diff --git a/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-Fixed-null-pointer-dereference-.patch b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-Fixed-null-pointer-dereference-.patch
new file mode 100644
index 0000000..db43154
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0009-wifi-mt76-mt7915-Fixed-null-pointer-dereference-.patch
@@ -0,0 +1,42 @@
+From ab20e5711ee36a8c0bace4b39d081626c616b94b Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Thu, 26 Oct 2023 21:11:05 +0800
+Subject: [PATCH] wifi: mt76: mt7915: Fixed null pointer dereference
+ issue
+
+Without this patch, when the station is still in Authentication stage and
+sends a "Notify bandwidth change action frame" to AP at the same time,
+there will be a race condition that causes a crash to occur because the AP
+access "msta->vif" that has not been fully initialized.
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Money Wang <money.wang@mediatek.com>
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ mt7915/main.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 96336b6..f2fe250 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1165,9 +1165,16 @@ static void mt7915_sta_rc_update(struct ieee80211_hw *hw,
+ 				 struct ieee80211_sta *sta,
+ 				 u32 changed)
+ {
++	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ 	struct mt7915_dev *dev = phy->dev;
+ 
++	if (!msta->vif) {
++		dev_warn(dev->mt76.dev, "Un-initialized STA %pM wcid %d in rc_work\n",
++			 sta->addr, msta->wcid.idx);
++		return;
++	}
++
+ 	mt7915_sta_rc_work(&changed, sta);
+ 	ieee80211_queue_work(hw, &dev->rc_work);
+ }
+-- 
+2.39.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
index ba96f5f..ee5851c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch
@@ -460,10 +460,10 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 00000000..fa8794fd
+index 0000000..4ab113e
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
-@@ -0,0 +1,1418 @@
+@@ -0,0 +1,1432 @@
 +#ifndef __MT7915_DEBUG_H
 +#define __MT7915_DEBUG_H
 +
@@ -634,6 +634,15 @@
 +	[MT_DBG_SWDEF_BASE]		= 0x411400,
 +};
 +
++static const u32 mt7981_dbg_base[] = {
++	[MT_DBG_WFDMA0_BASE]		= 0x24000,
++	[MT_DBG_WFDMA1_BASE]		= 0x25000,
++	[MT_DBG_WFDMA0_PCIE1_BASE]	= 0x28000,
++	[MT_DBG_WFDMA1_PCIE1_BASE]	= 0x29000,
++	[MT_DBG_WFDMA_EXT_CSR_BASE]	= 0x27000,
++	[MT_DBG_SWDEF_BASE]		= 0x411400,
++};
++
 +static const u32 mt7986_dbg_base[] = {
 +	[MT_DBG_WFDMA0_BASE]		= 0x24000,
 +	[MT_DBG_WFDMA1_BASE]		= 0x25000,
@@ -888,6 +897,11 @@
 +	  mt7916_dbg_reg,
 +	  mt7916_dbg_mask
 +	},
++	{ 0x7981,
++	  mt7981_dbg_base,
++	  mt7916_dbg_reg,
++	  mt7916_dbg_mask
++	},
 +	{ 0x7986,
 +	  mt7986_dbg_base,
 +	  mt7916_dbg_reg,
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
index b8198c4..34cfb64 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-wifi-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From d35da7aef3ecc8b64605277374e676dcf3bffd94 Mon Sep 17 00:00:00 2001
+From 2dcee575f60d16902ef7fc10fda827a9f389f61a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1004/1040] wifi: mt76: mt7915: certification patches
+Subject: [PATCH] wifi: mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -11,9 +11,9 @@
  mt7915/mcu.h         | 207 ++++++++++++++++++-
  mt7915/mt7915.h      |  13 ++
  mt7915/mtk_debugfs.c |   7 +-
- mt7915/vendor.c      | 187 +++++++++++++++++
+ mt7915/vendor.c      | 188 +++++++++++++++++
  mt7915/vendor.h      |  42 ++++
- 9 files changed, 954 insertions(+), 5 deletions(-)
+ 9 files changed, 955 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
 index c1d9191..9b065f3 100644
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index d667b44..ce5dcb3 100644
+index 7c27897..0b6622e 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -747,6 +747,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -748,6 +748,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -775,7 +778,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -776,7 +779,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -842,7 +842,7 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index b7c54cc..96655db 100644
+index 803cabc..587497b 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2562,7 +2562,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
@@ -867,7 +867,7 @@
  	}
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 43f9690..5a1cce1 100644
+index 43f9690..19c9e71 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -900,7 +900,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -779,6 +802,148 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+@@ -779,6 +802,149 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
  	return len + 1;
  }
  
@@ -1015,6 +1015,7 @@
 +			mt7915_set_wireless_vif, &val32);
 +		if (val8 == 3) /* DL20and80 */
 +			mt7915_mcu_set_dynalgo(phy, 1); /* Enable dynamic algo */
++		mt7915_mcu_set_mu_prot_frame_th(phy, 9999);
 +	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]) {
 +		val16 = nla_get_u16(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]);
 +		hw->max_tx_aggregation_subframes = val16;
@@ -1049,7 +1050,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -803,6 +968,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+@@ -803,6 +969,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.dumpit = mt7915_vendor_amnt_ctrl_dump,
  		.policy = amnt_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
diff --git a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
index ca61e6e..9f92153 100644
--- a/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1009-wifi-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 555abaed13e0426eb3295c7f7b02de57320a63e6 Mon Sep 17 00:00:00 2001
+From e7c6d49d0b5582ba7cb37d9d844a341b18c5a393 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH] wifi: mt76: testmode: additional supports
+Subject: [PATCH 1009/1042] wifi: mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -20,13 +20,13 @@
  mt7915/mmio.c     |    2 +
  mt7915/mt7915.h   |   17 +-
  mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1238 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.c | 1244 ++++++++++++++++++++++++++++++++++++++++++---
  mt7915/testmode.h |  278 ++++++++++
  testmode.c        |  287 +++++++++--
  testmode.h        |   79 +++
  tools/fields.c    |   90 +++-
  tx.c              |    3 +-
- 20 files changed, 2058 insertions(+), 167 deletions(-)
+ 20 files changed, 2063 insertions(+), 168 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index 24b44e7..8049830 100644
@@ -395,7 +395,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index ce5dcb3..3b18c95 100644
+index 0b6622e..44a1b21 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -642,7 +642,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4693919..8367204 100644
+index 4693919..32dc85c 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,10 @@
@@ -1528,7 +1528,18 @@
  	if (ret)
  		return ret;
  
-@@ -458,64 +1255,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -447,7 +1244,9 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
+ 		return;
+ 
+-	mt7915_mcu_set_sku_en(phy, !en);
++	phy->sku_limit_en = !en;
++	phy->sku_path_en = !en;
++	mt7915_mcu_set_sku_en(phy);
+ 
+ 	mt7915_tm_mode_ctrl(dev, en);
+ 	mt7915_tm_reg_backup_restore(phy);
+@@ -458,64 +1257,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  
  	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
  
@@ -1787,7 +1798,7 @@
  
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
-@@ -544,10 +1504,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -544,10 +1506,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  		return ret;
  
  	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
@@ -1798,7 +1809,7 @@
  
  	if (!clear) {
  		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
-@@ -562,13 +1518,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -562,13 +1520,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  	return 0;
  }
  
@@ -1861,7 +1872,7 @@
  
  		/* read-clear */
  		mt7915_tm_get_rx_stats(phy, true);
-@@ -576,9 +1580,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -576,9 +1582,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  		/* clear fw count */
  		mt7915_tm_set_phy_count(phy, 0);
  		mt7915_tm_set_phy_count(phy, 1);
@@ -1876,7 +1887,7 @@
  }
  
  static int
-@@ -617,34 +1624,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+@@ -617,34 +1626,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  	tx_cont->tx_ant = td->tx_antenna_mask;
  	tx_cont->band = band;
  
@@ -1912,12 +1923,14 @@
  
  	if (!en) {
  		req.op.rf.param.func_data = cpu_to_le32(band);
-@@ -728,6 +1708,16 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -728,6 +1710,18 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
  	if (changed & BIT(TM_CHANGED_TXPOWER))
  		mt7915_tm_set_tx_power(phy);
 +	if (changed & BIT(TM_CHANGED_SKU_EN)) {
-+		mt7915_mcu_set_sku_en(phy, td->sku_en);
++		phy->sku_limit_en = td->sku_en;
++		phy->sku_path_en = td->sku_en;
++		mt7915_mcu_set_sku_en(phy);
 +		mt7915_mcu_set_txpower_sku(phy);
 +	}
 +	if (changed & BIT(TM_CHANGED_AID))
@@ -1929,7 +1942,7 @@
  }
  
  static int
-@@ -737,6 +1727,11 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -737,6 +1731,11 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	struct mt7915_phy *phy = mphy->priv;
  	enum mt76_testmode_state prev_state = td->state;
  
@@ -1941,7 +1954,7 @@
  	mphy->test.state = state;
  
  	if (prev_state == MT76_TM_STATE_TX_FRAMES ||
-@@ -757,7 +1752,7 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -757,7 +1756,7 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	    (state == MT76_TM_STATE_OFF &&
  	     prev_state == MT76_TM_STATE_IDLE)) {
  		u32 changed = 0;
@@ -1950,7 +1963,7 @@
  
  		for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
  			u16 cur = tm_change_map[i];
-@@ -766,6 +1761,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -766,6 +1765,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  				changed |= BIT(i);
  		}
  
@@ -1961,7 +1974,7 @@
  		mt7915_tm_update_params(phy, changed);
  	}
  
-@@ -778,10 +1777,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+@@ -778,10 +1781,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
  {
  	struct mt76_testmode_data *td = &mphy->test;
  	struct mt7915_phy *phy = mphy->priv;
@@ -1974,7 +1987,7 @@
  
  	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
  
-@@ -789,9 +1786,9 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+@@ -789,9 +1790,9 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
  	    td->state == MT76_TM_STATE_OFF)
  		return 0;
  
@@ -1987,7 +2000,7 @@
  
  	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
  		if (tb[tm_change_map[i]])
-@@ -807,6 +1804,7 @@ static int
+@@ -807,6 +1808,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1995,7 +2008,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -827,6 +1825,16 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -827,6 +1829,16 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rssi);
  
@@ -2012,7 +2025,7 @@
  	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_IB_RSSI);
  	if (!rssi)
  		return -ENOMEM;
-@@ -852,11 +1860,75 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -852,11 +1864,75 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
index e6f1971..eedc6de 100644
--- a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
@@ -1,8 +1,8 @@
-From ea0393c4c9076db02c3ebe34b87dc381c34e5a3d Mon Sep 17 00:00:00 2001
+From abf253c784db9cb42cf14ca7b825227ef982c3cd Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH 1013/1040] wifi: mt76: testmode: add iBF/eBF cal and cert
- commands with golden
+Subject: [PATCH] wifi: mt76: testmode: add iBF/eBF cal and cert commands with
+ golden
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -15,20 +15,20 @@
  mt7915/mmio.c        |   2 +
  mt7915/mt7915.h      |  14 +-
  mt7915/mtk_debugfs.c |  35 ++++
- mt7915/mtk_mcu.c     | 246 ++++++++++++++++++++++-
+ mt7915/mtk_mcu.c     | 247 ++++++++++++++++++++++-
  mt7915/regs.h        |   4 +
  mt7915/testmode.c    | 461 ++++++++++++++++++++++++++++---------------
  mt7915/testmode.h    | 134 +------------
  testmode.c           |   1 +
  testmode.h           |   9 +
  tools/fields.c       |   9 +
- 16 files changed, 857 insertions(+), 324 deletions(-)
+ 16 files changed, 858 insertions(+), 324 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index ed69106..fa9c6a4 100644
+index 7ae061d..d16accd 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -716,6 +716,7 @@ struct mt76_testmode_data {
+@@ -718,6 +718,7 @@ struct mt76_testmode_data {
  
  	struct list_head tm_entry_list;
  	struct mt76_wcid *cur_entry;
@@ -36,7 +36,7 @@
  	u8 entry_num;
  	union {
  		struct mt76_testmode_entry_data ed;
-@@ -744,6 +745,9 @@ struct mt76_testmode_data {
+@@ -746,6 +747,9 @@ struct mt76_testmode_data {
  
  	u8 txbf_act;
  	u16 txbf_param[8];
@@ -68,10 +68,10 @@
  		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index bd0efd5..4244177 100644
+index 06a5fb1..948f07b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -729,8 +729,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+@@ -730,8 +730,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
  		val |= MT_TXD6_LDPC;
  
  	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
@@ -84,7 +84,7 @@
  	txwi[6] |= cpu_to_le32(val);
  #endif
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3b18c95..169d597 100644
+index 44a1b21..8c9b0b2 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
@@ -146,7 +146,7 @@
  
  	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
  	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
-@@ -279,7 +270,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -280,7 +271,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
@@ -468,10 +468,10 @@
  	[AGG_AALCR0]		= 0x028,
  	[AGG_AWSCR0]		= 0x030,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 33ac2d2..135b39b 100644
+index 78ddbaf..2ef63a3 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -274,7 +274,6 @@ struct mt7915_phy {
+@@ -275,7 +275,6 @@ struct mt7915_phy {
  
  		u8 spe_idx;
  
@@ -479,7 +479,7 @@
  		bool bf_ever_en;
  	} test;
  #endif
-@@ -379,7 +378,7 @@ struct mt7915_dev {
+@@ -380,7 +379,7 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -488,7 +488,7 @@
  	struct {
  		void *txbf_phase_cal;
  		void *txbf_pfmu_data;
-@@ -518,6 +517,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+@@ -519,6 +518,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int mt7915_dma_start(struct mt7915_dev *dev, bool reset, bool wed_reset);
  int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
@@ -496,7 +496,7 @@
  void mt7915_reset(struct mt7915_dev *dev);
  int mt7915_run(struct ieee80211_hw *hw);
  int mt7915_mcu_init(struct mt7915_dev *dev);
-@@ -598,8 +598,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -599,8 +599,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -508,7 +508,7 @@
  
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
-@@ -734,4 +736,10 @@ enum {
+@@ -735,4 +737,10 @@ enum {
  
  #endif
  
@@ -520,7 +520,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 96655db..7fc6a3f 100644
+index 587497b..2ce1837 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2890,6 +2890,36 @@ mt7915_txpower_level_set(void *data, u64 val)
@@ -564,16 +564,16 @@
  	debugfs_create_file("txpower_level", 0400, dir, dev,
  			    &fops_txpower_level);
  
-+	debugfs_create_file("txbf_pfmu_tag_idx", 0600, dir, phy,
++	debugfs_create_file("pfmu_tag_read", 0600, dir, phy,
 +			    &fops_txbf_pfmu_tag_idx);
-+	debugfs_create_file("txbf_sta_rec", 0600, dir, dev,
++	debugfs_create_file("bf_starec_read", 0600, dir, dev,
 +			    &fops_txbf_sta_rec);
 +
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
  	return 0;
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
-index 143dae2..906c872 100644
+index 143dae2..7a2d28c 100644
 --- a/mt7915/mtk_mcu.c
 +++ b/mt7915/mtk_mcu.c
 @@ -1,9 +1,10 @@
@@ -588,7 +588,7 @@
  
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
  {
-@@ -49,3 +50,246 @@ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
+@@ -49,3 +50,247 @@ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
  }
@@ -809,10 +809,11 @@
 +		.bfer = bfer,
 +		.dbdc_idx = phy->mt76->band_idx,
 +	};
-+	struct mt7915_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
 +
 +	/* Reset to 0 for mt7915_tm_txbf_profile_tag_write wait_event */
-+	tag->t1.pfmu_idx = 0;
++	if (tag)
++		tag->t1.pfmu_idx = 0;
 +
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
 +				 sizeof(req), true);
@@ -858,10 +859,10 @@
  #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
  #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index e321848..d5c74df 100644
+index 1e6791e..5e20cb9 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
-@@ -53,6 +53,8 @@ struct reg_band {
+@@ -55,6 +55,8 @@ struct reg_band {
  static struct reg_band reg_backup_list[TM_REG_MAX_ID];
  
  static void mt7915_tm_update_entry(struct mt7915_phy *phy);
@@ -870,7 +871,7 @@
  
  static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
  {
-@@ -92,6 +94,25 @@ mt7915_tm_check_antenna(struct mt7915_phy *phy)
+@@ -94,6 +96,25 @@ mt7915_tm_check_antenna(struct mt7915_phy *phy)
  	return 0;
  }
  
@@ -896,7 +897,7 @@
  static void
  mt7915_tm_update_channel(struct mt7915_phy *phy)
  {
-@@ -292,17 +313,33 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -294,17 +315,33 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_dev *dev = phy->dev;
@@ -937,7 +938,7 @@
  
  	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
  					    &msta->wcid);
-@@ -318,8 +355,11 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -320,8 +357,11 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	bf->ncol = nc;
  	bf->nrow = nr;
  	bf->ndp_rate = ndp_rate;
@@ -950,7 +951,7 @@
  
  	if (ebf) {
  		bf->mem[0].row = 0;
-@@ -372,11 +412,8 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+@@ -374,11 +414,8 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
  	}
  
  	memcpy(sta->addr, ed->addr[0], ETH_ALEN);
@@ -964,7 +965,7 @@
  
  	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
  		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
-@@ -401,6 +438,14 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+@@ -403,6 +440,14 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
  	list_add_tail(&msta->wcid.list, &td->tm_entry_list);
  	td->entry_num++;
  
@@ -979,7 +980,7 @@
  	return 0;
  }
  
-@@ -470,7 +515,7 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+@@ -472,7 +517,7 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
  	struct mt76_testmode_entry_data *ed, tmp;
  	struct mt76_wcid *wcid, *last;
  
@@ -988,7 +989,7 @@
  		return;
  
  	memcpy(&tmp, &td->ed, sizeof(tmp));
-@@ -491,20 +536,30 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+@@ -493,20 +538,30 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
  static int
  mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
  {
@@ -1022,7 +1023,7 @@
  					 MAX_PHASE_GROUP_NUM,
  					 GFP_KERNEL);
  		if (!phase_cal)
-@@ -514,7 +569,10 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+@@ -516,7 +571,10 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
  	}
  
  	if (!dev->test.txbf_pfmu_data) {
@@ -1034,7 +1035,7 @@
  		if (!pfmu_data)
  			return -ENOMEM;
  
-@@ -523,21 +581,77 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+@@ -525,21 +583,77 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
  
  	if (!dev->test.txbf_pfmu_tag) {
  		pfmu_tag = devm_kzalloc(dev->mt76.dev,
@@ -1118,7 +1119,7 @@
  
  	return mt7915_tm_set_trx(phy, TM_MAC_TX, true);
  }
-@@ -564,8 +678,7 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+@@ -566,8 +680,7 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
  		.read_from_e2p = val[3],
  		.disable = val[4],
  	};
@@ -1128,7 +1129,7 @@
  
  	wait_event_timeout(dev->mt76.tx_wait, phase[val[2]].status != 0, HZ);
  	memcpy(req.buf, &phase[val[2]].phase, sizeof(req.buf));
-@@ -578,32 +691,9 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+@@ -580,32 +693,9 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
  				 sizeof(req), true);
  }
  
@@ -1162,7 +1163,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct {
-@@ -630,8 +720,6 @@ static int
+@@ -632,8 +722,6 @@ static int
  mt7915_tm_txbf_apply_tx(struct mt7915_phy *phy, u16 wlan_idx, bool ebf,
  			bool ibf, bool phase_cal)
  {
@@ -1171,7 +1172,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 category;
-@@ -660,14 +748,15 @@ static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
+@@ -662,14 +750,15 @@ static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct mt76_testmode_entry_data *ed = mt76_testmode_entry_data(phy->mt76, wcid);
@@ -1189,7 +1190,7 @@
  	rate.nss = ed->tx_rate_nss;
  	rate.mcs = ed->tx_rate_idx;
  	rate.ldpc = (rate.bw || ed->tx_rate_ldpc) * GENMASK(2, 0);
-@@ -681,13 +770,14 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+@@ -683,13 +772,14 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
  {
  	bool bf_on = val[0], update = val[3];
  	/* u16 wlan_idx = val[2]; */
@@ -1206,7 +1207,7 @@
  		tag->t1.invalid_prof = false;
  		mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
  
-@@ -702,7 +792,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+@@ -704,7 +794,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
  		} else {
  			phy->test.bf_ever_en = false;
  
@@ -1215,7 +1216,7 @@
  			tag->t1.invalid_prof = true;
  			mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
  		}
-@@ -717,6 +807,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+@@ -719,6 +809,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
  static int
  mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  {
@@ -1223,7 +1224,7 @@
  	static const u8 mode_to_lm[] = {
  		[MT76_TM_TX_MODE_CCK] = 0,
  		[MT76_TM_TX_MODE_OFDM] = 0,
-@@ -730,7 +821,8 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+@@ -732,7 +823,8 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  	struct mt76_testmode_data *td = &phy->mt76->test;
  	struct mt76_wcid *wcid;
  	struct ieee80211_vif *vif = phy->monitor_vif;
@@ -1233,7 +1234,7 @@
  	u8 pfmu_idx = val[0], nc = val[2], nr;
  	bool is_atenl = val[6];
  	int ret;
-@@ -748,18 +840,22 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+@@ -750,18 +842,22 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  	tag->t1.nr = nr;
  	tag->t1.nc = nc;
  	tag->t1.invalid_prof = true;
@@ -1262,7 +1263,7 @@
  	} else {
  		tag->t1.row_id1 = 4;
  		tag->t1.row_id2 = 5;
-@@ -780,6 +876,20 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+@@ -782,6 +878,20 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  	if (ret)
  		return ret;
  
@@ -1283,7 +1284,7 @@
  	if (!ebf && is_atenl)
  		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
  
-@@ -797,7 +907,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+@@ -799,7 +909,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
  		u8 category;
  		u8 group_l_m_n;
  		u8 group;
@@ -1292,7 +1293,7 @@
  		u8 cal_type;
  		u8 lna_gain_level;
  		u8 _rsv[2];
-@@ -805,12 +915,12 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+@@ -807,12 +917,12 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
  		.category = MT_BF_PHASE_CAL,
  		.group = val[0],
  		.group_l_m_n = val[1],
@@ -1308,7 +1309,7 @@
  
  	phase[req.group].status = 0;
  
-@@ -818,53 +928,10 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+@@ -820,53 +930,10 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
  				 sizeof(req), true);
  }
  
@@ -1363,7 +1364,7 @@
  	struct mt76_testmode_data *td = &phy->mt76->test;
  	u8 nss = hweight8(td->tx_antenna_mask);
  	u16 pfmu_idx = val[0];
-@@ -874,9 +941,9 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -876,9 +943,9 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  	u16 angle31 = val[4];
  	u16 angle41 = val[5];
  	s16 phi11 = 0, phi21 = 0, phi31 = 0;
@@ -1375,7 +1376,7 @@
  		return -EINVAL;
  
  	if (nss == 2) {
-@@ -890,7 +957,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -892,7 +959,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  		phi31 = (s16)(angle41 - angle31);
  	}
  
@@ -1384,7 +1385,7 @@
  	pfmu_data = &pfmu_data[subc_id];
  
  	if (subc_id < 32)
-@@ -900,21 +967,21 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -902,21 +969,21 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  	pfmu_data->phi11 = cpu_to_le16(phi11);
  	pfmu_data->phi21 = cpu_to_le16(phi21);
  	pfmu_data->phi31 = cpu_to_le16(phi31);
@@ -1409,7 +1410,7 @@
  
  		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
  					 &req, sizeof(req), true);
-@@ -926,7 +993,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -928,7 +995,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  static int
  mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
  {
@@ -1418,7 +1419,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	u8 *eeprom = dev->mt76.eeprom.data;
  	u16 offset;
-@@ -936,7 +1003,7 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+@@ -938,7 +1005,7 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
  	is_7976 = mt7915_check_adie(dev, false) || is_mt7916(&dev->mt76);
  	offset = is_7976 ? 0x60a : 0x651;
  
@@ -1427,7 +1428,7 @@
  	for (i = 0; i < MAX_PHASE_GROUP_NUM; i++) {
  		p = &phase[i];
  
-@@ -951,17 +1018,75 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+@@ -953,17 +1020,75 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
  	return 0;
  }
  
@@ -1505,7 +1506,7 @@
  		return mt7915_tm_txbf_init(phy, val);
  	case MT76_TM_TXBF_ACT_UPDATE_CH:
  		mt7915_tm_update_channel(phy);
-@@ -987,6 +1112,36 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+@@ -989,6 +1114,36 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
  
  		return mt7915_tm_txbf_apply_tx(phy, wlan_idx, ebf, ibf, phase_cal);
  	}
@@ -1542,7 +1543,7 @@
  	default:
  		break;
  	};
-@@ -1262,9 +1417,10 @@ mt7915_tm_set_ipi(struct mt7915_phy *phy)
+@@ -1264,9 +1419,10 @@ mt7915_tm_set_ipi(struct mt7915_phy *phy)
  
  static int
  mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
@@ -1555,7 +1556,7 @@
  	struct mt7915_mcu_tx req = {
  		.valid = true,
  		.mode = tx_cmd,
-@@ -1272,6 +1428,9 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+@@ -1274,6 +1430,9 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
  	};
  	struct edca *e = &req.edca[0];
  
@@ -1565,7 +1566,7 @@
  	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
  	e->set = WMM_PARAM_SET;
  
-@@ -1284,17 +1443,19 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+@@ -1286,17 +1445,19 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
  }
  
  static int
@@ -1586,7 +1587,7 @@
  	u8 band = phy->mt76->band_idx;
  	u32 i2t_time, tr2t_time, txv_time;
  	u16 cw = 0;
-@@ -1308,6 +1469,7 @@ mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
+@@ -1310,6 +1471,7 @@ mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
  	ipg -= sig_ext;
  
  	if (ipg <= (TM_MAX_SIFS + slot_time)) {
@@ -1594,7 +1595,7 @@
  		sifs = ipg - slot_time;
  	} else {
  		u32 val = (ipg + slot_time) / slot_time;
-@@ -1343,10 +1505,12 @@ done:
+@@ -1345,10 +1507,12 @@ done:
  
  	mt7915_tm_set_slot_time(phy, slot_time, sifs);
  
@@ -1609,7 +1610,7 @@
  }
  
  static int
-@@ -1545,7 +1709,7 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -1547,7 +1711,7 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  
  		phy->mt76->test.aid = 0;
  		phy->mt76->test.tx_mpdu_len = 0;
@@ -1618,7 +1619,7 @@
  		mt7915_tm_set_entry(phy);
  	} else {
  		INIT_DELAYED_WORK(&phy->ipi_work, mt7915_tm_ipi_work);
-@@ -1730,7 +1894,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1732,7 +1896,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
  		u8 duty_cycle = td->tx_duty_cycle;
  
@@ -1627,7 +1628,7 @@
  			mt7915_tm_update_channel(phy);
  
  		if (td->tx_spe_idx)
-@@ -1745,7 +1909,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1747,7 +1911,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  			if (duty_cycle < 100)
  				tx_time = duty_cycle * ipg / (100 - duty_cycle);
  		}
@@ -1636,7 +1637,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
  		if (ipg)
-@@ -1764,6 +1928,9 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1766,6 +1930,9 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  		mt7915_tm_tx_frames_mu(phy, en);
  
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
@@ -1646,7 +1647,7 @@
  }
  
  static int
-@@ -1855,7 +2022,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -1857,7 +2024,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
  
  	if (en) {
@@ -1655,7 +1656,7 @@
  			mt7915_tm_update_channel(phy);
  		if (td->aid)
  			mt7915_tm_set_rx_user_idx(phy, td->aid);
-@@ -1872,6 +2039,9 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -1874,6 +2041,9 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  		mt7915_tm_set_muru_aid(phy, en ? td->aid : 0xf800);
  
  	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
@@ -1665,7 +1666,7 @@
  }
  
  static int
-@@ -1931,34 +2101,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+@@ -1933,34 +2103,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  		rate_idx = sband->bitrates[idx].hw_value & 0xff;
  	}
  
@@ -1846,10 +1847,10 @@
  
  #endif
 diff --git a/testmode.c b/testmode.c
-index babae8d..4ea5877 100644
+index 4c22dfc..410c7ab 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -195,6 +195,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
+@@ -196,6 +196,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
  
  	hdr = __skb_put_zero(head, sizeof(*hdr));
  	hdr->frame_control = cpu_to_le16(fc);
@@ -1858,10 +1859,10 @@
  	memcpy(hdr->addr2, addr[1], ETH_ALEN);
  	memcpy(hdr->addr3, addr[2], ETH_ALEN);
 diff --git a/testmode.h b/testmode.h
-index 97e7596..e13920e 100644
+index b39cf51..20fab3e 100644
 --- a/testmode.h
 +++ b/testmode.h
-@@ -299,7 +299,10 @@ enum mt76_testmode_cfg {
+@@ -303,7 +303,10 @@ enum mt76_testmode_cfg {
  };
  
  enum mt76_testmode_txbf_act {
@@ -1872,7 +1873,7 @@
  	MT76_TM_TXBF_ACT_UPDATE_CH,
  	MT76_TM_TXBF_ACT_PHASE_COMP,
  	MT76_TM_TXBF_ACT_TX_PREP,
-@@ -310,6 +313,12 @@ enum mt76_testmode_txbf_act {
+@@ -314,6 +317,12 @@ enum mt76_testmode_txbf_act {
  	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
  	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
  	MT76_TM_TXBF_ACT_E2P_UPDATE,
@@ -1886,7 +1887,7 @@
  	/* keep last */
  	NUM_MT76_TM_TXBF_ACT,
 diff --git a/tools/fields.c b/tools/fields.c
-index fc01043..7caacb9 100644
+index e2cf4b9..027b8cd 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -33,7 +33,10 @@ static const char * const testmode_tx_mode[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
index 9ab86d5..230ef81 100644
--- a/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1019-wifi-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,24 +1,25 @@
-From 21c0d49738d105ad23e248a213da069e4e57dd21 Mon Sep 17 00:00:00 2001
+From b33cf2d53b4719f00d96ba1b5280b7df593870cf Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1019/1040] wifi: mt76: mt7915: implement bin file mode
+Subject: [PATCH] wifi: mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- eeprom.c             | 20 ++++++++++++++++++++
- mt76.h               |  4 ++++
- mt7915/eeprom.c      | 36 +++++++++++++++++++++++++++++++++---
- mt7915/eeprom.h      |  7 +++++++
- mt7915/mt7915.h      |  3 +++
- mt7915/mtk_debugfs.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
- 6 files changed, 111 insertions(+), 3 deletions(-)
+ eeprom.c             | 25 +++++++++++++++++
+ mt76.h               |  4 +++
+ mt7915/eeprom.c      | 65 +++++++++++++++++++++++++++++++++++++++++---
+ mt7915/eeprom.h      |  7 +++++
+ mt7915/mt7915.h      |  3 ++
+ mt7915/mtk_debugfs.c | 44 ++++++++++++++++++++++++++++++
+ testmode.h           |  2 +-
+ 7 files changed, 145 insertions(+), 5 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 9b63799..eb532c7 100644
+index 9b63799..d5b8c56 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -159,6 +159,26 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
+@@ -159,6 +159,31 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
  }
  EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
  
@@ -33,8 +34,13 @@
 +	of_property_read_string(np, "bin_file_name", &bin_file_name);
 +
 +	dev->bin_file_name = bin_file_name;
-+	if (dev->bin_file_name)
++	if (dev->bin_file_name) {
 +		dev_info(dev->dev, "Using bin file %s\n", dev->bin_file_name);
++#ifdef CONFIG_NL80211_TESTMODE
++		dev->test_mtd.name = devm_kstrdup(dev->dev, bin_file_name, GFP_KERNEL);
++		dev->test_mtd.offset = -1;
++#endif
++	}
 +
 +	of_node_put(np);
 +
@@ -46,10 +52,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index fa9c6a4..13796ad 100644
+index d16accd..9673926 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -941,6 +941,9 @@ struct mt76_dev {
+@@ -943,6 +943,9 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -59,7 +65,7 @@
  };
  
  /* per-phy stats.  */
-@@ -1173,6 +1176,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1175,6 +1178,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -68,10 +74,53 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index a5c99a5..fd08d42 100644
+index a5c99a5..5eb9f88 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -47,8 +47,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+@@ -5,6 +5,30 @@
+ #include "mt7915.h"
+ #include "eeprom.h"
+ 
++static int
++mt7915_eeprom_load_precal_binfile(struct mt7915_dev *dev, u32 offs, u32 size)
++{
++	const struct firmware *fw = NULL;
++	int ret;
++
++	ret = request_firmware(&fw, dev->mt76.bin_file_name, dev->mt76.dev);
++	if (ret)
++		return ret;
++
++	if (!fw || !fw->data) {
++		dev_err(dev->mt76.dev, "Invalid bin (bin file mode), load precal fail\n");
++		ret = -EINVAL;
++		goto out;
++	}
++
++	memcpy(dev->cal, fw->data + offs, size);
++
++out:
++	release_firmware(fw);
++
++	return ret;
++}
++
+ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ {
+ 	struct mt76_dev *mdev = &dev->mt76;
+@@ -24,7 +48,10 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ 
+ 	offs = is_mt7915(&dev->mt76) ? MT_EE_PRECAL : MT_EE_PRECAL_V2;
+ 
+-	return mt76_get_of_eeprom(mdev, dev->cal, offs, size);
++	if (!dev->bin_file_mode)
++		return mt76_get_of_eeprom(mdev, dev->cal, offs, size);
++	else
++		return mt7915_eeprom_load_precal_binfile(dev, offs, size);
+ }
+ 
+ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+@@ -47,8 +74,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
  	}
  }
  
@@ -84,7 +133,7 @@
  	switch (mt76_chip(&dev->mt76)) {
  	case 0x7915:
  		return dev->dbdc_support ?
-@@ -89,7 +92,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
+@@ -89,7 +119,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
  		return ret;
  
  	if (!fw || !fw->data) {
@@ -96,7 +145,7 @@
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -114,6 +120,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -114,6 +147,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  
  	if (ret) {
  		dev->flash_mode = true;
@@ -104,7 +153,7 @@
  	} else {
  		u8 free_block_num;
  		u32 block_num, i;
-@@ -134,6 +141,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -134,6 +168,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  			if (ret < 0)
  				return ret;
  		}
@@ -113,7 +162,7 @@
  	}
  
  	return mt7915_check_eeprom(dev);
-@@ -239,12 +248,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -239,12 +275,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
  
@@ -167,10 +216,10 @@
  mt7915_get_channel_group_5g(int channel, bool is_7976)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c5f4e94..b6a564e 100644
+index 795af63..992323d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -350,6 +350,8 @@ struct mt7915_dev {
+@@ -351,6 +351,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -179,7 +228,7 @@
  	bool muru_debug;
  	bool ibf;
  
-@@ -726,6 +728,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
+@@ -727,6 +729,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
  int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
@@ -188,7 +237,7 @@
  #define PKT_BIN_DEBUG_MAGIC	0xc8763123
  enum {
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 7fc6a3f..b949ad7 100644
+index 7105cf0..5c676d8 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
@@ -256,6 +305,19 @@
  	return 0;
  }
  #endif
+diff --git a/testmode.h b/testmode.h
+index 20fab3e..91d1e86 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -17,7 +17,7 @@
+  * @MT76_TM_ATTR_RESET: reset parameters to default (flag)
+  * @MT76_TM_ATTR_STATE: test state (u32), see &enum mt76_testmode_state
+  *
+- * @MT76_TM_ATTR_MTD_PART: mtd partition used for eeprom data (string)
++ * @MT76_TM_ATTR_MTD_PART: mtd partition or binfile used for eeprom data (string)
+  * @MT76_TM_ATTR_MTD_OFFSET: offset of eeprom data within the partition (u32)
+  * @MT76_TM_ATTR_BAND_IDX: band idx of the chip (u8)
+  *
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index 17d289a..032e44d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1025-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,19 +1,21 @@
-From f793f54b26302abc942574b2e6f19f609b3a1c0e Mon Sep 17 00:00:00 2001
+From 51e7036b3f6295eb7a8e5925dea43cb71998f0dd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1025/1040] wifi: mt76: mt7915: add bf backoff limit table
+Subject: [PATCH 1025/1042] wifi: mt76: mt7915: add bf backoff limit table
  support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  debugfs.c        |   2 +-
- eeprom.c         |  34 +++++++++++-
+ eeprom.c         |  43 ++++++++++--
  mt76.h           |   8 +++
- mt7915/debugfs.c |  73 ++++++++++++++++++++++++--
- mt7915/mcu.c     | 132 ++++++++++++++++++++++++++++++++++++-----------
- mt7915/mcu.h     |   6 +++
- mt7915/mt7915.h  |   4 +-
- 7 files changed, 220 insertions(+), 39 deletions(-)
+ mt7915/debugfs.c |  73 ++++++++++++++++++--
+ mt7915/init.c    |   7 ++
+ mt7915/main.c    |   8 ++-
+ mt7915/mcu.c     | 175 +++++++++++++++++++++++++++++++++++++----------
+ mt7915/mcu.h     |   6 ++
+ mt7915/mt7915.h  |   9 ++-
+ 9 files changed, 279 insertions(+), 52 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
 index 1c8328d..19a835c 100644
@@ -29,10 +31,31 @@
  		seq_printf(file, " %2d", val[i]);
  	seq_puts(file, "\n");
 diff --git a/eeprom.c b/eeprom.c
-index eb532c7..4189525 100644
+index eb532c7..c0536f1 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -367,12 +367,16 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -326,9 +326,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
+ static void
+ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+ 			     const __be32 *data, size_t len, s8 target_power,
+-			     s8 nss_delta, s8 *max_power)
++			     s8 nss_delta)
+ {
+ 	int i, cur;
++	s8 max_power = -128;
+ 
+ 	if (!data)
+ 		return;
+@@ -340,7 +341,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+ 			break;
+ 
+ 		mt76_apply_array_limit(pwr + pwr_len * i, pwr_len, data + 1,
+-				       target_power, nss_delta, max_power);
++				       target_power, nss_delta, &max_power);
+ 		if (--cur > 0)
+ 			continue;
+ 
+@@ -367,12 +368,16 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	char band;
  	size_t len;
  	s8 max_power = -127;
@@ -50,9 +73,18 @@
  
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
-@@ -425,7 +429,33 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -418,14 +423,40 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+ 	val = mt76_get_of_array(np, "rates-mcs", &len, mcs_rates + 1);
+ 	mt76_apply_multi_array_limit(dest->mcs[0], ARRAY_SIZE(dest->mcs[0]),
+ 				     ARRAY_SIZE(dest->mcs), val, len,
+-				     target_power, txs_delta, &max_power);
++				     target_power, txs_delta);
+ 
+ 	val = mt76_get_of_array(np, "rates-ru", &len, ru_rates + 1);
+ 	mt76_apply_multi_array_limit(dest->ru[0], ARRAY_SIZE(dest->ru[0]),
  				     ARRAY_SIZE(dest->ru), val, len,
- 				     target_power, txs_delta, &max_power);
+-				     target_power, txs_delta, &max_power);
++				     target_power, txs_delta);
  
 -	return max_power;
 +	max_power_backoff = max_power;
@@ -71,12 +103,12 @@
 +	val = mt76_get_of_array(np, "paths-ru", &len, ARRAY_SIZE(dest->path.ru[0]) + 1);
 +	mt76_apply_multi_array_limit(dest->path.ru[0], ARRAY_SIZE(dest->path.ru[0]),
 +				     ARRAY_SIZE(dest->path.ru), val, len,
-+				     target_power_combine, txs_delta, &max_power_backoff);
++				     target_power_combine, txs_delta);
 +
 +	val = mt76_get_of_array(np, "paths-ru-bf", &len, ARRAY_SIZE(dest->path.ru_bf[0]) + 1);
 +	mt76_apply_multi_array_limit(dest->path.ru_bf[0], ARRAY_SIZE(dest->path.ru_bf[0]),
 +				     ARRAY_SIZE(dest->path.ru_bf), val, len,
-+				     target_power_combine, txs_delta, &max_power_backoff);
++				     target_power_combine, txs_delta);
 +
 +	if (max_power_backoff == target_power_combine)
 +		return max_power;
@@ -86,10 +118,10 @@
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
  
 diff --git a/mt76.h b/mt76.h
-index 13796ad..05c1874 100644
+index 9673926..6ed3e1e 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1047,6 +1047,14 @@ struct mt76_power_limits {
+@@ -1049,6 +1049,14 @@ struct mt76_power_limits {
  	s8 mcs[4][10];
  	s8 ru[7][12];
  	s8 eht[16][16];
@@ -216,8 +248,53 @@
  	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
+diff --git a/mt7915/init.c b/mt7915/init.c
+index d908a58..b2fdd43 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -284,6 +284,8 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+ 	int pwr_delta = mt7915_eeprom_get_power_delta(dev, sband->band);
+ 	struct mt76_power_limits limits;
+ 
++	phy->sku_limit_en = true;
++	phy->sku_path_en = true;
+ 	for (i = 0; i < sband->n_channels; i++) {
+ 		struct ieee80211_channel *chan = &sband->channels[i];
+ 		u32 target_power = 0;
+@@ -300,6 +302,11 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+ 		target_power = mt76_get_rate_power_limits(phy->mt76, chan,
+ 							  &limits,
+ 							  target_power);
++
++		/* MT7915N can not enable Backoff table without setting value in dts */
++		if (!limits.path.ofdm[0])
++			phy->sku_path_en = false;
++
+ 		target_power += nss_delta;
+ 		target_power = DIV_ROUND_UP(target_power, 2);
+ 		chan->max_power = min_t(int, chan->max_reg_power,
+diff --git a/mt7915/main.c b/mt7915/main.c
+index da9cfc6..df7aab5 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -74,10 +74,12 @@ int mt7915_run(struct ieee80211_hw *hw)
+ 		goto out;
+ 
+ #ifdef MTK_DEBUG
+-	ret = mt7915_mcu_set_sku_en(phy, !dev->dbg.sku_disable);
+-#else
+-	ret = mt7915_mcu_set_sku_en(phy, true);
++	if (dev->dbg.sku_disable) {
++		phy->sku_limit_en = false;
++		phy->sku_path_en = false;
++	}
+ #endif
++	ret = mt7915_mcu_set_sku_en(phy);
+ 	if (ret)
+ 		goto out;
+ 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7e33386..f65f0ec 100644
+index 7e33386..224ce21 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3311,7 +3311,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
@@ -230,8 +307,35 @@
  	if (ret)
  		return ret;
  
-@@ -3353,51 +3354,106 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3351,53 +3352,139 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+ 				 sizeof(req), true);
+ }
  
++static void
++mt7915_update_txpower(struct mt7915_phy *phy, int tx_power)
++{
++	struct mt76_phy *mphy = phy->mt76;
++	struct ieee80211_channel *chan = mphy->main_chan;
++	int chain_idx, val, e2p_power_limit = 0;
++
++	if (chan == NULL) {
++		mphy->txpower_cur = tx_power;
++		return;
++	}
++
++	for (chain_idx = 0; chain_idx < hweight16(mphy->chainmask); chain_idx++) {
++		val = mt7915_eeprom_get_target_power(phy->dev, chan, chain_idx);
++		val += mt7915_eeprom_get_power_delta(phy->dev, chan->band);
++
++		e2p_power_limit = max_t(int, e2p_power_limit, val);
++	}
++
++	if (phy->sku_limit_en)
++		mphy->txpower_cur = min_t(int, e2p_power_limit, tx_power);
++	else
++		mphy->txpower_cur = e2p_power_limit;
++}
++
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  {
 +#define TX_POWER_LIMIT_TABLE_RATE	0
@@ -259,31 +363,39 @@
 +	struct sk_buff *skb;
  
  	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
- 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
+-	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
 -					      &limits_array, tx_power);
-+					      &la, tx_power);
- 	mphy->txpower_cur = tx_power;
+-	mphy->txpower_cur = tx_power;
  
 -	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
 -		u8 mcs_num, len = mt7915_sku_group_len[i];
 -		int j;
++	if (phy->sku_limit_en) {
++		tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
++					      	      &la, tx_power);
++		mt7915_update_txpower(phy, tx_power);
++	} else {
++		mt7915_update_txpower(phy, tx_power);
++		return 0;
++	}
+ 
+-		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
+-			mcs_num = 10;
 +	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 +				 sizeof(hdr) + MT7915_SKU_RATE_NUM);
 +	if (!skb)
 +		return -ENOMEM;
  
--		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
--			mcs_num = 10;
-+	skb_put_data(skb, &hdr, sizeof(hdr));
-+	skb_put_data(skb, &la.cck, len[SKU_CCK] + len[SKU_OFDM]);
-+	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
-+	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
- 
 -			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
 -				la = (s8 *)&limits_array + 12;
 -		} else {
 -			mcs_num = len;
 -		}
++	skb_put_data(skb, &hdr, sizeof(hdr));
++	skb_put_data(skb, &la.cck, len[SKU_CCK] + len[SKU_OFDM]);
++	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
++	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
++
 +	/* vht */
 +	for (i = 0; i < 4; i++) {
 +		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
@@ -299,13 +411,13 @@
 +				    MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
 +	if (ret)
 +		return ret;
-+
-+	/* only set per-path power table when it's configured */
-+	if (!la.path.ofdm[0])
-+		return 0;
  
 -		la += mcs_num;
 -		idx += len;
++	/* only set per-path power table when it's configured */
++	if (!phy->sku_path_en)
++		return 0;
++
 +	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 +				 sizeof(hdr) + MT7915_SKU_PATH_NUM);
 +	if (!skb)
@@ -362,7 +474,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3406,10 +3462,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3406,10 +3493,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -374,7 +486,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3419,9 +3474,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3419,9 +3505,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -393,9 +505,21 @@
  
  	dev_kfree_skb(skb);
  
+@@ -3450,7 +3542,7 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+ 				 sizeof(req), false);
+ }
+ 
-@@ -3463,9 +3524,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+-int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
++int mt7915_mcu_set_sku_en(struct mt7915_phy *phy)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt7915_sku {
+@@ -3461,10 +3553,21 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+ 	} __packed req = {
+ 		.format_id = TX_POWER_LIMIT_ENABLE,
  		.band_idx = phy->mt76->band_idx,
- 		.sku_enable = enable,
+-		.sku_enable = enable,
++		.sku_enable = phy->sku_limit_en,
  	};
 +	int ret;
 +
@@ -404,14 +528,16 @@
 +				sizeof(req), true);
 +	if (ret)
 +		return ret;
- 
- 	pr_info("%s: enable = %d\n", __func__, enable);
++
++	pr_info("%s: sku enable = %d, path enable = %d\n", __func__,
++		phy->sku_limit_en, phy->sku_path_en);
  
+-	pr_info("%s: enable = %d\n", __func__, enable);
++	req.sku_enable = phy->sku_path_en;
 +	req.format_id = TX_POWER_LIMIT_PATH_ENABLE;
-+
+ 
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
- 				 sizeof(req), true);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
 index 5fc4e2e..142bfc1 100644
 --- a/mt7915/mcu.h
@@ -436,7 +562,7 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a3d7b4b..4dc3825 100644
+index 25a6815..c2fb12d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -72,6 +72,7 @@
@@ -447,9 +573,22 @@
  
  #define MT7915_MAX_TWT_AGRT		16
  #define MT7915_MAX_STA_TWT_AGRT		8
-@@ -572,7 +573,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+@@ -263,6 +264,9 @@ struct mt7915_phy {
+ 	struct list_head stats_list;
+ 	spinlock_t stats_lock;
+ 
++	bool sku_limit_en;
++	bool sku_path_en;
++
+ #ifdef CONFIG_NL80211_TESTMODE
+ 	struct {
+ 		u32 *reg_backup;
+@@ -571,9 +575,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+ 			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
- int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
+-int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
++int mt7915_mcu_set_sku_en(struct mt7915_phy *phy);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
 -int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
 +int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
diff --git a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
index 47b364d..96441b6 100644
--- a/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1036-wifi-mt76-mt7915-Disable-RegDB-when-enable-single-sk.patch
@@ -1,19 +1,19 @@
-From c499d09d496d723dab109aee2e3af8a28278a54c Mon Sep 17 00:00:00 2001
+From 378077f87cb5c696dbb2b313d9d4ef08383b1a6e Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Fri, 11 Aug 2023 16:46:53 +0800
-Subject: [PATCH 1036/1040] wifi: mt76: mt7915: Disable RegDB when enable
+Subject: [PATCH 1036/1042] wifi: mt76: mt7915: Disable RegDB when enable
  single sku
 
 ---
  eeprom.c         |  3 ++-
  mt76.h           |  3 +++
  mt7915/debugfs.c | 49 +++++++++++++++++++++++++++++++++++++++++++-----
- mt7915/init.c    |  9 ++++++++-
+ mt7915/init.c    | 11 +++++++++--
  mt7915/regs.h    |  8 ++++----
- 5 files changed, 61 insertions(+), 11 deletions(-)
+ 5 files changed, 62 insertions(+), 12 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 4189525..38b0a58 100644
+index c0536f1..cf5e933 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -216,7 +216,7 @@ static bool mt76_string_prop_find(struct property *prop, const char *str)
@@ -34,10 +34,10 @@
  static const __be32 *
  mt76_get_of_array(struct device_node *np, char *name, size_t *len, int min)
 diff --git a/mt76.h b/mt76.h
-index 05c1874..91da8c5 100644
+index 6ed3e1e..e3f0dff 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1673,6 +1673,9 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
+@@ -1675,6 +1675,9 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
  
  void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr, u32 clear, u32 set);
  
@@ -140,29 +140,32 @@
  	return ret;
  }
 diff --git a/mt7915/init.c b/mt7915/init.c
-index a942bc2..82fe443 100644
+index 39bc2f6..fdfd284 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -283,7 +283,9 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+@@ -283,9 +283,11 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
  	int nss_delta = mt76_tx_power_nss_delta(n_chains);
  	int pwr_delta = mt7915_eeprom_get_power_delta(dev, sband->band);
  	struct mt76_power_limits limits;
 +	struct device_node *np;
  
+ 	phy->sku_limit_en = true;
+ 	phy->sku_path_en = true;
 +	np = mt76_find_power_limits_node(&dev->mt76);
  	for (i = 0; i < sband->n_channels; i++) {
  		struct ieee80211_channel *chan = &sband->channels[i];
  		u32 target_power = 0;
-@@ -302,8 +304,13 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
- 							  target_power);
+@@ -309,8 +311,13 @@ void __mt7915_init_txpower(struct mt7915_phy *phy,
+ 
  		target_power += nss_delta;
  		target_power = DIV_ROUND_UP(target_power, 2);
 -		chan->max_power = min_t(int, chan->max_reg_power,
+-					target_power);
 +
 +		/* can NOT find country node in dts */
 +		if (!np)
 +			chan->max_power = min_t(int, chan->max_reg_power,
- 					target_power);
++						target_power);
 +		else
 +			chan->max_power = target_power;
  		chan->orig_mpwr = target_power;
diff --git a/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-mt7915-add-cheetah-eeprom-related-fix.patch b/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-mt7915-add-cheetah-eeprom-related-fix.patch
new file mode 100644
index 0000000..9ff6874
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1043-wifi-mt76-mt7915-add-cheetah-eeprom-related-fix.patch
@@ -0,0 +1,44 @@
+From 02120d0ab9b6d2f864706c2a0d6583c7b8fc60e8 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 31 Oct 2023 16:28:52 +0800
+Subject: [PATCH] wifi: mt76: mt7915: add cheetah eeprom related fix
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/eeprom.h | 3 ++-
+ mt7915/main.c   | 5 +++--
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index 9056d78..a1ab05a 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -160,7 +160,8 @@ static inline bool
+ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
+ {
+ 	u8 *eep = dev->mt76.eeprom.data;
+-	u8 val = eep[MT_EE_WIFI_CONF + 7];
++	u8 offs = is_mt7981(&dev->mt76) ? 8 : 7;
++	u8 val = eep[MT_EE_WIFI_CONF + offs];
+ 
+ 	if (band == NL80211_BAND_2GHZ)
+ 		return val & MT_EE_WIFI_CONF7_TSSI0_2G;
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 797a3b4..9ab93f4 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1110,8 +1110,9 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+ 
+ 	phy->mt76->antenna_mask = tx_ant;
+ 
+-	/* handle a variant of mt7916 which has 3T3R but nss2 on 5 GHz band */
+-	if (is_mt7916(&dev->mt76) && band && hweight8(tx_ant) == max_nss)
++	/* handle a variant of mt7916/mt7981 which has 3T3R but nss2 on 5 GHz band */
++	if ((is_mt7916(&dev->mt76) || is_mt7981(&dev->mt76)) &&
++	    band && hweight8(tx_ant) == max_nss)
+ 		phy->mt76->chainmask = (dev->chainmask >> chainshift) << chainshift;
+ 	else
+ 		phy->mt76->chainmask = tx_ant << (chainshift * band);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-testmode-add-cheetah-support.patch b/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-testmode-add-cheetah-support.patch
new file mode 100644
index 0000000..0f53710
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1044-wifi-mt76-testmode-add-cheetah-support.patch
@@ -0,0 +1,142 @@
+From 14b505d62c856f210ce46e831886ae0fab253252 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 31 Oct 2023 16:29:13 +0800
+Subject: [PATCH] wifi: mt76: testmode: add cheetah support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7915/eeprom.c   |  3 +--
+ mt7915/eeprom.h   | 12 ++++++++++++
+ mt7915/mcu.c      | 21 +++++++++++++++++++--
+ mt7915/testmode.c |  9 +++++----
+ 4 files changed, 37 insertions(+), 8 deletions(-)
+
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index f8166dd..50ed7ba 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -39,8 +39,7 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
+ 	if (!dev->flash_mode || !val)
+ 		return 0;
+ 
+-	size = mt7915_get_cal_group_size(dev) +
+-	       (is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2);
++	size = mt7915_get_cal_group_size(dev) + mt7915_get_cal_dpd_size(dev);
+ 
+ 	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
+ 	if (!dev->cal)
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index a1ab05a..99101f9 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -52,6 +52,7 @@ enum mt7915_eeprom_field {
+ #define MT_EE_CAL_GROUP_SIZE_7916_6G		(94 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
+ #define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
++#define MT_EE_CAL_DPD_SIZE_V2_7981		(102 * MT_EE_CAL_UNIT)	/* no 6g dpd data */
+ 
+ #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
+ #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
+@@ -192,6 +193,17 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
+ 	}
+ }
+ 
++static inline u32
++mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
++{
++	if (is_mt7915(&dev->mt76))
++		return MT_EE_CAL_DPD_SIZE_V1;
++	else if (is_mt7981(&dev->mt76))
++		return MT_EE_CAL_DPD_SIZE_V2_7981;
++	else
++		return MT_EE_CAL_DPD_SIZE_V2;
++}
++
+ extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
+ 
+ #endif
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index cd4f472..492cfcd 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3035,13 +3035,30 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
+ 		/* 5G BW160 */
+ 		5250, 5570, 5815
+ 	};
++	const u16 freq_list_v2_7981[] = {
++		/* 5G BW20 */
++		5180, 5200, 5220, 5240,
++		5260, 5280, 5300, 5320,
++		5500, 5520, 5540, 5560,
++		5580, 5600, 5620, 5640,
++		5660, 5680, 5700, 5720,
++		5745, 5765, 5785, 5805,
++		5825, 5845, 5865, 5885,
++		/* 5G BW160 */
++		5250, 5570, 5815
++	};
+ 	const u16 *freq_list = freq_list_v1;
+ 	int n_freqs = ARRAY_SIZE(freq_list_v1);
+ 	int idx;
+ 
+ 	if (!is_mt7915(&dev->mt76)) {
+-		freq_list = freq_list_v2;
+-		n_freqs = ARRAY_SIZE(freq_list_v2);
++		if (is_mt7981(&dev->mt76)) {
++			freq_list = freq_list_v2_7981;
++			n_freqs = ARRAY_SIZE(freq_list_v2_7981);
++		} else {
++			freq_list = freq_list_v2;
++			n_freqs = ARRAY_SIZE(freq_list_v2);
++		}
+ 	}
+ 
+ 	if (freq < 4000) {
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 5e20cb9..4aa7eb6 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -2149,7 +2149,7 @@ mt7915_tm_group_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
+ 	eeprom = mdev->eeprom.data;
+ 	dev->cur_prek_offset = 0;
+ 	group_size = mt7915_get_cal_group_size(dev);
+-	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++	dpd_size = mt7915_get_cal_dpd_size(dev);
+ 	size = group_size + dpd_size;
+ 	offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
+ 
+@@ -2231,11 +2231,11 @@ mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
+ 	eeprom = mdev->eeprom.data;
+ 	dev->cur_prek_offset = 0;
+ 	group_size = mt7915_get_cal_group_size(dev);
++	dpd_size = mt7915_get_cal_dpd_size(dev);
+ 	dev->dpd_chan_num_2g = hweight32(DPD_2G_CH_BW20_BITMAP_0);
+ 	if (is_mt7915(&dev->mt76)) {
+ 		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_7915_0);
+ 		dev->dpd_chan_num_6g = 0;
+-		dpd_size = MT_EE_CAL_DPD_SIZE_V1;
+ 		offs = MT_EE_DO_PRE_CAL;
+ 	} else {
+ 		dev->dpd_chan_num_5g = hweight32(DPD_5G_CH_BW20_BITMAP_0) +
+@@ -2244,7 +2244,8 @@ mt7915_tm_dpd_prek(struct mt7915_phy *phy, enum mt76_testmode_state state)
+ 		dev->dpd_chan_num_6g = hweight32(DPD_6G_CH_BW20_BITMAP_0) +
+ 				       hweight32(DPD_6G_CH_BW20_BITMAP_1) +
+ 				       ARRAY_SIZE(bw160_6g_freq);
+-		dpd_size = MT_EE_CAL_DPD_SIZE_V2;
++		if (is_mt7981(&dev->mt76))
++			dev->dpd_chan_num_6g = 0;
+ 		offs = MT_EE_DO_PRE_CAL_V2;
+ 	}
+ 	size = group_size + dpd_size;
+@@ -2707,7 +2708,7 @@ mt7915_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int
+ 	}
+ 
+ 	group_size = mt7915_get_cal_group_size(dev);
+-	dpd_size = is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2;
++	dpd_size = mt7915_get_cal_dpd_size(dev);
+ 	dpd_per_chan_size = is_mt7915(&dev->mt76) ? 2 : 3;
+ 	total_size = group_size + dpd_size;
+ 	pre_cal = dev->cal;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 4c9198f..c30f05a 100644
--- a/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2004-wifi-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 125ddf12e213498dbddda005b1b84587bc1f1a46 Mon Sep 17 00:00:00 2001
+From c6f5b4acf35c16b737f9dd72c4fc7245ed7224dc Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH] wifi: mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 2004/2012] wifi: mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
@@ -16,7 +16,7 @@
  7 files changed, 844 insertions(+), 4 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 49258905..9ad18833 100644
+index 4925890..9ad1883 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1175,6 +1175,7 @@ enum {
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 6dcee10c..ca42b698 100644
+index 6dcee10..ca42b69 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -466,10 +466,10 @@
  	if (!dev->dbdc_support || phy->mt76->band_idx) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 36621ad3..db627500 100644
+index e31a5a6..c643c33 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -600,10 +600,65 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -607,10 +607,65 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  	}
  }
  
@@ -535,7 +535,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -627,6 +682,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -634,6 +689,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		mt7915_mac_init_band(dev, i);
  
  	mt7915_init_led_mux(dev);
@@ -546,10 +546,10 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2dd4881f..8bcffd3f 100644
+index ee58f1c..040bc75 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -217,6 +217,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+@@ -219,6 +219,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	struct mt7915_dev *dev = phy->dev;
@@ -557,7 +557,7 @@
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
  	int idx, ret = 0;
-@@ -279,6 +280,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
+@@ -281,6 +282,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
@@ -567,7 +567,7 @@
  	return ret;
  }
  
-@@ -769,6 +773,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -771,6 +775,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -575,7 +575,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy = ext_phy ? mt7915_ext_phy(dev) : &dev->phy;
  #endif
-@@ -819,6 +824,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -821,6 +826,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (phy->muru_onoff & MUMIMO_DL_CERT)
  		mt7915_mcu_set_mimo(phy, 0);
  #endif
@@ -592,7 +592,7 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d8b93180..e5bfca3d 100644
+index 45344ac..636a2ab 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1674,7 +1674,7 @@ mt7915_mcu_add_group(struct mt7915_dev *dev, struct ieee80211_vif *vif,
@@ -624,7 +624,7 @@
  	ret = mt7915_mcu_add_group(dev, vif, sta);
  	if (ret) {
  		dev_kfree_skb(skb);
-@@ -3568,6 +3568,169 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3601,6 +3601,169 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -795,7 +795,7 @@
  {
  #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1d89814e..2b4ed04c 100644
+index 0c0bd82..90bfc47 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -141,6 +141,58 @@ struct mt7915_twt_flow {
@@ -865,7 +865,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -420,6 +473,8 @@ struct mt7915_dev {
+@@ -423,6 +476,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -874,7 +874,7 @@
  };
  
  enum {
-@@ -452,6 +507,15 @@ enum mt7915_rdd_cmd {
+@@ -455,6 +510,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -890,7 +890,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -581,6 +645,11 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -584,6 +648,11 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -899,11 +899,11 @@
 +int mt7915_mcu_set_vow_feature_ctrl(struct mt7915_dev *dev);
 +int mt7915_mcu_set_vow_band(struct mt7915_dev *dev, struct mt7915_vif *mvif);
 +void mt7915_vow_init_sta_bss_grp(struct mt7915_sta *sta);
- int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
+ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 9fe7dcb1..9ff4c5cd 100644
+index 9fe7dcb..9ff4c5c 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1368,7 +1368,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
diff --git a/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch b/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
new file mode 100644
index 0000000..e9267b5
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch
@@ -0,0 +1,211 @@
+From 72f6ac700c7a66508aeb8a8341789b138360c416 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Wed, 1 Nov 2023 07:50:08 +0800
+Subject: [PATCH 1/6] wifi: mt76: mt7915: wed: add per bss statistic info
+
+---
+ mt7915/init.c        |  1 +
+ mt7915/mac.c         | 21 +++++++++++++++++++++
+ mt7915/main.c        |  2 +-
+ mt7915/mcu.c         | 30 +++++++++++++++++++++++++++---
+ mt7915/mmio.c        | 24 ++++++++++++++++++++++++
+ mt7915/mt7915.h      |  3 ++-
+ mt7915/mtk_debugfs.c |  2 +-
+ 7 files changed, 77 insertions(+), 6 deletions(-)
+
+diff --git a/mt7915/init.c b/mt7915/init.c
+index c643c33..9978edb 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -397,6 +397,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_DISCOVERY);
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
+ 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
++	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STAS_COUNT);
+ 
+ 	if (!is_mt7915(&dev->mt76))
+ 		wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_STA_TX_PWR);
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index a473fc6..e403f0f 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1067,6 +1067,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 	struct mt7915_phy *phy;
+ 	struct mt76_wcid *wcid;
+ 	__le32 *txs_data = data;
++	u64 last_bytes;
+ 	u16 wcidx;
+ 	u8 pid;
+ 
+@@ -1085,6 +1086,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 	if (!wcid)
+ 		goto out;
+ 
++	last_bytes = wcid->stats.tx_bytes;
+ 	msta = container_of(wcid, struct mt7915_sta, wcid);
+ 
+ 	if (pid == MT_PACKET_ID_WED)
+@@ -1095,6 +1097,24 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 	if (!wcid->sta)
+ 		goto out;
+ 
++	if (wiphy_ext_feature_isset(dev->mphy.hw->wiphy,
++				    NL80211_EXT_FEATURE_STAS_COUNT)) {
++		struct ieee80211_vif *vif;
++		struct wireless_dev *wdev;
++
++		vif = container_of((void *)msta->vif, struct ieee80211_vif,
++				   drv_priv);
++		if (!vif)
++			goto out;
++
++		wdev = ieee80211_vif_to_wdev(vif);
++
++		if (vif->type == NL80211_IFTYPE_MONITOR)
++			goto out;
++
++		dev_sw_netstats_tx_add(wdev->netdev, 0, (wcid->stats.tx_bytes - last_bytes));
++	}
++
+ 	spin_lock_bh(&dev->mt76.sta_poll_lock);
+ 	if (list_empty(&msta->wcid.poll_list))
+ 		list_add_tail(&msta->wcid.poll_list, &dev->mt76.sta_poll_list);
+@@ -2081,6 +2101,7 @@ static void mt7915_mac_sta_stats_work(struct mt7915_phy *phy)
+ 		spin_unlock_bh(&phy->stats_lock);
+ 
+ 		mt7915_mcu_get_tx_rate(phy, sta->wcid.idx);
++		mt7915_mcu_wed_wa_tx_stats(phy->dev, sta->wcid.idx, sta);
+ 
+ 		spin_lock_bh(&phy->stats_lock);
+ 	}
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 72bcaab..9595b55 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1188,7 +1188,7 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
+ 
+-		if (!mt7915_mcu_wed_wa_tx_stats(phy->dev, msta->wcid.idx)) {
++		if (!mt7915_mcu_wed_wa_tx_stats(phy->dev, msta->wcid.idx, msta)) {
+ 			sinfo->tx_packets = msta->wcid.stats.tx_packets;
+ 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
+ 		}
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index fe3f151..72f74e1 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -4467,7 +4467,8 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+ 				 &req, sizeof(req), true);
+ }
+ 
+-int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
++int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx,
++			       struct mt7915_sta *sta)
+ {
+ 	struct {
+ 		__le32 cmd;
+@@ -4511,11 +4512,34 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx)
+ 	rcu_read_lock();
+ 
+ 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
+-	if (wcid)
++	if (wcid) {
++		struct ieee80211_vif *vif;
++		struct wireless_dev *wdev;
++
+ 		wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
+-	else
++
++		if (!wiphy_ext_feature_isset(dev->mphy.hw->wiphy,
++					     NL80211_EXT_FEATURE_STAS_COUNT) ||
++		    !sta)
++			 goto unlock;
++
++		vif = container_of((void *)sta->vif,
++				   struct ieee80211_vif,
++				   drv_priv);
++		if (!vif)
++			goto unlock;
++
++		wdev = ieee80211_vif_to_wdev(vif);
++
++		if (vif->type == NL80211_IFTYPE_MONITOR)
++			goto unlock;
++
++		dev_sw_netstats_tx_add(wdev->netdev, le32_to_cpu(res->tx_packets), 0);
++	} else {
+ 		ret = -EINVAL;
++	}
+ 
++unlock:
+ 	rcu_read_unlock();
+ out:
+ 	dev_kfree_skb(skb);
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 2ad7ba4..ce976b4 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -742,8 +742,32 @@ static void mt7915_mmio_wed_update_rx_stats(struct mtk_wed_device *wed,
+ 		wcid->stats.rx_packets += le32_to_cpu(stats->rx_pkt_cnt);
+ 		wcid->stats.rx_errors += le32_to_cpu(stats->rx_err_cnt);
+ 		wcid->stats.rx_drops += le32_to_cpu(stats->rx_drop_cnt);
++
++		if (wiphy_ext_feature_isset(dev->mphy.hw->wiphy,
++					    NL80211_EXT_FEATURE_STAS_COUNT)) {
++			struct mt7915_sta *msta;
++			struct ieee80211_vif *vif;
++			struct wireless_dev *wdev;
++
++			msta = container_of(wcid, struct mt7915_sta, wcid);
++
++			vif = container_of((void *)msta->vif,
++					   struct ieee80211_vif,
++					   drv_priv);
++			if (!vif)
++				goto unlock;
++
++			wdev = ieee80211_vif_to_wdev(vif);
++
++			if (vif->type == NL80211_IFTYPE_MONITOR)
++				goto unlock;
++
++			dev_sw_netstats_rx_add(wdev->netdev, le32_to_cpu(stats->rx_pkt_cnt),
++					       le32_to_cpu(stats->rx_byte_cnt));
++		}
+ 	}
+ 
++unlock:
+ 	rcu_read_unlock();
+ }
+ 
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 091af43..1510f10 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -683,7 +683,8 @@ int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 			   struct ieee80211_sta *sta, struct rate_info *rate);
+ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
+ 				     struct cfg80211_chan_def *chandef);
+-int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wcid);
++int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wcid,
++			       struct mt7915_sta *sta);
+ int mt7915_get_tx_stat(struct mt7915_phy *phy, u16 wlan_idx);
+ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
+ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index e73db5d..f481231 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -3812,7 +3812,7 @@ static int mt7915_reset_counter(void *data, u64 val)
+ 	struct mt76_wcid *wcid;
+ 
+ 	/* Clear the firmware counters */
+-	mt7915_mcu_wed_wa_tx_stats(dev, dev->wlan_idx);
++	mt7915_mcu_wed_wa_tx_stats(dev, dev->wlan_idx, NULL);
+ 	mt7915_get_tx_stat(phy, dev->wlan_idx);
+ 
+ 	rcu_read_lock();
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/2012-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch b/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches/2012-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
rename to recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
index aea2ccd..6d7a03f 100644
--- a/recipes-wifi/linux-mt76/files/patches/2012-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
@@ -1,8 +1,8 @@
-From 5959391d31be290f08b6614c178231a298b4b91e Mon Sep 17 00:00:00 2001
+From 5fb134dd94aaa8986704094e0b0a62c9f2bfd391 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 23 Oct 2023 10:25:13 +0800
-Subject: [PATCH 2012/2015] Revert "wifi: mt76: mt7921: fix the wrong rate
- selected in fw for the chanctx driver"
+Subject: [PATCH 2/6] Revert "wifi: mt76: mt7921: fix the wrong rate selected
+ in fw for the chanctx driver"
 
 This reverts commit 9fc37b0ac5467cfe5e3d2ad8a29e9a7646ece2be.
 ---
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 7 deletions(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index aa99bd78..3a6404a7 100644
+index 07bd57b..1d22ab9 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -837,9 +837,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -846,9 +846,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  			     struct ieee80211_vif *vif,
  			     u8 rcpi, u8 sta_state)
  {
@@ -24,7 +24,7 @@
  	enum nl80211_band band = chandef->chan->band;
  	struct mt76_dev *dev = mphy->dev;
  	struct sta_rec_ra_info *ra_info;
-@@ -1345,10 +1343,7 @@ EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
+@@ -1354,10 +1352,7 @@ EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
  const struct ieee80211_sta_he_cap *
  mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
  {
diff --git a/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch b/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
rename to recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
index 4997109..92b04dc 100644
--- a/recipes-wifi/linux-mt76/files/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
@@ -1,8 +1,8 @@
-From b5cc571132a848d5daa3bec3ee07274205a98df0 Mon Sep 17 00:00:00 2001
+From 8beef73782b0b068ed1d86dcfec92f16e8297d4e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 23 Oct 2023 10:25:18 +0800
-Subject: [PATCH 2013/2015] Revert "wifi: mt76: mt7921: fix the wrong rate
- pickup for the chanctx driver"
+Subject: [PATCH 3/6] Revert "wifi: mt76: mt7921: fix the wrong rate pickup for
+ the chanctx driver"
 
 This reverts commit 66d5694e1898c5584a83c60876bec16909ebe2b0.
 ---
@@ -12,10 +12,10 @@
  3 files changed, 5 insertions(+), 14 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 137c5204..37e6a627 100644
+index 6232534..e7c4dc4 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1710,16 +1710,11 @@ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
+@@ -1715,16 +1715,11 @@ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
  }
  EXPORT_SYMBOL_GPL(mt76_init_queue);
  
@@ -35,7 +35,7 @@
  
  	/* pick the lowest rate for hidden nodes */
 diff --git a/mt76.h b/mt76.h
-index 0a7f4f14..05144b2c 100644
+index 0a7f4f1..05144b2 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -1207,8 +1207,7 @@ bool mt76_check_bin_file_mode(struct mt76_dev *dev);
@@ -49,7 +49,7 @@
  				     int n_desc, int ring_base, u32 flags)
  {
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index faeae26d..431d60d3 100644
+index 02d5232..f2b4ec9 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -293,10 +293,7 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
diff --git a/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch b/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
rename to recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
index 27dc9f6..db3e36c 100644
--- a/recipes-wifi/linux-mt76/files/patches/2014-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
@@ -1,8 +1,8 @@
-From ae8181c30d187de764055ab15fd7f3efd8aa736c Mon Sep 17 00:00:00 2001
+From 7ff6353fd667964cc3e814dce1d79859e07fbdf4 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 23 Oct 2023 10:25:25 +0800
-Subject: [PATCH 2014/2015] Revert "wifi: mt76: move struct
- ieee80211_chanctx_conf up to struct mt76_vif"
+Subject: [PATCH 4/6] Revert "wifi: mt76: move struct ieee80211_chanctx_conf up
+ to struct mt76_vif"
 
 This reverts commit d1881b1b2bf6018d1cb1b91e4301a60021cacaa3.
 ---
@@ -13,7 +13,7 @@
  4 files changed, 9 insertions(+), 9 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 05144b2c..3ff348f2 100644
+index 05144b2..3ff348f 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -798,7 +798,6 @@ struct mt76_vif {
@@ -25,7 +25,7 @@
  
  struct mt76_phy {
 diff --git a/mt7921/main.c b/mt7921/main.c
-index 6a5c2cae..28c7e04b 100644
+index 6a5c2ca..28c7e04 100644
 --- a/mt7921/main.c
 +++ b/mt7921/main.c
 @@ -756,7 +756,7 @@ void mt7921_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -83,7 +83,7 @@
  	mt792x_mutex_release(dev);
  }
 diff --git a/mt792x.h b/mt792x.h
-index 548e89fa..39cbd139 100644
+index 548e89f..39cbd13 100644
 --- a/mt792x.h
 +++ b/mt792x.h
 @@ -93,6 +93,7 @@ struct mt792x_vif {
@@ -95,7 +95,7 @@
  
  struct mt792x_phy {
 diff --git a/mt792x_core.c b/mt792x_core.c
-index 7c4a74fb..8c97ac00 100644
+index 7c4a74f..8c97ac0 100644
 --- a/mt792x_core.c
 +++ b/mt792x_core.c
 @@ -243,7 +243,7 @@ int mt792x_assign_vif_chanctx(struct ieee80211_hw *hw,
diff --git a/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-fix-race-condition-related-to-check.patch b/recipes-wifi/linux-mt76/files/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
rename to recipes-wifi/linux-mt76/files/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
index 91507f4..d23662b 100644
--- a/recipes-wifi/linux-mt76/files/patches/2015-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
@@ -1,7 +1,7 @@
-From 20d498a3d24a4c20a421bc6bc19a058620aa86ec Mon Sep 17 00:00:00 2001
+From 04de28f9fec0bce1f37dd6bb3c2081d91bdc218e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 23 Oct 2023 10:26:01 +0800
-Subject: [PATCH 2015/2015] Revert "wifi: mt76: fix race condition related to
+Subject: [PATCH 5/6] Revert "wifi: mt76: fix race condition related to
  checking tx queue fill status"
 
 This reverts commit f1e1e67d97d1e9a8bb01b59ab20c45ebc985a958.
@@ -12,7 +12,7 @@
  3 files changed, 20 insertions(+), 120 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 37e6a627..923c6a31 100644
+index e7c4dc4..4caa714 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -427,9 +427,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -41,7 +41,7 @@
  	ieee80211_unregister_hw(hw);
  }
  EXPORT_SYMBOL_GPL(mt76_unregister_device);
-@@ -1460,9 +1455,6 @@ EXPORT_SYMBOL_GPL(mt76_sta_pre_rcu_remove);
+@@ -1465,9 +1460,6 @@ EXPORT_SYMBOL_GPL(mt76_sta_pre_rcu_remove);
  
  void mt76_wcid_init(struct mt76_wcid *wcid)
  {
@@ -51,7 +51,7 @@
  	INIT_LIST_HEAD(&wcid->list);
  	idr_init(&wcid->pktid);
  }
-@@ -1470,32 +1462,13 @@ EXPORT_SYMBOL_GPL(mt76_wcid_init);
+@@ -1475,32 +1467,13 @@ EXPORT_SYMBOL_GPL(mt76_wcid_init);
  
  void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
  {
@@ -85,7 +85,7 @@
  EXPORT_SYMBOL_GPL(mt76_wcid_cleanup);
  
 diff --git a/mt76.h b/mt76.h
-index 3ff348f2..5eb571ef 100644
+index 3ff348f..5eb571e 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -354,9 +354,6 @@ struct mt76_wcid {
@@ -108,10 +108,10 @@
  
  	struct cfg80211_chan_def chandef;
 diff --git a/tx.c b/tx.c
-index 23a1e4e2..9dfc2890 100644
+index 96f9009..c88fb29 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -322,32 +322,40 @@ void
+@@ -328,32 +328,40 @@ void
  mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
  	struct mt76_wcid *wcid, struct sk_buff *skb)
  {
@@ -164,7 +164,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_tx);
  
-@@ -578,86 +586,10 @@ void mt76_txq_schedule(struct mt76_phy *phy, enum mt76_txq_id qid)
+@@ -584,86 +592,10 @@ void mt76_txq_schedule(struct mt76_phy *phy, enum mt76_txq_id qid)
  }
  EXPORT_SYMBOL_GPL(mt76_txq_schedule);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
index 3d2e07e..3132a24 100644
--- a/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/9999-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,7 +1,7 @@
-From 87cc43ed074bca81b765e0961bd24da23f6e997e Mon Sep 17 00:00:00 2001
+From 8a9009b2bed6a9ae4c7a3a4d12fe8d7e15293103 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 5 Apr 2023 08:29:19 +0800
-Subject: [PATCH] mt76: revert for backports-5.15 wireless stack
+Subject: [PATCH 6/6] mt76: revert for backports-5.15 wireless stack
 
 wifi: mt76: mt7915: add support for he ldpc control from hostapd
 ---
@@ -24,7 +24,7 @@
  16 files changed, 259 insertions(+), 226 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 7c5e623c..908852c0 100644
+index 7c5e623..908852c 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -996,7 +996,7 @@ mt76_dma_init(struct mt76_dev *dev,
@@ -37,10 +37,10 @@
  		napi_enable(&dev->napi[i]);
  	}
 diff --git a/mac80211.c b/mac80211.c
-index 62325345..137c5204 100644
+index 4caa714..923c6a3 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1046,14 +1046,9 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1041,14 +1041,9 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  	status->enc_flags = mstat.enc_flags;
  	status->encoding = mstat.encoding;
  	status->bw = mstat.bw;
@@ -58,7 +58,7 @@
  	status->rate_idx = mstat.rate_idx;
  	status->nss = mstat.nss;
  	status->band = mstat.band;
-@@ -1573,7 +1568,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
+@@ -1546,7 +1541,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
  static void
  __mt76_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -67,7 +67,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -1595,7 +1590,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1568,7 +1563,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct mt76_dev *dev = priv;
  
@@ -77,7 +77,7 @@
  
  	dev->csa_complete |= ieee80211_beacon_cntdwn_is_complete(vif);
 diff --git a/mt7615/dma.c b/mt7615/dma.c
-index 0ce01ccc..ad324850 100644
+index 0ce01cc..ad32485 100644
 --- a/mt7615/dma.c
 +++ b/mt7615/dma.c
 @@ -282,8 +282,8 @@ int mt7615_dma_init(struct mt7615_dev *dev)
@@ -92,7 +92,7 @@
  
  	mt76_poll(dev, MT_WPDMA_GLO_CFG,
 diff --git a/mt7615/main.c b/mt7615/main.c
-index dab16b5f..d32a7520 100644
+index dab16b5..d32a752 100644
 --- a/mt7615/main.c
 +++ b/mt7615/main.c
 @@ -473,7 +473,7 @@ static int mt7615_config(struct ieee80211_hw *hw, u32 changed)
@@ -123,7 +123,7 @@
  	if (changed & BSS_CHANGED_MU_GROUPS)
  		 mt7615_update_mu_group(hw, vif, info);
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index db337aad..c4d97434 100644
+index db337aa..c4d9743 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -353,7 +353,7 @@ out:
@@ -163,10 +163,10 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 02d52328..faeae26d 100644
+index f2b4ec9..431d60d 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
-@@ -1110,7 +1110,7 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -1107,7 +1107,7 @@ void mt76_connac2_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  	u32 val;
  
  	if (!sta ||
@@ -176,7 +176,7 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 07bd57b8..aa99bd78 100644
+index 1d22ab9..3a6404a 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -198,7 +198,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
@@ -314,7 +314,7 @@
  	}
  
  	return mode;
-@@ -858,25 +849,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -856,25 +847,25 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	u16 supp_rates;
  
  	/* starec ht */
@@ -346,7 +346,7 @@
  	}
  
  	/* starec uapsd */
-@@ -885,11 +876,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -883,11 +874,11 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	if (!is_mt7921(dev))
  		return;
  
@@ -360,7 +360,7 @@
  		mt76_connac_mcu_sta_he_tlv(skb, sta);
  		mt76_connac_mcu_sta_he_tlv_v2(skb, sta);
  		if (band == NL80211_BAND_6GHZ &&
-@@ -899,7 +890,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -897,7 +888,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  			tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G,
  						      sizeof(*he_6g_capa));
  			he_6g_capa = (struct sta_rec_he_6g_capa *)tlv;
@@ -369,7 +369,7 @@
  		}
  	}
  
-@@ -909,14 +900,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -907,14 +898,14 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
  	phy->rcpi = rcpi;
  	phy->ampdu = FIELD_PREP(IEEE80211_HT_AMPDU_PARM_FACTOR,
@@ -387,7 +387,7 @@
  	if (band == NL80211_BAND_2GHZ)
  		supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
  			     FIELD_PREP(RA_LEGACY_CCK, supp_rates & 0xf);
-@@ -925,18 +916,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
+@@ -923,18 +914,18 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
  
  	ra_info->legacy = cpu_to_le16(supp_rates);
  
@@ -411,7 +411,7 @@
  			IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
  	}
  }
-@@ -952,7 +943,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
+@@ -950,7 +941,7 @@ void mt76_connac_mcu_wtbl_smps_tlv(struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_nested_tlv(skb, WTBL_SMPS, sizeof(*smps),
  					     wtbl_tlv, sta_wtbl);
  	smps = (struct wtbl_smps *)tlv;
@@ -420,7 +420,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_smps_tlv);
  
-@@ -964,27 +955,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -962,27 +953,27 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u32 flags = 0;
  
@@ -456,7 +456,7 @@
  		struct wtbl_vht *vht;
  		u8 af;
  
-@@ -993,18 +984,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -991,18 +982,18 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sta_wtbl);
  		vht = (struct wtbl_vht *)tlv;
  		vht->ldpc = vht_ldpc &&
@@ -478,7 +478,7 @@
  		/* sgi */
  		u32 msk = MT_WTBL_W5_SHORT_GI_20 | MT_WTBL_W5_SHORT_GI_40 |
  			  MT_WTBL_W5_SHORT_GI_80 | MT_WTBL_W5_SHORT_GI_160;
-@@ -1014,15 +1005,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1012,15 +1003,15 @@ void mt76_connac_mcu_wtbl_ht_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  						     sizeof(*raw), wtbl_tlv,
  						     sta_wtbl);
  
@@ -499,7 +499,7 @@
  				flags |= MT_WTBL_W5_SHORT_GI_160;
  		}
  		raw = (struct wtbl_raw *)tlv;
-@@ -1311,9 +1302,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1309,9 +1300,9 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  		return 0x38;
  
  	if (sta) {
@@ -512,7 +512,7 @@
  	} else {
  		struct ieee80211_supported_band *sband;
  
-@@ -1636,7 +1627,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1631,7 +1622,6 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	for (i = 0; i < sreq->n_ssids; i++) {
  		if (!sreq->ssids[i].ssid_len)
  			continue;
@@ -520,7 +520,7 @@
  		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
  		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
  		       sreq->ssids[i].ssid_len);
-@@ -1776,7 +1766,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
+@@ -1771,7 +1761,6 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
  		memcpy(req->ssids[i].ssid, ssid->ssid, ssid->ssid_len);
  		req->ssids[i].ssid_len = cpu_to_le32(ssid->ssid_len);
  	}
@@ -528,7 +528,7 @@
  	req->match_num = sreq->n_match_sets;
  	for (i = 0; i < req->match_num; i++) {
  		match = &sreq->match_sets[i];
-@@ -2272,10 +2261,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2267,10 +2256,8 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  				      struct mt76_vif *vif,
  				      struct ieee80211_bss_conf *info)
  {
@@ -540,7 +540,7 @@
  			   IEEE80211_BSS_ARP_ADDR_LIST_LEN);
  	struct {
  		struct {
-@@ -2303,7 +2290,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
+@@ -2298,7 +2285,7 @@ int mt76_connac_mcu_update_arp_filter(struct mt76_dev *dev,
  
  	skb_put_data(skb, &req_hdr, sizeof(req_hdr));
  	for (i = 0; i < len; i++)
@@ -550,7 +550,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD(OFFLOAD), true);
  }
 diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-index d5db6ffd..fec3d10d 100644
+index d5db6ff..fec3d10 100644
 --- a/mt76x02_mac.c
 +++ b/mt76x02_mac.c
 @@ -404,7 +404,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
@@ -575,7 +575,7 @@
  		if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
  			ba_size = 0;
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index fd35b579..117ebb56 100644
+index fd35b57..117ebb5 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -2049,8 +2049,8 @@ static ssize_t mt7915_sta_fixed_rate_set(struct file *file,
@@ -590,7 +590,7 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index f71ec55b..b4e231b7 100644
+index f71ec55..b4e231b 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -590,8 +590,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -605,10 +605,10 @@
  
  	mt7915_dma_enable(dev, false);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index db627500..0ce17775 100644
+index 9978edb..d50e694 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1173,8 +1173,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -1181,8 +1181,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  			mt76_connac_gen_ppe_thresh(he_cap->ppe_thres, nss);
  		} else {
  			he_cap_elem->phy_cap_info[9] |=
@@ -619,10 +619,10 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8bcffd3f..7af49404 100644
+index 9595b55..29bfec8 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -538,7 +538,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -540,7 +540,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  
  static int
  mt7915_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -631,7 +631,7 @@
  	       const struct ieee80211_tx_queue_params *params)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-@@ -639,7 +639,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
+@@ -641,7 +641,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
  static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  				    struct ieee80211_vif *vif,
  				    struct ieee80211_bss_conf *info,
@@ -640,7 +640,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -655,7 +655,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -657,7 +657,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	    vif->type == NL80211_IFTYPE_STATION)
  		set_bss_info = set_sta = !is_zero_ether_addr(info->bssid);
  	if (changed & BSS_CHANGED_ASSOC)
@@ -649,7 +649,7 @@
  	if (changed & BSS_CHANGED_BEACON_ENABLED &&
  	    vif->type != NL80211_IFTYPE_AP)
  		set_bss_info = set_sta = info->enable_beacon;
-@@ -703,27 +703,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -705,27 +705,8 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -678,7 +678,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -731,8 +712,6 @@ mt7915_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -733,8 +714,6 @@ mt7915_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -687,7 +687,7 @@
  	err = mt7915_mcu_add_bss_info(phy, vif, true);
  	if (err)
  		goto out;
-@@ -744,8 +723,7 @@ out:
+@@ -746,8 +725,7 @@ out:
  }
  
  static void
@@ -697,7 +697,7 @@
  {
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
  
-@@ -1307,10 +1285,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
+@@ -1317,10 +1295,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
@@ -711,7 +711,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ebacfd27..95c4188d 100644
+index 72f74e1..cb534af 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -67,7 +67,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
@@ -1303,7 +1303,7 @@
  	mt7915_mcu_beacon_cntdwn(vif, rskb, skb, bcn, &offs);
  	mt7915_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
  	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
-@@ -3331,17 +3411,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3351,17 +3431,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1325,7 +1325,7 @@
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b6779474..1e998113 100644
+index ce976b4..3755690 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -689,7 +689,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
@@ -1338,7 +1338,7 @@
  			skb_free_frag(ptr);
  			mt76_put_rxwi(&dev->mt76, r);
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 5e20cb9e..a765f387 100644
+index ecd6271..b2c442b 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -418,12 +418,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
@@ -1359,7 +1359,7 @@
  	sta->wme = 1;
  
 diff --git a/tx.c b/tx.c
-index 96f9009b..23a1e4e2 100644
+index c88fb29..9dfc289 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 9219623..8eeae08 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -8,6 +8,7 @@
     file://0006-wifi-mt76-mt7915-rework-mmio-access-flow.patch \
     file://0007-wifi-mt76-disable-HW-AMSDU-when-using-fixed-rate.patch \
     file://0008-wifi-mt76-mt7915-add-new-chip-version-in-power-on-se.patch \
+    file://0009-wifi-mt76-mt7915-Fixed-null-pointer-dereference-.patch \
     file://0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch \
     file://1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch \
     file://1001-wifi-mt76-mt7915-csi-implement-csi-support.patch \
@@ -52,6 +53,8 @@
     file://1040-wifi-mt76-mt7915-add-debug-log-for-SER-flow.patch \
     file://1041-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch \
     file://1042-wifi-mt76-mt7915-add-debuffs-knob-for-protect-thresh.patch \
+    file://1043-wifi-mt76-mt7915-add-cheetah-eeprom-related-fix.patch \
+    file://1044-wifi-mt76-testmode-add-cheetah-support.patch \
     file://2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://2001-wifi-mt76-mt7915-wed-add-wds-support-when-wed-is-ena.patch \
     file://2002-wifi-mt76-mt7915-wed-add-fill-receive-path-to-report.patch \
@@ -64,9 +67,10 @@
     file://2009-wifi-mt76-mt7915-enable-wa-log-to-uart.patch \
     file://2010-wifi-mt76-mt7915-add-error-message-when-driver-recei.patch \
     file://2011-wifi-mt76-mt7915-wed-change-wed-token-init-size-to-a.patch \
-    file://2012-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch \
-    file://2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch \
-    file://2014-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch \
-    file://2015-Revert-wifi-mt76-fix-race-condition-related-to-check.patch \
+    file://2012-wifi-mt76-mt7915-wed-add-per-bss-statistic-info.patch \
+    file://2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch \
+    file://2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch \
+    file://2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch \
+    file://2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch \
     file://9999-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "