diff --git a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch
new file mode 100644
index 0000000..1deda11
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -0,0 +1,644 @@
+From 8f5eeab00cf1eeb394132306db23fb1cd2ef5afa Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 27 Oct 2022 17:42:07 +0800
+Subject: [PATCH] mt76: testmode: add ZWDFS test mode support
+
+Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt76.h            |   8 ++
+ mt76_connac_mcu.h |   2 +
+ mt7915/mcu.c      |  64 ++++++++++++++
+ mt7915/mcu.h      |  46 ++++++++++
+ mt7915/mt7915.h   |   4 +
+ mt7915/testmode.c | 213 ++++++++++++++++++++++++++++++++++++++++++++++
+ testmode.c        |  23 ++++-
+ testmode.h        |  43 ++++++++++
+ tools/fields.c    |  20 +++++
+ 9 files changed, 422 insertions(+), 1 deletion(-)
+
+diff --git a/mt76.h b/mt76.h
+index 3ca449f..adeba98 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -708,6 +708,14 @@ struct mt76_testmode_data {
+ 		u64 fcs_error[__MT_RXQ_MAX];
+ 		u64 len_mismatch;
+ 	} rx_stats;
++
++	u8 offchan_ch;
++	u8 offchan_center_ch;
++	u8 offchan_bw;
++
++	u8 ipi_threshold;
++	u32 ipi_period;
++	u8 ipi_antenna_idx;
+ };
+ 
+ struct mt76_vif {
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index b14f931..d7ea781 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1148,6 +1148,7 @@ enum {
+ 	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
+ 	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
+ 	MCU_EXT_CMD_MURU_CTRL = 0x9f,
++	MCU_EXT_CMD_IPI_HIST_CTRL = 0xa3,
+ 	MCU_EXT_CMD_RX_STAT = 0xa4,
+ 	MCU_EXT_CMD_SET_SPR = 0xa8,
+ 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
+@@ -1158,6 +1159,7 @@ enum {
+ 	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
+ 	MCU_EXT_CMD_CERT_CFG = 0xb7,
+ 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
++	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
+ };
+ 
+ enum {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 34ce7d6..87578d7 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2665,6 +2665,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
+ 		req.monitor_chan = chandef->chan->hw_value;
+ 		req.monitor_central_chan =
+ 			ieee80211_frequency_to_channel(chandef->center_freq1);
++		req.monitor_bw = mt76_connac_chan_bw(chandef);
+ 		req.band_idx = phy != &dev->phy;
+ 		req.scan_mode = 2;
+ 		break;
+@@ -4236,3 +4237,66 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
+ }
+ #endif
++
++int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct sk_buff *skb;
++	int ret;
++	struct {
++		u8 ipi_hist_idx;
++		u8 band_idx;
++		u8 set_val;
++		u8 rsv;
++		int idle_power_th;
++		u32 idle_power_max_cnt;
++		u32 idle_power_duration;
++		u32 idle_power_cmd_type;
++	} __packed req = {
++		.ipi_hist_idx = cmd,
++		.band_idx = phy->band_idx,
++	};
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(IPI_HIST_CTRL),
++					&req, sizeof(req), wait_resp, &skb);
++	if (ret)
++		return ret;
++
++	if (!wait_resp)
++		return 0;
++
++	memcpy(data, skb->data, sizeof(struct mt7915_mcu_rdd_ipi_ctrl));
++	dev_kfree_skb(skb);
++
++	return 0;
++}
++
++int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct sk_buff *skb;
++	int ret;
++	struct rdd_ipi_hist_scan {
++		u8 mode;
++		u8 pd_setting;
++		u8 band_idx;
++		u8 rsv;
++	} __packed req = {
++		.mode = mode,
++		.pd_setting = 1,
++		.band_idx = phy->band_idx,
++	};
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(IPI_HIST_SCAN),
++					&req, sizeof(req), wait_resp, &skb);
++	if (ret)
++		return ret;
++
++	if (!wait_resp)
++		return 0;
++
++	memcpy(data, skb->data, sizeof(struct mt7915_mcu_rdd_ipi_scan));
++	dev_kfree_skb(skb);
++
++	return 0;
++}
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index ad85e56..e0fb5a1 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -576,6 +576,52 @@ struct csi_data {
+ };
+ #endif
+ 
++enum {
++	RDD_SET_IPI_CR_INIT,		/* CR initialization */
++	RDD_SET_IPI_HIST_RESET,		/* Reset IPI histogram counter */
++	RDD_SET_IDLE_POWER,		/* Idle power info */
++	RDD_SET_IPI_HIST_NUM
++};
++
++enum {
++	RDD_IPI_HIST_0,			/* IPI count for power <= -92 (dBm) */
++	RDD_IPI_HIST_1,			/* IPI count for -92 < power <= -89 (dBm) */
++	RDD_IPI_HIST_2,			/* IPI count for -89 < power <= -86 (dBm) */
++	RDD_IPI_HIST_3,			/* IPI count for -86 < power <= -83 (dBm) */
++	RDD_IPI_HIST_4,			/* IPI count for -83 < power <= -80 (dBm) */
++	RDD_IPI_HIST_5,			/* IPI count for -80 < power <= -75 (dBm) */
++	RDD_IPI_HIST_6,			/* IPI count for -75 < power <= -70 (dBm) */
++	RDD_IPI_HIST_7,			/* IPI count for -70 < power <= -65 (dBm) */
++	RDD_IPI_HIST_8,			/* IPI count for -65 < power <= -60 (dBm) */
++	RDD_IPI_HIST_9,			/* IPI count for -60 < power <= -55 (dBm) */
++	RDD_IPI_HIST_10,		/* IPI count for -55 < power        (dBm) */
++	RDD_IPI_FREE_RUN_CNT,		/* IPI count for counter++ per 8 us */
++	RDD_IPI_HIST_ALL_CNT,		/* Get all IPI */
++	RDD_IPI_HIST_0_TO_10_CNT,	/* Get IPI histogram 0 to 10 */
++	RDD_IPI_HIST_2_TO_10_CNT,	/* Get IPI histogram 2 to 10 */
++	RDD_TX_ASSERT_TIME,		/* Get band 1 TX assert time */
++	RDD_IPI_HIST_NUM
++};
++
++#define RDM_NF_MAX_WF_IDX		8
++#define POWER_INDICATE_HIST_MAX		RDD_IPI_FREE_RUN_CNT
++#define IPI_HIST_TYPE_NUM		(POWER_INDICATE_HIST_MAX + 1)
++
++struct mt7915_mcu_rdd_ipi_ctrl {
++	u8 ipi_hist_idx;
++	u8 band_idx;
++	u8 rsv[2];
++	u32 ipi_hist_val[IPI_HIST_TYPE_NUM];
++	u32 tx_assert_time;						/* unit: us */
++} __packed;
++
++struct mt7915_mcu_rdd_ipi_scan {
++	u32 ipi_hist_val[RDM_NF_MAX_WF_IDX][POWER_INDICATE_HIST_MAX];
++	u8 band_idx;
++	u8 rsv[2];
++	u8 tx_assert_time;						/* unit: us */
++} __packed;
++
+ /* MURU */
+ #define OFDMA_DL                       BIT(0)
+ #define OFDMA_UL                       BIT(1)
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index f3bbdba..d29c8ef 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -289,6 +289,7 @@ struct mt7915_phy {
+ 
+ 	struct mib_stats mib;
+ 	struct mt76_channel_state state_ts;
++	struct delayed_work ipi_work;
+ 
+ #ifdef CONFIG_NL80211_TESTMODE
+ 	struct {
+@@ -725,6 +726,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+ 				  struct ieee80211_sta *sta);
+ #endif
+ 
++int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
++int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
++
+ #ifdef MTK_DEBUG
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
+ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index f735ed6..8c48d2d 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -13,6 +13,11 @@ enum {
+ 	TM_CHANGED_AID,
+ 	TM_CHANGED_CFG,
+ 	TM_CHANGED_TXBF_ACT,
++	TM_CHANGED_OFF_CHAN_CH,
++	TM_CHANGED_OFF_CHAN_CENTER_CH,
++	TM_CHANGED_OFF_CHAN_BW,
++	TM_CHANGED_IPI_THRESHOLD,
++	TM_CHANGED_IPI_PERIOD,
+ 
+ 	/* must be last */
+ 	NUM_TM_CHANGED
+@@ -24,6 +29,11 @@ static const u8 tm_change_map[] = {
+ 	[TM_CHANGED_AID] = MT76_TM_ATTR_AID,
+ 	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
+ 	[TM_CHANGED_TXBF_ACT] = MT76_TM_ATTR_TXBF_ACT,
++	[TM_CHANGED_OFF_CHAN_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CH,
++	[TM_CHANGED_OFF_CHAN_CENTER_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
++	[TM_CHANGED_OFF_CHAN_BW] = MT76_TM_ATTR_OFF_CH_SCAN_BW,
++	[TM_CHANGED_IPI_THRESHOLD] = MT76_TM_ATTR_IPI_THRESHOLD,
++	[TM_CHANGED_IPI_PERIOD] = MT76_TM_ATTR_IPI_PERIOD,
+ };
+ 
+ struct reg_band {
+@@ -962,6 +972,201 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ 	return 0;
+ }
+ 
++static int
++mt7915_tm_set_offchan(struct mt7915_phy *phy)
++{
++	struct mt76_phy *mphy = phy->mt76;
++	struct mt7915_dev *dev = phy->dev;
++	struct ieee80211_hw *hw = mphy->hw;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct cfg80211_chan_def chandef = {};
++	struct ieee80211_channel *chan;
++	int ret, freq = ieee80211_channel_to_frequency(td->offchan_ch, NL80211_BAND_5GHZ);
++	int width_mhz;
++	const int bw_to_mhz[] = {
++		[NL80211_CHAN_WIDTH_20_NOHT] = 20,
++		[NL80211_CHAN_WIDTH_20] = 20,
++		[NL80211_CHAN_WIDTH_40] = 40,
++		[NL80211_CHAN_WIDTH_80] = 80,
++		[NL80211_CHAN_WIDTH_80P80] = 80,
++		[NL80211_CHAN_WIDTH_160] = 160,
++	};
++
++	if (phy->band_idx != NL80211_BAND_5GHZ && !freq) {
++		ret = -EINVAL;
++		dev_info(dev->mt76.dev, "Failed to set offchan (invalid band or channel)!\n");
++		goto out;
++	}
++
++	chandef.width = td->offchan_bw;
++	width_mhz = bw_to_mhz[chandef.width];
++	chandef.center_freq1 = freq;
++	chan = ieee80211_get_channel(hw->wiphy, freq);
++	chandef.chan = chan;
++
++	memset(&dev->rdd2_chandef, 0, sizeof(struct cfg80211_chan_def));
++
++	ret = mt7915_mcu_rdd_background_enable(phy, &chandef);
++
++	if (ret)
++		goto out;
++
++	dev->rdd2_phy = phy;
++	dev->rdd2_chandef = chandef;
++
++	return ret;
++
++out:
++	td->offchan_ch = 0;
++	td->offchan_bw = 0;
++
++	return ret;
++}
++
++static void
++mt7915_tm_dump_ipi(struct mt7915_phy *phy, void *data, u8 antenna_num,
++		   u8 start_antenna_idx, bool is_scan)
++{
++#define PRECISION	100
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_mcu_rdd_ipi_scan *scan_data;
++	struct mt7915_mcu_rdd_ipi_ctrl *ctrl_data;
++	u32 ipi_idx, ipi_free_count, ipi_percentage, ipi_hist_count_th, ipi_hist_total_count;
++	u32 self_idle_ratio, ipi_idle_ratio, channel_load, tx_assert_time;
++	u8 i, antenna_idx = start_antenna_idx;
++	u32 *ipi_hist_data;
++	const char *power_lower_bound, *power_upper_bound;
++	static const char * const ipi_idx_to_power_bound[] = {
++		[RDD_IPI_HIST_0] = "-92",
++		[RDD_IPI_HIST_1] = "-89",
++		[RDD_IPI_HIST_2] = "-86",
++		[RDD_IPI_HIST_3] = "-83",
++		[RDD_IPI_HIST_4] = "-80",
++		[RDD_IPI_HIST_5] = "-75",
++		[RDD_IPI_HIST_6] = "-70",
++		[RDD_IPI_HIST_7] = "-65",
++		[RDD_IPI_HIST_8] = "-60",
++		[RDD_IPI_HIST_9] = "-55",
++		[RDD_IPI_HIST_10] = "inf",
++	};
++
++	if (is_scan) {
++		scan_data = (struct mt7915_mcu_rdd_ipi_scan *)data;
++		tx_assert_time = scan_data->tx_assert_time;
++	} else {
++		ctrl_data = (struct mt7915_mcu_rdd_ipi_ctrl *)data;
++		tx_assert_time = ctrl_data->tx_assert_time;
++	}
++
++	for (i = 0; i < antenna_num; i++) {
++		ipi_free_count = 0;
++		ipi_hist_count_th = 0;
++		ipi_hist_total_count = 0;
++		ipi_hist_data = is_scan ? scan_data->ipi_hist_val[antenna_idx] :
++					  ctrl_data->ipi_hist_val;
++
++		dev_info(dev->mt76.dev, "Antenna index: %d\n", antenna_idx);
++		for (ipi_idx = 0; ipi_idx < POWER_INDICATE_HIST_MAX; ipi_idx++) {
++			power_lower_bound = ipi_idx ? ipi_idx_to_power_bound[ipi_idx - 1] :
++						      "-inf";
++			power_upper_bound = ipi_idx_to_power_bound[ipi_idx];
++
++			dev_info(dev->mt76.dev,
++				 "IPI %d (power range: (%s, %s] dBm): ipi count = %d\n",
++				 ipi_idx, power_lower_bound,
++				 power_upper_bound, ipi_hist_data[ipi_idx]);
++
++			if (td->ipi_threshold <= ipi_idx && ipi_idx <= RDD_IPI_HIST_10)
++				ipi_hist_count_th += ipi_hist_data[ipi_idx];
++
++			ipi_hist_total_count += ipi_hist_data[ipi_idx];
++		}
++		ipi_free_count = is_scan ? ipi_hist_total_count :
++					   ipi_hist_data[RDD_IPI_FREE_RUN_CNT];
++
++		dev_info(dev->mt76.dev,
++			 "IPI threshold %d: ipi_hist_count_th = %d, ipi_free_count = %d\n",
++			 td->ipi_threshold, ipi_hist_count_th, ipi_free_count);
++		dev_info(dev->mt76.dev, "TX assert time =  %d [ms]\n",
++			 tx_assert_time / 1000);
++
++		// Calculate channel load = (self idle ratio - idle ratio) / self idle ratio
++		if (ipi_hist_count_th >= UINT_MAX / (100 * PRECISION))
++			ipi_percentage = 100 * PRECISION *
++					(ipi_hist_count_th / (100 * PRECISION)) /
++					(ipi_free_count / (100 * PRECISION));
++		else
++			ipi_percentage = PRECISION * 100 * ipi_hist_count_th / ipi_free_count;
++
++		ipi_idle_ratio = ((100 * PRECISION) - ipi_percentage) / PRECISION;
++
++		self_idle_ratio = PRECISION * 100 *
++				  (td->ipi_period - (tx_assert_time / 1000)) /
++				  td->ipi_period / PRECISION;
++
++		if (self_idle_ratio < ipi_idle_ratio)
++			channel_load = 0;
++		else
++			channel_load = self_idle_ratio - ipi_idle_ratio;
++
++		if (self_idle_ratio <= td->ipi_threshold) {
++			dev_info(dev->mt76.dev,
++				 "band[%d]: self idle ratio = %d%%, idle ratio = %d%%\n",
++				 phy->band_idx, self_idle_ratio, ipi_idle_ratio);
++			return;
++		}
++
++		channel_load = (100 * channel_load) / self_idle_ratio;
++		dev_info(dev->mt76.dev,
++			 "band[%d]: chan load = %d%%, self idle ratio = %d%%, idle ratio = %d%%\n",
++			 phy->band_idx, channel_load, self_idle_ratio, ipi_idle_ratio);
++		antenna_idx++;
++	}
++}
++
++static void
++mt7915_tm_ipi_work(struct work_struct *work)
++{
++	struct mt7915_phy *phy = container_of(work, struct mt7915_phy, ipi_work.work);
++	struct mt7915_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	u8 start_antenna_idx = 0, antenna_num = 1;
++
++	if (!is_mt7915(&dev->mt76)) {
++		struct mt7915_mcu_rdd_ipi_scan data;
++
++		if (phy->band_idx)
++			start_antenna_idx = 4;
++
++		/* Use all antenna */
++		if (td->ipi_antenna_idx == MT76_TM_IPI_ANTENNA_ALL)
++			antenna_num = 4;
++		else
++			start_antenna_idx += td->ipi_antenna_idx;
++
++		mt7915_mcu_ipi_hist_scan(phy, &data, 0, true);
++		mt7915_tm_dump_ipi(phy, &data, antenna_num, start_antenna_idx, true);
++	} else {
++		struct mt7915_mcu_rdd_ipi_ctrl data;
++
++		mt7915_mcu_ipi_hist_ctrl(phy, &data, RDD_IPI_HIST_ALL_CNT, true);
++		mt7915_tm_dump_ipi(phy, &data, antenna_num, start_antenna_idx, false);
++	}
++}
++
++static int
++mt7915_tm_set_ipi(struct mt7915_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++
++	cancel_delayed_work(&phy->ipi_work);
++	ieee80211_queue_delayed_work(phy->mt76->hw, &phy->ipi_work,
++				     msecs_to_jiffies(td->ipi_period));
++
++	return 0;
++}
++
+ static int
+ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+ 		      u16 cw_max, u16 txop, u8 tx_cmd)
+@@ -1247,6 +1452,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ 		phy->mt76->test.tx_mpdu_len = 0;
+ 		phy->test.bf_en = 0;
+ 		mt7915_tm_set_entry(phy);
++	} else {
++		INIT_DELAYED_WORK(&phy->ipi_work, mt7915_tm_ipi_work);
+ 	}
+ }
+ 
+@@ -2004,6 +2211,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ 		mt7915_tm_set_cfg(phy);
+ 	if (changed & BIT(TM_CHANGED_TXBF_ACT))
+ 		mt7915_tm_set_txbf(phy);
++	if ((changed & BIT(TM_CHANGED_OFF_CHAN_CH)) &&
++	    (changed & BIT(TM_CHANGED_OFF_CHAN_BW)))
++		mt7915_tm_set_offchan(phy);
++	if ((changed & BIT(TM_CHANGED_IPI_THRESHOLD)) &&
++	    (changed & BIT(TM_CHANGED_IPI_PERIOD)))
++		mt7915_tm_set_ipi(phy);
+ }
+ 
+ static int
+diff --git a/testmode.c b/testmode.c
+index aa874a8..de2892b 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -24,6 +24,12 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+ 	[MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
+ 	[MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
+ 	[MT76_TM_ATTR_DRV_DATA] = { .type = NLA_NESTED },
++	[MT76_TM_ATTR_OFF_CH_SCAN_CH] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_PATH] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_THRESHOLD] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_PERIOD] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_IPI_ANTENNA_INDEX] = { .type = NLA_U8 },
+ };
+ EXPORT_SYMBOL_GPL(mt76_tm_policy);
+ 
+@@ -402,6 +408,7 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+ 	td->tx_count = 1;
+ 	td->tx_rate_mode = MT76_TM_TX_MODE_OFDM;
+ 	td->tx_rate_nss = 1;
++	td->ipi_antenna_idx = MT76_TM_IPI_ANTENNA_ALL;
+ 
+ 	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
+ 	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
+@@ -607,6 +614,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	if (tb[MT76_TM_ATTR_TX_RATE_IDX])
+ 		td->tx_rate_idx = nla_get_u8(tb[MT76_TM_ATTR_TX_RATE_IDX]);
+ 
++	if (tb[MT76_TM_ATTR_IPI_PERIOD])
++		td->ipi_period = nla_get_u32(tb[MT76_TM_ATTR_IPI_PERIOD]);
++
+ 	if (mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_MODE], &td->tx_rate_mode,
+ 			   0, MT76_TM_TX_MODE_MAX) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_NSS], &td->tx_rate_nss,
+@@ -623,7 +633,15 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			   &td->tx_power_control, 0, 1) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_ALLOC], &td->ru_alloc, 0, 0xff) ||
+-	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68))
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CH], &td->offchan_ch, 36, 196) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH], &td->offchan_center_ch,
++			   36, 196) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_BW],
++			   &td->offchan_bw, NL80211_CHAN_WIDTH_20_NOHT, NL80211_CHAN_WIDTH_160) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_IPI_THRESHOLD], &td->ipi_threshold, 0, 10) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_IPI_ANTENNA_INDEX], &td->ipi_antenna_idx,
++			   MT76_TM_IPI_ANTENNA_0, MT76_TM_IPI_ANTENNA_ALL))
+ 		goto out;
+ 
+ 	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
+@@ -857,6 +875,9 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_CH, td->offchan_ch) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH, td->offchan_center_ch) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_OFF_CH_SCAN_BW, td->offchan_bw) ||
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
+ 	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
+diff --git a/testmode.h b/testmode.h
+index 5d1fe79..9f61847 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -63,6 +63,19 @@
+  * 	(nested, u8 attrs)
+  *
+  * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
++ * @MT76_TM_ATTR_TXBF_ACT: txbf setting actions (u8)
++ * @MT76_TM_ATTR_TXBF_PARAM: txbf parameters (nested)
++ *
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CH: config the channel of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH: config the center channel of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_BW: config the bandwidth of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_PATH: config the tx path of background chain (ZWDFS) (u8)
++ *
++ * @MT76_TM_ATTR_IPI_THRESHOLD: config the IPI index you want to read (u8)
++ * @MT76_TM_ATTR_IPI_PERIOD: config the time period for reading
++ *			     the histogram of specific IPI index (u8)
++ * @MT76_TM_ATTR_IPI_ANTENNA_INDEX: config the antenna index for reading
++ *				    the histogram of specific IPI index (u8)
+  *
+  */
+ enum mt76_testmode_attr {
+@@ -116,6 +129,15 @@ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_TXBF_ACT,
+ 	MT76_TM_ATTR_TXBF_PARAM,
+ 
++	MT76_TM_ATTR_OFF_CH_SCAN_CH,
++	MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
++	MT76_TM_ATTR_OFF_CH_SCAN_BW,
++	MT76_TM_ATTR_OFF_CH_SCAN_PATH,
++
++	MT76_TM_ATTR_IPI_THRESHOLD,
++	MT76_TM_ATTR_IPI_PERIOD,
++	MT76_TM_ATTR_IPI_ANTENNA_INDEX,
++
+ 	/* keep last */
+ 	NUM_MT76_TM_ATTRS,
+ 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
+@@ -292,4 +314,25 @@ enum mt76_testmode_txbf_act {
+ 	MT76_TM_TXBF_ACT_MAX = NUM_MT76_TM_TXBF_ACT - 1,
+ };
+ 
++/**
++ * enum mt76_testmode_ipi_antenna - specify antenna index for ipi count
++ *
++ * @MT76_TM_IPI_ANTENNA_0: use antenna 0
++ * @MT76_TM_IPI_ANTENNA_1: use antenna 1
++ * @MT76_TM_IPI_ANTENNA_2: use antenna 2
++ * @MT76_TM_IPI_ANTENNA_3: use antenna 3
++ * @MT76_TM_IPI_ANTENNA_ALL: use all antenna
++ */
++enum mt76_testmode_ipi_antenna {
++	MT76_TM_IPI_ANTENNA_0,
++	MT76_TM_IPI_ANTENNA_1,
++	MT76_TM_IPI_ANTENNA_2,
++	MT76_TM_IPI_ANTENNA_3,
++	MT76_TM_IPI_ANTENNA_ALL,
++
++	/* keep last */
++	NUM_MT76_TM_IPI_ANTENNA,
++	MT76_TM_IPI_ANTENNA_MAX = NUM_MT76_TM_IPI_ANTENNA - 1,
++};
++
+ #endif
+diff --git a/tools/fields.c b/tools/fields.c
+index 47fc69f..21f6b19 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -46,6 +46,14 @@ static const char * const testmode_txbf_act[] = {
+ 	[MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
+ };
+ 
++static const char * const testmode_offchan_bw[] = {
++	[NL80211_CHAN_WIDTH_20_NOHT] = "NOHT",
++	[NL80211_CHAN_WIDTH_20] = "20",
++	[NL80211_CHAN_WIDTH_40] = "40",
++	[NL80211_CHAN_WIDTH_80] = "80",
++	[NL80211_CHAN_WIDTH_160] = "160",
++};
++
+ static void print_enum(const struct tm_field *field, struct nlattr *attr)
+ {
+ 	unsigned int i = nla_get_u8(attr);
+@@ -411,6 +419,12 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+ 	FIELD(u8, RU_IDX, "ru_idx"),
+ 	FIELD_ENUM(TXBF_ACT, "txbf_act", testmode_txbf_act),
+ 	FIELD_ARRAY(u16_hex, TXBF_PARAM, "txbf_param"),
++	FIELD(u8, OFF_CH_SCAN_CH, "offchan_ch"),
++	FIELD(u8, OFF_CH_SCAN_CENTER_CH, "offchan_center_ch"),
++	FIELD_ENUM(OFF_CH_SCAN_BW, "offchan_bw", testmode_offchan_bw),
++	FIELD(u8, IPI_THRESHOLD, "ipi_threshold"),
++	FIELD(u32, IPI_PERIOD, "ipi_period"),
++	FIELD(u8, IPI_ANTENNA_INDEX, "ipi_antenna_idx"),
+ 	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
+ 	FIELD_NESTED_RO(STATS, stats, "",
+ 			.print_extra = print_extra_stats),
+@@ -442,6 +456,12 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+ 	[MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
+ 	[MT76_TM_ATTR_TXBF_ACT] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_CH] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_BW] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_THRESHOLD] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_PERIOD] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_IPI_ANTENNA_INDEX] = { .type = NLA_U8 },
+ };
+ 
+ const struct tm_field msg_field = {
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
rename to recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 06237df..b35db14 100644
--- a/recipes-wifi/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,14 +1,14 @@
-From 5031592059aaedc2b8d287b191d2d389d672761f Mon Sep 17 00:00:00 2001
+From 9796c5aecec2bc0b4be41c71818469ca8b6601b6 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1114/1127] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1115/1128] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0a5a4b36..fdbf1eea 100644
+index 0a5a4b3..fdbf1ee 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
similarity index 74%
rename from recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
rename to recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 38827b4..b30999b 100644
--- a/recipes-wifi/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From 271c0cad1bc8013bc30a9be9fc24879739d7a87d Mon Sep 17 00:00:00 2001
+From 00d1ebebdfb0faf06ef9f771947d1466926616fe Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1115/1127] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1116/1128] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 34ce7d6f..b6733b1c 100644
+index 87578d7..caab84c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3558,7 +3558,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3559,7 +3559,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
@@ -24,5 +24,5 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
rename to recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch
index 82ebd57..ccf6d80 100644
--- a/recipes-wifi/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1117-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,14 +1,14 @@
-From b5812eb715903b1ee0e0c74e30871444e0fef807 Mon Sep 17 00:00:00 2001
+From c3922c28e124f89f9725781a4065d32207d8eed4 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1116/1127] mt76: airtime fairness feature off in mac80211
+Subject: [PATCH 1117/1128] mt76: airtime fairness feature off in mac80211
 
 ---
  mac80211.c | 1 -
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 454f449d..b7c1b13b 100644
+index 454f449..b7c1b13 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -20,5 +20,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
rename to recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index 0f09ca0..b1676a5 100644
--- a/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 87a9bde534000908f7154499a808575d77d66da9 Mon Sep 17 00:00:00 2001
+From 81944a83b700b0173adce47aa961d6798cadc150 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1117/1127] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1118/1128] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index e2482c65..d58a3201 100644
+index e2482c6..d58a320 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 88aaa16a..fdae347e 100644
+index 88aaa16..fdae347 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b6733b1c..69a266f6 100644
+index caab84c..8edd155 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2928,7 +2928,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2929,7 +2929,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2966,9 +2967,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2967,9 +2968,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2976,34 +2977,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2977,34 +2978,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3035,24 +3071,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3036,24 +3072,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
rename to recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch
index 9b489c4..e634a9f 100644
--- a/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From 96e6ea270e50b2d2c76998e8f3486c97dae66bb6 Mon Sep 17 00:00:00 2001
+From 680d744245598f99e718d68f72727e71eaeb1b72 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1118/1127] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1119/1128] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f3bbdbae..bd20e7c7 100644
+index d29c8ef..b440a34 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c7551848..77d71e48 100644
+index c755184..77d71e4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf9..719b851f 100644
+index a8e4ebf..719b851 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
rename to recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
index 8fd3f28..7f79958 100644
--- a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
@@ -1,33 +1,33 @@
-From d219c48c59fdf1ec69bd08d3c1fef708c3ab9300 Mon Sep 17 00:00:00 2001
+From 50c497714418693f8e2c4e8d90f4f86dbb41aa44 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1119/1127] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1120/1128] mt76: mt7915: add vendor subcmd EDCCA ctrl
 
 Change-Id: I92dabf8be9c5a7ecec78f35325bc5645af8d15ab
 ---
  mt76_connac_mcu.h |  1 +
  mt7915/main.c     |  3 +++
  mt7915/mcu.c      | 38 ++++++++++++++++++++++++++++
- mt7915/mcu.h      | 12 +++++++++
+ mt7915/mcu.h      | 13 ++++++++++
  mt7915/mt7915.h   |  2 ++
  mt7915/vendor.c   | 63 +++++++++++++++++++++++++++++++++++++++++++++++
  mt7915/vendor.h   | 19 ++++++++++++++
- 7 files changed, 138 insertions(+)
+ 7 files changed, 139 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b14f931b..6143d8e4 100644
+index d7ea781..1738773 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1157,6 +1157,7 @@ enum {
+@@ -1158,6 +1158,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
 +	MCU_EXT_CMD_EDCCA = 0xba,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ 	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
- 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index fdbf1eea..80f4d9dd 100644
+index fdbf1ee..80f4d9d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -456,6 +456,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -41,13 +41,13 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 69a266f6..8dcc54eb 100644
+index 8edd155..2c2575e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4272,3 +4272,41 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
+@@ -4336,3 +4336,41 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+ 
+ 	return 0;
  }
- #endif
 +
 +int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value,
 +			 s8 compensation)
@@ -87,13 +87,14 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ad85e56c..b8a433e5 100644
+index 14cb04b..481ef4d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -789,4 +789,16 @@ enum {
+@@ -834,4 +834,17 @@ enum {
+    MURU_DL_INIT,
+    MURU_UL_INIT,
  };
- #endif
- 
++
 +enum {
 +   EDCCA_CTRL_SET_EN = 0,
 +   EDCCA_CTRL_SET_THERS,
@@ -108,20 +109,20 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index bd20e7c7..1b08686e 100644
+index b440a34..53773fa 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -725,6 +725,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -726,6 +726,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
 +int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value,
 +			 s8 compensation);
  
- #ifdef MTK_DEBUG
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
+ int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
+ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..5a28a554 100644
+index 77d71e4..5a28a55 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,17 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -209,7 +210,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851f..83c41bc1 100644
+index 719b851..83c41bc 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -10,8 +10,27 @@ enum mtk_nl80211_vendor_subcmds {
@@ -241,5 +242,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
rename to recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch
index da1bb74..d5e605d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From 6ed6cb4cf561159bcd935f48000abce3652fb682 Mon Sep 17 00:00:00 2001
+From d4a8fb73f0ac7ca27986d91c12bfb624770474ab Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1120/1127] mt76: mt7915: implement bin file mode
+Subject: [PATCH 1121/1128] mt76: mt7915: implement bin file mode
 
 Change-Id: I2a726341541a11cbecdb210b33a8e79aefbd6cf3
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -13,7 +13,7 @@
  4 files changed, 71 insertions(+), 11 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 4c50bfe6..baca86fd 100644
+index e083964..5b9faf7 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -42,10 +42,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 3ca449f7..e547f79e 100644
+index adeba98..93a81da 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1001,6 +1001,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1009,6 +1009,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -54,7 +54,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index d58a3201..632ecc7b 100644
+index d58a320..632ecc7 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -46,26 +46,36 @@ static char *mt7915_eeprom_name(struct mt7915_dev *dev)
@@ -148,7 +148,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1b08686e..5fa1dfac 100644
+index 53773fa..e90fd85 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -51,6 +51,15 @@
@@ -167,7 +167,7 @@
  #define MT7915_EEPROM_SIZE		3584
  #define MT7916_EEPROM_SIZE		4096
  
-@@ -373,6 +382,7 @@ struct mt7915_dev {
+@@ -374,6 +383,7 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -176,5 +176,5 @@
  	bool ibf;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch
similarity index 79%
rename from recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch
rename to recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch
index 49f0d06..6e4a407 100644
--- a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 5f1203708a71e815d3d3f40ca18005d1667453cb Mon Sep 17 00:00:00 2001
+From 109de0e4b5c9ed13308510e5735475cd02ea5310 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1121/1127] mt76 mt7915 initialize wcid
+Subject: [PATCH 1122/1128] mt76 mt7915 initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,7 +9,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 100ed7e1..27f9419a 100644
+index 100ed7e..27f9419 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -969,7 +969,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch
rename to recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch
index 2c124c2..9e08c34 100644
--- a/recipes-wifi/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1123-mt76-HEMU-Add-dump-support.patch
@@ -1,7 +1,7 @@
-From e3d3c941dcf1d99d78e57d72989cf2f98f9f5b6b Mon Sep 17 00:00:00 2001
+From 26b122531211e0ed0d9e0daef554eaf0eb0c74a7 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1122/1127] mt76: HEMU: Add dump support
+Subject: [PATCH 1123/1128] mt76: HEMU: Add dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 27 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5a28a554..7acb3304 100644
+index 5a28a55..7acb330 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -61,7 +61,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 83c41bc1..57f52f3a 100644
+index 83c41bc..57f52f3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -58,6 +58,7 @@ enum mtk_vendor_attr_hemu_ctrl {
@@ -73,5 +73,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
rename to recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 74c02b6..d07dee3 100644
--- a/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,10 +1,10 @@
-From 513897014f6bafe1f38bcfa48d0bb43ed30d4d82 Mon Sep 17 00:00:00 2001
+From dad54bcc966435cea908f5b2fa25addd4bc25f83 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Tue, 30 Aug 2022 15:29:38 +0800
-Subject: [PATCH 1123/1127] mt76: mt7915: add vendor subcmd three wire (PTA)
+Date: Fri, 28 Oct 2022 10:15:56 +0800
+Subject: [PATCH 1124/1128] mt76: mt7915: add vendor subcmd three wire (PTA)
  ctrl
 
-Change-Id: Ie092d63af9a1e06bef36fc5a5bac40fdab73dba5
+Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt76_connac_mcu.h |  2 +-
@@ -16,10 +16,10 @@
  6 files changed, 107 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6143d8e4..27a36241 100644
+index 1738773..9a57505 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1156,7 +1156,7 @@ enum {
+@@ -1157,7 +1157,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -27,12 +27,12 @@
 +	MCU_EXT_CMD_SET_CFG = 0xb7,
  	MCU_EXT_CMD_EDCCA = 0xba,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- };
+ 	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8dcc54eb..d67495c4 100644
+index 2c2575e..d59f568 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4019,37 +4019,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4020,37 +4020,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,12 +94,12 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b8a433e5..9d0fac47 100644
+index 1d58e8b..7738e96 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -576,6 +576,35 @@ struct csi_data {
- };
- #endif
+@@ -622,6 +622,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+ 	u8 tx_assert_time;						/* unit: us */
+ } __packed;
  
 +struct cert_cfg {
 +	__le16 tag;
@@ -134,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5fa1dfac..f4038207 100644
+index e90fd85..429824b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -727,6 +727,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -728,6 +728,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7acb3304..7f67c0d3 100644
+index 7acb330..7f67c0d 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -220,7 +220,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 57f52f3a..e0c5fd94 100644
+index 57f52f3..e0c5fd9 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,6 +11,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -250,5 +250,5 @@
  enum mtk_capi_control_changed {
  	CAPI_RFEATURE_CHANGED		= BIT(16),
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
rename to recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch
index 1bb1bcc..0636928 100644
--- a/recipes-wifi/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1125-mt76-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 8bf75c1a4afd5a2f0abd5ccda8a174b80b0fbd07 Mon Sep 17 00:00:00 2001
+From c3c725d511749dc69151d300906b05515521e4be Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1124/1127] mt76: add ibf control vendor cmd
+Subject: [PATCH 1125/1128] mt76: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 94 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7f67c0d3..cbbb0843 100644
+index 7f67c0d..cbbb084 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -78,6 +78,16 @@ edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
@@ -105,7 +105,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index e0c5fd94..5aac5595 100644
+index e0c5fd9..5aac559 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,7 +11,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -146,5 +146,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-AMPDU-AMSDU-OnOff-ctonrol.patch b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-AMPDU-AMSDU-OnOff-ctonrol.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-AMPDU-AMSDU-OnOff-ctonrol.patch
rename to recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-AMPDU-AMSDU-OnOff-ctonrol.patch
index ad78deb..3c6e3ed 100644
--- a/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-AMPDU-AMSDU-OnOff-ctonrol.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-AMPDU-AMSDU-OnOff-ctonrol.patch
@@ -1,7 +1,7 @@
-From 73ed020063abbe785ad02d2fdab8dc6fdcec07a3 Mon Sep 17 00:00:00 2001
+From 4d425d098a578b80535153feec322a6974f88bb6 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 21 Sep 2022 13:55:15 -0700
-Subject: [PATCH 1125/1127] mt76: mt7915: add AMPDU/AMSDU OnOff ctonrol
+Subject: [PATCH 1126/1128] mt76: mt7915: add AMPDU/AMSDU OnOff ctonrol
 
 Change-Id: I6030b3a420e96b02e83b0c7a3c3626a3b23c97e3
 ---
@@ -12,7 +12,7 @@
  4 files changed, 83 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 27f9419a..3896c3d5 100644
+index 27f9419..3896c3d 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -1939,6 +1939,34 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
@@ -51,10 +51,10 @@
  void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f4038207..d5e0c3e9 100644
+index 429824b..6e8148f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -715,6 +715,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -716,6 +716,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -64,7 +64,7 @@
  void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index cbbb0843..d73fdd4c 100644
+index cbbb084..d73fdd4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -30,10 +30,18 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -137,7 +137,7 @@
  		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 5aac5595..53abb100 100644
+index 5aac559..53abb10 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -58,6 +58,8 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -169,5 +169,5 @@
  	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
rename to recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index 9d5aeaa..2fb2cb1 100644
--- a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,7 +1,7 @@
-From 6a0356a60feb88001aa785b3ae6fe9a26fe9e25e Mon Sep 17 00:00:00 2001
+From f481a0d8fb712e0551d15d0063b3edc294238d23 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1126/1127] mt76: mt7915: add E3 re-bonding for low yield rate
+Subject: [PATCH 1127/1128] mt76: mt7915: add E3 re-bonding for low yield rate
  issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,7 +12,7 @@
  3 files changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 632ecc7b..34a4a624 100644
+index 632ecc7..34a4a62 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -133,7 +133,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
@@ -64,10 +64,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d67495c4..4438e748 100644
+index d59f568..d50482d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2849,7 +2849,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+@@ -2850,7 +2850,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
  				 &req, sizeof(req), true);
  }
  
@@ -76,7 +76,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2866,8 +2866,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2867,8 +2867,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -95,10 +95,10 @@
  
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d5e0c3e9..b5784d92 100644
+index 6e8148f..c8e9c3b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -543,6 +543,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -544,6 +544,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
@@ -106,7 +106,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev);
  void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  				struct mt7915_phy *phy);
-@@ -597,7 +598,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -598,7 +599,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
  int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
@@ -116,5 +116,5 @@
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1128-mt76-support-on-off-SW-ACI-through-debugfs.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch
rename to recipes-wifi/linux-mt76/files/patches/1128-mt76-support-on-off-SW-ACI-through-debugfs.patch
index 8ec0a45..4536ed1 100644
--- a/recipes-wifi/linux-mt76/files/patches/1127-mt76-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1128-mt76-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,7 +1,7 @@
-From eb6849812919d13e38cb8253632e96edec6a582a Mon Sep 17 00:00:00 2001
+From a6c223bb69c974e93d1c3793615d1e1937d159bf Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1127/1127] mt76: support on off SW ACI through debugfs
+Subject: [PATCH 1128/1128] mt76: support on off SW ACI through debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
@@ -11,19 +11,19 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 27a36241..c7e28e3e 100644
+index 9a57505..85bf978 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1158,6 +1158,7 @@ enum {
+@@ -1159,6 +1159,7 @@ enum {
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_SET_CFG = 0xb7,
  	MCU_EXT_CMD_EDCCA = 0xba,
 +	MCU_EXT_CMD_SWLNA_ACI_CTRL = 0xc0,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ 	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
- 
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9de5b0f6..c5e04728 100644
+index 9de5b0f..c5e0472 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2893,6 +2893,25 @@ mt7915_wa_debug(void *data, u64 val)
@@ -62,5 +62,5 @@
  }
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
index 038f10c..f770ee0 100644
--- a/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
@@ -1,9 +1,10 @@
-From a96024fdb9633ad7a309bc13800cf730fd00f7dc Mon Sep 17 00:00:00 2001
+From da55b34ff3c8b76a2b8d89467a95d026bdb7f015 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sun, 12 Jun 2022 16:38:45 +0800
-Subject: [PATCH 3001/3011] mt76 add wed tx support
+Subject: [PATCH 3001/3010] mt76 add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt76_connac.h |  1 +
  mt7915/mac.c  | 11 +++++++----
@@ -12,7 +13,7 @@
  4 files changed, 20 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 0915eb57..9a468878 100644
+index 0915eb5..9a46887 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -24,7 +25,7 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3896c3d5..98925ed5 100644
+index 3896c3d..98925ed 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -828,9 +828,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -65,7 +66,7 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 80f4d9dd..4e915279 100644
+index 80f4d9d..4e91527 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1457,14 +1457,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -86,7 +87,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 1eda361f..5819281c 100644
+index 1eda361..5819281 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -10,7 +10,7 @@
@@ -148,5 +149,5 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
index fd4d484..8f6f8e0 100644
--- a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,9 +1,10 @@
-From 1672984d38b180a4e7cd64cc262a7a30cf39a329 Mon Sep 17 00:00:00 2001
+From 2e853a721466623df8fe208778afb48e7382b753 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
-Subject: [PATCH 3002/3011] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
+Subject: [PATCH 3002/3010] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mac80211.c      |  5 ++++-
  mt76.h          |  2 ++
@@ -16,7 +17,7 @@
  8 files changed, 76 insertions(+), 5 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index b7c1b13b..1e13b654 100644
+index b7c1b13..1e13b65 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1364,7 +1364,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
@@ -32,7 +33,7 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index e547f79e..335f0b10 100644
+index 93a81da..1888706 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -454,6 +454,7 @@ struct mt76_driver_ops {
@@ -43,7 +44,7 @@
  };
  
  struct mt76_channel_state {
-@@ -814,6 +815,7 @@ struct mt76_dev {
+@@ -822,6 +823,7 @@ struct mt76_dev {
  	spinlock_t status_lock;
  
  	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
@@ -52,7 +53,7 @@
  
  	u64 vif_mask;
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6833bbf5..8055c6ea 100644
+index 6833bbf..8055c6e 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -695,6 +695,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -72,7 +73,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4e915279..62b9658b 100644
+index 4e91527..62b9658 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -150,7 +151,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index bd7b81e6..4aa859e5 100644
+index d50482d..8f03a7d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2350,6 +2350,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
@@ -180,7 +181,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9d0fac47..1f56db6b 100644
+index 7738e96..cb95add 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -268,6 +268,7 @@ enum {
@@ -192,7 +193,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 5819281c..84a47c94 100644
+index 5819281..84a47c9 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -596,6 +596,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
@@ -213,7 +214,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b5784d92..5a2d15ff 100644
+index c8e9c3b..a20d4b8 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -226,7 +227,7 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -696,6 +699,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -697,6 +700,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
@@ -235,5 +236,5 @@
  void mt7915_stats_work(struct work_struct *work);
  int mt76_dfs_start_rdd(struct mt7915_dev *dev, bool force);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch b/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
index 795bc23..974ef99 100644
--- a/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
@@ -1,9 +1,10 @@
-From 6a8ab8991772977d92928b560b6b881132728508 Mon Sep 17 00:00:00 2001
+From a242bbf9b619b24729315038c35b319d2cc314ef Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 5 Jul 2022 19:42:55 +0800
-Subject: [PATCH 3003/3011] mt76 add wed rx support
+Subject: [PATCH 3003/3010] mt76 add wed rx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  dma.c             | 250 ++++++++++++++++++++++++++++++++++++++--------
  dma.h             |  10 ++
@@ -28,7 +29,7 @@
  20 files changed, 448 insertions(+), 67 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 82b4da26..a8739eb4 100644
+index 82b4da2..a8739eb 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -98,6 +98,63 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
@@ -479,7 +480,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 diff --git a/dma.h b/dma.h
-index fdf786f9..90370d12 100644
+index fdf786f..90370d1 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -16,6 +16,16 @@
@@ -500,7 +501,7 @@
  #define MT_RX_INFO_LEN			4
  #define MT_FCE_INFO_LEN			4
 diff --git a/mac80211.c b/mac80211.c
-index 1e13b654..3e276357 100644
+index 1e13b65..3e27635 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -603,11 +603,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -531,7 +532,7 @@
  
  	mt76_rx_complete(dev, &frames, napi);
 diff --git a/mt76.h b/mt76.h
-index 335f0b10..959fb240 100644
+index 1888706..45439a7 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -20,6 +20,8 @@
@@ -580,7 +581,7 @@
  
  	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
  
-@@ -771,6 +778,7 @@ struct mt76_dev {
+@@ -779,6 +786,7 @@ struct mt76_dev {
  	struct ieee80211_hw *hw;
  
  	spinlock_t lock;
@@ -588,7 +589,7 @@
  	spinlock_t cc_lock;
  
  	u32 cur_cc_bss_rx;
-@@ -796,6 +804,7 @@ struct mt76_dev {
+@@ -804,6 +812,7 @@ struct mt76_dev {
  	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
  
  	struct list_head txwi_cache;
@@ -596,7 +597,7 @@
  	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
  	struct mt76_queue q_rx[__MT_RXQ_MAX];
  	const struct mt76_queue_ops *queue_ops;
-@@ -809,6 +818,9 @@ struct mt76_dev {
+@@ -817,6 +826,9 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -606,7 +607,7 @@
  
  	wait_queue_head_t tx_wait;
  	/* spinclock used to protect wcid pktid linked list */
-@@ -1351,6 +1363,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1359,6 +1371,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -615,7 +616,7 @@
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1495,6 +1509,12 @@ struct mt76_txwi_cache *
+@@ -1503,6 +1517,12 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -629,7 +630,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9d..2ff71c53 100644
+index 590cff9..2ff71c5 100644
 --- a/mt7603/dma.c
 +++ b/mt7603/dma.c
 @@ -69,7 +69,7 @@ free:
@@ -642,7 +643,7 @@
  	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d90..f2ce22ae 100644
+index 0fd46d9..f2ce22a 100644
 --- a/mt7603/mt7603.h
 +++ b/mt7603/mt7603.h
 @@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -655,7 +656,7 @@
  void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7615/mac.c b/mt7615/mac.c
-index 2ce1705c..59125b4d 100644
+index 2ce1705..59125b4 100644
 --- a/mt7615/mac.c
 +++ b/mt7615/mac.c
 @@ -1653,7 +1653,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -668,7 +669,7 @@
  	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 060d52c8..232b0f29 100644
+index 060d52c..232b0f2 100644
 --- a/mt7615/mt7615.h
 +++ b/mt7615/mt7615.h
 @@ -511,7 +511,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
@@ -681,7 +682,7 @@
  int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 01561a56..0f800909 100644
+index 01561a5..0f80090 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -1192,6 +1192,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
@@ -729,7 +730,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
 diff --git a/mt76x02.h b/mt76x02.h
-index 849c2644..49112ab6 100644
+index 849c264..49112ab 100644
 --- a/mt76x02.h
 +++ b/mt76x02.h
 @@ -187,7 +187,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
@@ -742,7 +743,7 @@
  irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
  void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
 diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 3a313075..5d6c8f71 100644
+index 3a31307..5d6c8f7 100644
 --- a/mt76x02_txrx.c
 +++ b/mt76x02_txrx.c
 @@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
@@ -755,7 +756,7 @@
  	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
  	void *rxwi = skb->data;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index e3918860..702d629a 100644
+index e391886..702d629 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -344,7 +344,8 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
@@ -811,7 +812,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
  				       MT_RXQ_ID(MT_RXQ_BAND1),
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 98925ed5..1ef7cb45 100644
+index 98925ed..1ef7cb4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -217,7 +217,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -951,7 +952,7 @@
  			return;
  		}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 4aa859e5..6603effd 100644
+index 8f03a7d..79c7eff 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1724,6 +1724,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
@@ -972,7 +973,7 @@
  				     MCU_EXT_CMD(STA_REC_UPDATE), true);
  }
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 84a47c94..45520c74 100644
+index 84a47c9..45520c7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -29,6 +29,7 @@ static const u32 mt7915_reg[] = {
@@ -1064,7 +1065,7 @@
  		return 0;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5a2d15ff..e2127e02 100644
+index a20d4b8..346571a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -81,6 +81,7 @@
@@ -1075,7 +1076,7 @@
  
  struct mt7915_vif;
  struct mt7915_sta;
-@@ -543,7 +544,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -544,7 +545,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -1086,7 +1087,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
-@@ -697,7 +700,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -698,7 +701,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1096,7 +1097,7 @@
  bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 8fd2f69a..36ad2433 100644
+index 8fd2f69..36ad243 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -28,6 +28,7 @@ enum reg_rev {
@@ -1130,7 +1131,7 @@
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
 diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 1abf7d9b..2ad7b33a 100644
+index 1abf7d9..2ad7b33 100644
 --- a/mt7921/mac.c
 +++ b/mt7921/mac.c
 @@ -692,7 +692,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -1143,7 +1144,7 @@
  	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index eaba114a..54a30ca1 100644
+index eaba114..54a30ca 100644
 --- a/mt7921/mt7921.h
 +++ b/mt7921/mt7921.h
 @@ -408,7 +408,7 @@ void mt7921_tx_worker(struct mt76_worker *w);
@@ -1156,7 +1157,7 @@
  void mt7921_stats_work(struct work_struct *work);
  void mt7921_set_stream_he_caps(struct mt7921_phy *phy);
 diff --git a/tx.c b/tx.c
-index 8b33186b..b812d067 100644
+index 8b33186..b812d06 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -778,3 +778,37 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
@@ -1198,5 +1199,5 @@
 +}
 +EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch b/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
index 4212bca..400080f 100644
--- a/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
@@ -1,15 +1,16 @@
-From 9f6f4b064b75c34530c28b8f9027ea499af76409 Mon Sep 17 00:00:00 2001
+From 725852c4a994b35b6b9320b153175df5d910b867 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3011] mt76: add fill receive path to report wed idx
+Subject: [PATCH 3004/3010] mt76: add fill receive path to report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt7915/main.c | 19 +++++++++++++++++++
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 62b9658b..5e37c4c8 100644
+index 62b9658..5e37c4c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1512,6 +1512,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -45,5 +46,5 @@
  #endif
  };
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
index 1db7b07..8fc8e61 100644
--- a/recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
@@ -1,9 +1,10 @@
-From 47a51d19218454afda6bac509c8c7633e9f61330 Mon Sep 17 00:00:00 2001
+From fcd960471fe61d47225ac1da974e64a2700cd797 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 28 Jul 2022 11:16:15 +0800
-Subject: [PATCH 3005/3011] mt76 add ser spport when wed on
+Subject: [PATCH 3005/3010] mt76 add ser spport when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  dma.c           | 29 ++++++++++++++++++++---------
  dma.h           |  2 +-
@@ -15,7 +16,7 @@
  7 files changed, 76 insertions(+), 15 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index a8739eb4..d63b02f5 100644
+index a8739eb..d63b02f 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -169,7 +169,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -109,7 +110,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 90370d12..083cbca4 100644
+index 90370d1..083cbca 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -58,5 +58,5 @@ enum mt76_mcu_evt_type {
@@ -120,10 +121,10 @@
 +int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
  #endif
 diff --git a/mt76.h b/mt76.h
-index 959fb240..3530d213 100644
+index 45439a7..13bdc08 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1365,6 +1365,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1373,6 +1373,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,7 +133,7 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 702d629a..96cad2b5 100644
+index 702d629..96cad2b 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -532,6 +532,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -203,7 +204,7 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 1ef7cb45..e78f30fc 100644
+index 1ef7cb4..e78f30f 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -918,6 +918,8 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -248,7 +249,7 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 45520c74..6a1877d4 100644
+index 45520c7..6a1877d 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -616,6 +616,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
@@ -261,10 +262,10 @@
  	if (mtk_wed_device_attach(wed))
  		return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e2127e02..3a81261b 100644
+index 346571a..412f4f4 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -547,6 +547,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -548,6 +548,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
@@ -273,5 +274,5 @@
  void mt7915_unregister_device(struct mt7915_dev *dev);
  void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
index ec3a0a3..4d886be 100644
--- a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
@@ -1,9 +1,10 @@
-From 3c7f7b7883ce2dd0f185488d1f67d689330213d4 Mon Sep 17 00:00:00 2001
+From 301353df129dc70115481141357c590b4362a5c8 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Fri, 5 Aug 2022 13:58:11 -0700
-Subject: [PATCH 3006/3011] mt76: mt7915: add statistic for H/W Rx Path
+Subject: [PATCH 3006/3010] mt76: mt7915: add statistic for H/W Rx Path
 
 Change-Id: Id94d663f08e91c83d296bd57e5e9b65a505ae1c7
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt76.h          |  4 ++++
  mt7915/mac.c    | 25 +++++++++++++++++++++++++
@@ -13,7 +14,7 @@
  5 files changed, 56 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 3530d213..47a92132 100644
+index 13bdc08..14c58bc 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -278,6 +278,10 @@ struct mt76_sta_stats {
@@ -28,7 +29,7 @@
  
  enum mt76_wcid_flags {
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e78f30fc..7fb161db 100644
+index e78f30f..7fb161d 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -942,6 +942,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
@@ -64,7 +65,7 @@
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 5e37c4c8..01d64b2f 100644
+index 5e37c4c..01d64b2 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1050,7 +1050,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
@@ -91,7 +92,7 @@
  }
  
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6a1877d4..cd8326b0 100644
+index 6a1877d..cd8326b 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -9,6 +9,7 @@
@@ -133,10 +134,10 @@
  #else
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3a81261b..b1fbbae9 100644
+index 412f4f4..9977162 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -548,6 +548,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
+@@ -549,6 +549,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
  void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
@@ -146,5 +147,5 @@
  void mt7915_unregister_device(struct mt7915_dev *dev);
  void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
index 805db7c..57ec82a 100644
--- a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
@@ -1,7 +1,7 @@
-From ad97dee36cde2face7aa7b19470e040b8681e7c8 Mon Sep 17 00:00:00 2001
+From 7953cd4cc8b1f91e56ee6cae491a227bafe5f81e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3007/3011] mt76: mt7915: enable red per-band token drop for HW
+Subject: [PATCH 3007/3010] mt76: mt7915: enable red per-band token drop for HW
  Path
 
 Limit the number of token used by each band. If a band uses too many token,
@@ -9,6 +9,7 @@
 problem by AQL.
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt7915/mcu.c    | 53 +++++++++++++++++++++++++++++++++++++++----------
  mt7915/mcu.h    |  1 +
@@ -16,7 +17,7 @@
  3 files changed, 45 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 87e02de7..7fc24e67 100644
+index eda4f70..b98c8e8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2412,8 +2412,13 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
@@ -110,7 +111,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1f56db6b..9181e961 100644
+index cb95add..4071a73 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -269,6 +269,7 @@ enum {
@@ -122,15 +123,18 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b1fbbae9..ac3f4763 100644
+index 9977162..e0c0b49 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -752,11 +752,11 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -753,6 +753,7 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value,
  			 s8 compensation);
 +int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
  
+ int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
+ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
+@@ -760,7 +761,6 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
@@ -139,5 +143,5 @@
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
index 8b511a9..87b609b 100644
--- a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
@@ -1,16 +1,17 @@
-From 9082a5d0fef0f16f1d34285898b9c5090ab21a03 Mon Sep 17 00:00:00 2001
+From a75a445f60dd12ccd14c21e04eb5bab872546926 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH 3008/3011] mt76: mt7915: update mt7916 trinfo when hw path
+Subject: [PATCH 3008/3010] mt76: mt7915: update mt7916 trinfo when hw path
  enable
 
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt7915/mt7915_debug.h | 10 ++++++++++
  mt7915/mtk_debugfs.c  | 16 +++++++++++++---
  2 files changed, 23 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-index ecdc02ab..0a1ee808 100644
+index ecdc02a..0a1ee80 100644
 --- a/mt7915/mt7915_debug.h
 +++ b/mt7915/mt7915_debug.h
 @@ -133,6 +133,8 @@ enum dbg_reg_rev {
@@ -57,7 +58,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9de5b0f6..5f09f0aa 100644
+index c5e0472..41bd0ff 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -855,12 +855,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
@@ -87,5 +88,5 @@
  	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
  	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
index 09b05b8..4555f30 100644
--- a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
@@ -1,18 +1,19 @@
-From 8798ce118731d2446d8d1b1c4ab0f1062fc08ea7 Mon Sep 17 00:00:00 2001
+From ee742fbd2c1d7334553fc07787fca09b227e71f5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 27 Sep 2022 16:34:26 +0800
-Subject: [PATCH 3009/3011] mt76: mt7915: find rx token by physical address
+Subject: [PATCH 3009/3010] mt76: mt7915: find rx token by physical address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
 WED HW bug. Lookup correct token id by physical address in sdp0.
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  dma.c | 19 ++++++++++++++++++-
  1 file changed, 18 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index d63b02f5..a7a4538a 100644
+index d63b02f..a7a4538 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -380,11 +380,28 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -46,5 +47,5 @@
  		if (!r)
  			return NULL;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
index e516e83..de8d4df 100644
--- a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
@@ -1,12 +1,13 @@
-From a71f60174d354cd7d4bf82ade7534c1578a8fd17 Mon Sep 17 00:00:00 2001
+From b5a473223aa9bebafa51b5dd465cf6924871eecf Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 28 Sep 2022 18:52:54 +0800
-Subject: [PATCH 3010/3011] mt76: mt7915: drop scatter and gather frame
+Subject: [PATCH 3010/3010] mt76: mt7915: drop scatter and gather frame
 
 The scatter and gather frame may be incorrect because WED and WO may
 send frames to host driver interleaved.
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  dma.c  | 9 +++++++++
  dma.h  | 1 +
@@ -14,7 +15,7 @@
  3 files changed, 11 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index a7a4538a..c106ae42 100644
+index a7a4538..c106ae4 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -419,6 +419,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -34,7 +35,7 @@
  		buf_addr = e->dma_addr[0];
  		e->buf = NULL;
 diff --git a/dma.h b/dma.h
-index 083cbca4..221fcc8e 100644
+index 083cbca..221fcc8 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -21,6 +21,7 @@
@@ -46,7 +47,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index 47a92132..1af188e1 100644
+index 14c58bc..e5748f2 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -32,6 +32,7 @@
@@ -58,5 +59,5 @@
  #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
  				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index bdcae31..ee016a0 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -19,20 +19,21 @@
     file://1111-mt76-testmode-additional-supports.patch \
     file://1112-mt76-testmode-add-pre-cal-support.patch \
     file://1113-mt76-testmode-add-iBF-command-mode-support.patch \
-    file://1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
-    file://1116-mt76-airtime-fairness-feature-off-in-mac80211.patch \
-    file://1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
-    file://1118-mt76-mt7915-add-phy-capability-vendor-command.patch \
-    file://1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch \
-    file://1120-mt76-mt7915-implement-bin-file-mode.patch \
-    file://1121-mt76-mt7915-initialize-wcid.patch \
-    file://1122-mt76-HEMU-Add-dump-support.patch \
-    file://1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
-    file://1124-mt76-add-ibf-control-vendor-cmd.patch \
-    file://1125-mt76-mt7915-add-AMPDU-AMSDU-OnOff-ctonrol.patch \
-    file://1126-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
-    file://1127-mt76-support-on-off-SW-ACI-through-debugfs.patch \
+    file://1114-mt76-testmode-add-ZWDFS-test-mode-support.patch \
+    file://1115-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
+    file://1116-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
+    file://1117-mt76-airtime-fairness-feature-off-in-mac80211.patch \
+    file://1118-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
+    file://1119-mt76-mt7915-add-phy-capability-vendor-command.patch \
+    file://1120-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch \
+    file://1121-mt76-mt7915-implement-bin-file-mode.patch \
+    file://1122-mt76-mt7915-initialize-wcid.patch \
+    file://1123-mt76-HEMU-Add-dump-support.patch \
+    file://1124-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
+    file://1125-mt76-add-ibf-control-vendor-cmd.patch \
+    file://1126-mt76-mt7915-add-AMPDU-AMSDU-OnOff-ctonrol.patch \
+    file://1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
+    file://1128-mt76-support-on-off-SW-ACI-through-debugfs.patch \
     file://3001-mt76-add-wed-tx-support.patch \
     file://3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch \
     file://3003-mt76-add-wed-rx-support.patch \