-basic-testmode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0020-mt76-testmode-add-basic-testmode-support.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0027-wifi-mt76-testmode-add-basic-testmode-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0020-mt76-testmode-add-basic-testmode-support.patch
index b47f160..30eef7a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0027-wifi-mt76-testmode-add-basic-testmode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0020-mt76-testmode-add-basic-testmode-support.patch
@@ -1,13 +1,13 @@
-From ead183c5143c45e4f188d0bb0214b0d41c113ed2 Mon Sep 17 00:00:00 2001
+From 058747d35c83a796712bec098cf6509965cf28cc Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 11:59:16 +0800
-Subject: [PATCH 27/29] wifi: mt76: testmode: add basic testmode support
+Subject: [PATCH 20/22] mt76: testmode: add basic testmode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  eeprom.c          |   6 +-
  mac80211.c        |   3 +-
- mt76.h            |  11 +
+ mt76.h            |  33 +++
  mt76_connac_mcu.h |   2 +
  mt7996/Makefile   |   2 +
  mt7996/eeprom.c   |  35 ++-
@@ -17,17 +17,17 @@
  mt7996/mcu.c      |  39 ++-
  mt7996/mcu.h      |  27 ++
  mt7996/mt7996.h   |  22 ++
- mt7996/testmode.c | 615 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/testmode.h | 292 ++++++++++++++++++++++
- testmode.c        |  45 +++-
+ mt7996/testmode.c | 632 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/testmode.h | 295 ++++++++++++++++++++++
+ testmode.c        |  73 ++++--
  testmode.h        |  60 +++++
  tools/fields.c    |  92 +++++++
- 17 files changed, 1257 insertions(+), 17 deletions(-)
+ 17 files changed, 1315 insertions(+), 29 deletions(-)
  create mode 100644 mt7996/testmode.c
  create mode 100644 mt7996/testmode.h
 
 diff --git a/eeprom.c b/eeprom.c
-index ea54b7a..263e508 100644
+index ea54b7af..263e5089 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -44,7 +44,7 @@
  
  out_put_node:
 diff --git a/mac80211.c b/mac80211.c
-index e53166f..a4b3d34 100644
+index 467afef9..d1cdaee8 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -826,7 +826,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -58,7 +58,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index c3d1313..343bd91 100644
+index 6b07b8fa..31d5dc37 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -652,8 +652,12 @@ struct mt76_testmode_ops {
@@ -92,19 +92,48 @@
  	u32 freq_offset;
  
  	u8 tx_power[4];
-@@ -692,7 +700,10 @@ struct mt76_testmode_data {
+@@ -692,7 +700,16 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
 +		u64 len_mismatch;
  	} rx_stats;
 +	u8 flag;
++
++	struct {
++		u8 type;
++		u8 enable;
++	} cfg;
++
 +	u8 aid;
  };
  
  struct mt76_vif {
+@@ -1258,6 +1275,22 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
+ int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
+ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
+ 
++static inline void
++mt76_testmode_param_set(struct mt76_testmode_data *td, u16 idx)
++{
++#ifdef CONFIG_NL80211_TESTMODE
++	td->param_set[idx / 32] |= BIT(idx % 32);
++#endif
++}
++
++static inline bool
++mt76_testmode_param_present(struct mt76_testmode_data *td, u16 idx)
++{
++#ifdef CONFIG_NL80211_TESTMODE
++	return td->param_set[idx / 32] & BIT(idx % 32);
++#endif
++}
++
+ static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
+ {
+ #ifdef CONFIG_NL80211_TESTMODE
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 79dde31..bfbf18d 100644
+index fbb1206f..17cb8128 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1218,10 +1218,12 @@ enum {
@@ -119,19 +148,19 @@
 +	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
- };
+ 	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index bcb9a3c..f9fb1b0 100644
+index 07c8b555..bed9efd6 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
-@@ -4,3 +4,5 @@ obj-$(CONFIG_MT7996E) += mt7996e.o
- 
- mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+@@ -6,3 +6,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
  	     debugfs.o mmio.o
+ 
+ mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
 +
 +mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 2e48c5a..64e3c4e 100644
+index 544b6c6f..f5e95460 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -6,6 +6,11 @@
@@ -201,7 +230,7 @@
  		if (ret < 0)
  			return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index cfc4869..f7497c9 100644
+index 0c749774..0f8f0cd8 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -213,10 +242,10 @@
  	MT_EE_RATE_DELTA_2G =	0x1400,
  	MT_EE_RATE_DELTA_5G =	0x147d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 381917a..29a6783 100644
+index d44e3ae9..36ead6db 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -621,6 +621,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -639,6 +639,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  
  	set_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
  
@@ -227,7 +256,7 @@
  	ret = mt7996_mcu_init(dev);
  	if (ret)
  		return ret;
-@@ -1055,6 +1059,9 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1054,6 +1058,9 @@ int mt7996_register_device(struct mt7996_dev *dev)
  
  	mt7996_init_wiphy(hw);
  
@@ -238,10 +267,10 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mphy.leds.cdev.brightness_set = mt7996_led_set_brightness;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 4e9536e..b24c75a 100644
+index 059cc420..3820b235 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -22,6 +22,17 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
+@@ -23,6 +23,17 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
  	return phy && test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  }
  
@@ -259,7 +288,7 @@
  int mt7996_run(struct ieee80211_hw *hw)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-@@ -36,6 +47,8 @@ int mt7996_run(struct ieee80211_hw *hw)
+@@ -37,6 +48,8 @@ int mt7996_run(struct ieee80211_hw *hw)
  			goto out;
  	}
  
@@ -268,7 +297,7 @@
  	mt7996_mac_enable_nf(dev, phy->mt76->band_idx);
  
  	ret = mt7996_mcu_set_rts_thresh(phy, 0x92b);
-@@ -1343,6 +1356,8 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1390,6 +1403,8 @@ const struct ieee80211_ops mt7996_ops = {
  	.sta_set_decap_offload = mt7996_sta_set_decap_offload,
  	.add_twt_setup = mt7996_mac_add_twt_setup,
  	.twt_teardown_request = mt7996_twt_teardown_request,
@@ -278,10 +307,10 @@
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  #endif
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index deb6e1e..0a52afd 100644
+index 43a4f939..24adeb12 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2580,7 +2580,10 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2467,7 +2467,10 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  		release_firmware(fw);						\
  	} while (0)
  
@@ -293,7 +322,7 @@
  	LOAD_RAM(DSP);
  	LOAD_RAM(WA);
  #undef LOAD_RAM
-@@ -4109,3 +4112,37 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
+@@ -4012,3 +4015,37 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RRO), &req,
  				 sizeof(req), true);
  }
@@ -332,7 +361,7 @@
 +				 &req, sizeof(req), false);
 +}
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 778deed..ebc6271 100644
+index 778deedf..ebc62713 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -686,6 +686,33 @@ enum {
@@ -370,7 +399,7 @@
  	UNI_CMD_ACCESS_REG_BASIC = 0x0,
  	UNI_CMD_ACCESS_RF_REG_BASIC,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c2f8900..e3fd50f 100644
+index ab4521a4..9bf3bf1a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -30,9 +30,11 @@
@@ -385,7 +414,7 @@
  #define MT7996_EEPROM_SIZE		7680
  #define MT7996_EEPROM_BLOCK_SIZE	16
  #define MT7996_TOKEN_SIZE		8192
-@@ -58,6 +60,7 @@ struct mt7996_dfs_pattern;
+@@ -62,6 +64,7 @@ struct mt7996_dfs_pattern;
  
  enum mt7996_ram_type {
  	MT7996_RAM_TYPE_WM = 0,
@@ -393,7 +422,7 @@
  	MT7996_RAM_TYPE_WA,
  	MT7996_RAM_TYPE_DSP,
  };
-@@ -245,6 +248,20 @@ struct mt7996_phy {
+@@ -243,6 +246,20 @@ struct mt7996_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -414,7 +443,7 @@
  };
  
  struct mt7996_dev {
-@@ -296,6 +313,8 @@ struct mt7996_dev {
+@@ -302,6 +319,8 @@ struct mt7996_dev {
  	bool flash_mode:1;
  	bool has_eht:1;
  
@@ -423,7 +452,7 @@
  	bool ibf;
  	u8 fw_debug_wm;
  	u8 fw_debug_wa;
-@@ -401,6 +420,7 @@ mt7996_phy3(struct mt7996_dev *dev)
+@@ -407,6 +426,7 @@ mt7996_phy3(struct mt7996_dev *dev)
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
@@ -431,7 +460,7 @@
  
  struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  				     void __iomem *mem_base, u32 device_id);
-@@ -410,6 +430,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
+@@ -416,6 +436,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
  int mt7996_eeprom_init(struct mt7996_dev *dev);
@@ -439,8 +468,8 @@
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
-@@ -485,6 +506,7 @@ int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
- int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+@@ -492,6 +513,7 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
 +int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
@@ -449,10 +478,10 @@
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
 new file mode 100644
-index 0000000..5dbbb78
+index 00000000..6d7cdbd5
 --- /dev/null
 +++ b/mt7996/testmode.c
-@@ -0,0 +1,615 @@
+@@ -0,0 +1,632 @@
 +// SPDX-License-Identifier: ISC
 +/*
 + * Copyright (C) 2022 MediaTek Inc.
@@ -468,6 +497,7 @@
 +	TM_CHANGED_FREQ_OFFSET,
 +	TM_CHANGED_TX_LENGTH,
 +	TM_CHANGED_TX_TIME,
++	TM_CHANGED_CFG,
 +
 +	/* must be last */
 +	NUM_TM_CHANGED
@@ -478,6 +508,7 @@
 +	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
 +	[TM_CHANGED_TX_LENGTH] = MT76_TM_ATTR_TX_LENGTH,
 +	[TM_CHANGED_TX_TIME] = MT76_TM_ATTR_TX_TIME,
++	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
 +};
 +
 +static u8 mt7996_tm_bw_mapping(enum nl80211_chan_width width, enum bw_mapping_method method)
@@ -575,10 +606,9 @@
 +#define RX_ANTENNA_MASK		GENMASK(20, 16)		/* RX antenna mask at most 5 bit */
 +	struct mt7996_dev *dev = phy->dev;
 +	struct mt76_testmode_data *td = &phy->mt76->test;
-+	u32 antenna_mask, idx = MT76_TM_ATTR_TX_ANTENNA;
-+	bool is_antenna_set = td->param_set[idx / 32] & BIT(idx % 32);
++	u32 antenna_mask;
 +
-+	if (!is_antenna_set)
++	if (!mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA))
 +		return;
 +
 +	if (func_idx == SET_ID(TX_PATH))
@@ -715,7 +745,18 @@
 +		mt7996_tm_set(dev, SET_ID(TX_COUNT), td->tx_count);
 +		mt7996_tm_set(dev, SET_ID(TX_MODE), mt7996_tm_rate_to_phy(td->tx_rate_mode));
 +		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
-+		mt7996_tm_set(dev, SET_ID(POWER), td->tx_power[0]);
++
++		if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER))
++			mt7996_tm_set(dev, SET_ID(POWER), td->tx_power[0]);
++
++		if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_TIME)) {
++			mt7996_tm_set(dev, SET_ID(TX_LEN), 0);
++			mt7996_tm_set(dev, SET_ID(TX_TIME), td->tx_time);
++		} else {
++			mt7996_tm_set(dev, SET_ID(TX_LEN), td->tx_mpdu_len);
++			mt7996_tm_set(dev, SET_ID(TX_TIME), 0);
++		}
++
 +		mt7996_tm_set_antenna(phy, SET_ID(TX_PATH));
 +		mt7996_tm_set(dev, SET_ID(STBC), td->tx_rate_stbc);
 +		mt7996_tm_set(dev, SET_ID(ENCODE_MODE), td->tx_rate_ldpc);
@@ -836,6 +877,11 @@
 +		mt7996_tm_set(dev, SET_ID(TX_LEN), 0);
 +		mt7996_tm_set(dev, SET_ID(TX_TIME), td->tx_time);
 +	}
++	if (changed & BIT(TM_CHANGED_CFG)) {
++		u32 func_idx = td->cfg.enable ? SET_ID(CFG_ON) : SET_ID(CFG_OFF);
++
++		mt7996_tm_set(dev, func_idx, td->cfg.type);
++	}
 +}
 +
 +static int
@@ -873,7 +919,7 @@
 +		for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
 +			u16 cur = tm_change_map[i];
 +
-+			if (td->param_set[cur / 32] & BIT(cur % 32))
++			if (mt76_testmode_param_present(td, cur))
 +				changed |= BIT(i);
 +		}
 +
@@ -977,7 +1023,7 @@
 +}
 +
 +static void
-+mt7996_tm_reset_rx_stats(struct mt76_phy *mphy)
++mt7996_tm_reset_trx_stats(struct mt76_phy *mphy)
 +{
 +	struct mt7996_phy *phy = mphy->priv;
 +	struct mt7996_dev *dev = phy->dev;
@@ -1065,15 +1111,15 @@
 +	.set_state = mt7996_tm_set_state,
 +	.set_params = mt7996_tm_set_params,
 +	.dump_stats = mt7996_tm_dump_stats,
-+	.reset_rx_stats = mt7996_tm_reset_rx_stats,
++	.reset_rx_stats = mt7996_tm_reset_trx_stats,
 +	.tx_stop = mt7996_tm_tx_stop,
 +};
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
 new file mode 100644
-index 0000000..f381da5
+index 00000000..f00e51f4
 --- /dev/null
 +++ b/mt7996/testmode.h
-@@ -0,0 +1,292 @@
+@@ -0,0 +1,295 @@
 +/* SPDX-License-Identifier: ISC */
 +/* Copyright (C) 2020 MediaTek Inc. */
 +
@@ -1209,6 +1255,7 @@
 +	RF_TEST_ID_SET_TRX_COUNTER_RESET = 91,
 +	RF_TEST_ID_SET_MAC_HEADER = 101,
 +	RF_TEST_ID_SET_SEQ_CTRL = 102,
++	RF_TEST_ID_SET_PAYLOAD = 103,
 +	RF_TEST_ID_SET_BAND_IDX = 104,
 +	RF_TEST_ID_SET_RX_PATH = 106,
 +	RF_TEST_ID_SET_FREQ_OFFSET = 107,
@@ -1222,6 +1269,8 @@
 +	RF_TEST_ID_SET_RX_MU_AID = 157,
 +	RF_TEST_ID_SET_HW_TX_MODE = 167,
 +	RF_TEST_ID_SET_PUNCTURE = 168,
++	RF_TEST_ID_SET_CFG_ON = 176,
++	RF_TEST_ID_SET_CFG_OFF = 177,
 +	RF_TEST_ID_SET_BSSID = 189,
 +	RF_TEST_ID_SET_TX_TIME = 190,
 +	RF_TEST_ID_SET_MAX_PE = 191,
@@ -1367,7 +1416,7 @@
 +
 +#endif
 diff --git a/testmode.c b/testmode.c
-index 0d2bae9..007358b 100644
+index 0d2bae9f..fc68c2af 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -2,6 +2,7 @@
@@ -1423,7 +1472,23 @@
  	mt76_worker_disable(&dev->tx_worker);
  
  	td->tx_pending = 0;
-@@ -311,6 +327,7 @@ static void
+@@ -295,22 +311,11 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+ 	mt76_testmode_free_skb(phy);
+ }
+ 
+-static inline void
+-mt76_testmode_param_set(struct mt76_testmode_data *td, u16 idx)
+-{
+-	td->param_set[idx / 32] |= BIT(idx % 32);
+-}
+-
+-static inline bool
+-mt76_testmode_param_present(struct mt76_testmode_data *td, u16 idx)
+-{
+-	return td->param_set[idx / 32] & BIT(idx % 32);
+-}
+-
+ static void
  mt76_testmode_init_defaults(struct mt76_phy *phy)
  {
  	struct mt76_testmode_data *td = &phy->test;
@@ -1431,7 +1496,7 @@
  
  	if (td->tx_mpdu_len > 0)
  		return;
-@@ -318,11 +335,18 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+@@ -318,11 +323,18 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
  	td->tx_mpdu_len = 1024;
  	td->tx_count = 1;
  	td->tx_rate_mode = MT76_TM_TX_MODE_OFDM;
@@ -1440,20 +1505,20 @@
 +	/* 0xffff for OFDMA no puncture */
 +	td->tx_preamble_puncture = ~(td->tx_preamble_puncture & 0);
 +	td->tx_ipg = 50;
++
++	/* rx stat user config */
++	td->aid = 1;
  
 -	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
 -	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
 -	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
-+	/* rx stat user config */
-+	td->aid = 1;
-+
 +	memcpy(td->addr[0], addr, ETH_ALEN);
 +	memcpy(td->addr[1], addr, ETH_ALEN);
 +	memcpy(td->addr[2], addr, ETH_ALEN);
  }
  
  static int
-@@ -352,7 +376,7 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+@@ -352,7 +364,7 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
  	if (state == MT76_TM_STATE_TX_FRAMES)
  		mt76_testmode_tx_start(phy);
  	else if (state == MT76_TM_STATE_RX_FRAMES) {
@@ -1462,7 +1527,7 @@
  	}
  
  	phy->test.state = state;
-@@ -453,7 +477,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -453,7 +465,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
@@ -1472,7 +1537,7 @@
  		goto out;
  
  	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -493,7 +518,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -493,7 +506,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    idx >= ARRAY_SIZE(td->tx_power))
  				goto out;
  
@@ -1483,7 +1548,30 @@
  		}
  	}
  
+@@ -511,6 +526,22 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		}
+ 	}
+ 
-@@ -560,6 +587,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
++	if (tb[MT76_TM_ATTR_CFG]) {
++		struct nlattr *cur;
++		int rem, idx = 0;
++
++		nla_for_each_nested(cur, tb[MT76_TM_ATTR_CFG], rem) {
++			if (nla_len(cur) != 1 || idx >= 2)
++				goto out;
++
++			if (idx == 0)
++				td->cfg.type = nla_get_u8(cur);
++			else
++				td->cfg.enable = nla_get_u8(cur);
++			idx++;
++		}
++	}
++
+ 	if (dev->test_ops->set_params) {
+ 		err = dev->test_ops->set_params(phy, tb, state);
+ 		if (err)
+@@ -560,6 +591,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
  			      MT76_TM_STATS_ATTR_PAD) ||
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
@@ -1493,7 +1581,7 @@
  			      MT76_TM_STATS_ATTR_PAD))
  		return -EMSGSIZE;
  
-@@ -624,6 +654,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -624,6 +658,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
@@ -1502,7 +1590,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index a40cd74..8d0b970 100644
+index a40cd74b..8d0b9702 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -39,6 +39,11 @@
@@ -1622,7 +1710,7 @@
  	/* keep last */
  	NUM_MT76_TM_TX_MODES,
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f6908..e5cf7c5 100644
+index e3f69089..e5cf7c53 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -1784,5 +1872,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0028-wifi-mt76-testmode-add-chainmask-hacking-for-eagle-b.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0021-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
similarity index 67%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0028-wifi-mt76-testmode-add-chainmask-hacking-for-eagle-b.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0021-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
index 4e05664..a3a0633 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0028-wifi-mt76-testmode-add-chainmask-hacking-for-eagle-b.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0021-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
@@ -1,8 +1,8 @@
-From 576d54b4dce61e33ad31b8d8266548972ea13049 Mon Sep 17 00:00:00 2001
+From 59c4b77798c213a1766b3dac36a9de08145f063e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 9 Mar 2023 18:45:04 +0800
-Subject: [PATCH 28/29] wifi: mt76: testmode: add chainmask hacking for eagle
- band 2 4T5R
+Subject: [PATCH 21/22] mt76: testmode: add chainmask hacking for eagle band 2
+ 4T5R
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -10,10 +10,10 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 5dbbb78..1721251 100644
+index 6d7cdbd5..0d4d9138 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -446,6 +446,7 @@ mt7996_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+@@ -463,6 +463,7 @@ mt7996_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
  		return 0;
  
  	chainmask = chainmask >> dev->chainshift[band_idx];
@@ -22,5 +22,5 @@
  		return -EINVAL;
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
deleted file mode 100644
index fd8a2fb..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From b45cb95c51dbe6118d9133255eceafe765765be8 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Tue, 7 Mar 2023 17:05:01 +0800
-Subject: [PATCH 21/29] wifi: mt76: mt7996: Fix using the wrong phy for
- background radar event
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/mcu.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ed1abe1..cc6c6a4 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -339,10 +339,15 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
- 	if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
- 		return;
- 
--	mphy = dev->mt76.phys[r->band_idx];
-+	if (dev->rdd2_phy && r->band_idx == MT_RX_SEL2)
-+		mphy = dev->rdd2_phy->mt76;
-+	else
-+		mphy = dev->mt76.phys[r->band_idx];
-+
- 	if (!mphy)
- 		return;
- 
-+	/* TODO: check fw background chain's rdd idx */
- 	if (r->band_idx == MT_RX_SEL2)
- 		cfg80211_background_radar_event(mphy->hw->wiphy,
- 						&dev->rdd2_chandef,
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0999-wifi-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0022-mt76-revert-page-pool-changes.patch
similarity index 75%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0999-wifi-mt76-mt7996-for-build-pass.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0022-mt76-revert-page-pool-changes.patch
index 3005b16..f0daca8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0999-wifi-mt76-mt7996-for-build-pass.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0022-mt76-revert-page-pool-changes.patch
@@ -1,45 +1,20 @@
-From 589b56aaeaead7d2d4fb28be20fd577e46706de3 Mon Sep 17 00:00:00 2001
+From d28a3716f729848ef65192c84411b0912afe70c6 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 3 Nov 2022 00:27:17 +0800
-Subject: [PATCH] wifi: mt76: mt7996: for build pass
+Date: Mon, 6 Feb 2023 15:34:43 +0800
+Subject: [PATCH 22/22] mt76: revert page pool changes
 
 ---
- debugfs.c         |  3 ++
- dma.c             | 74 ++++++++++++++++++++++++-----------------------
- eeprom.c          |  8 ++++-
- mac80211.c        | 57 ------------------------------------
- mcu.c             |  1 +
- mt76.h            | 22 +-------------
- mt7615/mcu.c      |  1 +
- mt76_connac_mcu.c |  1 +
- mt7915/main.c     | 26 +++++++----------
- mt7915/mcu.c      |  1 +
- mt7915/mmio.c     | 55 +++++++++++++++++++++--------------
- mt7921/main.c     | 31 +++-----------------
- mt7996/dma.c      |  4 +--
- mt7996/eeprom.c   |  1 +
- mt7996/mcu.c      |  1 +
- usb.c             | 43 +++++++++++++--------------
- 16 files changed, 127 insertions(+), 202 deletions(-)
+ dma.c         | 72 ++++++++++++++++++++++++++-------------------------
+ mac80211.c    | 57 ----------------------------------------
+ mt76.h        | 22 +---------------
+ mt7915/main.c | 26 +++++++------------
+ mt7915/mmio.c | 55 ++++++++++++++++++++++++---------------
+ mt7921/main.c | 31 +++-------------------
+ usb.c         | 43 +++++++++++++++---------------
+ 7 files changed, 108 insertions(+), 198 deletions(-)
 
-diff --git a/debugfs.c b/debugfs.c
-index 79064a4..e10d4cb 100644
---- a/debugfs.c
-+++ b/debugfs.c
-@@ -33,8 +33,11 @@ mt76_napi_threaded_set(void *data, u64 val)
- 	if (!mt76_is_mmio(dev))
- 		return -EOPNOTSUPP;
- 
-+#if 0
-+	/* need to backport patch from networking stack */
- 	if (dev->napi_dev.threaded != val)
- 		return dev_set_threaded(&dev->napi_dev, val);
-+#endif
- 
- 	return 0;
- }
 diff --git a/dma.c b/dma.c
-index df2ca73..2fc70e2 100644
+index 465190eb..f560d37d 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -173,7 +173,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
@@ -77,7 +52,7 @@
  	}
  
  	return buf;
-@@ -584,11 +584,11 @@ free_skb:
+@@ -586,11 +586,11 @@ free_skb:
  }
  
  static int
@@ -92,7 +67,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -596,25 +596,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -598,25 +598,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  	spin_lock_bh(&q->lock);
  
  	while (q->queued < q->ndesc - 1) {
@@ -130,7 +105,7 @@
  			break;
  		}
  		frames++;
-@@ -658,7 +659,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -660,7 +661,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  		/* WED txfree queue needs ring to be initialized before setup */
  		q->flags = 0;
  		mt76_dma_queue_reset(dev, q);
@@ -139,7 +114,7 @@
  		q->flags = flags;
  
  		ret = mtk_wed_device_txfree_ring_setup(wed, q->regs);
-@@ -706,10 +707,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -708,10 +709,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -150,7 +125,7 @@
  	ret = mt76_dma_wed_setup(dev, q, false);
  	if (ret)
  		return ret;
-@@ -723,6 +720,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -725,6 +722,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -158,7 +133,7 @@
  	void *buf;
  	bool more;
  
-@@ -736,7 +734,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -738,7 +736,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  		if (!buf)
  			break;
  
@@ -167,7 +142,7 @@
  	} while (1);
  
  	if (q->rx_head) {
-@@ -745,6 +743,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -747,6 +745,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	}
  
  	spin_unlock_bh(&q->lock);
@@ -181,7 +156,7 @@
  }
  
  static void
-@@ -765,7 +770,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -767,7 +772,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  	mt76_dma_wed_setup(dev, q, true);
  	if (q->flags != MT_WED_Q_TXFREE) {
  		mt76_dma_sync_idx(dev, q);
@@ -190,7 +165,7 @@
  	}
  }
  
-@@ -783,7 +788,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -785,7 +790,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
  	} else {
@@ -199,13 +174,7 @@
  	}
  
  	if (more)
-@@ -851,12 +856,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 		    !(dev->drv->rx_check(dev, data, len)))
- 			goto free_frag;
- 
--		skb = napi_build_skb(data, q->buf_size);
-+		skb = build_skb(data, q->buf_size);
- 		if (!skb)
+@@ -858,7 +863,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  			goto free_frag;
  
  		skb_reserve(skb, q->buf_offset);
@@ -213,7 +182,7 @@
  
  		*(u32 *)skb->cb = info;
  
-@@ -872,10 +876,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -874,10 +878,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		continue;
  
  free_frag:
@@ -226,7 +195,7 @@
  	return done;
  }
  
-@@ -920,7 +924,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -922,7 +926,7 @@ mt76_dma_init(struct mt76_dev *dev,
  
  	mt76_for_each_q_rx(dev, i) {
  		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
@@ -235,7 +204,7 @@
  		napi_enable(&dev->napi[i]);
  	}
  
-@@ -971,8 +975,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -973,8 +977,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  		netif_napi_del(&dev->napi[i]);
  		mt76_dma_rx_cleanup(dev, q);
@@ -244,29 +213,8 @@
  	}
  
  	mt76_free_pending_txwi(dev);
-diff --git a/eeprom.c b/eeprom.c
-index 263e508..aa88925 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -108,9 +108,15 @@ void
- mt76_eeprom_override(struct mt76_phy *phy)
- {
- 	struct mt76_dev *dev = phy->dev;
-+#ifdef CONFIG_OF
- 	struct device_node *np = dev->dev->of_node;
-+	const u8 *mac = NULL;
- 
--	of_get_mac_address(np, phy->macaddr);
-+	if (np)
-+		mac = of_get_mac_address(np);
-+	if (!IS_ERR_OR_NULL(mac))
-+		ether_addr_copy(phy->macaddr, mac);
-+#endif
- 
- 	if (!is_valid_ether_addr(phy->macaddr)) {
- 		eth_random_addr(phy->macaddr);
 diff --git a/mac80211.c b/mac80211.c
-index a4b3d34..40fda9d 100644
+index d1cdaee8..4599f697 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -325,7 +273,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1747,21 +1705,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1748,21 +1706,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -347,20 +295,8 @@
  enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
  {
  	struct ieee80211_hw *hw = phy->hw;
-diff --git a/mcu.c b/mcu.c
-index a8cafa3..fa4b054 100644
---- a/mcu.c
-+++ b/mcu.c
-@@ -4,6 +4,7 @@
-  */
- 
- #include "mt76.h"
-+#include <linux/moduleparam.h>
- 
- struct sk_buff *
- __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt76.h b/mt76.h
-index 343bd91..3d96b33 100644
+index 31d5dc37..f012ac0c 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -202,7 +202,7 @@ struct mt76_queue {
@@ -372,7 +308,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1340,7 +1340,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1363,7 +1363,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -380,7 +316,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1452,25 +1451,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1475,25 +1474,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
@@ -406,35 +342,11 @@
  
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
-diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index eea398c..4593b2e 100644
---- a/mt7615/mcu.c
-+++ b/mt7615/mcu.c
-@@ -10,6 +10,7 @@
- #include "mcu.h"
- #include "mac.h"
- #include "eeprom.h"
-+#include <linux/moduleparam.h>
- 
- static bool prefer_offload_fw = true;
- module_param(prefer_offload_fw, bool, 0644);
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 4e4f6b3..e581522 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -4,6 +4,7 @@
- #include <linux/firmware.h>
- #include "mt76_connac2_mac.h"
- #include "mt76_connac_mcu.h"
-+#include <linux/module.h>
- 
- int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
- {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3bbccbd..161a2d1 100644
+index 8ce7b1c5..fbff908f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1291,22 +1291,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1289,22 +1289,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
@@ -463,7 +375,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1334,7 +1331,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1332,7 +1329,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  	};
  	struct mib_stats *mib = &phy->mib;
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -472,7 +384,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1415,12 +1412,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1413,12 +1410,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -488,20 +400,8 @@
  }
  
  static void
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d08907f..99ef8c9 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -6,6 +6,7 @@
- #include "mcu.h"
- #include "mac.h"
- #include "eeprom.h"
-+#include <linux/moduleparam.h>
- 
- #define fw_name(_dev, name, ...)	({			\
- 	char *_fw;						\
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6f0c0e2..5ef43c4 100644
+index 984b5f60..1bb8a4cb 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -596,9 +596,13 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
@@ -605,10 +505,10 @@
  	return -ENOMEM;
  }
 diff --git a/mt7921/main.c b/mt7921/main.c
-index a72964e..4c40022 100644
+index 3b6adb29..47eb38e4 100644
 --- a/mt7921/main.c
 +++ b/mt7921/main.c
-@@ -1090,34 +1090,17 @@ static void
+@@ -1083,34 +1083,17 @@ static void
  mt7921_get_et_strings(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		      u32 sset, u8 *data)
  {
@@ -644,7 +544,7 @@
  }
  
  static void
-@@ -1137,7 +1120,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1130,7 +1113,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			 struct ethtool_stats *stats, u64 *data)
  {
  	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
@@ -652,7 +552,7 @@
  	struct mt7921_phy *phy = mt7921_hw_phy(hw);
  	struct mt7921_dev *dev = phy->dev;
  	struct mib_stats *mib = &phy->mib;
-@@ -1193,14 +1175,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1186,14 +1168,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -670,47 +570,8 @@
  }
  
  static u64
-diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 18ea758..3e2967f 100644
---- a/mt7996/dma.c
-+++ b/mt7996/dma.c
-@@ -343,8 +343,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
- 	if (ret < 0)
- 		return ret;
- 
--	netif_napi_add_tx(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
--			  mt7996_poll_tx);
-+	netif_tx_napi_add(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
-+			  mt7996_poll_tx, NAPI_POLL_WEIGHT);
- 	napi_enable(&dev->mt76.tx_napi);
- 
- 	mt7996_dma_enable(dev);
-diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 64e3c4e..7bff504 100644
---- a/mt7996/eeprom.c
-+++ b/mt7996/eeprom.c
-@@ -121,6 +121,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
- 	if (ret)
- 		return ret;
- 
-+	cap = 0x4b249248;	/* internal hardcode */
- 	if (cap) {
- 		dev->has_eht = !(cap & MODE_HE_ONLY);
- 		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0a52afd..cc94839 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -5,6 +5,7 @@
- 
- #include <linux/firmware.h>
- #include <linux/fs.h>
-+#include <linux/moduleparam.h>
- #include "mt7996.h"
- #include "mcu.h"
- #include "mac.h"
 diff --git a/usb.c b/usb.c
-index 5e5c7bf..3e28171 100644
+index 5e5c7bf5..3e281715 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
@@ -844,5 +705,5 @@
  
  static void mt76u_free_rx(struct mt76_dev *dev)
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0029-wifi-mt76-mt7996-set-SUPPORTS_VHT_EXT_NSS_BW-in-mt79.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0029-wifi-mt76-mt7996-set-SUPPORTS_VHT_EXT_NSS_BW-in-mt79.patch
deleted file mode 100644
index b19ee65..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0029-wifi-mt76-mt7996-set-SUPPORTS_VHT_EXT_NSS_BW-in-mt79.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From f4ce8f80fee46f630d564e48880cc0b02cb10ed5 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 27 Mar 2023 14:30:25 +0800
-Subject: [PATCH 29/29] wifi: mt76: mt7996: set SUPPORTS_VHT_EXT_NSS_BW in
- mt7996_init_wiphy
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/init.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 29a6783..fbe1b71 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -394,6 +394,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
- 			IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
- 		phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
- 			IEEE80211_HT_MPDU_DENSITY_1;
-+		ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
- 	}
- 
- 	mt76_set_stream_caps(phy->mt76, true);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch
new file mode 100644
index 0000000..89d1cdd
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch
@@ -0,0 +1,159 @@
+From c187058bfc83a80b3cfbfed4ce0c73ece6efb1fe Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 3 Nov 2022 00:27:17 +0800
+Subject: [PATCH 0999/1001] mt76: mt7996: for build pass
+
+Change-Id: Ieb44c33ee6e6a2e6058c1ef528404c1a1cbcfdaf
+---
+ debugfs.c         | 3 +++
+ dma.c             | 2 +-
+ eeprom.c          | 8 +++++++-
+ mcu.c             | 1 +
+ mt7615/mcu.c      | 1 +
+ mt76_connac_mcu.c | 1 +
+ mt7915/mcu.c      | 1 +
+ mt7996/dma.c      | 4 ++--
+ mt7996/eeprom.c   | 1 +
+ mt7996/mcu.c      | 1 +
+ 10 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/debugfs.c b/debugfs.c
+index 79064a4d..e10d4cbc 100644
+--- a/debugfs.c
++++ b/debugfs.c
+@@ -33,8 +33,11 @@ mt76_napi_threaded_set(void *data, u64 val)
+ 	if (!mt76_is_mmio(dev))
+ 		return -EOPNOTSUPP;
+ 
++#if 0
++	/* need to backport patch from networking stack */
+ 	if (dev->napi_dev.threaded != val)
+ 		return dev_set_threaded(&dev->napi_dev, val);
++#endif
+ 
+ 	return 0;
+ }
+diff --git a/dma.c b/dma.c
+index f560d37d..ffc5b553 100644
+--- a/dma.c
++++ b/dma.c
+@@ -858,7 +858,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 		    !(dev->drv->rx_check(dev, data, len)))
+ 			goto free_frag;
+ 
+-		skb = napi_build_skb(data, q->buf_size);
++		skb = build_skb(data, q->buf_size);
+ 		if (!skb)
+ 			goto free_frag;
+ 
+diff --git a/eeprom.c b/eeprom.c
+index 263e5089..aa889258 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -108,9 +108,15 @@ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+ 	struct mt76_dev *dev = phy->dev;
++#ifdef CONFIG_OF
+ 	struct device_node *np = dev->dev->of_node;
++	const u8 *mac = NULL;
+ 
+-	of_get_mac_address(np, phy->macaddr);
++	if (np)
++		mac = of_get_mac_address(np);
++	if (!IS_ERR_OR_NULL(mac))
++		ether_addr_copy(phy->macaddr, mac);
++#endif
+ 
+ 	if (!is_valid_ether_addr(phy->macaddr)) {
+ 		eth_random_addr(phy->macaddr);
+diff --git a/mcu.c b/mcu.c
+index a8cafa39..fa4b0544 100644
+--- a/mcu.c
++++ b/mcu.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include "mt76.h"
++#include <linux/moduleparam.h>
+ 
+ struct sk_buff *
+ __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
+diff --git a/mt7615/mcu.c b/mt7615/mcu.c
+index 8d745c97..86061e95 100644
+--- a/mt7615/mcu.c
++++ b/mt7615/mcu.c
+@@ -10,6 +10,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ static bool prefer_offload_fw = true;
+ module_param(prefer_offload_fw, bool, 0644);
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 5fab6772..c24dac10 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -4,6 +4,7 @@
+ #include <linux/firmware.h>
+ #include "mt76_connac2_mac.h"
+ #include "mt76_connac_mcu.h"
++#include <linux/module.h>
+ 
+ int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
+ {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index aa706ff6..e8c1e572 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -6,6 +6,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ #define fw_name(_dev, name, ...)	({			\
+ 	char *_fw;						\
+diff --git a/mt7996/dma.c b/mt7996/dma.c
+index 53414346..733d1228 100644
+--- a/mt7996/dma.c
++++ b/mt7996/dma.c
+@@ -343,8 +343,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	netif_napi_add_tx(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
+-			  mt7996_poll_tx);
++	netif_tx_napi_add(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
++			  mt7996_poll_tx, NAPI_POLL_WEIGHT);
+ 	napi_enable(&dev->mt76.tx_napi);
+ 
+ 	mt7996_dma_enable(dev);
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index f5e95460..50f2227f 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -121,6 +121,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	cap = 0x4b249248;	/* internal hardcode */
+ 	if (cap) {
+ 		dev->has_eht = !(cap & MODE_HE_ONLY);
+ 		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 24adeb12..f2bfbd8a 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -5,6 +5,7 @@
+ 
+ #include <linux/firmware.h>
+ #include <linux/fs.h>
++#include <linux/moduleparam.h>
+ #include "mt7996.h"
+ #include "mcu.h"
+ #include "mac.h"
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1000-wifi-mt76-mt7996-add-debug-tool.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1000-mt76-mt7996-add-debug-tool.patch
similarity index 99%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1000-wifi-mt76-mt7996-add-debug-tool.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1000-mt76-mt7996-add-debug-tool.patch
index 31111b4..018c7b9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1000-wifi-mt76-mt7996-add-debug-tool.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1000-mt76-mt7996-add-debug-tool.patch
@@ -1,7 +1,7 @@
-From c31edeef8cd035268a52e3343e00d03e5b5ce6a5 Mon Sep 17 00:00:00 2001
+From 9cf11ae2bfdf56babbdfe4fe03f61f492c06ce1a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Mar 2023 14:02:32 +0800
-Subject: [PATCH 1000/1001] wifi: mt76: mt7996: add debug tool
+Subject: [PATCH 1000/1001] mt76: mt7996: add debug tool
 
 Change-Id: Ie10390b01f17db893dbfbf3221bf63a4bd1fe38f
 ---
@@ -21,7 +21,7 @@
  create mode 100644 mt7996/mtk_mcu.h
 
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index f9fb1b0..5056e17 100644
+index bed9efd6..9ef0b824 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
 @@ -1,4 +1,5 @@
@@ -30,17 +30,17 @@
  
  obj-$(CONFIG_MT7996E) += mt7996e.o
  
-@@ -6,3 +7,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
- 	     debugfs.o mmio.o
+@@ -8,3 +9,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+ mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
  
  mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
 +
 +mt7996e-y += mtk_debugfs.o mtk_mcu.o
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 34c30a5..6d04f27 100644
+index 04220180..0bfded17 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -307,6 +307,9 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+@@ -301,6 +301,9 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
  	int ret;
  
  	dev->fw_debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
@@ -50,7 +50,7 @@
  
  	if (dev->fw_debug_bin)
  		val = MCU_FW_LOG_RELAY;
-@@ -413,16 +416,22 @@ mt7996_fw_debug_bin_set(void *data, u64 val)
+@@ -407,16 +410,22 @@ mt7996_fw_debug_bin_set(void *data, u64 val)
  	};
  	struct mt7996_dev *dev = data;
  
@@ -76,7 +76,7 @@
  	return mt7996_fw_debug_wm_set(dev, dev->fw_debug_wm);
  }
  
-@@ -827,8 +836,13 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
+@@ -821,8 +830,13 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
  					    mt7996_rdd_monitor);
  	}
  
@@ -91,7 +91,7 @@
  
  	return 0;
  }
-@@ -842,6 +856,12 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
+@@ -836,6 +850,12 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
  	void *dest;
  
  	spin_lock_irqsave(&lock, flags);
@@ -104,7 +104,7 @@
  	dest = relay_reserve(dev->relay_fwlog, hdrlen + len + 4);
  	if (dest) {
  		*(u32 *)dest = hdrlen + len;
-@@ -874,9 +894,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
+@@ -868,9 +888,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -115,10 +115,10 @@
  	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
  	hdr.len = *(__le16 *)data;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index cc94839..1461ba8 100644
+index f2bfbd8a..ef779cf9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2437,6 +2437,7 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
+@@ -2324,6 +2324,7 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
  
  	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
@@ -126,7 +126,7 @@
  
  	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
  		struct mt7996_patch_sec *sec;
-@@ -2566,6 +2567,9 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2453,6 +2454,9 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  		hdr = (const struct mt7996_fw_trailer *)			\
  				(fw->data + fw->size - sizeof(*hdr));		\
  										\
@@ -137,10 +137,10 @@
  			 "%s Firmware Version: %.10s, Build Time: %.15s\n",	\
  			 #_type, hdr->fw_ver, hdr->build_date);			\
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index e3fd50f..8b76d69 100644
+index 9bf3bf1a..1ac54520 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -333,6 +333,17 @@ struct mt7996_dev {
+@@ -339,6 +339,17 @@ struct mt7996_dev {
  	u32 reg_l2_backup;
  
  	u8 wtbl_size_group;
@@ -158,7 +158,7 @@
  };
  
  enum {
-@@ -596,4 +607,8 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -608,4 +619,8 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -169,7 +169,7 @@
  #endif
 diff --git a/mt7996/mtk_debug.h b/mt7996/mtk_debug.h
 new file mode 100644
-index 0000000..a48bac5
+index 00000000..a48bac50
 --- /dev/null
 +++ b/mt7996/mtk_debug.h
 @@ -0,0 +1,2166 @@
@@ -2341,7 +2341,7 @@
 +#endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
 new file mode 100644
-index 0000000..080f756
+index 00000000..080f756e
 --- /dev/null
 +++ b/mt7996/mtk_debugfs.c
 @@ -0,0 +1,2344 @@
@@ -4691,7 +4691,7 @@
 +#endif
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
 new file mode 100644
-index 0000000..e887016
+index 00000000..e8870166
 --- /dev/null
 +++ b/mt7996/mtk_mcu.c
 @@ -0,0 +1,18 @@
@@ -4715,7 +4715,7 @@
 +#endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
 new file mode 100644
-index 0000000..e741aa2
+index 00000000..e741aa27
 --- /dev/null
 +++ b/mt7996/mtk_mcu.h
 @@ -0,0 +1,16 @@
@@ -4736,7 +4736,7 @@
 +
 +#endif
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a10..3c6a61d 100644
+index e5d4a105..3c6a61d7 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
@@ -4820,5 +4820,5 @@
  	return ret;
  }
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-wifi-mt76-mt7996-add-txpower-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7996-add-txpower-support.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1001-wifi-mt76-mt7996-add-txpower-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7996-add-txpower-support.patch
index 4829d35..a9a371d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1001-wifi-mt76-mt7996-add-txpower-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7996-add-txpower-support.patch
@@ -1,7 +1,7 @@
-From 9443665b4459780c945eff91ac20812a5336dc18 Mon Sep 17 00:00:00 2001
+From 0169bc58ed8089fc7ca07d08a0ce90a02db4a3dd Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Mar 2023 23:35:30 +0800
-Subject: [PATCH 1001/1001] wifi: mt76: mt7996: add txpower support
+Subject: [PATCH 1001/1001] mt76: mt7996: add txpower support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ic3e7b17f3664fa7f774137572f885359fa2ec93b
@@ -17,10 +17,10 @@
  8 files changed, 423 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 7bff504..670e0db 100644
+index 50f2227f..c8f65b98 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -284,3 +284,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
+@@ -280,3 +280,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
  
  	return val & MT_EE_RATE_DELTA_SIGN ? delta : -delta;
  }
@@ -59,10 +59,10 @@
 +	[SKU_EHT3x996_484] = 16,
 +};
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index f7497c9..b5852da 100644
+index 0f8f0cd8..54e180fb 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
-@@ -73,4 +73,46 @@ mt7996_get_channel_group_6g(int channel)
+@@ -72,4 +72,46 @@ mt7996_get_channel_group_6g(int channel)
  	return DIV_ROUND_UP(channel - 29, 32);
  }
  
@@ -110,7 +110,7 @@
 +
  #endif
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index ebc6271..476e007 100644
+index ebc62713..476e007b 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -698,6 +698,7 @@ struct tx_power_ctrl {
@@ -130,10 +130,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8b76d69..d5be582 100644
+index 1ac54520..9bed13a1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -53,6 +53,8 @@
+@@ -57,6 +57,8 @@
  #define MT7996_CRIT_TEMP		110
  #define MT7996_MAX_TEMP			120
  
@@ -142,7 +142,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -518,6 +520,7 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+@@ -525,6 +527,7 @@ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
@@ -151,7 +151,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 080f756..c05f846 100644
+index 080f756e..c05f8465 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2296,6 +2296,232 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
@@ -398,7 +398,7 @@
  	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
  				    mt7996_wtbl_read);
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index e887016..f772243 100644
+index e8870166..f772243b 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -12,7 +12,30 @@
@@ -433,7 +433,7 @@
  
  #endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index e741aa2..1fa449e 100644
+index e741aa27..1fa449ea 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -10,6 +10,84 @@
@@ -522,10 +522,10 @@
  #endif
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 0775ca5..03e8329 100644
+index d1d3d154..d01cc8c9 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
-@@ -543,15 +543,22 @@ enum base_rev {
+@@ -557,15 +557,22 @@ enum base_rev {
  
  #define MT_PCIE1_MAC_INT_ENABLE			MT_PCIE1_MAC(0x188)
  
@@ -552,7 +552,7 @@
  /* PHYRX CSD */
  #define MT_WF_PHYRX_CSD_BASE			0x83000000
  #define MT_WF_PHYRX_CSD(_band, _wf, ofs)	(MT_WF_PHYRX_CSD_BASE + \
-@@ -560,7 +567,7 @@ enum base_rev {
+@@ -574,7 +581,7 @@ enum base_rev {
  #define MT_WF_PHYRX_CSD_IRPI(_band, _wf)	MT_WF_PHYRX_CSD(_band, _wf, 0x1000)
  
  /* PHYRX CSD BAND */
@@ -562,5 +562,5 @@
  #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index 529b5ab..12953cf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -1,37 +1,28 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
-    file://0000-wifi-mt76-api_update.patch \
-    file://0000-wifi-mt76-ignore-key-disable-commands.patch \
     file://0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch \
-    file://0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch \
-    file://0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch \
-    file://0004-wifi-mt76-mt7996-init-mpdu-density.patch \
-    file://0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch \
-    file://0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch \
-    file://0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch \
-    file://0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch \
-    file://0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch \
-    file://0010-wifi-mt76-mt7996-add-muru-support.patch \
-    file://0011-wifi-mt76-mt7996-set-txd-v1.patch \
-    file://0012-wifi-mt76-mt7996-add-thermal-protection-support.patch \
-    file://0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch \
-    file://0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch \
-    file://0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch \
-    file://0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch \
-    file://0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch \
-    file://0018-wifi-mt76-mt7996-set-wcid-in-txp.patch \
-    file://0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch \
-    file://0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch \
-    file://0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch \
-    file://0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch \
-    file://0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch \
-    file://0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch \
-    file://0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch \
-    file://0026-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch \
-    file://0027-wifi-mt76-testmode-add-basic-testmode-support.patch \
-    file://0028-wifi-mt76-testmode-add-chainmask-hacking-for-eagle-b.patch \
-    file://0029-wifi-mt76-mt7996-set-SUPPORTS_VHT_EXT_NSS_BW-in-mt79.patch \
-    file://0999-wifi-mt76-mt7996-for-build-pass.patch \
-    file://1000-wifi-mt76-mt7996-add-debug-tool.patch \
-    file://1001-wifi-mt76-mt7996-add-txpower-support.patch \
+    file://0002-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch \
+    file://0003-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch \
+    file://0004-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch \
+    file://0005-wifi-mt76-mt7996-add-muru-support.patch \
+    file://0006-wifi-mt76-mt7996-set-txd-v1.patch \
+    file://0007-wifi-mt76-mt7996-add-thermal-protection-support.patch \
+    file://0008-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch \
+    file://0009-wifi-mt76-mt7996-add-dsp-firmware-download.patch \
+    file://0010-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch \
+    file://0011-wifi-mt76-mt7996-set-wcid-in-txp.patch \
+    file://0012-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch \
+    file://0013-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch \
+    file://0014-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch \
+    file://0015-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch \
+    file://0016-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch \
+    file://0017-wifi-mt76-mt7996-update-wmm-queue-mapping.patch \
+    file://0018-wifi-mt76-mt7996-enable-IDS-debug-log.patch \
+    file://0019-mt76-testmode-add-atenl-support-in-mt7996.patch \
+    file://0020-mt76-testmode-add-basic-testmode-support.patch \
+    file://0021-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch \
+    file://0022-mt76-revert-page-pool-changes.patch \
+    file://0999-mt76-mt7996-for-build-pass.patch \
+    file://1000-mt76-mt7996-add-debug-tool.patch \
+    file://1001-mt76-mt7996-add-txpower-support.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-fix-background-radar-event-being-bl.patch b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-fix-background-radar-event-being-bl.patch
index af78fb1..b40ba17 100644
--- a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-fix-background-radar-event-being-bl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-fix-background-radar-event-being-bl.patch
@@ -1,7 +1,7 @@
-From 5ead86610e48462b90a076f32ae439c049bb61f7 Mon Sep 17 00:00:00 2001
+From 2247f39a4638afa622c21bb2b12f2d1744673a57 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 15 Mar 2023 17:41:16 +0800
-Subject: [PATCH 1/5] wifi: mt76: mt7915: fix background radar event being
+Subject: [PATCH 1/6] wifi: mt76: mt7915: fix background radar event being
  blocked
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d08907f..dc24a47 100644
+index aa706ff..7d9c46b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -274,7 +274,7 @@ mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -277,7 +277,7 @@ mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	r = (struct mt7915_mcu_rdd_report *)skb->data;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-Update-beacon-size-limitation-for-1.patch b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-Update-beacon-size-limitation-for-1.patch
index 335824a..abecf0a 100644
--- a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-Update-beacon-size-limitation-for-1.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-Update-beacon-size-limitation-for-1.patch
@@ -1,7 +1,7 @@
-From 509c05e322eb3d167aa9ec0b00b7f1df91f92de3 Mon Sep 17 00:00:00 2001
+From 02041c431dd8866954f76bd0d57af44971e1167a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 23 Mar 2023 08:49:48 +0800
-Subject: [PATCH 2/5] wifi: mt76: mt7915: Update beacon size limitation for 11v
+Subject: [PATCH 2/6] wifi: mt76: mt7915: Update beacon size limitation for 11v
 
 Separate the beacon offload command into two;
 one is for beacons and the other is for inband discovery frames.
@@ -21,10 +21,10 @@
  4 files changed, 45 insertions(+), 33 deletions(-)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3bbccbd..ea1d4e6 100644
+index 8ce7b1c..14930f5 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -647,11 +647,13 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -645,11 +645,13 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  		mt7915_update_bss_color(hw, vif, &info->he_bss_color);
  
  	if (changed & (BSS_CHANGED_BEACON |
@@ -42,11 +42,11 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index dc24a47..03ae3bc 100644
+index 7d9c46b..8ab4239 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1953,10 +1953,9 @@ mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 	}
+@@ -1875,10 +1875,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
  }
  
 -static void
@@ -59,7 +59,7 @@
  {
  #define OFFLOAD_TX_MODE_SU	BIT(0)
  #define OFFLOAD_TX_MODE_MU	BIT(1)
-@@ -1966,14 +1965,28 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -1888,14 +1887,28 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
  	enum nl80211_band band = chandef->chan->band;
  	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
@@ -90,7 +90,7 @@
  	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
  	    vif->bss_conf.fils_discovery.max_interval) {
  		interval = vif->bss_conf.fils_discovery.max_interval;
-@@ -1985,26 +1998,25 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -1907,26 +1920,25 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	}
  
  	if (!skb)
@@ -123,7 +123,7 @@
  	discov->tx_mode = OFFLOAD_TX_MODE_SU;
  	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
-@@ -2012,13 +2024,16 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -1934,13 +1946,16 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
  	discov->enable = true;
  
@@ -141,7 +141,7 @@
  }
  
  int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-@@ -2054,7 +2069,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1976,7 +1991,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (!skb)
  		return -EINVAL;
  
@@ -150,7 +150,7 @@
  		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
  		dev_kfree_skb(skb);
  		return -EINVAL;
-@@ -2070,11 +2085,6 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1990,11 +2005,6 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
  	dev_kfree_skb(skb);
  
@@ -199,10 +199,10 @@
  mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3cbfb9b..b66938b 100644
+index 103cd0d..9c79eff 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -506,6 +506,8 @@ int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
+@@ -497,6 +497,8 @@ int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
  			 bool add);
  int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  				struct cfg80211_he_bss_color *he_bss_color);
diff --git a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-disable-wfdma-tx-rx-during-SER-reco.patch b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-disable-wfdma-tx-rx-during-SER-reco.patch
index 47741b9..d7deb35 100644
--- a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-disable-wfdma-tx-rx-during-SER-reco.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-disable-wfdma-tx-rx-during-SER-reco.patch
@@ -1,7 +1,8 @@
-From d0242b056d4e4f22dcdec8755798e5461cf131b5 Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Tue, 11 Apr 2023 10:56:17 +0800
-Subject: [PATCH] wifi: mt76: mt7915: disable wfdma tx/rx during SER recovery.
+From 98998425cb0089e60f7172552f8231814736e921 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Thu, 18 May 2023 18:02:17 +0800
+Subject: [PATCH 3/6] wifi: mt76: mt7915: disable wfdma tx/rx during SER
+ recovery.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -12,7 +13,7 @@
  4 files changed, 103 insertions(+), 69 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index df2ca73..c22ea64 100644
+index 465190e..05d9ab3 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -466,6 +466,9 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
@@ -36,7 +37,7 @@
  	if (!t)
  		goto free_skb;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 43a5456..9f19609 100644
+index 86a93de..4c8cf0c 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -250,12 +250,90 @@ static void mt7915_dma_disable(struct mt7915_dev *dev, bool rst)
@@ -103,7 +104,7 @@
 +		int ret;
 +
 +		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
-+		if (!is_mt7986(&dev->mt76))
++		if (!is_mt798x(&dev->mt76))
 +			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
 +		else
 +			mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
@@ -183,7 +184,7 @@
 -		int ret;
 -
 -		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
--		if (!is_mt7986(&dev->mt76))
+-		if (!is_mt798x(&dev->mt76))
 -			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
 -		else
 -			mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
@@ -221,10 +222,10 @@
  	return 0;
  }
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 97ca55d..f1fdcfd 100644
+index fb6bab8..7be1e17 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1578,6 +1578,8 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1574,6 +1574,8 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -232,8 +233,8 @@
 +		 wiphy_name(dev->mt76.hw->wiphy));
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
  		mtk_wed_device_stop(&dev->mt76.mmio.wed);
- 		if (!is_mt7986(&dev->mt76))
-@@ -1615,6 +1617,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 		if (!is_mt798x(&dev->mt76))
+@@ -1611,6 +1613,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  		mt7915_wait_reset_state(dev, MT_MCU_CMD_RECOVERY_DONE);
  	}
  
@@ -246,9 +247,9 @@
  	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
  	clear_bit(MT76_RESET, &dev->mphy.state);
  	if (phy2)
-@@ -1629,9 +1637,6 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1625,9 +1633,6 @@ void mt7915_mac_reset_work(struct work_struct *work)
  
- 	tasklet_schedule(&dev->irq_tasklet);
+ 	tasklet_schedule(&dev->mt76.irq_tasklet);
  
 -	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_RESET_DONE);
 -	mt7915_wait_reset_state(dev, MT_MCU_CMD_NORMAL_STATE);
@@ -256,7 +257,7 @@
  	mt76_worker_enable(&dev->mt76.tx_worker);
  
  	local_bh_disable();
-@@ -1653,6 +1658,8 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1649,6 +1654,8 @@ void mt7915_mac_reset_work(struct work_struct *work)
  		ieee80211_queue_delayed_work(ext_phy->hw,
  					     &phy2->mt76->mac_work,
  					     MT7915_WATCHDOG_TIME);
@@ -265,7 +266,7 @@
  }
  
  /* firmware coredump */
-@@ -1727,6 +1734,10 @@ skip_coredump:
+@@ -1723,6 +1730,10 @@ skip_coredump:
  
  void mt7915_reset(struct mt7915_dev *dev)
  {
@@ -277,10 +278,10 @@
  		return;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b66938b..6c40108 100644
+index 9c79eff..d1715ff 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -481,6 +481,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2);
+@@ -472,6 +472,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2);
  void mt7915_dma_prefetch(struct mt7915_dev *dev);
  void mt7915_dma_cleanup(struct mt7915_dev *dev);
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
diff --git a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-the-beamformer-issue.patch b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-the-beamformer-issue.patch
index e6c0d76..59a5f54 100644
--- a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-the-beamformer-issue.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-fix-the-beamformer-issue.patch
@@ -1,7 +1,7 @@
-From e1aa3c0a4dcb136b287f95ac7cac1764f89a124b Mon Sep 17 00:00:00 2001
+From dc866136370fb7ce58bbc27ba7e5fdf40b6138d9 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 12 Apr 2023 15:53:42 +0800
-Subject: [PATCH 4/5] wifi: mt76: mt7915: fix the beamformer issue
+Subject: [PATCH 4/6] wifi: mt76: mt7915: fix the beamformer issue
 
 without this patch, when ap sets the tx stream number to 2,
 ap doesn't send any beamform packets.
@@ -12,13 +12,13 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 03ae3bc..2a5ad03 100644
+index 8ab4239..d374465 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1008,13 +1008,13 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1008,13 +1008,13 @@ static inline bool
+ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			struct ieee80211_sta *sta, bool bfee)
  {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 -	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
 +	int sts = hweight16(phy->mt76->chainmask);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
index 703a3bb..253ed63 100644
--- a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch
@@ -1,7 +1,7 @@
-From e04f540b9f4ec973e0d1af2832463f771aefe2c8 Mon Sep 17 00:00:00 2001
-From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Date: Fri, 24 Mar 2023 18:01:27 +0800
-Subject: [PATCH] wifi: mt76: fix incorrect HE TX GI report
+From 2692ebd0cb63c666eb7e8db099e71f5b67fcd323 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Thu, 18 May 2023 18:11:37 +0800
+Subject: [PATCH 5/6] wifi: mt76: fix incorrect HE TX GI report
 
 Change GI reporting source from static capability to rate-tuning module.
 
@@ -17,7 +17,7 @@
  7 files changed, 280 insertions(+), 20 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 183b0fc5..11d49363 100644
+index 8b4635e..3f13cec 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -254,12 +254,16 @@ struct mt76_queue_ops {
@@ -38,10 +38,10 @@
  	MT_PHY_TYPE_HE_EXT_SU,
  	MT_PHY_TYPE_HE_TB,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index b88c3827..611a82b6 100644
+index f85f7d3..abca909 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -644,6 +644,8 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -648,6 +648,8 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	struct mt76_phy *mphy = phy->mt76;
  	int ret;
  
@@ -50,7 +50,7 @@
  	INIT_DELAYED_WORK(&mphy->mac_work, mt7915_mac_work);
  
  	mt7915_eeprom_parse_hw_cap(dev, phy);
-@@ -1197,6 +1199,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1180,6 +1182,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->phy.dev = dev;
  	dev->phy.mt76 = &dev->mt76.phy;
  	dev->mt76.phy.priv = &dev->phy;
@@ -60,10 +60,10 @@
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7915_mac_work);
  	INIT_LIST_HEAD(&dev->sta_rc_list);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f1fdcfde..8e30070b 100644
+index 7be1e17..a3ed4dd 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -177,15 +177,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
+@@ -173,15 +173,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
  						       rx_cur);
  		}
  
@@ -79,7 +79,7 @@
  
  		switch (rate->bw) {
  		case RATE_INFO_BW_160:
-@@ -202,18 +194,6 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
+@@ -198,18 +190,6 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
  			break;
  		}
  
@@ -98,7 +98,7 @@
  		/* get signal strength of resp frames (CTS/BA/ACK) */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, idx, 30);
  		val = mt76_rr(dev, addr);
-@@ -982,6 +962,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -978,6 +958,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
  			struct mt76_wcid *wcid;
@@ -106,7 +106,7 @@
  			u16 idx;
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
-@@ -991,10 +972,17 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -987,10 +968,17 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  				continue;
  
  			msta = container_of(wcid, struct mt7915_sta, wcid);
@@ -124,7 +124,7 @@
  			continue;
  		}
  
-@@ -1055,6 +1043,7 @@ mt7915_mac_tx_free_v0(struct mt7915_dev *dev, void *data, int len)
+@@ -1051,6 +1039,7 @@ mt7915_mac_tx_free_v0(struct mt7915_dev *dev, void *data, int len)
  static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  {
  	struct mt7915_sta *msta = NULL;
@@ -132,7 +132,7 @@
  	struct mt76_wcid *wcid;
  	__le32 *txs_data = data;
  	u16 wcidx;
-@@ -1090,6 +1079,11 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+@@ -1086,6 +1075,11 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
  		list_add_tail(&msta->poll_list, &dev->sta_poll_list);
  	spin_unlock_bh(&dev->sta_poll_lock);
  
@@ -144,7 +144,7 @@
  out:
  	rcu_read_unlock();
  }
-@@ -2016,6 +2010,27 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2012,6 +2006,27 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -172,7 +172,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2071,6 +2086,11 @@ void mt7915_mac_work(struct work_struct *work)
+@@ -2067,6 +2082,11 @@ void mt7915_mac_work(struct work_struct *work)
  		mt7915_mac_severe_check(phy);
  	}
  
@@ -185,10 +185,10 @@
  
  	mt76_tx_status_check(mphy->dev, false);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index ea1d4e6a..870b7b23 100644
+index 14930f5..1a741b8 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -684,6 +684,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -682,6 +682,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  
  	INIT_LIST_HEAD(&msta->rc_list);
  	INIT_LIST_HEAD(&msta->poll_list);
@@ -196,7 +196,7 @@
  	msta->vif = mvif;
  	msta->wcid.sta = 1;
  	msta->wcid.idx = idx;
-@@ -708,6 +709,7 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -706,6 +707,7 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  {
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
@@ -204,7 +204,7 @@
  	int i;
  
  	mt7915_mcu_add_sta(dev, vif, sta, false);
-@@ -724,6 +726,11 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -722,6 +724,11 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (!list_empty(&msta->rc_list))
  		list_del_init(&msta->rc_list);
  	spin_unlock_bh(&dev->sta_poll_lock);
@@ -217,10 +217,10 @@
  
  static void mt7915_tx(struct ieee80211_hw *hw,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2a5ad033..5ee2ee2b 100644
+index d374465..8d8a203 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3752,6 +3752,167 @@ out:
+@@ -3672,6 +3672,167 @@ out:
  	return ret;
  }
  
@@ -389,7 +389,7 @@
  				struct cfg80211_he_bss_color *he_bss_color)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1592b5d6..aebacc7d 100644
+index 1592b5d..aebacc7 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -152,6 +152,61 @@ struct mt7915_mcu_eeprom_info {
@@ -463,10 +463,10 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6c401080..891d21ea 100644
+index d1715ff..5451024 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -131,6 +131,7 @@ struct mt7915_sta {
+@@ -138,6 +138,7 @@ struct mt7915_sta {
  
  	struct list_head poll_list;
  	struct list_head rc_list;
@@ -474,7 +474,7 @@
  	u32 airtime_ac[8];
  
  	int ack_signal;
-@@ -280,6 +281,10 @@ struct mt7915_phy {
+@@ -273,6 +274,10 @@ struct mt7915_phy {
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
  
@@ -485,7 +485,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -553,6 +558,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
+@@ -544,6 +549,7 @@ int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch);
  int mt7915_mcu_get_temperature(struct mt7915_phy *phy);
  int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state);
  int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
diff --git a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-fix-DFS-CAC-tx-emission-issue-after.patch b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-fix-DFS-CAC-tx-emission-issue-after.patch
new file mode 100644
index 0000000..420aeb0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-fix-DFS-CAC-tx-emission-issue-after.patch
@@ -0,0 +1,40 @@
+From c32e29ad8916241b5a0bdc5f662e766687524327 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 17 May 2023 17:34:55 +0800
+Subject: [PATCH 6/6] wifi: mt76: mt7915: fix DFS CAC tx emission issue after
+ interface down up
+
+FW's channel state is set during the first wifi interface setup. If the switch reason for
+setting the tx/rx path during second-time wifi interface setup is CH_SWITCH_NORMAL,
+then the FW would perform runtime dpd channel calibration during DFS CAC, which leads to
+tx emission. Therefore, in order to bypass tx calibration during DFS CAC, set the switch reason
+to CH_SWITCH_DFS whenever chandef is set to DFS channel.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/mcu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 8d8a203..9dd4e34 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2693,12 +2693,12 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+ 	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
+ 		req.tx_path_num = fls(phy->mt76->antenna_mask);
+ 
+-	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
+-	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
++	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
+ 		req.switch_reason = CH_SWITCH_NORMAL;
+ 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
+ 		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
+-	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
++	else if (cfg80211_chandef_valid(chandef) &&
++		 !cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
+ 					  NL80211_IFTYPE_AP))
+ 		req.switch_reason = CH_SWITCH_DFS;
+ 	else
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch b/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
index a31b0e5..89cb09b 100644
--- a/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch
@@ -1,7 +1,8 @@
-From ed9230087e1ef8314f3364b6a3db65165abf8934 Mon Sep 17 00:00:00 2001
+From 74a8d89cbec86aa3cddf05a8ecadc65458fb4f14 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Sat, 1 Apr 2023 08:18:17 +0800
-Subject: [PATCH] wifi: mt76: mt7915: build pass for Linux Kernel 5.4 fixes
+Subject: [PATCH 0999/1033] wifi: mt76: mt7915: build pass for Linux Kernel 5.4
+ fixes
 
 ---
  debugfs.c         |  2 ++
@@ -37,7 +38,7 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index c22ea64..e1b73a1 100644
+index 05d9ab3..c9d2671 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -173,7 +173,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
@@ -75,7 +76,7 @@
  	}
  
  	return buf;
-@@ -590,11 +590,11 @@ free_skb:
+@@ -592,11 +592,11 @@ free_skb:
  }
  
  static int
@@ -90,7 +91,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -602,25 +602,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -604,25 +604,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  	spin_lock_bh(&q->lock);
  
  	while (q->queued < q->ndesc - 1) {
@@ -128,7 +129,7 @@
  			break;
  		}
  		frames++;
-@@ -664,7 +665,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -666,7 +667,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  		/* WED txfree queue needs ring to be initialized before setup */
  		q->flags = 0;
  		mt76_dma_queue_reset(dev, q);
@@ -137,7 +138,7 @@
  		q->flags = flags;
  
  		ret = mtk_wed_device_txfree_ring_setup(wed, q->regs);
-@@ -712,10 +713,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -714,10 +715,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -148,7 +149,7 @@
  	ret = mt76_dma_wed_setup(dev, q, false);
  	if (ret)
  		return ret;
-@@ -729,6 +726,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -731,6 +728,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -156,7 +157,7 @@
  	void *buf;
  	bool more;
  
-@@ -742,7 +740,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -744,7 +742,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  		if (!buf)
  			break;
  
@@ -165,7 +166,7 @@
  	} while (1);
  
  	if (q->rx_head) {
-@@ -751,6 +749,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -753,6 +751,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	}
  
  	spin_unlock_bh(&q->lock);
@@ -179,7 +180,7 @@
  }
  
  static void
-@@ -771,7 +776,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -773,7 +778,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  	mt76_dma_wed_setup(dev, q, true);
  	if (q->flags != MT_WED_Q_TXFREE) {
  		mt76_dma_sync_idx(dev, q);
@@ -188,7 +189,7 @@
  	}
  }
  
-@@ -789,7 +794,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -791,7 +796,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
  	} else {
@@ -197,7 +198,7 @@
  	}
  
  	if (more)
-@@ -857,12 +862,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -859,12 +864,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		    !(dev->drv->rx_check(dev, data, len)))
  			goto free_frag;
  
@@ -211,7 +212,7 @@
  
  		*(u32 *)skb->cb = info;
  
-@@ -878,10 +882,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -880,10 +884,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		continue;
  
  free_frag:
@@ -224,7 +225,7 @@
  	return done;
  }
  
-@@ -926,7 +930,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -928,7 +932,7 @@ mt76_dma_init(struct mt76_dev *dev,
  
  	mt76_for_each_q_rx(dev, i) {
  		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
@@ -233,7 +234,7 @@
  		napi_enable(&dev->napi[i]);
  	}
  
-@@ -977,8 +981,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -979,8 +983,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  		netif_napi_del(&dev->napi[i]);
  		mt76_dma_rx_cleanup(dev, q);
@@ -264,7 +265,7 @@
  	if (!is_valid_ether_addr(phy->macaddr)) {
  		eth_random_addr(phy->macaddr);
 diff --git a/mac80211.c b/mac80211.c
-index 87902f4..577d81a 100644
+index 2c4a529..991d91b 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -323,7 +324,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1741,21 +1699,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1742,21 +1700,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -358,7 +359,7 @@
  struct sk_buff *
  __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt76.h b/mt76.h
-index 11d4936..ffa9595 100644
+index 3f13cec..a8f26a8 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -202,7 +202,7 @@ struct mt76_queue {
@@ -370,7 +371,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1323,7 +1323,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1324,7 +1324,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -378,7 +379,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1435,25 +1434,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1436,25 +1435,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
@@ -405,7 +406,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index eea398c..4593b2e 100644
+index 8d745c9..86061e9 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -10,6 +10,7 @@
@@ -417,10 +418,10 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac.h b/mt76_connac.h
-index b339c50..2ee9a3c 100644
+index 77ca8f0..ca26984 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
-@@ -42,7 +42,6 @@ enum {
+@@ -56,7 +56,6 @@ enum {
  	CMD_CBW_10MHZ,
  	CMD_CBW_5MHZ,
  	CMD_CBW_8080MHZ,
@@ -428,7 +429,7 @@
  
  	CMD_HE_MCS_BW80 = 0,
  	CMD_HE_MCS_BW160,
-@@ -240,7 +239,6 @@ static inline u8 mt76_connac_chan_bw(struct cfg80211_chan_def *chandef)
+@@ -264,7 +263,6 @@ static inline u8 mt76_connac_chan_bw(struct cfg80211_chan_def *chandef)
  		[NL80211_CHAN_WIDTH_10] = CMD_CBW_10MHZ,
  		[NL80211_CHAN_WIDTH_20] = CMD_CBW_20MHZ,
  		[NL80211_CHAN_WIDTH_20_NOHT] = CMD_CBW_20MHZ,
@@ -437,7 +438,7 @@
  
  	if (chandef->width >= ARRAY_SIZE(width_to_bw))
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index efb9bfa..b0dcc5a 100644
+index 46f69aa..732a4e6 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -509,10 +510,10 @@
  #define DEFAULT_HE_DURATION_RTS_THRES	1023
  static void
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 40a99e0..d5fb7a6 100644
+index 91d98ef..ebb7f58 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1871,12 +1871,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val);
+@@ -1883,12 +1883,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val);
  
  const struct ieee80211_sta_he_cap *
  mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
@@ -526,10 +527,10 @@
  int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			    struct mt76_connac_sta_key_conf *sta_key_conf,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 870b7b2..546a0c9 100644
+index 1a741b8..f78f2bf 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1300,22 +1300,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1298,22 +1298,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
@@ -558,7 +559,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1343,7 +1340,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1341,7 +1338,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  	};
  	struct mib_stats *mib = &phy->mib;
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -567,7 +568,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1424,12 +1421,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1422,12 +1419,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -584,7 +585,7 @@
  
  static void
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a9f8a88..173dc35 100644
+index 9dd4e34..dbdc48a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -596,7 +597,7 @@
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6f0c0e2..5ef43c4 100644
+index 984b5f6..1bb8a4c 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -596,9 +596,13 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
@@ -700,10 +701,10 @@
  	return -ENOMEM;
  }
 diff --git a/mt7921/main.c b/mt7921/main.c
-index a72964e..4c40022 100644
+index 3b6adb2..47eb38e 100644
 --- a/mt7921/main.c
 +++ b/mt7921/main.c
-@@ -1090,34 +1090,17 @@ static void
+@@ -1083,34 +1083,17 @@ static void
  mt7921_get_et_strings(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		      u32 sset, u8 *data)
  {
@@ -739,7 +740,7 @@
  }
  
  static void
-@@ -1137,7 +1120,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1130,7 +1113,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			 struct ethtool_stats *stats, u64 *data)
  {
  	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
@@ -747,7 +748,7 @@
  	struct mt7921_phy *phy = mt7921_hw_phy(hw);
  	struct mt7921_dev *dev = phy->dev;
  	struct mib_stats *mib = &phy->mib;
-@@ -1193,14 +1175,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1186,14 +1168,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		return;
  
  	ei += wi.worker_stat_count;
diff --git a/recipes-wifi/linux-mt76/files/patches/100-api_update.patch b/recipes-wifi/linux-mt76/files/patches/100-api_update.patch
deleted file mode 100644
index 3a76f11..0000000
--- a/recipes-wifi/linux-mt76/files/patches/100-api_update.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/tx.c
-+++ b/tx.c
-@@ -330,7 +330,7 @@ mt76_tx(struct mt76_phy *phy, struct iee
- 	if ((dev->drv->drv_flags & MT_DRV_HW_MGMT_TXQ) &&
- 	    !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
- 	    !ieee80211_is_data(hdr->frame_control) &&
--	    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
-+	    !ieee80211_is_bufferable_mmpdu(skb)) {
- 		qid = MT_TXQ_PSD;
- 	}
- 
diff --git a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
index fb7ec7d..6af8966 100644
--- a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
@@ -1,7 +1,7 @@
-From e3361b20136b07d73efe290843e8e83d5a3e3ad5 Mon Sep 17 00:00:00 2001
+From 7bfb1fb85edfcbd68b4b680e387efdfcf2f00f77 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1000/1032] wifi: mt76: mt7915: add mtk internal debug tools
+Subject: [PATCH 1000/1033] wifi: mt76: mt7915: add mtk internal debug tools
  for mt76
 
 ---
@@ -23,7 +23,7 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index d5fb7a6..82e323c 100644
+index ebb7f58..8d6c422 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1148,6 +1148,7 @@ enum {
@@ -47,7 +47,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index f033116..cbcb64b 100644
+index c4dca9c..fd71141 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -4,7 +4,7 @@ EXTRA_CFLAGS += -DCONFIG_MT76_LEDS
@@ -58,9 +58,9 @@
 +	     debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o
  
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
- mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
+ mt7915e-$(CONFIG_MT798X_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 5a46813..eb14910 100644
+index 879884e..9fca009 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -232,10 +232,10 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d052036..9ac0b42 100644
+index a3ed4dd..b5805bb 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -279,6 +279,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -275,6 +275,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	__le16 fc = 0;
  	int idx;
  
@@ -246,7 +246,7 @@
  	memset(status, 0, sizeof(*status));
  
  	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->mt76->band_idx) {
-@@ -462,6 +466,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -458,6 +462,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  	}
  
  	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
@@ -257,7 +257,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		struct ieee80211_vif *vif;
  		int err;
-@@ -799,6 +807,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -795,6 +803,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -271,7 +271,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 546a0c9..9cd9b9f 100644
+index f78f2bf..699f767 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -287,10 +287,10 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 173dc35..ec1b0e1 100644
+index dbdc48a..5acba67 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -200,6 +200,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -203,6 +203,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  	else
  		qid = MT_MCUQ_WM;
  
@@ -302,7 +302,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -2326,7 +2331,10 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
+@@ -2246,7 +2251,10 @@ static int mt7915_red_set_watermark(struct mt7915_dev *dev)
  				 sizeof(req), false);
  }
  
@@ -314,7 +314,7 @@
  {
  #define RED_DISABLE		0
  #define RED_BY_WA_ENABLE	2
-@@ -3390,6 +3398,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3310,6 +3318,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -323,7 +323,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3941,6 +3951,23 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3908,6 +3918,23 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -347,7 +347,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -3969,3 +3996,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3936,3 +3963,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -371,10 +371,10 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 3429e24..9b07d5d 100644
+index aebacc7..daea67f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -314,6 +314,10 @@ enum {
+@@ -333,6 +333,10 @@ enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
  	MCU_WA_PARAM_RED = 0x0e,
@@ -386,7 +386,7 @@
  };
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 81246f3..a7525f3 100644
+index 5451024..29394b6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -397,7 +397,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -378,6 +379,28 @@ struct mt7915_dev {
+@@ -370,6 +371,28 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -426,7 +426,7 @@
  };
  
  enum {
-@@ -660,4 +683,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -650,4 +673,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
index f1409b0..67a82bb 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-wifi-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,7 +1,7 @@
-From 50009a4cc5c65384e445e04c99e6d2aafbf7468d Mon Sep 17 00:00:00 2001
+From 97b4997c04cfdae312ae7a67249422f88be91c40 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 1001/1032] wifi: mt76: mt7915: csi: implement csi support
+Subject: [PATCH 1001/1033] wifi: mt76: mt7915: csi: implement csi support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -17,7 +17,7 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 82e323c..1321445 100644
+index 8d6c422..4f7db5c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1000,6 +1000,7 @@ enum {
@@ -37,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index cbcb64b..6a922a9 100644
+index fd71141..65129b4 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,10 +1,10 @@
@@ -52,12 +52,12 @@
 +	     debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o vendor.o
  
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
- mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
+ mt7915e-$(CONFIG_MT798X_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 611a82b..d21086d 100644
+index abca909..1fe123d 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -666,6 +666,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -670,6 +670,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
  	mt7915_init_wiphy(phy);
  
@@ -70,7 +70,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1167,6 +1173,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1150,6 +1156,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -96,7 +96,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1175,6 +1200,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1158,6 +1183,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -107,18 +107,18 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1187,6 +1216,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1170,6 +1199,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
- 	tasklet_disable(&dev->irq_tasklet);
+ 	tasklet_disable(&dev->mt76.irq_tasklet);
  
 +#ifdef CONFIG_MTK_VENDOR
 +	mt7915_unregister_features(&dev->phy);
 +#endif
 +
- 	if (is_mt7986(&dev->mt76))
+ 	if (is_mt798x(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1229,6 +1262,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1212,6 +1245,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,10 +132,10 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ec1b0e1..82cff6d 100644
+index 5acba67..b3fdcdf 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -37,6 +37,10 @@ static bool sr_scene_detect = true;
+@@ -40,6 +40,10 @@ static bool sr_scene_detect = true;
  module_param(sr_scene_detect, bool, 0644);
  MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
  
@@ -146,7 +146,7 @@
  static u8
  mt7915_mcu_get_sta_nss(u16 mcs_map)
  {
-@@ -372,6 +376,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -375,6 +379,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_FW_LOG_2_HOST:
  		mt7915_mcu_rx_log_message(dev, skb);
  		break;
@@ -158,7 +158,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3951,6 +3960,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3918,6 +3927,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -268,10 +268,10 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9b07d5d..9a6a52a 100644
+index daea67f..e082511 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -570,4 +570,81 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
+@@ -589,4 +589,81 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
  enum {
  	MCU_GET_TX_RATE = 4
  };
@@ -354,10 +354,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a7525f3..e02dcd0 100644
+index 29394b6..43705fb 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -299,6 +299,20 @@ struct mt7915_phy {
+@@ -292,6 +292,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -378,7 +378,7 @@
  };
  
  struct mt7915_dev {
-@@ -683,6 +697,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -673,6 +687,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
index 2db295a..fc76eb5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1002-wifi-mt76-mt7915-air-monitor-support.patch
@@ -1,7 +1,7 @@
-From ce343108ce124478d610539f672d39f343b54103 Mon Sep 17 00:00:00 2001
+From 85e642f5fbd701ab10c29b24113ca354dd0e9345 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1002/1032] wifi: mt76: mt7915: air monitor support
+Subject: [PATCH 1002/1033] wifi: mt76: mt7915: air monitor support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -13,7 +13,7 @@
  6 files changed, 442 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 1321445..411911c 100644
+index 4f7db5c..6174505 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1194,6 +1194,8 @@ enum {
@@ -26,10 +26,10 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9ac0b42..89c86b3 100644
+index b5805bb..ff4e1dd 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -527,6 +527,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -523,6 +523,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
  			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
  			qos_ctl = *ieee80211_get_qos_ctl(hdr);
  		}
@@ -41,10 +41,10 @@
  		status->flag |= RX_FLAG_8023;
  		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 9cd9b9f..098aad3 100644
+index 699f767..4438e7b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -705,6 +705,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -703,6 +703,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e02dcd0..61a6374 100644
+index 43705fb..51d7f34 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -251,6 +251,35 @@ struct mt7915_hif {
+@@ -244,6 +244,35 @@ struct mt7915_hif {
  	int irq;
  };
  
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -312,6 +341,8 @@ struct mt7915_phy {
+@@ -305,6 +334,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -701,6 +732,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -691,6 +722,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2..b94d787 100644
+index 98fd9c2..43f9690 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,355 @@ out:
diff --git a/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch b/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
index 22061cb..eea919e 100644
--- a/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1003-wifi-mt76-mt7915-add-support-for-muru_onoff-via.patch
@@ -1,21 +1,21 @@
-From e8e2cbb21272ed092a0b32d4fdca7fdf36ba1876 Mon Sep 17 00:00:00 2001
+From e308945d818a93dd553f5f311865b1eff33954f2 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 4 Apr 2023 02:23:57 +0800
-Subject: [PATCH 1003/1032] wifi: mt76: mt7915: add support for muru_onoff via
+Subject: [PATCH 1003/1033] wifi: mt76: mt7915: add support for muru_onoff via
 
 ---
  mt7915/init.c        |  2 ++
- mt7915/mcu.c         | 12 +++++++++---
+ mt7915/mcu.c         | 10 ++++++++--
  mt7915/mcu.h         |  6 ++++++
  mt7915/mt7915.h      |  2 ++
  mt7915/mtk_debugfs.c | 33 +++++++++++++++++++++++++++++++++
- 5 files changed, 52 insertions(+), 3 deletions(-)
+ 5 files changed, 51 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index d21086d..f6f3e8a 100644
+index 1fe123d..7250998 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -445,6 +445,8 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+@@ -449,6 +449,8 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
  		mphy->leds.cdev.brightness_set = mt7915_led_set_brightness;
  		mphy->leds.cdev.blink_set = mt7915_led_set_blink;
  	}
@@ -25,27 +25,26 @@
  
  static void
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 82cff6d..2e680f6 100644
+index b3fdcdf..68e3583 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -865,6 +865,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -866,6 +866,7 @@ static void
+ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 +	struct mt7915_phy *phy = mvif->phy;
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
-@@ -877,13 +878,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -878,13 +879,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  
  	muru = (struct sta_rec_muru *)tlv;
  
--	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
--			       mvif->cap.vht_mu_ebfer ||
--			       mvif->cap.vht_mu_ebfee;
-+	muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
-+				mvif->cap.vht_mu_ebfer ||
-+			        mvif->cap.vht_mu_ebfee) &&
+-	muru->cfg.mimo_dl_en = vif->bss_conf.he_mu_beamformer ||
++	muru->cfg.mimo_dl_en = (vif->bss_conf.he_mu_beamformer ||
+ 			       vif->bss_conf.vht_mu_beamformer ||
+-			       vif->bss_conf.vht_mu_beamformee;
++			       vif->bss_conf.vht_mu_beamformee) &&
 +			       !!(phy->muru_onoff & MUMIMO_DL);
  	if (!is_mt7915(&dev->mt76))
  		muru->cfg.mimo_ul_en = true;
@@ -59,10 +58,10 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9a6a52a..ac1109e 100644
+index e082511..fedae7e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -647,4 +647,10 @@ struct csi_data {
+@@ -666,4 +666,10 @@ struct csi_data {
  };
  #endif
  
@@ -74,10 +73,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 61a6374..f9f8c5d 100644
+index 51d7f34..7613e60 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -308,6 +308,8 @@ struct mt7915_phy {
+@@ -301,6 +301,8 @@ struct mt7915_phy {
  	u32 rx_ampdu_ts;
  	u32 ampdu_ref;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
index 51ef92e..1849dcc 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From 89812ca04e1295ed4049c27abaca6bded3e44ac3 Mon Sep 17 00:00:00 2001
+From 87ac75bc1a347093b56c35111cf0bfd210314785 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1004/1032] wifi: mt76: mt7915: certification patches
+Subject: [PATCH 1004/1033] wifi: mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -16,7 +16,7 @@
  9 files changed, 954 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 411911c..ba16e57 100644
+index 6174505..978a4d0 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1196,6 +1196,7 @@ enum {
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 89c86b3..2b26837 100644
+index ff4e1dd..5c7a47c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -8,6 +8,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -2043,6 +2044,21 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+@@ -2045,6 +2046,21 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
  	spin_unlock_bh(&phy->stats_lock);
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -2065,6 +2081,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -2067,6 +2083,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 098aad3..1988d8f 100644
+index 4438e7b..e7523c1 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -680,6 +680,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -678,6 +678,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -708,7 +711,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -706,7 +709,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -107,10 +107,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2e680f6..fc762f7 100644
+index 68e3583..8ee1d48 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4066,6 +4066,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -4033,6 +4033,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -584,10 +584,10 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ac1109e..76bc066 100644
+index fedae7e..765ad11 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -452,10 +452,14 @@ enum {
+@@ -471,10 +471,14 @@ enum {
  	RATE_PARAM_FIXED = 3,
  	RATE_PARAM_MMPS_UPDATE = 5,
  	RATE_PARAM_FIXED_HE_LTF = 7,
@@ -603,7 +603,7 @@
  };
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
-@@ -467,6 +471,9 @@ enum {
+@@ -486,6 +490,9 @@ enum {
  #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
  #define RATE_CFG_HE_LTF			GENMASK(31, 28)
  
@@ -613,7 +613,7 @@
  enum {
  	TX_POWER_LIMIT_ENABLE,
  	TX_POWER_LIMIT_TABLE = 0x4,
-@@ -652,5 +659,203 @@ struct csi_data {
+@@ -671,5 +678,203 @@ struct csi_data {
  #define OFDMA_UL                       BIT(1)
  #define MUMIMO_DL                      BIT(2)
  #define MUMIMO_UL                      BIT(3)
@@ -818,10 +818,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f9f8c5d..9c110b3 100644
+index 7613e60..60364f0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -731,6 +731,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -721,6 +721,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -867,7 +867,7 @@
  	}
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787..beb0583 100644
+index 43f9690..5a1cce1 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -900,7 +900,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -777,6 +800,148 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -779,6 +802,148 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len + 1;
  }
  
@@ -1049,7 +1049,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -801,6 +966,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -803,6 +968,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_amnt_ctrl_dump,
  		.policy = amnt_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch b/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
index 0d42b9c..151e20d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-wifi-mt76-mt7915-add-support-for-runtime-set-in-band.patch
@@ -1,7 +1,7 @@
-From 1de2606cd6297bd5f6dfc1e8c27e1ef826a8e34a Mon Sep 17 00:00:00 2001
+From aad666a7107ef807bf965d02ea2699447d7a738c Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 23 Mar 2023 09:55:50 +0800
-Subject: [PATCH 1005/1032] wifi: mt76: mt7915: add support for runtime set
+Subject: [PATCH 1005/1033] wifi: mt76: mt7915: add support for runtime set
  in-band discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fc762f7..7d42bd0 100644
+index 8ee1d48..922ae18 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2008,8 +2008,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1930,8 +1930,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	bcn = (struct bss_info_bcn *)tlv;
  	bcn->enable = true;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2043,7 +2042,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1965,7 +1964,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 5cf49d0..a621d88 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-wifi-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,7 +1,7 @@
-From 7c420a8fb200fe8ce03001edd05b811ac2f12169 Mon Sep 17 00:00:00 2001
+From fb010c2d8e8e547bc52e8485840c4821f9e49d4c Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Tue, 4 Apr 2023 02:27:44 +0800
-Subject: [PATCH 1006/1032] wifi: mt76: mt7915: add mt76 vendor muru onoff
+Subject: [PATCH 1006/1033] wifi: mt76: mt7915: add mt76 vendor muru onoff
  command
 
 ---
@@ -12,10 +12,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7d42bd0..8aec083 100644
+index 922ae18..5a68bb7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4085,6 +4085,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -4052,6 +4052,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			phy->muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -30,10 +30,10 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 76bc066..e593520 100644
+index 765ad11..84afa7f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -459,6 +459,7 @@ enum {
+@@ -478,6 +478,7 @@ enum {
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
  	RATE_PARAM_FIXED_OFDMA = 31,
@@ -42,7 +42,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index beb0583..8d864c8 100644
+index 5a1cce1..df1cac3 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -57,7 +57,7 @@
  static const struct nla_policy
  rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
  	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
-@@ -942,6 +947,33 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+@@ -944,6 +949,33 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -91,7 +91,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -988,6 +1020,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -990,6 +1022,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_wireless_ctrl,
  		.policy = wireless_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
index 06e2768..1d7ea79 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-wifi-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,17 +1,17 @@
-From 3233402f296ee8cd5c4fbfb53aec5a5d405d51de Mon Sep 17 00:00:00 2001
+From 24c4b9c1156af2f9edb0d880a506ce1e3e2d599d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 1007/1032] wifi: mt76: mt7915: drop undefined action frame
+Subject: [PATCH 1007/1033] wifi: mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 2b26837..4554a93 100644
+index 5c7a47c..25acb97 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -740,6 +740,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -736,6 +736,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info)
  {
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
@@ -20,7 +20,7 @@
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
-@@ -770,6 +772,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -766,6 +768,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-mt7915-add-fw_version-dump.patch
index e617d92..638abb7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1008-wifi-mt76-mt7915-add-fw_version-dump.patch
@@ -1,7 +1,7 @@
-From cdeb1fb2bbd41993968676db9f1087c358c46dd6 Mon Sep 17 00:00:00 2001
+From 64d91a2c5c82e023639c032c8dde34da2d125628 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH 1008/1032] wifi: mt76: mt7915: add fw_version dump
+Subject: [PATCH 1008/1033] wifi: mt76: mt7915: add fw_version dump
 
 ---
  mt76.h               |  4 ++++
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index ffa9595..c75f316 100644
+index a8f26a8..3425159 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -848,6 +848,10 @@ struct mt76_dev {
+@@ -849,6 +849,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,10 +25,10 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index b0dcc5a..856b289 100644
+index 732a4e6..1cdef36 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2969,6 +2969,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2976,6 +2976,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
  
@@ -38,7 +38,7 @@
  	release_firmware(fw);
  
  	if (!fw_wa)
-@@ -2994,6 +2997,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -3001,6 +3004,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -48,7 +48,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -3064,6 +3070,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -3071,6 +3077,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
@@ -59,7 +59,7 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index fc148d4..99e7c88 100644
+index fc148d4..c6cec57 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2799,6 +2799,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
@@ -70,7 +70,7 @@
 +{
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	struct mt76_dev *mdev = NULL;
-+	seq_printf(s, "Version: 2.2.10.0\n");
++	seq_printf(s, "Version: 2.2.11.0\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
diff --git a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-rework-testmode-init-registers.patch
index 85b5bcb..e9a09e4 100644
--- a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 983f4f2fa2b73a1f0cdcd0d8cf49ac89f707fc5f Mon Sep 17 00:00:00 2001
+From 4a809f8898c4009e88370959802bfd38e2eb94f3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1009/1032] wifi: mt76: testmode: rework testmode init
+Subject: [PATCH 1009/1033] wifi: mt76: testmode: rework testmode init
  registers
 
 ---
@@ -18,7 +18,7 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 577d81a..c3fa85d 100644
+index 991d91b..115bb05 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -784,7 +784,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -32,7 +32,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index c75f316..7a4ede7 100644
+index 3425159..492fe42 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -648,6 +648,8 @@ struct mt76_testmode_ops {
@@ -62,7 +62,7 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ba16e57..aa6d2da 100644
+index 978a4d0..d6165a3 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1190,6 +1190,7 @@ enum {
@@ -74,7 +74,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index e593520..6248e4b 100644
+index 84afa7f..1be6cf3 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -86,7 +86,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 5ef43c4..9451bf5 100644
+index 1bb8a4c..b97aca7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -120,6 +120,7 @@ static const u32 mt7986_reg[] = {
@@ -106,7 +106,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index c8e478a..d6a05f1 100644
+index 374677f..e7bc181 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -48,6 +48,7 @@ enum reg_rev {
diff --git a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-additional-supports.patch
index 0c8ddf3..cbdece6 100644
--- a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From d56368a0d7c5146418b9906ef7b75acf119cf724 Mon Sep 17 00:00:00 2001
+From 29deaa7cb606cf334238cb36d89891fa80bef0fc Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH] wifi: mt76: testmode: additional supports
+Subject: [PATCH 1010/1033] wifi: mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -29,7 +29,7 @@
  20 files changed, 1991 insertions(+), 156 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index e1b73a1..dc53cc7 100644
+index c9d2671..fc92e39 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -574,8 +574,7 @@ free:
@@ -43,7 +43,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index c3fa85d..f6fa788 100644
+index 115bb05..75e2ffe 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -73,7 +73,7 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 7a4ede7..7517135 100644
+index 492fe42..3191626 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -646,6 +646,21 @@ struct mt76_testmode_ops {
@@ -154,7 +154,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1146,6 +1183,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1147,6 +1184,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -214,7 +214,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1156,7 +1246,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1157,7 +1247,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -224,7 +224,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1258,7 +1349,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1259,7 +1350,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -235,15 +235,15 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 856b289..5649377 100644
+index 1cdef36..15ed126 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -395,6 +395,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+@@ -395,6 +395,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	switch (vif->type) {
  	case NL80211_IFTYPE_MESH_POINT:
  	case NL80211_IFTYPE_AP:
 +	case NL80211_IFTYPE_MONITOR:
- 		if (vif->p2p)
+ 		if (vif->p2p && !is_mt7921(dev))
  			conn_type = CONNECTION_P2P_GC;
  		else
 @@ -576,6 +577,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
@@ -257,7 +257,7 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index aa6d2da..9641a08 100644
+index d6165a3..79416e6 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -996,6 +996,7 @@ enum {
@@ -277,10 +277,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index a796289..f1b1471 100644
+index 76be730..f5ab331 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -126,7 +126,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -131,7 +131,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  		/* read eeprom data from efuse */
  		block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
  		for (i = 0; i < block_num; i++) {
@@ -290,10 +290,10 @@
  				return ret;
  		}
 diff --git a/mt7915/init.c b/mt7915/init.c
-index f6f3e8a..2da66cb 100644
+index 7250998..8eacf34 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -697,7 +697,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -701,7 +701,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -303,10 +303,10 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 8c83507..a45e48c 100644
+index 25acb97..ee33850 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -607,16 +607,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -603,16 +603,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  {
  #ifdef CONFIG_NL80211_TESTMODE
  	struct mt76_testmode_data *td = &phy->mt76->test;
@@ -348,7 +348,7 @@
  
  	switch (td->tx_rate_mode) {
  	case MT76_TM_TX_MODE_HT:
-@@ -647,7 +669,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -643,7 +665,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  			rate_idx += 4;
  
  		r = &phy->mt76->hw->wiphy->bands[band]->bitrates[rate_idx];
@@ -357,7 +357,7 @@
  
  		mode = val >> 8;
  		rate_idx = val & 0xff;
-@@ -706,13 +728,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -702,13 +724,14 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  	if (mode >= MT_PHY_TYPE_HE_SU)
  		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
  
@@ -375,7 +375,7 @@
  #endif
  }
  
-@@ -1473,7 +1496,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+@@ -1469,7 +1492,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
  		goto out;
  
  	/* set the necessary init items */
@@ -385,7 +385,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1988d8f..f2dd21f 100644
+index e7523c1..798eaa8 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -398,10 +398,10 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index dca7dc8..5302813 100644
+index 5a68bb7..e4ab3e0 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -384,6 +384,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -387,6 +387,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -413,7 +413,7 @@
  	default:
  		break;
  	}
-@@ -415,6 +420,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -418,6 +423,7 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	    rxd->ext_eid == MCU_EXT_EVENT_ASSERT_DUMP ||
  	    rxd->ext_eid == MCU_EXT_EVENT_PS_SYNC ||
  	    rxd->ext_eid == MCU_EXT_EVENT_BCC_NOTIFY ||
@@ -421,7 +421,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2861,21 +2867,21 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2781,21 +2787,21 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -446,7 +446,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2884,7 +2890,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2804,7 +2810,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  	struct mt7915_mcu_eeprom_info *res;
  	struct sk_buff *skb;
  	int ret;
@@ -455,7 +455,7 @@
  
  	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
  					MCU_EXT_QUERY(EFUSE_ACCESS),
-@@ -2893,8 +2899,11 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2813,8 +2819,11 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -527,7 +527,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 9451bf5..22dcd18 100644
+index b97aca7..fd5722b 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -134,6 +134,7 @@ static const u32 mt7915_offs[] = {
@@ -547,10 +547,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 811d966..7ef615b 100644
+index 60364f0..83743cd 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -328,6 +328,9 @@ struct mt7915_phy {
+@@ -321,6 +321,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -560,7 +560,7 @@
  	} test;
  #endif
  
-@@ -427,6 +430,14 @@ struct mt7915_dev {
+@@ -419,6 +422,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -575,7 +575,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -600,8 +611,8 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -591,8 +602,8 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -586,7 +586,7 @@
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
-@@ -639,6 +650,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -630,6 +641,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -595,7 +595,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index d6a05f1..e876848 100644
+index e7bc181..0339d4b 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -3006,10 +3006,10 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 1f309d0..6d55566 100644
+index 72b3ec7..94f0d82 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -250,8 +250,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
+@@ -252,8 +252,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
  	if (mt76_is_testmode_skb(dev, skb, &hw)) {
  		struct mt76_phy *phy = hw->priv;
  
@@ -3020,5 +3020,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.39.0
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-pre-cal-support.patch
index 548e02a..ac7b121 100644
--- a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 4202d3f9c10603525aa3014d4c40039167559ee8 Mon Sep 17 00:00:00 2001
+From 0b10a07db9b3c9dd93861d71da449c521e228b3e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1011/1032] wifi: mt76: testmode: add pre-cal support
+Subject: [PATCH 1011/1033] wifi: mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
@@ -37,7 +37,7 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 7517135..2b0934f 100644
+index 3191626..c632852 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -647,6 +647,7 @@ struct mt76_testmode_ops {
@@ -49,7 +49,7 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9641a08..22d6a91 100644
+index 79416e6..df7e50b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -992,6 +992,7 @@ enum {
@@ -114,10 +114,10 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5f8a615..60343b6 100644
+index e4ab3e0..abb54eb 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -388,6 +388,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -391,6 +391,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BF_STATUS_READ:
  		mt7915_tm_txbf_status_read(dev, skb);
  		break;
@@ -127,7 +127,7 @@
  #endif
  	default:
  		break;
-@@ -2967,7 +2970,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2887,7 +2890,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -136,7 +136,7 @@
  		return 0;
  
  	/*
-@@ -3047,11 +3050,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -2967,11 +2970,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index cf4af05..0fcb262 100644
+index 83743cd..54e8944 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -414,6 +414,10 @@ struct mt7915_dev {
+@@ -406,6 +406,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -651,6 +655,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -642,6 +646,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 1ed2ea8..1c9da92 100644
+index c44f13f..146c4d3 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-command-mode-support.patch
index 0daa589..5a4d921 100644
--- a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 22391ca94ce63ac500d042a7b909cae04092c740 Mon Sep 17 00:00:00 2001
+From 5537367425c0e52ce5da53612e4aaa1bc756c39f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1012/1032] wifi: mt76: testmode: add iBF command mode support
+Subject: [PATCH 1012/1033] wifi: mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 1c9da92..fe8bcf4 100644
+index 146c4d3..6a18cdb 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
diff --git a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
index ba8a597..164b46a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From 1965cf53639ac3ba07c3e8a53d49161559501948 Mon Sep 17 00:00:00 2001
+From 32e4319f0e34cb0a1ebb2dbb45c6561a96196a52 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1013/1032] wifi: mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1013/1033] wifi: mt76: testmode: add ZWDFS test mode support
 
 Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -19,7 +19,7 @@
  10 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 2b0934f..3eb098f 100644
+index c632852..f4412a2 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -730,6 +730,15 @@ struct mt76_testmode_data {
@@ -39,7 +39,7 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 22d6a91..adfe677 100644
+index df7e50b..7663522 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1192,6 +1192,7 @@ enum {
@@ -59,10 +59,10 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 60343b6..5415ce6 100644
+index abb54eb..2432e57 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2699,6 +2699,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+@@ -2619,6 +2619,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
  		req.monitor_chan = chandef->chan->hw_value;
  		req.monitor_central_chan =
  			ieee80211_frequency_to_channel(chandef->center_freq1);
@@ -70,7 +70,7 @@
  		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4634,3 +4635,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4601,3 +4602,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -140,10 +140,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 11ac2ad..28dae7b 100644
+index 0020025..d361f63 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -667,6 +667,52 @@ struct csi_data {
+@@ -686,6 +686,52 @@ struct csi_data {
  };
  #endif
  
@@ -197,10 +197,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0fcb262..003ad3c 100644
+index 54e8944..e9fc92a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -312,6 +312,7 @@ struct mt7915_phy {
+@@ -305,6 +305,7 @@ struct mt7915_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -208,7 +208,7 @@
  
  	u8 stats_work_count;
  	struct list_head stats_list;
-@@ -769,6 +770,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -759,6 +760,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -219,10 +219,10 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e876848..f4b5709 100644
+index 0339d4b..0798b08 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -1194,6 +1194,8 @@ enum offs_rev {
+@@ -1205,6 +1205,8 @@ enum offs_rev {
  #define MT_WF_IRPI_NSS(phy, nss)	MT_WF_IRPI(0x6000 + ((phy) << 20) + ((nss) << 16))
  #define MT_WF_IRPI_NSS_MT7916(phy, nss)	MT_WF_IRPI(0x1000 + ((phy) << 20) + ((nss) << 16))
  
@@ -232,7 +232,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index fe8bcf4..4dc63f4 100644
+index 6a18cdb..09b0e98 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
diff --git a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
index 8661564..a89117d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
@@ -1,8 +1,8 @@
-From 0a6fa26a5c4c9f63a044cd098edf5ed4d36229f6 Mon Sep 17 00:00:00 2001
+From baeb3dcb1db74bbe3cd499f6d97624c3495c6c69 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH] wifi: mt76: testmode: add iBF/eBF cal and cert commands with
- golden
+Subject: [PATCH 1014/1033] wifi: mt76: testmode: add iBF/eBF cal and cert
+ commands with golden
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -25,7 +25,7 @@
  16 files changed, 856 insertions(+), 324 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 3eb098f..699bb77 100644
+index f4412a2..8e679a1 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -692,6 +692,7 @@ struct mt76_testmode_data {
@@ -47,10 +47,10 @@
  	u32 tx_pending;
  	u32 tx_queued;
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 5649377..d406013 100644
+index 15ed126..d228312 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2757,6 +2757,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -2764,6 +2764,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
  	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
  	struct bss_info_basic *bss;
  	struct tlv *tlv;
@@ -58,7 +58,7 @@
  
  	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
  	bss = (struct bss_info_basic *)tlv;
-@@ -2816,6 +2817,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -2823,6 +2824,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
  		bss->dtim_period = vif->bss_conf.dtim_period;
  		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
  							 chandef->chan->band, NULL);
@@ -68,10 +68,10 @@
  		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a074608..db2b8af 100644
+index ee33850..af90e19 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -732,8 +732,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -728,8 +728,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  		val |= MT_TXD6_LDPC;
  
  	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
@@ -84,7 +84,7 @@
  	txwi[6] |= cpu_to_le32(val);
  #endif
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f2dd21f..2fba3e8 100644
+index 798eaa8..a9cbaed 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
@@ -146,7 +146,7 @@
  
  	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
  	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
-@@ -279,7 +270,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -278,7 +269,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
@@ -175,10 +175,10 @@
  
  	return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5415ce6..6af4ae7 100644
+index 2432e57..bc28454 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -194,6 +194,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -197,6 +197,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  	int ret;
  
  	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
@@ -186,7 +186,7 @@
  	if (ret)
  		return ret;
  
-@@ -384,10 +385,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -387,10 +388,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
@@ -201,7 +201,7 @@
  	case MCU_EXT_EVENT_RF_TEST:
  		mt7915_tm_rf_test_event(dev, skb);
  		break;
-@@ -674,11 +677,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
+@@ -677,11 +680,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
  	if (enable)
  		mt76_connac_mcu_bss_omac_tlv(skb, vif);
  
@@ -227,7 +227,7 @@
  
  	if (enable) {
  		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
-@@ -3469,6 +3483,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3389,6 +3403,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  
  int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  {
@@ -235,7 +235,7 @@
  	struct {
  		u8 action;
  		union {
-@@ -3495,7 +3510,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+@@ -3415,7 +3430,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  		.action = action,
  	};
  
@@ -243,7 +243,7 @@
  	switch (action) {
  	case MT_BF_SOUNDING_ON:
  		req.snd.snd_mode = MT_BF_PROCESSING;
-@@ -4527,6 +4541,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
+@@ -4494,6 +4508,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
  		req.he_opt = v2;
  		req.glo_opt = v3;
  		break;
@@ -254,10 +254,10 @@
  		return -EINVAL;
  	}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 28dae7b..a50b48f 100644
+index d361f63..7f13f3b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -512,10 +512,12 @@ enum {
+@@ -531,10 +531,12 @@ enum {
  };
  
  enum {
@@ -270,7 +270,7 @@
  	MT_BF_PHASE_CAL = 14,
  	MT_BF_IBF_PHASE_COMP = 15,
  	MT_BF_PROFILE_WRITE_ALL = 17,
-@@ -523,6 +525,176 @@ enum {
+@@ -542,6 +544,176 @@ enum {
  	MT_BF_MODULE_UPDATE = 25
  };
  
@@ -448,7 +448,7 @@
  	MURU_SET_ARB_OP_MODE = 14,
  	MURU_SET_PLATFORM_TYPE = 25,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 22dcd18..fa99df1 100644
+index fd5722b..d5198eb 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -133,6 +133,7 @@ static const u32 mt7915_offs[] = {
@@ -468,10 +468,10 @@
  	[AGG_AALCR0]		= 0x028,
  	[AGG_AWSCR0]		= 0x030,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 63cabe8..1a253a4 100644
+index e9fc92a..3bfd611 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -330,7 +330,6 @@ struct mt7915_phy {
+@@ -323,7 +323,6 @@ struct mt7915_phy {
  
  		u8 spe_idx;
  
@@ -479,7 +479,7 @@
  		bool bf_ever_en;
  	} test;
  #endif
-@@ -435,7 +434,7 @@ struct mt7915_dev {
+@@ -427,7 +426,7 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -488,7 +488,7 @@
  	struct {
  		void *txbf_phase_cal;
  		void *txbf_pfmu_data;
-@@ -574,6 +573,7 @@ void mt7915_dma_cleanup(struct mt7915_dev *dev);
+@@ -565,6 +564,7 @@ void mt7915_dma_cleanup(struct mt7915_dev *dev);
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int __mt7915_dma_enable(struct mt7915_dev *dev, bool reset, bool wed_reset);
  int mt7915_txbf_init(struct mt7915_dev *dev);
@@ -496,7 +496,7 @@
  void mt7915_init_txpower(struct mt7915_dev *dev,
  			 struct ieee80211_supported_band *sband);
  void mt7915_reset(struct mt7915_dev *dev);
-@@ -655,8 +655,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -646,8 +646,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -508,7 +508,7 @@
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
-@@ -793,4 +795,10 @@ enum {
+@@ -783,4 +785,10 @@ enum {
  
  #endif
  
@@ -520,7 +520,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 99e7c88..69dc311 100644
+index c6cec57..20133a4 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2908,6 +2908,36 @@ mt7915_txpower_level_set(void *data, u64 val)
@@ -836,7 +836,7 @@
 +}
 +#endif
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index f4b5709..007fd4d 100644
+index 0798b08..7955d01 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -61,6 +61,7 @@ enum offs_rev {
@@ -858,7 +858,7 @@
  #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
  #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4dc63f4..f3b9392 100644
+index 09b0e98..b99bed5 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -53,6 +53,8 @@ struct reg_band {
diff --git a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index b6889a4..5a6e92f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1015-wifi-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,7 +1,7 @@
-From 69b6daca7311f3836c73515d34f2fdb9f3a65b65 Mon Sep 17 00:00:00 2001
+From 0ec1b67bab3908a2990b9698093f5307535ee697 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1015/1032] wifi: mt76: mt7915: init rssi in WTBL when add
+Subject: [PATCH 1015/1033] wifi: mt76: mt7915: init rssi in WTBL when add
  station
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2fba3e8..a53cc19 100644
+index a9cbaed..972cd1a 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -694,6 +694,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -692,6 +692,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
  #endif
  	int ret, idx;
@@ -20,7 +20,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -718,6 +719,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -716,6 +717,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch b/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
index 45221e9..b5fa9d4 100644
--- a/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1016-wifi-mt76-connac-airtime-fairness-feature-off-in-mac.patch
@@ -1,7 +1,7 @@
-From bcd6c41baa00f6bc22ca381e561f0d7be39da3f0 Mon Sep 17 00:00:00 2001
+From fc4243228375ae6b3b27dc6bd73b16bc86cd5482 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1016/1032] wifi: mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1016/1033] wifi: mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index f6fa788..1654cc9 100644
+index 75e2ffe..fb0aea6 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -436,7 +436,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
diff --git a/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch b/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
index 6ba5a3e..0a2cb92 100644
--- a/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1017-wifi-mt76-mt7915-add-mt7986-and-mt7916-pre-calibrati.patch
@@ -1,7 +1,7 @@
-From ae1f52f10839ca0eb145db9cdaff0d4ffa05a3eb Mon Sep 17 00:00:00 2001
+From cd68747e751a5efef46b66675568ba16050d84d2 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1017/1032] wifi: mt76: mt7915: add mt7986 and mt7916
+Subject: [PATCH 1017/1033] wifi: mt76: mt7915: add mt7986 and mt7916
  pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
@@ -16,7 +16,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index f1b1471..77a1047 100644
+index f5ab331..a5c99a5 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -63,10 +63,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6af4ae7..51d1f60 100644
+index bc28454..fcd07ed 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2983,7 +2983,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2903,7 +2903,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -76,7 +76,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -3021,9 +3022,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2941,9 +2942,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -88,7 +88,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -3031,34 +3032,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2951,34 +2952,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -168,7 +168,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3090,24 +3126,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3010,24 +3046,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
index 58cae0f..f373601 100644
--- a/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1018-wifi-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From 6bece086f0d38b439b3e53628ea5a2ab1e150b79 Mon Sep 17 00:00:00 2001
+From 5b4357f01aa42091e84846490bbb453e97e2cf40 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1018/1032] wifi: mt76: mt7915: add phy capability vendor
+Subject: [PATCH 1018/1033] wifi: mt76: mt7915: add phy capability vendor
  command
 
 ---
@@ -11,7 +11,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2e101a0..4f40eed 100644
+index 3bfd611..fdedacf 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -23,7 +23,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 8d864c8..607e66b 100644
+index df1cac3..3dbbd32 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -45,7 +45,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -974,6 +986,35 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
+@@ -976,6 +988,35 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -81,7 +81,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1031,6 +1072,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1033,6 +1074,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_mu_ctrl,
  		.policy = mu_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_MU_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
index 1de8f62..ead4458 100644
--- a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable.patch
@@ -1,7 +1,7 @@
-From 501550e5040bfe26e0b8eef58e5e22de1e343e10 Mon Sep 17 00:00:00 2001
+From 6b3ebcfbfb1252a3c203c4f6c6309909020b4be2 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1019/1032] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1019/1033] wifi: mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
@@ -16,7 +16,7 @@
  7 files changed, 265 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index adfe677..1460aa8 100644
+index 7663522..35fb252 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1202,6 +1202,7 @@ enum {
@@ -28,10 +28,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index a53cc19..4d4fdeb 100644
+index 972cd1a..260385e 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -479,6 +479,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -477,6 +477,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  			mutex_unlock(&dev->mt76.mutex);
  		}
  #endif
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 51d1f60..1ba96f0 100644
+index fcd07ed..9cde484 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4753,3 +4753,76 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4720,3 +4720,76 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -123,10 +123,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a50b48f..9c90854 100644
+index 7f13f3b..97ae882 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -1096,6 +1096,27 @@ enum {
+@@ -1116,6 +1116,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -155,10 +155,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4f40eed..ca81289 100644
+index fdedacf..2409bf5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -772,7 +772,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -762,7 +762,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -169,7 +169,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 607e66b..e748ab1 100644
+index 3dbbd32..afba18e 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -197,7 +197,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1015,6 +1033,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1017,6 +1035,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -306,7 +306,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1083,6 +1203,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1085,6 +1205,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_phy_capa_ctrl_dump,
  		.policy = phy_capa_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-implement-bin-file-mode.patch
index 09d1f95..d0e5afe 100644
--- a/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1020-wifi-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From c8744205bdfda122ef0cc2bb7b0105dac23b6f8b Mon Sep 17 00:00:00 2001
+From c7577e7c0c00532de4c3aac99b11d96fc178ca43 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH] wifi: mt76: mt7915: implement bin file mode
+Subject: [PATCH 1020/1033] wifi: mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -10,9 +10,9 @@
  mt76.h               |  3 +++
  mt7915/eeprom.c      | 36 +++++++++++++++++++++++++++++++++---
  mt7915/eeprom.h      |  7 +++++++
- mt7915/mt7915.h      |  9 ++++++---
+ mt7915/mt7915.h      |  3 +++
  mt7915/mtk_debugfs.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
- 6 files changed, 113 insertions(+), 6 deletions(-)
+ 6 files changed, 110 insertions(+), 3 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
 index aa88925..412740f 100644
@@ -46,10 +46,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 699bb77..614c607 100644
+index 8e679a1..668ab2b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -905,9 +905,11 @@ struct mt76_dev {
+@@ -906,9 +906,11 @@ struct mt76_dev {
  		struct mt76_sdio sdio;
  	};
  
@@ -61,7 +61,7 @@
  };
  
  struct mt76_power_limits {
-@@ -1044,6 +1046,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1045,6 +1047,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -70,10 +70,10 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 77a1047..612be3f 100644
+index a5c99a5..fd08d42 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -45,8 +45,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+@@ -47,8 +47,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
  	}
  }
  
@@ -86,7 +86,7 @@
  	switch (mt76_chip(&dev->mt76)) {
  	case 0x7915:
  		return dev->dbdc_support ?
-@@ -84,7 +87,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
+@@ -89,7 +92,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
  		return ret;
  
  	if (!fw || !fw->data) {
@@ -98,7 +98,7 @@
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -109,6 +115,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -114,6 +120,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  
  	if (ret) {
  		dev->flash_mode = true;
@@ -106,7 +106,7 @@
  	} else {
  		u8 free_block_num;
  		u32 block_num, i;
-@@ -129,6 +136,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -134,6 +141,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  			if (ret < 0)
  				return ret;
  		}
@@ -115,7 +115,7 @@
  	}
  
  	return mt7915_check_eeprom(dev);
-@@ -234,12 +243,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -239,12 +248,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
  
@@ -169,23 +169,10 @@
  mt7915_get_channel_group_5g(int channel, bool is_7976)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ca81289..17efd20 100644
+index 2409bf5..25f92e1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -42,9 +42,9 @@
- #define MT7986_ROM_PATCH		"mediatek/mt7986_rom_patch.bin"
- #define MT7986_ROM_PATCH_MT7975		"mediatek/mt7986_rom_patch_mt7975.bin"
- 
--#define MT7915_EEPROM_DEFAULT		"mediatek/mt7915_eeprom.bin"
--#define MT7915_EEPROM_DEFAULT_DBDC	"mediatek/mt7915_eeprom_dbdc.bin"
--#define MT7916_EEPROM_DEFAULT		"mediatek/mt7916_eeprom.bin"
-+#define MT7915_EEPROM_DEFAULT			"mediatek/mt7915_eeprom.bin"
-+#define MT7915_EEPROM_DEFAULT_DBDC		"mediatek/mt7915_eeprom_dbdc.bin"
-+#define MT7916_EEPROM_DEFAULT			"mediatek/mt7916_eeprom.bin"
- #define MT7986_EEPROM_MT7975_DEFAULT		"mediatek/mt7986_eeprom_mt7975.bin"
- #define MT7986_EEPROM_MT7975_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7975_dual.bin"
- #define MT7986_EEPROM_MT7976_DEFAULT		"mediatek/mt7986_eeprom_mt7976.bin"
-@@ -408,6 +408,8 @@ struct mt7915_dev {
+@@ -400,6 +400,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -194,7 +181,7 @@
  	bool muru_debug;
  	bool ibf;
  
-@@ -785,6 +787,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
+@@ -775,6 +777,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
  int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
@@ -203,7 +190,7 @@
  #define PKT_BIN_DEBUG_MAGIC	0xc8763123
  enum {
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 69dc311..53d10e3 100644
+index 20133a4..2cccebe 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-initialize-wcid.patch
index 4813fb3..16954d3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1021-wifi-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From bb8dcc01d382ba5114286193ddba18a1971399cc Mon Sep 17 00:00:00 2001
+From 3351af0e260216cb75d03db85982bf4bc9308f7d Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1021/1032] wifi: mt76: mt7915: initialize wcid
+Subject: [PATCH 1021/1033] wifi: mt76: mt7915: initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index db2b8af..63a1124 100644
+index af90e19..e5ecb5b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1011,7 +1011,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1007,7 +1007,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
diff --git a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-Add-mu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-Add-mu-dump-support.patch
index 9731768..747cbf2 100644
--- a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-Add-mu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-Add-mu-dump-support.patch
@@ -1,7 +1,7 @@
-From bddd3537739bd46e25e17ae6d365c836a65c9223 Mon Sep 17 00:00:00 2001
+From 95f591a8dcc2d3517b85147928677b60f5c9e015 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1022/1032] wifi: mt76: mt7915: Add mu dump support
+Subject: [PATCH 1022/1033] wifi: mt76: mt7915: Add mu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 25 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index e748ab1..6915ac8 100644
+index afba18e..0c0b47e 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -21,7 +21,7 @@
  };
  
  static const struct nla_policy
-@@ -1004,6 +1005,28 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
+@@ -1006,6 +1007,28 @@ static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -50,7 +50,7 @@
  static int
  mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1190,6 +1213,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1192,6 +1215,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
  			WIPHY_VENDOR_CMD_NEED_RUNNING,
  		.doit = mt7915_vendor_mu_ctrl,
diff --git a/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch b/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
index ceee265..2d62615 100644
--- a/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1023-wifi-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ct.patch
@@ -1,7 +1,7 @@
-From 682aa9cd8ce82422216a65ec11c4e59b92194d15 Mon Sep 17 00:00:00 2001
+From ceaf2875e70fba9ac5c4a65f6cfa13c447a2cf0d Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1023/1032] wifi: mt76: mt7915: add vendor subcmd three wire
+Subject: [PATCH 1023/1033] wifi: mt76: mt7915: add vendor subcmd three wire
  (PTA) ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
@@ -16,7 +16,7 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 1460aa8..5c7086d 100644
+index 35fb252..661d790 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1201,7 +1201,7 @@ enum {
@@ -29,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1ba96f0..cd2b313 100644
+index 9cde484..7603bd8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4452,37 +4452,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4419,37 +4419,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,10 +94,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9c90854..d919da2 100644
+index 97ae882..3da650c 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -885,6 +885,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -904,6 +904,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -134,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 17efd20..a837c74 100644
+index 25f92e1..b3a0f2a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -766,6 +766,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -756,6 +756,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 6915ac8..b26b1cc 100644
+index 0c0b47e..b651cea 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
@@ -161,7 +161,7 @@
  static const struct nla_policy
  rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
  	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
-@@ -971,7 +976,7 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+@@ -973,7 +978,7 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
  			mt7915_set_wireless_vif, &val32);
  	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]) {
  		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
@@ -170,7 +170,7 @@
  		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
  	}
  
-@@ -1115,6 +1120,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
+@@ -1117,6 +1122,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -178,7 +178,7 @@
  static int
  mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1158,6 +1164,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1160,6 +1166,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len;
  }
  
@@ -210,7 +210,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1239,6 +1270,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1241,6 +1272,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_edcca_ctrl_dump,
  		.policy = edcca_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 8fad354..29dbd3b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1024-wifi-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 4e0f8e91e27ce57f37ae8a3f66e69a899f40b81c Mon Sep 17 00:00:00 2001
+From d85a245c188aaad1fbc08a45c147e2328ac33922 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1024/1032] wifi: mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1024/1033] wifi: mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b26b1cc..3e5c479 100644
+index b651cea..b661ea4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
@@ -25,7 +25,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1188,6 +1193,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
+@@ -1190,6 +1195,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
  	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
  }
  
@@ -80,7 +80,7 @@
  
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
-@@ -1281,6 +1334,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1283,6 +1336,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_3wire_ctrl,
  		.policy = three_wire_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-E3-re-bonding-for-low-yield-rat.patch b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-E3-re-bonding-for-low-yield-rat.patch
index dfb125a..04e6733 100644
--- a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-E3-re-bonding-for-low-yield-rat.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-E3-re-bonding-for-low-yield-rat.patch
@@ -1,7 +1,7 @@
-From bcce531b2dadd05b31180658e933b2da05226f7a Mon Sep 17 00:00:00 2001
+From db8ca122f32340716f8f130485f7df58cc0d436a Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 30 Mar 2023 15:12:37 +0800
-Subject: [PATCH 1025/1032] wifi: mt76: mt7915: add E3 re-bonding for low yield
+Subject: [PATCH 1025/1033] wifi: mt76: mt7915: add E3 re-bonding for low yield
  rate issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -11,10 +11,10 @@
  2 files changed, 29 insertions(+)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 612be3f..c6d8ca1 100644
+index fd08d42..3b44a9d 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -239,6 +239,32 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+@@ -244,6 +244,32 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  	dev->chainshift = hweight8(dev->mphy.chainmask);
  }
  
@@ -47,7 +47,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
-@@ -275,6 +301,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -280,6 +306,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  			return ret;
  	}
  
@@ -57,10 +57,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a837c74..c147ca1 100644
+index b3a0f2a..e2f196b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -563,6 +563,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -554,6 +554,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
diff --git a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
index fa83862..99dfad3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1026-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch
@@ -1,7 +1,7 @@
-From c8f06183f7b3a64c5ecb0bee3426a2757c2de0c9 Mon Sep 17 00:00:00 2001
+From 4127f1f3a388e72e8271f032dc081301a79bfba5 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1026/1032] wifi: mt76: mt7915: support on off SW ACI through
+Subject: [PATCH 1026/1033] wifi: mt76: mt7915: support on off SW ACI through
  debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
@@ -12,7 +12,7 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5c7086d..b3ac14d 100644
+index 661d790..1fdbc1c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1203,6 +1203,7 @@ enum {
@@ -24,10 +24,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 4c94ed3..da4056e 100644
+index 2cccebe..acff7ce 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3641,6 +3641,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -3644,6 +3644,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -53,7 +53,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3730,6 +3749,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3733,6 +3752,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
diff --git a/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index a8f989b..bce4a14 100644
--- a/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1027-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,7 +1,7 @@
-From c1d658044e6246c3575b1b25788e711f0ee8385b Mon Sep 17 00:00:00 2001
+From cd39ff8dad3bfea4c0ec7ac7e71b92158cfa11b5 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1027/1032] wifi: mt76: mt7915: add bf backoff limit table
+Subject: [PATCH 1027/1033] wifi: mt76: mt7915: add bf backoff limit table
  support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -58,10 +58,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
 diff --git a/mt76.h b/mt76.h
-index 614c607..278a676 100644
+index 668ab2b..ea43716 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -917,6 +917,14 @@ struct mt76_power_limits {
+@@ -918,6 +918,14 @@ struct mt76_power_limits {
  	s8 ofdm[8];
  	s8 mcs[4][10];
  	s8 ru[7][12];
@@ -77,7 +77,7 @@
  
  struct mt76_ethtool_worker_info {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index eb14910..129a15c 100644
+index 9fca009..a122457 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1027,7 +1027,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -189,10 +189,10 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index cd2b313..ba25580 100644
+index 7603bd8..0bec0bc 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3340,7 +3340,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3260,7 +3260,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	int ret;
  	s8 txpower_sku[MT7915_SKU_RATE_NUM];
  
@@ -202,7 +202,7 @@
  	if (ret)
  		return ret;
  
-@@ -3382,51 +3383,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3302,51 +3303,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  {
@@ -326,7 +326,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3435,10 +3483,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3355,10 +3403,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -338,7 +338,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3448,9 +3495,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3368,9 +3415,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -357,7 +357,7 @@
  
  	dev_kfree_skb(skb);
  
-@@ -3492,9 +3545,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3412,9 +3465,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.band_idx = phy->mt76->band_idx,
  		.sku_enable = enable,
  	};
@@ -377,10 +377,10 @@
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d919da2..a999e0c 100644
+index 3da650c..240a315 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -483,12 +483,18 @@ enum {
+@@ -502,12 +502,18 @@ enum {
  
  enum {
  	TX_POWER_LIMIT_ENABLE,
@@ -400,10 +400,10 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c147ca1..75c2f15 100644
+index e2f196b..b4644f6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -65,6 +65,7 @@
+@@ -72,6 +72,7 @@
  #define MT7915_CDEV_THROTTLE_MAX	99
  
  #define MT7915_SKU_RATE_NUM		161
@@ -411,7 +411,7 @@
  
  #define MT7915_MAX_TWT_AGRT		16
  #define MT7915_MAX_STA_TWT_AGRT		8
-@@ -630,7 +631,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+@@ -621,7 +622,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
  int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
diff --git a/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-amsdu-set-and-get-control.patch b/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
index 7d7ed1f..0f0a54f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1028-wifi-mt76-mt7915-amsdu-set-and-get-control.patch
@@ -1,7 +1,7 @@
-From 02de52b2ba50a43e6eabbb6dcc2eb7c1843380ef Mon Sep 17 00:00:00 2001
+From 433251f722c4efb2b14e19619a19ee85fe58c026 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH 1028/1032] wifi: mt76: mt7915: amsdu set and get control
+Subject: [PATCH 1028/1033] wifi: mt76: mt7915: amsdu set and get control
 
 ---
  mt7915/mac.c    | 10 ++++++++++
@@ -11,10 +11,10 @@
  4 files changed, 54 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 63a1124..06d4f2f 100644
+index e5ecb5b..1301b61 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -2075,6 +2075,16 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+@@ -2077,6 +2077,16 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
  	spin_unlock_bh(&phy->stats_lock);
  }
  
@@ -32,10 +32,10 @@
  void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 75c2f15..1680413 100644
+index b4644f6..b0743c0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -757,6 +757,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -747,6 +747,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -44,7 +44,7 @@
  void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 3e5c479..2e5f07c 100644
+index b661ea4..3d1984b 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -30,10 +30,16 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -64,7 +64,7 @@
  static const struct nla_policy
  mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
  	[MTK_VENDOR_ATTR_MU_CTRL_ONOFF] = {.type = NLA_U8 },
-@@ -983,11 +989,35 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+@@ -985,11 +991,35 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
  		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
  		mt7915_mcu_set_cfg(phy, CFGINFO_CERT_CFG, val8); /* Cert Enable for OMI */
  		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
@@ -100,7 +100,7 @@
  static int mt7915_vendor_mu_ctrl(struct wiphy *wiphy,
  				  struct wireless_dev *wdev,
  				  const void *data,
-@@ -1286,6 +1316,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1288,6 +1318,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
  			WIPHY_VENDOR_CMD_NEED_RUNNING,
  		.doit = mt7915_vendor_wireless_ctrl,
diff --git a/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch b/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
rename to recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
index a7ff9cf..d28ba31 100644
--- a/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch
@@ -1,7 +1,7 @@
-From c3a3b89c1f0bb12ab9eca69ebca213a0743242bb Mon Sep 17 00:00:00 2001
+From 680ee306a830525879b8d972f8cd894b01514225 Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 14:32:08 +0800
-Subject: [PATCH 1030/1032] wifi: mt76: mt7915: Add vendor command attribute
+Subject: [PATCH 1029/1033] wifi: mt76: mt7915: Add vendor command attribute
  for RTS BW signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -13,10 +13,10 @@
  4 files changed, 20 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 13b86ed..0fe15a5 100644
+index 0bec0bc..3939768 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4531,6 +4531,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
+@@ -4497,6 +4497,12 @@ int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
  		req.cert.length = cpu_to_le16(tlv_len);
  		req.cert.cert_program = type;
  		break;
@@ -30,10 +30,10 @@
  		tlv_len = sizeof(struct three_wire_cfg);
  		req.three_wire.tag = cpu_to_le16(cfg_info);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a999e0c..acfd715 100644
+index 240a315..8ac70e5 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -905,6 +905,13 @@ struct three_wire_cfg {
+@@ -924,6 +924,13 @@ struct three_wire_cfg {
  	u8 rsv[3];
  } __packed;
  
@@ -47,7 +47,7 @@
  struct cfg_basic_info {
  	u8 dbdc_idx;
  	u8 rsv[3];
-@@ -912,11 +919,13 @@ struct cfg_basic_info {
+@@ -931,11 +938,13 @@ struct cfg_basic_info {
  	union {
  		struct cert_cfg cert;
  		struct three_wire_cfg three_wire;
@@ -62,7 +62,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 2e5f07c..3b7ac09 100644
+index 3d1984b..6bbdc6f 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -33,6 +33,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -73,7 +73,7 @@
  };
  
  static const struct nla_policy
-@@ -992,6 +993,9 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+@@ -994,6 +995,9 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
  	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]) {
  		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]);
  		mt7915_set_wireless_amsdu(hw, val8);
diff --git a/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch b/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch
deleted file mode 100644
index cd5cc99..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1029-wifi-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 6303c0b54acc6fcfe126a17357a7895054c951a0 Mon Sep 17 00:00:00 2001
-From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Thu, 12 Jan 2023 15:15:42 +0800
-Subject: [PATCH 1029/1032] wifi: mt76: mt7915: add support for he ldpc control
- from hostapd
-
----
- mt7915/mcu.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ba25580..13b86ed 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -1984,6 +1984,7 @@ mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
- 		he = (void *)(ie + 3);
- 
- 		vc->he_ldpc =
-+			HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, he->phy_cap_info[1]) &&
- 			HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, pe->phy_cap_info[1]);
- 		vc->he_su_ebfer =
- 			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch b/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
rename to recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
index a47f216..1d9d84a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1030-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch
@@ -1,7 +1,7 @@
-From 7c4fae95d00e39603ac209413b6f042065923bd7 Mon Sep 17 00:00:00 2001
+From 6f671ea083717d2e0d9578239c761d4fe55e4d74 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Thu, 26 Jan 2023 08:50:47 +0800
-Subject: [PATCH 1031/1032] wifi: mt76: mt7915: add vendor cmd to get available
+Subject: [PATCH 1030/1033] wifi: mt76: mt7915: add vendor cmd to get available
  color bitmap
 
 Add a vendor cmd to notify user space available color bitmap.
@@ -14,7 +14,7 @@
  2 files changed, 48 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 3b7ac09..b021bd5 100644
+index 6bbdc6f..af60880 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -98,6 +98,11 @@ ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
@@ -29,7 +29,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -1275,6 +1280,27 @@ mt7915_vendor_ibf_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -1277,6 +1282,27 @@ mt7915_vendor_ibf_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return 1;
  }
  
@@ -57,7 +57,7 @@
  
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
-@@ -1381,6 +1407,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -1383,6 +1409,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_ibf_ctrl_dump,
  		.policy = ibf_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_IBF_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch b/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
rename to recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
index f8c2ac8..5e89b94 100644
--- a/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1031-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch
@@ -1,7 +1,7 @@
-From 19fae145418da66151cab3e3af3e3ad9632a6381 Mon Sep 17 00:00:00 2001
+From 12591211de7e8688434cc1cc93143871e3403507 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Feb 2023 16:29:42 +0800
-Subject: [PATCH 1032/1032] wifi: mt76: mt7915: disable SW-ACI by default
+Subject: [PATCH 1031/1033] wifi: mt76: mt7915: disable SW-ACI by default
 
 Support to enable/disable SW-ACI by module parameter "sw_aci_enable".
 SW-ACI feature is disable by default.
@@ -13,7 +13,7 @@
  4 files changed, 29 insertions(+), 9 deletions(-)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4d4fdeb..0d5e527 100644
+index 260385e..8d1120c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -8,6 +8,10 @@
@@ -39,10 +39,10 @@
  
  	if (phy != &dev->phy) {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0fe15a5..f87a386 100644
+index 3939768..13e5a54 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4891,3 +4891,18 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
+@@ -4857,3 +4857,18 @@ int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
  
  	return 0;
  }
@@ -62,10 +62,10 @@
 +				 sizeof(req), NULL);
 +}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1680413..c379b2a 100644
+index b0743c0..82d632b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -781,6 +781,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -771,6 +771,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
@@ -74,10 +74,10 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index da4056e..e102ddc 100644
+index acff7ce..4629f6b 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3644,16 +3644,12 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -3647,16 +3647,12 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  static int
  mt7915_sw_aci_set(void *data, u64 val)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-Add-5G-UNII4-support.patch b/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-Add-5G-UNII4-support.patch
similarity index 73%
rename from recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-Add-5G-UNII4-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-Add-5G-UNII4-support.patch
index 2f4390a..af92dad 100644
--- a/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-Add-5G-UNII4-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1032-wifi-mt76-mt7915-Add-5G-UNII4-support.patch
@@ -1,14 +1,14 @@
-From 1b24a353f3304b569dd17d28f9633fbc213651b2 Mon Sep 17 00:00:00 2001
+From ebee8109eb2d0dba82518e3b1ceae58580b65b69 Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 2 May 2023 15:08:42 +0800
-Subject: [PATCH] wifi: mt76: mt7915: Add 5G UNII4 support.
+Subject: [PATCH 1032/1033] wifi: mt76: mt7915: Add 5G UNII4 support.
 
 ---
  mac80211.c | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/mac80211.c b/mac80211.c
-index 4c88710..8ac1448 100644
+index fb0aea6..553d901 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -82,6 +82,7 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch b/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
rename to recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
index 05cab8b..dac7194 100644
--- a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1033-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch
@@ -1,7 +1,7 @@
-From 945359050d7ed6bc288a187a22f39351985c9007 Mon Sep 17 00:00:00 2001
+From e3d526b4c7a48f8b220899020e96c1e110f492ca Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 27 Apr 2023 15:37:33 +0800
-Subject: [PATCH] wifi: mt76: mt7915: add muru user number debug
+Subject: [PATCH 1033/1033] wifi: mt76: mt7915: add muru user number debug
  command
 
 ---
@@ -11,10 +11,10 @@
  3 files changed, 17 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2e5295b..f9922f9 100644
+index 82d632b..45a5254 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -644,6 +644,7 @@ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
+@@ -635,6 +635,7 @@ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev,
  int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,
  			    const struct mt7915_dfs_pattern *pattern);
  int mt7915_mcu_set_muru_ctrl(struct mt7915_dev *dev, u32 cmd, u32 val);
@@ -78,5 +78,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_MU_CTRL,
 -- 
-2.39.0
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/110-wifi-mt76-ignore-key-disable-commands.patch b/recipes-wifi/linux-mt76/files/patches/110-wifi-mt76-ignore-key-disable-commands.patch
deleted file mode 100644
index 78b70d7..0000000
--- a/recipes-wifi/linux-mt76/files/patches/110-wifi-mt76-ignore-key-disable-commands.patch
+++ /dev/null
@@ -1,326 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 22 Mar 2023 10:17:49 +0100
-Subject: [PATCH] wifi: mt76: ignore key disable commands
-
-This helps avoid cleartext leakage of already queued or powersave buffered
-packets, when a reassoc triggers the key deletion.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/mt7603/main.c
-+++ b/mt7603/main.c
-@@ -512,15 +512,15 @@ mt7603_set_key(struct ieee80211_hw *hw,
- 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
- 		return -EOPNOTSUPP;
- 
--	if (cmd == SET_KEY) {
--		key->hw_key_idx = wcid->idx;
--		wcid->hw_key_idx = idx;
--	} else {
-+	if (cmd != SET_KEY) {
- 		if (idx == wcid->hw_key_idx)
- 			wcid->hw_key_idx = -1;
- 
--		key = NULL;
-+		return 0;
- 	}
-+
-+	key->hw_key_idx = wcid->idx;
-+	wcid->hw_key_idx = idx;
- 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 
- 	return mt7603_wtbl_set_key(dev, wcid->idx, key);
---- a/mt7615/mac.c
-+++ b/mt7615/mac.c
-@@ -1193,8 +1193,7 @@ EXPORT_SYMBOL_GPL(mt7615_mac_enable_rtsc
- static int
- mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
- 			   struct ieee80211_key_conf *key,
--			   enum mt76_cipher_type cipher, u16 cipher_mask,
--			   enum set_key_cmd cmd)
-+			   enum mt76_cipher_type cipher, u16 cipher_mask)
- {
- 	u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx) + 30 * 4;
- 	u8 data[32] = {};
-@@ -1203,27 +1202,18 @@ mt7615_mac_wtbl_update_key(struct mt7615
- 		return -EINVAL;
- 
- 	mt76_rr_copy(dev, addr, data, sizeof(data));
--	if (cmd == SET_KEY) {
--		if (cipher == MT_CIPHER_TKIP) {
--			/* Rx/Tx MIC keys are swapped */
--			memcpy(data, key->key, 16);
--			memcpy(data + 16, key->key + 24, 8);
--			memcpy(data + 24, key->key + 16, 8);
--		} else {
--			if (cipher_mask == BIT(cipher))
--				memcpy(data, key->key, key->keylen);
--			else if (cipher != MT_CIPHER_BIP_CMAC_128)
--				memcpy(data, key->key, 16);
--			if (cipher == MT_CIPHER_BIP_CMAC_128)
--				memcpy(data + 16, key->key, 16);
--		}
-+	if (cipher == MT_CIPHER_TKIP) {
-+		/* Rx/Tx MIC keys are swapped */
-+		memcpy(data, key->key, 16);
-+		memcpy(data + 16, key->key + 24, 8);
-+		memcpy(data + 24, key->key + 16, 8);
- 	} else {
-+		if (cipher_mask == BIT(cipher))
-+			memcpy(data, key->key, key->keylen);
-+		else if (cipher != MT_CIPHER_BIP_CMAC_128)
-+			memcpy(data, key->key, 16);
- 		if (cipher == MT_CIPHER_BIP_CMAC_128)
--			memset(data + 16, 0, 16);
--		else if (cipher_mask)
--			memset(data, 0, 16);
--		if (!cipher_mask)
--			memset(data, 0, sizeof(data));
-+			memcpy(data + 16, key->key, 16);
- 	}
- 
- 	mt76_wr_copy(dev, addr, data, sizeof(data));
-@@ -1234,7 +1224,7 @@ mt7615_mac_wtbl_update_key(struct mt7615
- static int
- mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid,
- 			  enum mt76_cipher_type cipher, u16 cipher_mask,
--			  int keyidx, enum set_key_cmd cmd)
-+			  int keyidx)
- {
- 	u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx), w0, w1;
- 
-@@ -1253,9 +1243,7 @@ mt7615_mac_wtbl_update_pk(struct mt7615_
- 	else
- 		w0 &= ~MT_WTBL_W0_RX_IK_VALID;
- 
--	if (cmd == SET_KEY &&
--	    (cipher != MT_CIPHER_BIP_CMAC_128 ||
--	     cipher_mask == BIT(cipher))) {
-+	if (cipher != MT_CIPHER_BIP_CMAC_128 || cipher_mask == BIT(cipher)) {
- 		w0 &= ~MT_WTBL_W0_KEY_IDX;
- 		w0 |= FIELD_PREP(MT_WTBL_W0_KEY_IDX, keyidx);
- 	}
-@@ -1272,19 +1260,10 @@ mt7615_mac_wtbl_update_pk(struct mt7615_
- 
- static void
- mt7615_mac_wtbl_update_cipher(struct mt7615_dev *dev, struct mt76_wcid *wcid,
--			      enum mt76_cipher_type cipher, u16 cipher_mask,
--			      enum set_key_cmd cmd)
-+			      enum mt76_cipher_type cipher, u16 cipher_mask)
- {
- 	u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx);
- 
--	if (!cipher_mask) {
--		mt76_clear(dev, addr + 2 * 4, MT_WTBL_W2_KEY_TYPE);
--		return;
--	}
--
--	if (cmd != SET_KEY)
--		return;
--
- 	if (cipher == MT_CIPHER_BIP_CMAC_128 &&
- 	    cipher_mask & ~BIT(MT_CIPHER_BIP_CMAC_128))
- 		return;
-@@ -1295,8 +1274,7 @@ mt7615_mac_wtbl_update_cipher(struct mt7
- 
- int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
- 			      struct mt76_wcid *wcid,
--			      struct ieee80211_key_conf *key,
--			      enum set_key_cmd cmd)
-+			      struct ieee80211_key_conf *key)
- {
- 	enum mt76_cipher_type cipher;
- 	u16 cipher_mask = wcid->cipher;
-@@ -1306,19 +1284,14 @@ int __mt7615_mac_wtbl_set_key(struct mt7
- 	if (cipher == MT_CIPHER_NONE)
- 		return -EOPNOTSUPP;
- 
--	if (cmd == SET_KEY)
--		cipher_mask |= BIT(cipher);
--	else
--		cipher_mask &= ~BIT(cipher);
--
--	mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask, cmd);
--	err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask,
--					 cmd);
-+	cipher_mask |= BIT(cipher);
-+	mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask);
-+	err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask);
- 	if (err < 0)
- 		return err;
- 
- 	err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, cipher_mask,
--					key->keyidx, cmd);
-+					key->keyidx);
- 	if (err < 0)
- 		return err;
- 
-@@ -1329,13 +1302,12 @@ int __mt7615_mac_wtbl_set_key(struct mt7
- 
- int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
- 			    struct mt76_wcid *wcid,
--			    struct ieee80211_key_conf *key,
--			    enum set_key_cmd cmd)
-+			    struct ieee80211_key_conf *key)
- {
- 	int err;
- 
- 	spin_lock_bh(&dev->mt76.lock);
--	err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
-+	err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
- 	spin_unlock_bh(&dev->mt76.lock);
- 
- 	return err;
---- a/mt7615/main.c
-+++ b/mt7615/main.c
-@@ -391,18 +391,17 @@ static int mt7615_set_key(struct ieee802
- 
- 	if (cmd == SET_KEY)
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	if (mt76_is_mmio(&dev->mt76))
--		err = mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
-+		err = mt7615_mac_wtbl_set_key(dev, wcid, key);
- 	else
--		err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
-+		err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
- 
- out:
- 	mt7615_mutex_release(dev);
---- a/mt7615/mt7615.h
-+++ b/mt7615/mt7615.h
-@@ -491,11 +491,9 @@ int mt7615_mac_write_txwi(struct mt7615_
- void mt7615_mac_set_timing(struct mt7615_phy *phy);
- int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
- 			      struct mt76_wcid *wcid,
--			      struct ieee80211_key_conf *key,
--			      enum set_key_cmd cmd);
-+			      struct ieee80211_key_conf *key);
- int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
--			    struct ieee80211_key_conf *key,
--			    enum set_key_cmd cmd);
-+			    struct ieee80211_key_conf *key);
- void mt7615_mac_reset_work(struct work_struct *work);
- u32 mt7615_mac_get_sta_tid_sn(struct mt7615_dev *dev, int wcid, u8 tid);
- 
---- a/mt76x02_util.c
-+++ b/mt76x02_util.c
-@@ -454,20 +454,20 @@ int mt76x02_set_key(struct ieee80211_hw
- 	msta = sta ? (struct mt76x02_sta *)sta->drv_priv : NULL;
- 	wcid = msta ? &msta->wcid : &mvif->group_wcid;
- 
--	if (cmd == SET_KEY) {
--		key->hw_key_idx = wcid->idx;
--		wcid->hw_key_idx = idx;
--		if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
--			key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
--			wcid->sw_iv = true;
--		}
--	} else {
-+	if (cmd != SET_KEY) {
- 		if (idx == wcid->hw_key_idx) {
- 			wcid->hw_key_idx = -1;
- 			wcid->sw_iv = false;
- 		}
- 
--		key = NULL;
-+		return 0;
-+	}
-+
-+	key->hw_key_idx = wcid->idx;
-+	wcid->hw_key_idx = idx;
-+	if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
-+		key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
-+		wcid->sw_iv = true;
- 	}
- 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -410,16 +410,15 @@ static int mt7915_set_key(struct ieee802
- 		mt7915_mcu_add_bss_info(phy, vif, true);
- 	}
- 
--	if (cmd == SET_KEY)
-+	if (cmd == SET_KEY) {
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	} else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
- 				      key, MCU_EXT_CMD(STA_REC_UPDATE),
- 				      &msta->wcid, cmd);
---- a/mt7921/main.c
-+++ b/mt7921/main.c
-@@ -569,16 +569,15 @@ static int mt7921_set_key(struct ieee802
- 
- 	mt7921_mutex_acquire(dev);
- 
--	if (cmd == SET_KEY)
-+	if (cmd == SET_KEY) {
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	} else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
- 				      key, MCU_UNI_CMD(STA_REC_UPDATE),
- 				      &msta->wcid, cmd);
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -351,16 +351,15 @@ static int mt7996_set_key(struct ieee802
- 		mt7996_mcu_add_bss_info(phy, vif, true);
- 	}
- 
--	if (cmd == SET_KEY)
-+	if (cmd == SET_KEY) {
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	} else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	err = mt7996_mcu_add_key(&dev->mt76, vif, &msta->bip,
- 				 key, MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
- 				 &msta->wcid, cmd);
diff --git a/recipes-wifi/linux-mt76/files/patches/3000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/3000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
index 985137a..cc09bac 100644
--- a/recipes-wifi/linux-mt76/files/patches/3000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From 65e219aa7474e080497ba207c5116437596fa7cc Mon Sep 17 00:00:00 2001
+From 30912b07f4f8a8e3c6639c4d61326fe872ba8ce5 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 3000/3013] wifi: mt76: mt7915: wed: add wed tx support
+Subject: [PATCH 3000/3012] wifi: mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -13,10 +13,10 @@
  5 files changed, 14 insertions(+), 9 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 2ee9a3c..5a0a3ce 100644
+index ca26984..fc453e5 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
-@@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
+@@ -130,6 +130,7 @@ struct mt76_connac_sta_key_conf {
  };
  
  #define MT_TXP_MAX_BUF_NUM		6
@@ -25,10 +25,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 06d4f2f..d7b0e63 100644
+index 1301b61..26b5e15 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -870,9 +870,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -866,9 +866,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -40,7 +40,7 @@
  }
  
  static void
-@@ -988,6 +988,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -984,6 +984,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -48,7 +48,7 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1051,12 +1052,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1047,12 +1048,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -66,10 +66,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0d5e527..33df772 100644
+index 8d1120c..59e879b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1548,14 +1548,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1546,14 +1546,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -87,7 +87,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index fa99df1..0e79faf 100644
+index d5198eb..3f4749b 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -13,7 +13,7 @@
@@ -117,10 +117,10 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c379b2a..c3cc35d 100644
+index 45a5254..d0ae42f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -55,7 +55,7 @@
+@@ -62,7 +62,7 @@
  #define MT7916_EEPROM_SIZE		4096
  
  #define MT7915_EEPROM_BLOCK_SIZE	16
diff --git a/recipes-wifi/linux-mt76/files/patches/3001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch b/recipes-wifi/linux-mt76/files/patches/3001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
index 72059c0..be9a604 100644
--- a/recipes-wifi/linux-mt76/files/patches/3001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch
@@ -1,7 +1,7 @@
-From 5474f456818029dcc4a994257436090344f0a850 Mon Sep 17 00:00:00 2001
+From 7d1859d341a5c77b206b6b72c8a3d06dcef60042 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 17:51:26 +0800
-Subject: [PATCH 3001/3013] wifi: mt76: mt7915: wed: add wds support when wed
+Subject: [PATCH 3001/3012] wifi: mt76: mt7915: wed: add wds support when wed
  is enabled
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 82 insertions(+), 10 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 278a676..0ee2291 100644
+index ea43716..3d36913 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -60,6 +60,12 @@ enum mt76_wed_type {
@@ -32,10 +32,10 @@
  	u32 (*rr)(struct mt76_dev *dev, u32 offset);
  	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 33df772..a8fe1a5 100644
+index 59e879b..13e797f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -706,8 +706,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -704,8 +704,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -52,7 +52,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1184,6 +1191,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1182,6 +1189,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -66,7 +66,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1555,8 +1569,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1553,8 +1567,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -81,10 +81,10 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f87a386..78822cc 100644
+index 13e5a54..e9bc4b1 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2427,10 +2427,18 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2346,10 +2346,18 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -108,10 +108,10 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index acfd715..bd0ccb5 100644
+index 8ac70e5..c533a7d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -320,6 +320,7 @@ enum {
+@@ -339,6 +339,7 @@ enum {
  	MCU_WA_PARAM_PDMA_RX = 0x04,
  	MCU_WA_PARAM_CPU_UTIL = 0x0b,
  	MCU_WA_PARAM_RED = 0x0e,
diff --git a/recipes-wifi/linux-mt76/files/patches/3002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch b/recipes-wifi/linux-mt76/files/patches/3002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
index c6b1359..a39c895 100644
--- a/recipes-wifi/linux-mt76/files/patches/3002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch
@@ -1,23 +1,22 @@
-From 1105e82cdf7e8b5c902004e772a46e8a28dd516f Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3002/3013] wifi: mt76: mt7915: wed: add fill receive path to
+From 73eb4f4af78b3158592dfeb97e15196f471bf4c1 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Fri, 19 May 2023 07:05:22 +0800
+Subject: [PATCH 3002/3012] wifi: mt76: mt7915: wed: add fill receive path to 
  report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- mt7915/main.c | 19 +++++++++++++++++++
- 1 file changed, 19 insertions(+)
+ mt7915/main.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index a8fe1a5..4f7288b 100644
+index 13e797f..275c6a0 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1580,6 +1580,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
- 
+@@ -1579,6 +1579,23 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	return 0;
  }
-+
+ 
 +static int
 +mt7915_net_fill_receive_path(struct ieee80211_hw *hw,
 +			     struct net_device_path_ctx *ctx,
@@ -35,14 +34,15 @@
 +	return 0;
 +}
 +
- #endif
- 
- const struct ieee80211_ops mt7915_ops = {
-@@ -1632,5 +1650,6 @@ const struct ieee80211_ops mt7915_ops = {
+ static int
+ mt7915_net_setup_tc(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		    struct net_device *netdev, enum tc_setup_type type,
+@@ -1644,6 +1661,7 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
 +	.net_fill_receive_path = mt7915_net_fill_receive_path,
+ 	.net_setup_tc = mt7915_net_setup_tc,
  #endif
  };
 -- 
diff --git a/recipes-wifi/linux-mt76/files/patches/3003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch b/recipes-wifi/linux-mt76/files/patches/3003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
index 1effaa3..fcfae5a 100644
--- a/recipes-wifi/linux-mt76/files/patches/3003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
@@ -1,7 +1,7 @@
-From 7dfdee77a764461fe25c01de88e8a9670a078451 Mon Sep 17 00:00:00 2001
+From 354522be19efd1be1c35b765ebcc5d9ea11bd465 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 3003/3013] wifi: mt76: mt7915: wed: find rx token by physical
+Subject: [PATCH 3003/3012] wifi: mt76: mt7915: wed: find rx token by physical
  address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -13,7 +13,7 @@
  1 file changed, 24 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index dc53cc7..550bdaf 100644
+index fc92e39..3047f8b 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -403,9 +403,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
diff --git a/recipes-wifi/linux-mt76/files/patches/3004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 6ea8dba..a8a355e 100644
--- a/recipes-wifi/linux-mt76/files/patches/3004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 664b011af344230a6c0a24965b798de7ceb11786 Mon Sep 17 00:00:00 2001
+From 5f06d232336902dee12f67fad58ac6b637ef89ec Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3004/3013] wifi: mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 3004/3012] wifi: mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 826 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b3ac14d..8e559ef 100644
+index 1fdbc1c..fd5aecb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1161,6 +1161,7 @@ enum {
@@ -35,7 +35,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 129a15c..079629a 100644
+index a122457..e44ac9a 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -465,10 +465,10 @@
  	if (!dev->dbdc_support || phy->mt76->band_idx) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 2da66cb..21286a6 100644
+index 8eacf34..8684d7a 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -571,10 +571,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -575,10 +575,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  	}
  }
  
@@ -515,7 +515,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -596,6 +632,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -600,6 +636,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		mt7915_mac_init_band(dev, i);
  
  	mt7915_init_led_mux(dev);
@@ -526,7 +526,7 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4f7288b..ca42a05 100644
+index 275c6a0..2ba36da 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -217,6 +217,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
@@ -537,7 +537,7 @@
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
  	int idx, ret = 0;
-@@ -278,6 +279,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+@@ -277,6 +278,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
@@ -547,7 +547,7 @@
  	return ret;
  }
  
-@@ -701,6 +705,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -699,6 +703,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -555,7 +555,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
  #endif
-@@ -751,6 +756,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -749,6 +754,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (phy->muru_onoff & MUMIMO_DL_CERT)
  		mt7915_mcu_set_mimo(phy, 0);
  #endif
@@ -573,10 +573,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 78822cc..35ea3fc 100644
+index e9bc4b1..3b0ba5c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3588,6 +3588,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3507,6 +3507,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -749,10 +749,10 @@
  {
  #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c3cc35d..0ec94aa 100644
+index d0ae42f..fddca24 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -127,6 +127,58 @@ struct mt7915_twt_flow {
+@@ -134,6 +134,58 @@ struct mt7915_twt_flow {
  
  DECLARE_EWMA(avg_signal, 10, 8)
  
@@ -811,15 +811,15 @@
  struct mt7915_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -149,6 +201,7 @@ struct mt7915_sta {
+@@ -156,6 +208,7 @@ struct mt7915_sta {
  		u8 flowid_mask;
  		struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
  	} twt;
 +	struct mt7915_vow_sta_cfg vow_sta_cfg;
  };
  
- struct mt7915_vif_cap {
-@@ -467,6 +520,8 @@ struct mt7915_dev {
+ struct mt7915_vif {
+@@ -459,6 +512,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -828,7 +828,7 @@
  };
  
  enum {
-@@ -499,6 +554,15 @@ enum mt7915_rdd_cmd {
+@@ -491,6 +546,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -844,7 +844,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -629,6 +693,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -620,6 +684,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -856,7 +856,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e102ddc..b9f4de5 100644
+index 4629f6b..361b50c 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1368,7 +1368,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/3005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch b/recipes-wifi/linux-mt76/files/patches/3005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
index 3ec4670..dc542aa 100644
--- a/recipes-wifi/linux-mt76/files/patches/3005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch
@@ -1,7 +1,7 @@
-From 633bf63e524f39224f9e277e192f53171733430c Mon Sep 17 00:00:00 2001
+From dbd501e7d4570588f1bae9cd53177e83d3f5f81e Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 6 Jan 2023 18:18:50 +0800
-Subject: [PATCH 3005/3013] wifi: mt76: mt7915: wed: add rxwi for further in
+Subject: [PATCH 3005/3012] wifi: mt76: mt7915: wed: add rxwi for further in
  chip rro
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -16,7 +16,7 @@
  7 files changed, 87 insertions(+), 80 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 550bdaf..b2b17cc 100644
+index 3047f8b..b210e39 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -244,10 +244,10 @@
  unmap:
  	for (n--; n > 0; n--)
 diff --git a/mac80211.c b/mac80211.c
-index 1654cc9..4dc7627 100644
+index 553d901..4a0f333 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -602,7 +602,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -603,7 +603,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	spin_lock_init(&dev->lock);
  	spin_lock_init(&dev->cc_lock);
  	spin_lock_init(&dev->status_lock);
@@ -255,7 +255,7 @@
  	mutex_init(&dev->mutex);
  	init_waitqueue_head(&dev->tx_wait);
  
-@@ -633,6 +632,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -634,6 +633,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	INIT_LIST_HEAD(&dev->txwi_cache);
  	INIT_LIST_HEAD(&dev->rxwi_cache);
  	dev->token_size = dev->drv->token_size;
@@ -264,7 +264,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index 0ee2291..a215d2f 100644
+index 3d36913..b178b95 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -165,6 +165,7 @@ struct mt76_queue_entry {
@@ -311,7 +311,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1410,8 +1416,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1411,8 +1417,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -322,7 +322,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1563,9 +1569,9 @@ struct mt76_txwi_cache *
+@@ -1564,9 +1570,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -335,7 +335,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 3b8a2ab..7a9ced4 100644
+index 4c8cf0c..3784b7b 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -509,7 +509,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -355,7 +355,7 @@
  
  		/* rx data queue for band1 */
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 0e79faf..fc9aadb 100644
+index 3f4749b..1c416bc 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -610,18 +610,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -436,7 +436,7 @@
  
  	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -1037,6 +1037,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -1038,6 +1038,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  				SURVEY_INFO_TIME_RX |
  				SURVEY_INFO_TIME_BSS_RX,
  		.token_size = MT7915_TOKEN_SIZE,
@@ -445,10 +445,10 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0ec94aa..81970ef 100644
+index fddca24..646f3e8 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -57,6 +57,7 @@
+@@ -64,6 +64,7 @@
  #define MT7915_EEPROM_BLOCK_SIZE	16
  #define MT7915_HW_TOKEN_SIZE		7168
  #define MT7915_TOKEN_SIZE		8192
@@ -457,10 +457,10 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index 6d55566..a72b777 100644
+index 94f0d82..a87e361 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -756,16 +756,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+@@ -760,16 +760,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  EXPORT_SYMBOL_GPL(mt76_token_consume);
  
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
@@ -481,7 +481,7 @@
  	}
  	spin_unlock_bh(&dev->rx_token_lock);
  
-@@ -802,15 +802,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+@@ -806,15 +806,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
  }
  EXPORT_SYMBOL_GPL(mt76_token_release);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/3007-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch b/recipes-wifi/linux-mt76/files/patches/3006-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches/3007-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch
rename to recipes-wifi/linux-mt76/files/patches/3006-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch
index 1e06935..1b26803 100644
--- a/recipes-wifi/linux-mt76/files/patches/3007-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3006-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch
@@ -1,7 +1,8 @@
-From 4f1290c149c6cc3ef2f2623ca09f23fe9bb4c133 Mon Sep 17 00:00:00 2001
+From 13f5dc38354525add94b7c60ee289fd011ae5dbc Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 18 Jan 2023 16:37:22 +0800
-Subject: [PATCH] wifi: mt76: mt7915: add wa command to get tx msdu count
+Subject: [PATCH 3006/3012] wifi: mt76: mt7915: add wa command to get tx msdu
+ count
 
 ---
  mt76.h             |  2 +-
@@ -15,7 +16,7 @@
  8 files changed, 79 insertions(+), 12 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index a215d2f1..c7bd147f 100644
+index b178b95..4794b6a 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -288,7 +288,7 @@ struct mt76_sta_stats {
@@ -28,22 +29,22 @@
  	u32 tx_failed;
  	/* WED RX */
 diff --git a/mt76_connac2_mac.h b/mt76_connac2_mac.h
-index f33171bc..101e7602 100644
+index a5ec0f6..e7a4019 100644
 --- a/mt76_connac2_mac.h
 +++ b/mt76_connac2_mac.h
-@@ -164,6 +164,7 @@ enum {
+@@ -174,6 +174,7 @@ enum {
  
  #define MT_TXS6_MPDU_FAIL_CNT		GENMASK(31, 23)
  
 +#define MT_TXS7_MPDU_RETRY_BYTE		GENMASK(22, 0)
  #define MT_TXS7_MPDU_RETRY_CNT		GENMASK(31, 23)
  
- /* RXD DW1 */
+ /* RXD DW0 */
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 8d316d3a..1816bcbc 100644
+index ee0fbfc..ee37fe5 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -491,7 +491,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+@@ -523,7 +523,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
  
  		/* counting non-offloading skbs */
  		wcid->stats.tx_bytes += skb->len;
@@ -54,7 +55,7 @@
  	}
  
  	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len + sz_txd) |
-@@ -575,9 +577,8 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
+@@ -608,9 +610,8 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
  	/* PPDU based reporting */
  	if (FIELD_GET(MT_TXS0_TXS_FORMAT, txs) > 1) {
  		stats->tx_bytes +=
@@ -67,7 +68,7 @@
  			le32_get_bits(txs_data[6], MT_TXS6_MPDU_FAIL_CNT);
  		stats->tx_retries +=
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 8e559efb..dd7ee32f 100644
+index fd5aecb..97d732a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1000,6 +1000,7 @@ enum {
@@ -79,10 +80,10 @@
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
  	MCU_EXT_EVENT_CSI_REPORT = 0xc2,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index da49e318..6714f635 100644
+index 2ba36da..ccdb148 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1117,9 +1117,6 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1116,9 +1116,6 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
  
@@ -92,7 +93,7 @@
  		sinfo->tx_failed = msta->wcid.stats.tx_failed;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
  
-@@ -1135,6 +1132,11 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1134,6 +1131,11 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  		}
  	}
  
@@ -105,10 +106,10 @@
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b5d1e637..29b2486c 100644
+index 3b0ba5c..c27b8f9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -169,7 +169,9 @@ mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
+@@ -172,7 +172,9 @@ mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
  	}
  
  	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
@@ -119,7 +120,7 @@
  		return -EAGAIN;
  
  	if (cmd == MCU_CMD(PATCH_SEM_CONTROL)) {
-@@ -421,13 +423,14 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -424,13 +426,14 @@ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb)
  	struct mt76_connac2_mcu_rxd *rxd;
  
  	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
@@ -136,7 +137,7 @@
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
  		mt76_mcu_rx_event(&dev->mt76, skb);
-@@ -4272,7 +4275,7 @@ int mt7915_mcu_get_tx_rate_v2(struct mt7915_phy *phy, u16 wcidx)
+@@ -4139,7 +4142,7 @@ int mt7915_mcu_get_tx_rate_v2(struct mt7915_phy *phy, u16 wcidx)
  	};
  
  	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(GET_TX_STAT),
@@ -145,7 +146,7 @@
  	if (ret)
  		return ret;
  
-@@ -4316,6 +4319,53 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx)
+@@ -4174,6 +4177,53 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx)
  		return mt7915_mcu_get_tx_rate_v2(phy, wcidx);
  }
  
@@ -200,7 +201,7 @@
  				struct cfg80211_he_bss_color *he_bss_color)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d3cbe160..a7098427 100644
+index c533a7d..eca028b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -347,6 +347,17 @@ enum {
@@ -222,10 +223,10 @@
  	MCU_MMPS_STATIC,
  	MCU_MMPS_DYNAMIC,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8a1be2db..28a2416c 100644
+index 646f3e8..ef9b0e1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -722,6 +722,7 @@ int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
+@@ -714,6 +714,7 @@ int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy);
  int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx);
  int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta, struct rate_info *rate);
diff --git a/recipes-wifi/linux-mt76/files/patches/3006-wifi-mt76-mt7915-wed-add-mt7915_net_setup_tc-to-supp.patch b/recipes-wifi/linux-mt76/files/patches/3006-wifi-mt76-mt7915-wed-add-mt7915_net_setup_tc-to-supp.patch
deleted file mode 100644
index c96a09c..0000000
--- a/recipes-wifi/linux-mt76/files/patches/3006-wifi-mt76-mt7915-wed-add-mt7915_net_setup_tc-to-supp.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 9fa461b123446cb78316366dfb289226ebec9290 Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Tue, 27 Dec 2022 09:45:14 +0800
-Subject: [PATCH 3006/3013] wifi: mt76: mt7915: wed: add mt7915_net_setup_tc to
- support wifi2wifi offload
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- mt7915/main.c | 18 ++++++++++++++++++
- 1 file changed, 18 insertions(+)
-
-diff --git a/mt7915/main.c b/mt7915/main.c
-index ca42a05..779d038 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -1613,6 +1613,23 @@ mt7915_net_fill_receive_path(struct ieee80211_hw *hw,
- 	return 0;
- }
- 
-+static int mt7915_net_setup_tc(struct ieee80211_hw *hw,
-+			       struct ieee80211_vif *vif,
-+			       struct net_device *ndev,
-+			       enum tc_setup_type type,
-+			       void *type_data)
-+{
-+	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
-+
-+	if (!mtk_wed_device_active(wed))
-+		return -ENODEV;
-+
-+	mtk_wed_device_setup_tc(wed, ndev, type, type_data);
-+
-+	return 0;
-+}
-+
- #endif
- 
- const struct ieee80211_ops mt7915_ops = {
-@@ -1666,5 +1683,6 @@ const struct ieee80211_ops mt7915_ops = {
- #ifdef CONFIG_NET_MEDIATEK_SOC_WED
- 	.net_fill_forward_path = mt7915_net_fill_forward_path,
- 	.net_fill_receive_path = mt7915_net_fill_receive_path,
-+	.net_setup_tc = mt7915_net_setup_tc,
- #endif
- };
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches/3008-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch b/recipes-wifi/linux-mt76/files/patches/3007-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches/3008-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch
rename to recipes-wifi/linux-mt76/files/patches/3007-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch
index b989b63..9e29a40 100644
--- a/recipes-wifi/linux-mt76/files/patches/3008-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3007-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch
@@ -1,7 +1,7 @@
-From 03ed3a6af6c489136ead033dfbfe6b3a67e208c0 Mon Sep 17 00:00:00 2001
+From 7624f0f425a72927b29178227f92d9bb88d5202c Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 11 Jan 2023 10:56:27 +0800
-Subject: [PATCH 3008/3013] wifi: mt76: get tx count and tx failed from mcu
+Subject: [PATCH 3007/3012] wifi: mt76: get tx count and tx failed from mcu
  command
 
 ---
@@ -15,7 +15,7 @@
  7 files changed, 136 insertions(+), 6 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index c7bd147..ee7e1b1 100644
+index 4794b6a..e0bb41e 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -289,6 +289,7 @@ struct mt76_sta_stats {
@@ -27,10 +27,10 @@
  	u32 tx_failed;
  	/* WED RX */
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 1816bcb..abcb9a2 100644
+index ee37fe5..6cd8c27 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -579,8 +579,6 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
+@@ -612,8 +612,6 @@ bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
  		stats->tx_bytes +=
  			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_BYTE) -
  			le32_get_bits(txs_data[7], MT_TXS7_MPDU_RETRY_BYTE);
@@ -40,7 +40,7 @@
  			le32_get_bits(txs_data[7], MT_TXS7_MPDU_RETRY_CNT);
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index dd7ee32..b80a101 100644
+index 97d732a..b299a54 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1160,6 +1160,7 @@ enum {
@@ -52,10 +52,10 @@
  	MCU_EXT_CMD_SET_DRR_CTRL = 0x36,
  	MCU_EXT_CMD_SET_FEATURE_CTRL = 0x38,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 64709e1..3074091 100644
+index ccdb148..c377ef2 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1118,9 +1118,6 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1116,9 +1116,6 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
  
@@ -65,7 +65,7 @@
  		sinfo->tx_retries = msta->wcid.stats.tx_retries;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
  
-@@ -1138,6 +1135,11 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1136,6 +1133,11 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
  	}
  
@@ -78,10 +78,10 @@
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fd72eba..083034e 100644
+index c27b8f9..2c6dddc 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4258,6 +4258,114 @@ out:
+@@ -4224,6 +4224,114 @@ out:
  	return ret;
  }
  
@@ -197,10 +197,10 @@
  				struct cfg80211_he_bss_color *he_bss_color)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f91f4bc..73e2957 100644
+index eca028b..c712dbb 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -778,7 +778,8 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
+@@ -797,7 +797,8 @@ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
  }
  
  enum {
@@ -210,7 +210,7 @@
  };
  
  #ifdef CONFIG_MTK_VENDOR
-@@ -1056,6 +1057,24 @@ struct mt7915_muru {
+@@ -1076,6 +1077,24 @@ struct mt7915_muru {
  /* DL&UL User config */
  #define MURU_USER_CNT                   BIT(4)
  
@@ -236,10 +236,10 @@
     CAPI_SU,
     CAPI_MU,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 943253c..4879130 100644
+index ef9b0e1..52cf748 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -723,6 +723,7 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx);
+@@ -715,6 +715,7 @@ int mt7915_mcu_get_tx_rate(struct mt7915_phy *phy, u16 wcidx);
  int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta, struct rate_info *rate);
  int mt7915_mcu_get_tx_stat_wa(struct mt7915_dev *dev, u16 wcid);
diff --git a/recipes-wifi/linux-mt76/files/patches/3009-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch b/recipes-wifi/linux-mt76/files/patches/3008-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches/3009-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch
rename to recipes-wifi/linux-mt76/files/patches/3008-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch
index 54dff6d..63744a8 100644
--- a/recipes-wifi/linux-mt76/files/patches/3009-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3008-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch
@@ -1,7 +1,8 @@
-From 769ca30484c3c8a3e84b11d27cf71b77cdb65c0f Mon Sep 17 00:00:00 2001
+From 475282f29cf4364626cf6146d78da23640ea7dfd Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 18 Jan 2023 11:50:38 +0800
-Subject: [PATCH] wifi: mt76: mt7915: enable PPDU-TxS to host when wed enable
+Subject: [PATCH 3008/3012] wifi: mt76: mt7915: enable PPDU-TxS to host when
+ wed enable
 
 Calculate tx bytes and tx retries from PPDU-TxS
 ---
@@ -12,10 +13,10 @@
  4 files changed, 27 insertions(+), 23 deletions(-)
 
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index abcb9a27..5a5861a8 100644
+index 6cd8c27..8b77e93 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -490,8 +490,6 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+@@ -522,8 +522,6 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
  			mt76_connac_lmac_mapping(skb_get_queue_mapping(skb));
  
  		/* counting non-offloading skbs */
@@ -25,10 +26,10 @@
  			wcid->stats.tx_packets++;
  	}
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 21286a6d..6f309d0d 100644
+index 8684d7a..9036f44 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -503,6 +503,12 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+@@ -507,6 +507,12 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
  	set = FIELD_PREP(MT_WTBLOFF_TOP_RSCR_RCPI_MODE, 0) |
  	      FIELD_PREP(MT_WTBLOFF_TOP_RSCR_RCPI_PARAM, 0x3);
  	mt76_rmw(dev, MT_WTBLOFF_TOP_RSCR(band), mask, set);
@@ -42,7 +43,7 @@
  
  static void
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index fc9aadb1..65ee2afa 100644
+index 1c416bc..bbaaa33 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -551,7 +551,6 @@ static u32 mt7915_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
@@ -93,10 +94,10 @@
  
  static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
 diff --git a/tx.c b/tx.c
-index 25683c1f..823c8680 100644
+index a87e361..335ddb5 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -120,6 +120,7 @@ mt76_tx_status_skb_add(struct mt76_dev *dev, struct mt76_wcid *wcid,
+@@ -122,6 +122,7 @@ mt76_tx_status_skb_add(struct mt76_dev *dev, struct mt76_wcid *wcid,
  		       struct sk_buff *skb)
  {
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -104,7 +105,7 @@
  	struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
  	int pid;
  
-@@ -131,6 +132,11 @@ mt76_tx_status_skb_add(struct mt76_dev *dev, struct mt76_wcid *wcid,
+@@ -133,6 +134,11 @@ mt76_tx_status_skb_add(struct mt76_dev *dev, struct mt76_wcid *wcid,
  	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
  		return MT_PACKET_ID_NO_ACK;
  
@@ -116,7 +117,7 @@
  	if (!(info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS |
  			     IEEE80211_TX_CTL_RATE_CTRL_PROBE)))
  		return MT_PACKET_ID_NO_SKB;
-@@ -260,8 +266,23 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
+@@ -262,8 +268,23 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
  #endif
  
  	if (cb->pktid < MT_PACKET_ID_FIRST) {
@@ -137,9 +138,9 @@
 +				status.n_rates = 0;
 +			}
 +		}
+ 		spin_lock_bh(&dev->rx_lock);
  		ieee80211_tx_status_ext(hw, &status);
- 		goto out;
- 	}
+ 		spin_unlock_bh(&dev->rx_lock);
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch b/recipes-wifi/linux-mt76/files/patches/3009-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch
similarity index 68%
rename from recipes-wifi/linux-mt76/files/patches/3010-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch
rename to recipes-wifi/linux-mt76/files/patches/3009-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch
index 1f726b4..e4e0343 100644
--- a/recipes-wifi/linux-mt76/files/patches/3010-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3009-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch
@@ -1,20 +1,34 @@
-From d3a40cf6ad567d4fb50d65cb6960d0672a38abe7 Mon Sep 17 00:00:00 2001
+From 7fad725b238b5b94403b9c4457aa0c3c0acdd576 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 17 Jan 2023 21:15:00 +0800
-Subject: [PATCH 3010/3013] wifi: mt76: mt7915: get tx retries from tx free
+Subject: [PATCH 3009/3012] wifi: mt76: mt7915: get tx retries from tx free
  done event for sw path
 
 ---
- mt7915/mac.c  | 14 +++++++++++---
- mt7915/mac.h  |  5 ++++-
- mt7915/main.c |  6 +++---
- 3 files changed, 18 insertions(+), 7 deletions(-)
+ mt76_connac2_mac.h |  2 ++
+ mt7915/mac.c       | 14 +++++++++++---
+ mt7915/mac.h       |  3 ++-
+ mt7915/main.c      |  6 +++---
+ 4 files changed, 18 insertions(+), 7 deletions(-)
 
+diff --git a/mt76_connac2_mac.h b/mt76_connac2_mac.h
+index e7a4019..e6170ea 100644
+--- a/mt76_connac2_mac.h
++++ b/mt76_connac2_mac.h
+@@ -38,6 +38,8 @@ enum {
+ /* 0: success, others: dropped */
+ #define MT_TX_FREE_STATUS		GENMASK(14, 13)
+ #define MT_TX_FREE_MSDU_ID		GENMASK(30, 16)
++#define MT_TX_FREE_TX_COUNT		GENMASK(12, 0)
++#define MT_TX_FREE_TX_COUNT_V3		GENMASK(27, 24)
+ #define MT_TX_FREE_PAIR			BIT(31)
+ /* will support this field in further revision */
+ #define MT_TX_FREE_RATE			GENMASK(13, 0)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d7b0e63..7690cc3 100644
+index 26b5e15..0994ce1 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -985,6 +985,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -981,6 +981,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	struct mt76_dev *mdev = &dev->mt76;
  	struct mt76_txwi_cache *txwi;
  	struct ieee80211_sta *sta = NULL;
@@ -22,7 +36,7 @@
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
-@@ -999,7 +1000,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -995,7 +996,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	v3 = (FIELD_GET(MT_TX_FREE_VER, txd) == 0x4);
  
  	for (cur_info = tx_info; count < total; cur_info++) {
@@ -31,7 +45,7 @@
  		u8 i;
  
  		if (WARN_ON_ONCE((void *)cur_info >= end))
-@@ -1012,7 +1013,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1008,7 +1009,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
@@ -39,7 +53,7 @@
  			struct mt7915_phy *phy;
  			u16 idx;
  
-@@ -1037,7 +1037,15 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1033,7 +1033,15 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			continue;
  		}
  
@@ -57,27 +71,24 @@
  
  		for (i = 0; i < 1 + v3; i++) {
 diff --git a/mt7915/mac.h b/mt7915/mac.h
-index 6fa9c79..afadc51 100644
+index ce94f87..859298d 100644
 --- a/mt7915/mac.h
 +++ b/mt7915/mac.h
-@@ -36,8 +36,11 @@ enum rx_pkt_type {
- #define MT_TX_FREE_LATENCY		GENMASK(12, 0)
+@@ -9,7 +9,8 @@
+ #define MT_TX_FREE_VER			GENMASK(18, 16)
+ #define MT_TX_FREE_MSDU_CNT_V0		GENMASK(6, 0)
  /* 0: success, others: dropped */
- #define MT_TX_FREE_MSDU_ID		GENMASK(30, 16)
-+#define MT_TX_FREE_TX_COUNT		GENMASK(12, 0)
-+#define MT_TX_FREE_TX_COUNT_V3		GENMASK(27, 24)
- #define MT_TX_FREE_PAIR			BIT(31)
 -#define MT_TX_FREE_MPDU_HEADER		BIT(30)
 +#define MT_TX_FREE_MPDU_HEADER		BIT(15)
 +#define MT_TX_FREE_MPDU_HEADER_V3	BIT(30)
  #define MT_TX_FREE_MSDU_ID_V3		GENMASK(14, 0)
  
- /* will support this field in further revision */
+ #define MT_TXS5_F0_FINAL_MPDU		BIT(31)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3074091..7cc3a99 100644
+index c377ef2..f836aa8 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1118,9 +1118,6 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1116,9 +1116,6 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
  
@@ -87,7 +98,7 @@
  		if (mtk_wed_get_rx_capa(&phy->dev->mt76.mmio.wed)) {
  			sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
  			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
-@@ -1130,6 +1127,9 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1128,6 +1125,9 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  		}
  	}
  
diff --git a/recipes-wifi/linux-mt76/files/patches/3011-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch b/recipes-wifi/linux-mt76/files/patches/3010-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches/3011-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch
rename to recipes-wifi/linux-mt76/files/patches/3010-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch
index e9ab141..3142884 100644
--- a/recipes-wifi/linux-mt76/files/patches/3011-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3010-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch
@@ -1,7 +1,7 @@
-From f5a0fb214a18b6b2627c671b16f20bc6a0e03aea Mon Sep 17 00:00:00 2001
+From 629de725ea7db82076de9c1d23e84b24c64dc64b Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Jan 2023 11:36:32 +0800
-Subject: [PATCH 3011/3013] wifi: mt76: update debugfs knob for reset counter
+Subject: [PATCH 3010/3012] wifi: mt76: update debugfs knob for reset counter
  and get tx packet error rate
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 62 insertions(+)
 
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index b9f4de5..aedd48d 100644
+index 361b50c..f896e53 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -3787,6 +3787,66 @@ mt7915_sw_aci_set(void *data, u64 val)
+@@ -3790,6 +3790,66 @@ mt7915_sw_aci_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_sw_aci, NULL,
  			 mt7915_sw_aci_set, "%llx\n");
  
@@ -79,7 +79,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3878,6 +3938,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3881,6 +3941,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  				    mt7915_show_eeprom_mode);
  	debugfs_create_file("sw_aci", 0600, dir, dev,
  			    &fops_sw_aci);
diff --git a/recipes-wifi/linux-mt76/files/patches/3012-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch b/recipes-wifi/linux-mt76/files/patches/3011-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches/3012-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
rename to recipes-wifi/linux-mt76/files/patches/3011-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
index 13373e4..d62d58a 100644
--- a/recipes-wifi/linux-mt76/files/patches/3012-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3011-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch
@@ -1,7 +1,7 @@
-From b94c8a7b8fcba09d42c962c8ff65a38411f6d131 Mon Sep 17 00:00:00 2001
+From 3ad0a83922b0778c06201d453f42b25e60c32fef Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 6 Apr 2023 17:50:52 +0800
-Subject: [PATCH 3012/3013] wifi: mt76: mt7915: add ctxd support for mt7916
+Subject: [PATCH 3011/3012] wifi: mt76: mt7915: add ctxd support for mt7916
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 35 insertions(+)
 
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 7a9ced4..60138f5 100644
+index 3784b7b..daa01fd 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -433,6 +433,26 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -41,7 +41,7 @@
  	} else {
  		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 007fd4d..a57673f 100644
+index 7955d01..2f32a00 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -603,6 +603,7 @@ enum offs_rev {
@@ -79,7 +79,7 @@
  #define MT_WFDMA_EXT_CSR_HIF_MISC	MT_WFDMA_EXT_CSR_PHYS(0x44)
  #define MT_WFDMA_EXT_CSR_HIF_MISC_BUSY	BIT(0)
  
-@@ -1172,6 +1186,7 @@ enum offs_rev {
+@@ -1183,6 +1197,7 @@ enum offs_rev {
  
  #define MT_HW_BOUND			0x70010020
  #define MT_HW_REV			0x70010204
diff --git a/recipes-wifi/linux-mt76/files/patches/3013-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches/3012-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/3013-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
rename to recipes-wifi/linux-mt76/files/patches/3012-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
index c867ae1..93b297d 100644
--- a/recipes-wifi/linux-mt76/files/patches/3013-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3012-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,7 +1,7 @@
-From e487bf5e35aa348a6c854b35cc028889a19ee737 Mon Sep 17 00:00:00 2001
+From c06020d2384a5d5cd773bdd8a1975ebe12cb1135 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 5 Jan 2023 16:43:57 +0800
-Subject: [PATCH 3013/3013] wifi: mt76: connac: wed: add wed rx copy skb
+Subject: [PATCH 3012/3012] wifi: mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 85 insertions(+), 26 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index b2b17cc..7c147c1 100644
+index b210e39..4daa64d 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -208,11 +208,11 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
@@ -108,7 +108,7 @@
  }
  
  static int
-@@ -618,6 +652,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -620,6 +654,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	int len = SKB_WITH_OVERHEAD(q->buf_size);
  	int frames = 0, offset = q->buf_offset;
  	dma_addr_t addr;
@@ -116,7 +116,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -641,7 +676,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -643,7 +678,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		qbuf.addr = addr + offset;
  		qbuf.len = len - offset;
  		qbuf.skip_unmap = false;
@@ -125,7 +125,7 @@
  			dma_unmap_single(dev->dma_dev, addr, len,
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
-@@ -650,7 +685,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -652,7 +687,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		frames++;
  	}
  
@@ -137,7 +137,7 @@
  		mt76_dma_kick_queue(dev, q);
  
  	spin_unlock_bh(&q->lock);
-@@ -773,12 +811,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -775,12 +813,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	spin_unlock_bh(&q->lock);
  
@@ -158,7 +158,7 @@
  
  static void
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 65ee2af..614bb40 100644
+index bbaaa33..4113ab2 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -581,6 +581,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
diff --git a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
index f299d08..a22d9b3 100644
--- a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,31 +1,33 @@
-From b423b5a658598085c00e78e6a3bfbe2c7671c147 Mon Sep 17 00:00:00 2001
+From db40f94c0f681cb7f36efcee47997a9755c63325 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 5 Apr 2023 08:29:19 +0800
 Subject: [PATCH] mt76: revert for backports-5.15 wireless stack
 
+wifi: mt76: mt7915: add support for he ldpc control from hostapd
 ---
  dma.c             |   2 +-
  mac80211.c        |   4 +-
  mt7615/dma.c      |   4 +-
  mt7615/main.c     |   6 +-
- mt7615/mcu.c      |   8 +--
- mt76_connac_mcu.c | 108 +++++++++++++++---------------
+ mt7615/mcu.c      |   8 +-
+ mt76_connac_mcu.c | 108 +++++++++---------
  mt76x02_mac.c     |   6 +-
  mt7915/debugfs.c  |   4 +-
  mt7915/dma.c      |   4 +-
  mt7915/init.c     |   3 +-
  mt7915/mac.c      |   2 +-
- mt7915/main.c     |  10 +--
- mt7915/mcu.c      | 166 +++++++++++++++++++++++-----------------------
- mt7915/testmode.c |   8 +--
- tx.c              |  26 ++------
- 15 files changed, 172 insertions(+), 189 deletions(-)
+ mt7915/main.c     |  11 +-
+ mt7915/mcu.c      | 273 ++++++++++++++++++++++++++++++----------------
+ mt7915/mt7915.h   |  14 +++
+ mt7915/testmode.c |   8 +-
+ tx.c              |  26 ++---
+ 16 files changed, 282 insertions(+), 201 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 7c147c19..2169682c 100644
+index 4daa64d..220e684 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -992,7 +992,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -994,7 +994,7 @@ mt76_dma_init(struct mt76_dev *dev,
  	init_completion(&dev->mmio.wed_reset_complete);
  
  	mt76_for_each_q_rx(dev, i) {
@@ -35,10 +37,10 @@
  		napi_enable(&dev->napi[i]);
  	}
 diff --git a/mac80211.c b/mac80211.c
-index 7e663a5c..8ac14486 100644
+index 4a0f333..b3058e0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1518,7 +1518,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
+@@ -1519,7 +1519,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
  static void
  __mt76_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -47,7 +49,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -1540,7 +1540,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1541,7 +1541,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct mt76_dev *dev = priv;
  
@@ -57,10 +59,10 @@
  
  	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
 diff --git a/mt7615/dma.c b/mt7615/dma.c
-index f1914431..ec729dbe 100644
+index 0ce01cc..ad32485 100644
 --- a/mt7615/dma.c
 +++ b/mt7615/dma.c
-@@ -281,8 +281,8 @@ int mt7615_dma_init(struct mt7615_dev *dev)
+@@ -282,8 +282,8 @@ int mt7615_dma_init(struct mt7615_dev *dev)
  	if (ret < 0)
  		return ret;
  
@@ -72,7 +74,7 @@
  
  	mt76_poll(dev, MT_WPDMA_GLO_CFG,
 diff --git a/mt7615/main.c b/mt7615/main.c
-index dadb13f2..2c61c368 100644
+index dadb13f..2c61c36 100644
 --- a/mt7615/main.c
 +++ b/mt7615/main.c
 @@ -473,7 +473,7 @@ static int mt7615_config(struct ieee80211_hw *hw, u32 changed)
@@ -103,7 +105,7 @@
  	mt7615_mutex_release(dev);
  }
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index 4593b2e1..39e81d26 100644
+index 86061e9..a79308b 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -353,7 +353,7 @@ out:
@@ -124,7 +126,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -1074,7 +1074,7 @@ mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
+@@ -1075,7 +1075,7 @@ mt7615_mcu_uni_add_beacon_offload(struct mt7615_dev *dev,
  	if (!enable)
  		goto out;
  
@@ -133,7 +135,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -2525,7 +2525,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
+@@ -2526,7 +2526,7 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif,
  		u8 pad;
  	} req = {
  		.bss_idx = mvif->mt76.idx,
@@ -143,7 +145,7 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index d4060136..703ca736 100644
+index d228312..665de18 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -197,7 +197,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
@@ -155,7 +157,7 @@
  	};
  
  	if (vif->type != NL80211_IFTYPE_STATION)
-@@ -409,7 +409,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+@@ -409,7 +409,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  		else
  			conn_type = CONNECTION_INFRA_AP;
  		basic->conn_type = cpu_to_le32(conn_type);
@@ -454,7 +456,7 @@
  		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
  		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
  		       sreq->ssids[i].ssid_len);
-@@ -1749,7 +1748,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
+@@ -1756,7 +1755,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
  		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
  		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
  	}
@@ -462,7 +464,7 @@
  	req->match_num = sreq->n_match_sets;
  	for (i = 0; i < req->match_num; i++) {
  		match = &sreq->match_sets[i];
-@@ -2236,10 +2234,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2243,10 +2241,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  				      struct mt76_vif *vif,
  				      struct ieee80211_bss_conf *info)
  {
@@ -474,7 +476,7 @@
  			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
  	struct {
  		struct {
-@@ -2267,7 +2263,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2274,7 +2270,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  
  	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
  	for (i = 0; i < len; i++)
@@ -484,7 +486,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
  }
 diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-index d3f74473..87ea3db1 100644
+index 3e41d80..c289ae0 100644
 --- a/mt76x02_mac.c
 +++ b/mt76x02_mac.c
 @@ -404,7 +404,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
@@ -509,7 +511,7 @@
  		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
  			ba_size = 0;
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 079629a3..dcd773c7 100644
+index e44ac9a..e841d1e 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1911,8 +1911,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
@@ -524,7 +526,7 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 4d9ab064..a8d581d1 100644
+index daa01fd..5b8426a 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -590,8 +590,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -539,11 +541,11 @@
  
  	mt7915_dma_enable(dev, false);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6f309d0d..0ca7e9f5 100644
+index 9036f44..f5d5adb 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1162,8 +1162,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
- 			mt7915_gen_ppe_thresh(he_cap->ppe_thres, nss);
+@@ -1145,8 +1145,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+ 			mt76_connac_gen_ppe_thresh(he_cap->ppe_thres, nss);
  		} else {
  			he_cap_elem->phy_cap_info[9] |=
 -				u8_encode_bits(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_16US,
@@ -553,10 +555,10 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 596faf00..583bb554 100644
+index 0994ce1..e9156af 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -882,7 +882,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -878,7 +878,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  	u16 fc, tid;
  	u32 val;
  
@@ -566,10 +568,18 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 712f77fc..c51dcd30 100644
+index f836aa8..653dffe 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -530,7 +530,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -273,6 +273,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+ 	vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
+ 
+ 	mt7915_init_bitrate_mask(vif);
++	memset(&mvif->cap, -1, sizeof(mvif->cap));
+ 
+ 	mt7915_mcu_add_bss_info(phy, vif, true);
+ 	mt7915_mcu_add_sta(dev, vif, NULL, true);
+@@ -529,7 +530,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  
  static int
  mt7915_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -578,7 +588,7 @@
  	       const struct ieee80211_tx_queue_params *params)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-@@ -625,7 +625,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
+@@ -624,7 +625,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
  static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  				    struct ieee80211_vif *vif,
  				    struct ieee80211_bss_conf *info,
@@ -587,7 +597,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -645,7 +645,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -644,7 +645,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	}
  
  	if (changed & BSS_CHANGED_ASSOC)
@@ -596,7 +606,7 @@
  
  	if (changed & BSS_CHANGED_ERP_CTS_PROT)
  		mt7915_mac_enable_rtscts(dev, vif, info->use_cts_prot);
-@@ -1241,10 +1241,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
+@@ -1240,10 +1241,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
@@ -610,10 +620,10 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 062e8aca..bbd3ce47 100644
+index 2c6dddc..94c3215 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -64,7 +64,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+@@ -67,7 +67,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
  	struct mt7915_dev *dev = msta->vif->phy->dev;
  	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
  	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
@@ -622,7 +632,7 @@
  
  	for (nss = 0; nss < max_nss; nss++) {
  		int mcs;
-@@ -104,7 +104,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+@@ -107,7 +107,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
  
  		/* only support 2ss on 160MHz for mt7915 */
  		if (is_mt7915(&dev->mt76) && nss > 1 &&
@@ -631,7 +641,7 @@
  			break;
  	}
  
-@@ -117,8 +117,8 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -120,8 +120,8 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  {
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_dev *dev = msta->vif->phy->dev;
@@ -642,7 +652,7 @@
  	u16 mcs;
  
  	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
-@@ -140,7 +140,7 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -143,7 +143,7 @@ mt7915_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  
  		/* only support 2ss on 160MHz for mt7915 */
  		if (is_mt7915(&dev->mt76) && nss > 1 &&
@@ -651,7 +661,7 @@
  			break;
  	}
  }
-@@ -149,10 +149,10 @@ static void
+@@ -152,10 +152,10 @@ static void
  mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
  			  const u8 *mask)
  {
@@ -664,7 +674,7 @@
  }
  
  static int
-@@ -233,7 +233,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+@@ -236,7 +236,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
  static void
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -673,7 +683,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -334,7 +334,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -337,7 +337,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
  static void
  mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -682,11 +692,12 @@
  		return;
  
  	ieee80211_color_change_finish(vif);
-@@ -748,13 +748,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -750,13 +750,14 @@ static void
+ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  		      struct ieee80211_vif *vif)
  {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 -	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 +	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
  	struct ieee80211_he_mcs_nss_supp mcs_map;
  	struct sta_rec_he *he;
@@ -698,7 +709,16 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -840,8 +840,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -783,7 +784,7 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+ 	     IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G))
+ 		cap |= STA_REC_HE_CAP_BW20_RU242_SUPPORT;
+ 
+-	if (vif->bss_conf.he_ldpc &&
++	if (mvif->cap.he_ldpc &&
+ 	    (elem->phy_cap_info[1] &
+ 	     IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
+ 		cap |= STA_REC_HE_CAP_LDPC;
+@@ -842,8 +843,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -709,16 +729,31 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -892,7 +892,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -892,8 +893,9 @@ static void
+ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+ 			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
- 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct mt7915_phy *phy = mvif->phy;
 -	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
 +	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -916,11 +916,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -905,9 +907,9 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+ 
+ 	muru = (struct sta_rec_muru *)tlv;
+ 
+-	muru->cfg.mimo_dl_en = (vif->bss_conf.he_mu_beamformer ||
+-			       vif->bss_conf.vht_mu_beamformer ||
+-			       vif->bss_conf.vht_mu_beamformee) &&
++	muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
++			       mvif->cap.vht_mu_ebfer ||
++			       mvif->cap.vht_mu_ebfee) &&
+ 			       !!(phy->muru_onoff & MUMIMO_DL);
+ 	if (!is_mt7915(&dev->mt76))
+ 		muru->cfg.mimo_ul_en = true;
+@@ -917,11 +919,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
  
@@ -733,7 +768,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -954,13 +954,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -955,13 +957,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_ht *ht;
  	struct tlv *tlv;
  
@@ -749,7 +784,7 @@
  }
  
  static void
-@@ -969,15 +969,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -970,15 +972,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
  
@@ -769,7 +804,7 @@
  }
  
  static void
-@@ -992,7 +992,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -993,7 +995,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -778,7 +813,7 @@
  	    return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -1001,7 +1001,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1002,7 +1004,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	amsdu->amsdu_en = true;
  	msta->wcid.amsdu = true;
  
@@ -787,7 +822,26 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		if (!is_mt7915(&dev->mt76)) {
  			amsdu->max_mpdu_size =
-@@ -1064,8 +1064,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1045,8 +1047,8 @@ mt7915_mcu_sta_wtbl_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+ 	mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, vif, wcid, tlv, wtbl_hdr);
+ 	if (sta)
+ 		mt76_connac_mcu_wtbl_ht_tlv(&dev->mt76, skb, sta, tlv,
+-					    wtbl_hdr, vif->bss_conf.ht_ldpc,
+-					    vif->bss_conf.vht_ldpc);
++					    wtbl_hdr, mvif->cap.ht_ldpc,
++					    mvif->cap.vht_ldpc);
+ 
+ 	return 0;
+ }
+@@ -1055,6 +1057,7 @@ static inline bool
+ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 			struct ieee80211_sta *sta, bool bfee)
+ {
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ 	int sts = hweight16(phy->mt76->chainmask);
+ 
+ 	if (vif->type != NL80211_IFTYPE_STATION &&
+@@ -1064,25 +1067,25 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	if (!bfee && sts < 2)
  		return false;
  
@@ -797,8 +851,12 @@
 +		struct ieee80211_he_cap_elem *pe = &sta->he_cap.he_cap_elem;
  
  		if (bfee)
- 			return mvif->cap.he_su_ebfee &&
-@@ -1075,8 +1075,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+-			return vif->bss_conf.he_su_beamformee &&
++			return mvif->cap.he_su_ebfee &&
+ 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
+ 		else
+-			return vif->bss_conf.he_su_beamformer &&
++			return mvif->cap.he_su_ebfer &&
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -808,8 +866,16 @@
 +		u32 cap = sta->vht_cap.cap;
  
  		if (bfee)
- 			return mvif->cap.vht_su_ebfee &&
-@@ -1102,7 +1102,7 @@ static void
+-			return vif->bss_conf.vht_su_beamformee &&
++			return mvif->cap.vht_su_ebfee &&
+ 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
+ 		else
+-			return vif->bss_conf.vht_su_beamformer &&
++			return mvif->cap.vht_su_ebfer &&
+ 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
+ 	}
+ 
+@@ -1102,7 +1105,7 @@ static void
  mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		       struct sta_rec_bf *bf)
  {
@@ -818,7 +884,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1127,7 +1127,7 @@ static void
+@@ -1127,7 +1130,7 @@ static void
  mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  			struct sta_rec_bf *bf, bool explicit)
  {
@@ -827,7 +893,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1148,14 +1148,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
+@@ -1148,14 +1151,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -844,7 +910,7 @@
  			bf->ibf_nrow = 1;
  	}
  }
-@@ -1164,7 +1164,7 @@ static void
+@@ -1164,7 +1167,7 @@ static void
  mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
  {
@@ -853,7 +919,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1189,7 +1189,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1189,7 +1192,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -862,7 +928,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1237,7 +1237,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1237,7 +1240,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -871,7 +937,7 @@
  		return;
  
  	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1251,21 +1251,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1251,21 +1254,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -899,7 +965,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1275,7 +1275,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1275,7 +1278,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -908,7 +974,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1300,7 +1300,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1300,7 +1303,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -917,7 +983,7 @@
  		return;
  
  	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1309,13 +1309,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1309,13 +1312,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
  	bfee = (struct sta_rec_bfee *)tlv;
  
@@ -935,7 +1001,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1371,7 +1371,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -1371,7 +1374,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -944,7 +1010,7 @@
  		break;
  	case RATE_PARAM_SPE_UPDATE:
  		ra->spe_idx = *(u8 *)data;
-@@ -1446,7 +1446,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1446,7 +1449,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  	do {									\
  		u8 i, gi = mask->control[band]._gi;				\
  		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
@@ -953,7 +1019,7 @@
  			phy.sgi |= gi << (i << (_he));				\
  			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
  		}								\
-@@ -1460,11 +1460,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1460,11 +1463,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		}								\
  	} while (0)
  
@@ -968,7 +1034,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -1498,7 +1498,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1498,7 +1501,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		 * actual txrate hardware sends out.
  		 */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
@@ -977,7 +1043,7 @@
  			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1531,7 +1531,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1531,7 +1534,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra *ra;
  	struct tlv *tlv;
@@ -986,7 +1052,7 @@
  	u32 cap = sta->wme ? STA_CAP_WMM : 0;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1541,9 +1541,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1541,9 +1544,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	ra->auto_rate = true;
  	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
  	ra->channel = chandef->chan->hw_value;
@@ -999,7 +1065,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -1563,22 +1563,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1563,22 +1566,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		}
  	}
  
@@ -1024,13 +1090,14 @@
 -		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
 +		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
  			cap |= STA_CAP_RX_STBC;
- 		if (mvif->cap.ht_ldpc &&
+-		if (vif->bss_conf.ht_ldpc &&
 -		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
++		if (mvif->cap.ht_ldpc &&
 +		    (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
  			cap |= STA_CAP_LDPC;
  
  		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1586,37 +1586,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1586,37 +1589,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
  	}
  
@@ -1057,8 +1124,9 @@
 -		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
 +		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
  			cap |= STA_CAP_VHT_RX_STBC;
- 		if (mvif->cap.vht_ldpc &&
+-		if (vif->bss_conf.vht_ldpc &&
 -		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
++		if (mvif->cap.vht_ldpc &&
 +		    (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
  			cap |= STA_CAP_VHT_LDPC;
  
@@ -1078,7 +1146,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  
-@@ -1825,7 +1825,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -1825,7 +1828,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1087,7 +1155,7 @@
  	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
  					   &bcn->sub_ntlv, &bcn->len);
  	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -1910,9 +1910,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1910,9 +1913,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1099,7 +1167,93 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -2112,7 +2112,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1922,6 +1925,85 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
+ }
+ 
++static void
++mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
++			     struct sk_buff *skb)
++{
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct mt7915_vif_cap *vc = &mvif->cap;
++	const struct ieee80211_he_cap_elem *he;
++	const struct ieee80211_vht_cap *vht;
++	const struct ieee80211_ht_cap *ht;
++	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
++	const u8 *ie;
++	u32 len, bc;
++
++	/* Check missing configuration options to allow AP mode in mac80211
++	 * to remain in sync with hostapd settings, and get a subset of
++	 * beacon and hardware capabilities.
++	 */
++	if (WARN_ON_ONCE(skb->len <= (mgmt->u.beacon.variable - skb->data)))
++		return;
++
++	memset(vc, 0, sizeof(*vc));
++
++	len = skb->len - (mgmt->u.beacon.variable - skb->data);
++
++	ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, mgmt->u.beacon.variable,
++			      len);
++	if (ie && ie[1] >= sizeof(*ht)) {
++		ht = (void *)(ie + 2);
++		vc->ht_ldpc = !!(le16_to_cpu(ht->cap_info) &
++				 IEEE80211_HT_CAP_LDPC_CODING);
++	}
++
++	ie = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, mgmt->u.beacon.variable,
++			      len);
++	if (ie && ie[1] >= sizeof(*vht)) {
++		u32 pc = phy->mt76->sband_5g.sband.vht_cap.cap;
++
++		vht = (void *)(ie + 2);
++		bc = le32_to_cpu(vht->vht_cap_info);
++
++		vc->vht_ldpc = !!(bc & IEEE80211_VHT_CAP_RXLDPC);
++		vc->vht_su_ebfer =
++			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE) &&
++			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
++		vc->vht_su_ebfee =
++			(bc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) &&
++			(pc & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
++		vc->vht_mu_ebfer =
++			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE) &&
++			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);
++		vc->vht_mu_ebfee =
++			(bc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) &&
++			(pc & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
++	}
++
++	ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY,
++				  mgmt->u.beacon.variable, len);
++	if (ie && ie[1] >= sizeof(*he) + 1) {
++		const struct ieee80211_sta_he_cap *pc =
++			mt76_connac_get_he_phy_cap(phy->mt76, vif);
++		const struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
++
++		he = (void *)(ie + 3);
++
++		vc->he_ldpc =
++			HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, he->phy_cap_info[1]) &&
++			HE_PHY(CAP1_LDPC_CODING_IN_PAYLOAD, pe->phy_cap_info[1]);
++		vc->he_su_ebfer =
++			HE_PHY(CAP3_SU_BEAMFORMER, he->phy_cap_info[3]) &&
++			HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
++		vc->he_su_ebfee =
++			HE_PHY(CAP4_SU_BEAMFORMEE, he->phy_cap_info[4]) &&
++			HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
++		vc->he_mu_ebfer =
++			HE_PHY(CAP4_MU_BEAMFORMER, he->phy_cap_info[4]) &&
++			HE_PHY(CAP4_MU_BEAMFORMER, pe->phy_cap_info[4]);
++	}
++}
++
+ int
+ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 			     u32 changed)
+@@ -2033,7 +2115,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (!en)
  		goto out;
  
@@ -1108,7 +1262,15 @@
  	if (!skb)
  		return -EINVAL;
  
+@@ -2046,6 +2128,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	info = IEEE80211_SKB_CB(skb);
+ 	info->hw_queue = FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
+ 
-@@ -3364,17 +3364,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
++	mt7915_mcu_beacon_check_caps(phy, vif, skb);
+ 	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
+ 	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
+ 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
+@@ -3283,17 +3366,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1129,8 +1291,36 @@
  					offs += len + sku_len[SKU_HE_RU26] * 3;
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 52cf748..fcd10b3 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -212,9 +212,23 @@ struct mt7915_sta {
+ 	struct mt7915_vow_sta_cfg vow_sta_cfg;
+ };
+ 
++struct mt7915_vif_cap {
++	bool ht_ldpc:1;
++	bool vht_ldpc:1;
++	bool he_ldpc:1;
++	bool vht_su_ebfer:1;
++	bool vht_su_ebfee:1;
++	bool vht_mu_ebfer:1;
++	bool vht_mu_ebfee:1;
++	bool he_su_ebfer:1;
++	bool he_su_ebfee:1;
++	bool he_mu_ebfer:1;
++};
++
+ struct mt7915_vif {
+ 	struct mt76_vif mt76; /* must be first */
+ 
++	struct mt7915_vif_cap cap;
+ 	struct mt7915_sta sta;
+ 	struct mt7915_phy *phy;
+ 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index b99bed54..8b9813b4 100644
+index b99bed5..8b9813b 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -397,12 +397,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
@@ -1151,7 +1341,7 @@
  	sta->wme = 1;
  
 diff --git a/tx.c b/tx.c
-index 823c8680..607f494a 100644
+index 335ddb5..445469e 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
@@ -1178,7 +1368,7 @@
  		}
  
  		hw = mt76_tx_status_get_hw(dev, skb);
-@@ -236,6 +231,7 @@ mt76_tx_check_non_aql(struct mt76_dev *dev, struct mt76_wcid *wcid,
+@@ -238,6 +233,7 @@ mt76_tx_check_non_aql(struct mt76_dev *dev, struct mt76_wcid *wcid,
  void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *skb,
  			    struct list_head *free_list)
  {
@@ -1186,7 +1376,7 @@
  	struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
  	struct ieee80211_tx_status status = {
  		.skb = skb,
-@@ -266,21 +262,13 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
+@@ -268,21 +264,13 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
  #endif
  
  	if (cb->pktid < MT_PACKET_ID_FIRST) {
@@ -1210,7 +1400,7 @@
 +				status.rate = &wcid->rate;
  			}
  		}
- 		ieee80211_tx_status_ext(hw, &status);
+ 		spin_lock_bh(&dev->rx_lock);
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index f5a9b57..eee7706 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -5,8 +5,8 @@
     file://0003-wifi-mt76-mt7915-disable-wfdma-tx-rx-during-SER-reco.patch \
     file://0004-wifi-mt76-mt7915-fix-the-beamformer-issue.patch \
     file://0005-wifi-mt76-fix-incorrect-HE-TX-GI-report.patch \
+    file://0006-wifi-mt76-mt7915-fix-DFS-CAC-tx-emission-issue-after.patch \
     file://0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch \
-    file://100-api_update.patch \
     file://1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch \
     file://1001-wifi-mt76-mt7915-csi-implement-csi-support.patch \
     file://1002-wifi-mt76-mt7915-air-monitor-support.patch \
@@ -36,26 +36,23 @@
     file://1026-wifi-mt76-mt7915-support-on-off-SW-ACI-through-debug.patch \
     file://1027-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
     file://1028-wifi-mt76-mt7915-amsdu-set-and-get-control.patch \
-    file://1029-wifi-mt76-mt7915-add-support-for-he-ldpc-control-fro.patch \
-    file://1030-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch \
-    file://1031-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch \
-    file://1032-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch \
-    file://1033-wifi-mt76-mt7915-Add-5G-UNII4-support.patch \
-    file://1034-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch \
-    file://110-wifi-mt76-ignore-key-disable-commands.patch \
+    file://1029-wifi-mt76-mt7915-Add-vendor-command-attribute-for-RT.patch \
+    file://1030-wifi-mt76-mt7915-add-vendor-cmd-to-get-available-col.patch \
+    file://1031-wifi-mt76-mt7915-disable-SW-ACI-by-default.patch \
+    file://1032-wifi-mt76-mt7915-Add-5G-UNII4-support.patch \
+    file://1033-wifi-mt76-mt7915-add-muru-user-number-debug-command.patch \
     file://3000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://3001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch \
     file://3002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch \
     file://3003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch \
     file://3004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch \
     file://3005-wifi-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rr.patch \
-    file://3006-wifi-mt76-mt7915-wed-add-mt7915_net_setup_tc-to-supp.patch \
-    file://3007-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch \
-    file://3008-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch \
-    file://3009-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch \
-    file://3010-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch \
-    file://3011-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch \
-    file://3012-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch \
-    file://3013-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch \
+    file://3006-wifi-mt76-mt7915-add-wa-command-to-get-tx-msdu-count.patch \
+    file://3007-wifi-mt76-get-tx-count-and-tx-failed-from-mcu-comman.patch \
+    file://3008-wifi-mt76-mt7915-enable-PPDU-TxS-to-host-when-wed-en.patch \
+    file://3009-wifi-mt76-mt7915-get-tx-retries-from-tx-free-done-ev.patch \
+    file://3010-wifi-mt76-update-debugfs-knob-for-reset-counter-and-.patch \
+    file://3011-wifi-mt76-mt7915-add-ctxd-support-for-mt7916.patch \
+    file://3012-wifi-mt76-connac-wed-add-wed-rx-copy-skb.patch \
     file://9999-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "