[rdk-b][common][bsp][Refactor and sync kernel/wifi from Openwrt]

[Description]
Refactor and sync kernel/wifi from Openwrt
1. wifi release from mt76 openwrt 2022/12/19

[Release-log]
N/A

diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
index c4c2b78..c0aa8f7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
@@ -1,7 +1,7 @@
-From 00cd9ac2311cf4b66ab7c3d6eb3593b52bea1bec Mon Sep 17 00:00:00 2001
+From 8e713a822b50ac009c97a257dde21897400de02d Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 2 Dec 2022 10:16:49 +0800
-Subject: [PATCH 1/4] wifi: mt76: mt7915: call
+Subject: [PATCH 1/6] wifi: mt76: mt7915: call
  mt7915_mcu_set_thermal_throttling() only after init_work
 
 Enable thermal management by default shall not be executed during mcu
@@ -17,7 +17,7 @@
  2 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6fd5c63e..a03d0b3b 100644
+index 6fd5c63..a03d0b3 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -201,8 +201,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
@@ -31,7 +31,7 @@
  
  static void mt7915_led_set_config(struct led_classdev *led_cdev,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0511d6a5..98af032e 100644
+index 0511d6a..98af032 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -57,6 +57,12 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -48,5 +48,5 @@
  					     phy->mt76->band_idx);
  	if (ret)
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
index 618a14e..9e6c27f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
@@ -1,7 +1,7 @@
-From 906bad79c7beb43c81a80fdb97898ebb977e527a Mon Sep 17 00:00:00 2001
+From 38da46e9edb3f699df3f57525b445690338857dc Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 5 Dec 2022 14:09:18 +0800
-Subject: [PATCH 2/4] wifi: mt76: mt7915: rework
+Subject: [PATCH 2/6] wifi: mt76: mt7915: rework
  mt7915_mcu_set_thermal_throttling
 
 This patch includes 2 changes:
@@ -22,7 +22,7 @@
  4 files changed, 37 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index a03d0b3b..df3a35d5 100644
+index a03d0b3..df3a35d 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -134,9 +134,6 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,
@@ -36,7 +36,7 @@
  		return 0;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 98af032e..7589af4b 100644
+index 98af032..7589af4 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -60,6 +60,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -52,7 +52,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 35441dcb..7c14a189 100644
+index 35441dc..7c14a18 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3077,6 +3077,29 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
@@ -135,7 +135,7 @@
  				 &req, sizeof(req), false);
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6351feba..855779f8 100644
+index 6351feb..855779f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -543,6 +543,7 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy);
@@ -147,5 +147,5 @@
  			   struct ieee80211_sta *sta, struct rate_info *rate);
  int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
index f1c0093..91a258f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
@@ -1,7 +1,7 @@
-From 2cd5969305cc6ba22a1a3ffc45f46758d09bbd1e Mon Sep 17 00:00:00 2001
+From 728ee842b9f9819251e4dd4a2779ee337b003321 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 12 Dec 2022 11:30:37 +0800
-Subject: [PATCH 3/4] wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
+Subject: [PATCH 3/6] wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
 
 Call mt7915_mcu_set_thermal_protect() through
 mt7915_thermal_temp_store() to update firmware trigger/restore temp
@@ -16,7 +16,7 @@
  2 files changed, 19 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index df3a35d5..98655e4d 100644
+index df3a35d..98655e4 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -83,9 +83,23 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev,
@@ -55,7 +55,7 @@
  	return 0;
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 855779f8..e58650bb 100644
+index 855779f..e58650b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -70,6 +70,9 @@
@@ -69,5 +69,5 @@
  struct mt7915_sta;
  struct mt7915_dfs_pulse;
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
index 8f9fa45..2334dd5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
@@ -1,7 +1,7 @@
-From 30bd3547690ec1463b34c726577ae821e92a4390 Mon Sep 17 00:00:00 2001
+From 52c2b1c1b68a4bf886a86a39f9d2a489de0b3914 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 12 Dec 2022 13:18:49 +0800
-Subject: [PATCH 4/4] wifi: mt76: mt7915: add error message in
+Subject: [PATCH 4/6] wifi: mt76: mt7915: add error message in
  mt7915_thermal_set_cur_throttle_state()
 
 Add dev_err so that it is easier to see invalid setting while looking at
@@ -16,7 +16,7 @@
  2 files changed, 9 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 98655e4d..b23a2fb8 100644
+index 98655e4..b23a2fb 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -145,8 +145,11 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,
@@ -61,7 +61,7 @@
  {
  	struct mt7915_phy *phy2;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e58650bb..942d70c5 100644
+index e58650b..942d70c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -72,6 +72,8 @@
@@ -74,5 +74,5 @@
  struct mt7915_vif;
  struct mt7915_sta;
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch
new file mode 100644
index 0000000..2385ac3
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch
@@ -0,0 +1,29 @@
+From d2d8c86a980592caefe1993cbb0a75136de3ec8d Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Thu, 15 Dec 2022 17:15:49 +0800
+Subject: [PATCH 5/6] wifi: mt76: mt7915: set sku initial value to zero
+
+Set sku initial value to prevent mcu get an invalid value before mcu starts
+to run.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/soc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/mt7915/soc.c b/mt7915/soc.c
+index 686c9bb..2ac0a0f 100644
+--- a/mt7915/soc.c
++++ b/mt7915/soc.c
+@@ -883,6 +883,8 @@ static int mt7986_wmac_wm_enable(struct mt7915_dev *dev, bool enable)
+ {
+ 	u32 cur;
+ 
++	mt76_wr(dev, MT_CONNINFRA_SKU_DEC_ADDR, 0);
++
+ 	mt76_rmw_field(dev, MT7986_TOP_WM_RESET,
+ 		       MT7986_TOP_WM_RESET_MASK, enable);
+ 	if (!enable)
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch
new file mode 100644
index 0000000..6a9cebe
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch
@@ -0,0 +1,43 @@
+From e6b4dcb07b02fea725d11d364fabb0f801423edd Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 8 Dec 2022 15:54:19 +0800
+Subject: [PATCH 6/6] wifi: mt76: mt7915: add chip id condition in
+ mt7915_check_eeprom()
+
+When flash mode is enabled, and the eeprom data in the flash is not for
+the current chipset, it'll still be checked valid, and the default
+eeprom bin won't be loaded.
+(e.g., mt7915 NIC inserted with mt7916 eeprom data in the flash.)
+
+Fix this kind of case by adding chip id into consideration in
+mt7915_check_eeprom().
+
+Reported-by: Cheng-Ji Li <cheng-ji.li@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/eeprom.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index 24efa28..a796289 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -33,11 +33,14 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+ 	u8 *eeprom = dev->mt76.eeprom.data;
+ 	u16 val = get_unaligned_le16(eeprom);
+ 
++#define CHECK_EEPROM_ERR(match)	(match ? 0 : -EINVAL)
+ 	switch (val) {
+ 	case 0x7915:
++		return CHECK_EEPROM_ERR(is_mt7915(&dev->mt76));
+ 	case 0x7916:
++		return CHECK_EEPROM_ERR(is_mt7916(&dev->mt76));
+ 	case 0x7986:
+-		return 0;
++		return CHECK_EEPROM_ERR(is_mt7986(&dev->mt76));
+ 	default:
+ 		return -EINVAL;
+ 	}
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 18417be..4696cf4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,7 +1,7 @@
-From 53904fff8723ca80699e95efeb4b3fe9ededafbd Mon Sep 17 00:00:00 2001
+From 896f096e8d6f31674edf48b1523814d81c059291 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1001/1042] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    7 +
@@ -13,10 +13,10 @@
  mt7915/mcu.h          |    4 +
  mt7915/mt7915.h       |   44 +
  mt7915/mt7915_debug.h | 1350 +++++++++++++++++++
- mt7915/mtk_debugfs.c  | 2925 +++++++++++++++++++++++++++++++++++++++++
+ mt7915/mtk_debugfs.c  | 2926 +++++++++++++++++++++++++++++++++++++++++
  mt7915/mtk_mcu.c      |   51 +
  tools/fwlog.c         |   44 +-
- 12 files changed, 4568 insertions(+), 13 deletions(-)
+ 12 files changed, 4569 insertions(+), 13 deletions(-)
  create mode 100644 mt7915/mt7915_debug.h
  create mode 100644 mt7915/mtk_debugfs.c
  create mode 100644 mt7915/mtk_mcu.c
@@ -243,10 +243,10 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0511d6a..b44507f 100644
+index 7589af4..f6edab6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -62,7 +62,11 @@ int mt7915_run(struct ieee80211_hw *hw)
+@@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
  	if (ret)
  		goto out;
  
@@ -259,7 +259,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 35441dc..56e5ea5 100644
+index 7c14a18..644e6a8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -274,7 +274,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3323,6 +3328,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3331,6 +3336,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -283,7 +283,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3760,6 +3767,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3768,6 +3775,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -327,7 +327,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -3788,3 +3832,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3796,3 +3840,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -366,7 +366,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6351feb..7c129f7 100644
+index 942d70c..afe2ec7 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -377,7 +377,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -367,6 +368,29 @@ struct mt7915_dev {
+@@ -372,6 +373,29 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -407,7 +407,7 @@
  };
  
  enum {
-@@ -644,4 +668,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -650,4 +674,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -1790,10 +1790,10 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..747a901
+index 0000000..53f98d1
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
-@@ -0,0 +1,2925 @@
+@@ -0,0 +1,2926 @@
 +#include<linux/inet.h>
 +#include "mt7915.h"
 +#include "mt7915_debug.h"
@@ -4177,7 +4177,8 @@
 +
 +	if (txd->txd_2 & MT_TXD2_FIX_RATE) {
 +		/* Fixed BandWidth mode [2:0] */
-+		printk("\t\tbw = %ld\n", FIELD_GET(MT_TXD6_BW, txd->txd_6));
++		printk("\t\tbw = %ld\n",
++		       FIELD_GET(MT_TXD6_BW, txd->txd_6) | (txd->txd_6 & MT_TXD6_FIXED_BW));
 +
 +		/* DYN_BW [3] */
 +		printk("\t\tdyn_bw = %d\n", (txd->txd_6 & MT_TXD6_DYN_BW) ? 1 : 0);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
index ed75241..10e5f57 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,7 +1,7 @@
-From 06233088901511040fafaba99f8e6f85faf63557 Mon Sep 17 00:00:00 2001
+From fb6a20679c1b404d3e06e79f1c83e8014ead7dc4 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 1002/1042] mt76: mt7915: csi: implement csi support
+Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -53,10 +53,10 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6fd5c63..79080ae 100644
+index b23a2fb..844a92f 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -645,6 +645,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -658,6 +658,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
  	mt7915_init_wiphy(phy);
  
@@ -69,7 +69,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1151,6 +1157,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1164,6 +1170,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -95,7 +95,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1159,6 +1184,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1172,6 +1197,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -106,7 +106,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1171,6 +1200,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1184,6 +1213,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -117,7 +117,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1212,6 +1245,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1224,6 +1257,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -131,7 +131,7 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 56e5ea5..f483d44 100644
+index 644e6a8..788f3fb 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
@@ -157,7 +157,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3767,6 +3776,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3775,6 +3784,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -352,10 +352,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 7c129f7..8bb6d09 100644
+index afe2ec7..53e1315 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -288,6 +288,20 @@ struct mt7915_phy {
+@@ -293,6 +293,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -376,7 +376,7 @@
  };
  
  struct mt7915_dev {
-@@ -668,6 +682,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -674,6 +688,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
index 95ba41a..a6203f9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,7 +1,7 @@
-From 348d91e6cd920a4728d71711e9279596837b4a85 Mon Sep 17 00:00:00 2001
+From e2209fc24e4bbaf715da173844888195192d2c36 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1003/1042] mt76: mt7915: air monitor support
+Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -41,10 +41,10 @@
  		status->flag |= RX_FLAG_8023;
  		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b44507f..33db720 100644
+index f6edab6..04f248f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -691,6 +691,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -702,6 +702,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8bb6d09..33ca8e8 100644
+index 53e1315..29082b6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -244,6 +244,35 @@ struct mt7915_hif {
+@@ -249,6 +249,35 @@ struct mt7915_hif {
  	int irq;
  };
  
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -301,6 +330,8 @@ struct mt7915_phy {
+@@ -306,6 +335,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -686,6 +717,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -692,6 +723,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 3c804e0..c59c29c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,7 +1,7 @@
-From fb6b74ae5596a63325eaa024cf2ca4abdc9ba67e Mon Sep 17 00:00:00 2001
+From 6e393c35dff8447e3f1cb95fa8e17ff573786b83 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
-Subject: [PATCH 1004/1042] mt76: mt7915: add support for muru_onoff via
+Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
  debugfs
 
 ---
@@ -12,10 +12,10 @@
  4 files changed, 48 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 79080ae..172bdcf 100644
+index 844a92f..00ddab7 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -680,6 +680,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -693,6 +693,7 @@ static void mt7915_init_work(struct work_struct *work)
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
  	mt7915_txbf_init(dev);
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f483d44..e0e25a9 100644
+index 788f3fb..ce07eee 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -876,13 +876,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -65,10 +65,10 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 747a901..176937a 100644
+index 53f98d1..2719a8d 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
+@@ -2481,6 +2481,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -107,7 +107,7 @@
  static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -2859,6 +2891,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2860,6 +2892,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
index 636f0a6..887416d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1005-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From 0e5f3fbc65dd09924683c8c5e6ba62f60cbd2843 Mon Sep 17 00:00:00 2001
+From d907288c5570f0677e9c968672d428fe27fe1fde Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1005/1042] mt76: mt7915: certification patches
+Subject: [PATCH 1005/1009] mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 33db720..3d309bc 100644
+index 04f248f..2c4e392 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -667,6 +667,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -678,6 +678,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -694,7 +697,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -705,7 +708,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -109,10 +109,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e0e25a9..4e36910 100644
+index ce07eee..c459258 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3881,6 +3881,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3889,6 +3889,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -820,10 +820,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 33ca8e8..415fe82 100644
+index 29082b6..9fdb80b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -714,6 +714,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -720,6 +720,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -844,10 +844,10 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 176937a..e24b4d7 100644
+index 2719a8d..b03ae39 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+@@ -2487,7 +2487,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
  
         *val = dev->dbg.muru_onoff;
  
@@ -857,7 +857,7 @@
                 !!(dev->dbg.muru_onoff & MUMIMO_UL),
                 !!(dev->dbg.muru_onoff & MUMIMO_DL),
                 !!(dev->dbg.muru_onoff & OFDMA_UL),
-@@ -2499,8 +2500,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+@@ -2500,8 +2501,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
  {
         struct mt7915_dev *dev = data;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 23681ef..16a6e86 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,7 +1,7 @@
-From 9427ac3e09d513858340177b70927f17cacd709c Mon Sep 17 00:00:00 2001
+From 4a702a59295eac2b9ff96f95d4233d8389af3445 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
-Subject: [PATCH 1006/1042] mt76: mt7915:add support for runtime set in-band
+Subject: [PATCH 1006/1009] mt76: mt7915: add support for runtime set in-band
  discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 4e36910..47dee76 100644
+index c459258..3baed2c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1993,8 +1993,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 0d0a199..14ba128 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,7 +1,7 @@
-From 19680b3e37b2fbee253100ff02f6aabf9c8025f6 Mon Sep 17 00:00:00 2001
+From b84df4fe11ae05b26b79293435e18503646a368d Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
-Subject: [PATCH 1007/1042] mt76: mt7915: add mt76 vendor muru onoff command
+Subject: [PATCH 1007/1009] mt76: mt7915: add mt76 vendor muru onoff command
 
 ---
  mt7915/mcu.c    |  7 +++++++
@@ -11,10 +11,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 47dee76..ec306f0 100644
+index 3baed2c..7728e82 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3900,6 +3900,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3908,6 +3908,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
index 0f987a7..ca530b8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1008-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,7 +1,7 @@
-From fbc8ac0d6765825b5db2917b094c8327a547f1f6 Mon Sep 17 00:00:00 2001
+From 8d4b1752e1a575f0b888c703604b5ea7706b5184 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 1008/1042] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 1008/1009] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
index d17456e..8fa4904 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,7 +1,7 @@
-From 52bdf313f5aa51dc7617fd32ca35267fd6b1a8f6 Mon Sep 17 00:00:00 2001
+From c130c667f1179d03f63f175a3a0eac9208464625 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH 1009/1042] mt76: mt7915: add fw_version dump
+Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
 
 ---
  mt76.h               |  4 ++++
@@ -59,10 +59,10 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e24b4d7..766b278 100644
+index b03ae39..583bc19 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
+@@ -2722,6 +2722,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -85,7 +85,7 @@
  /*usage: <en> <num> <len>
  	en: BIT(16) 0: sw amsdu  1: hw amsdu
  	num: GENMASK(15, 8) range 1-8
-@@ -2954,6 +2970,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2955,6 +2971,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-testmode-rework-testmode-init-registers.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-testmode-rework-testmode-init-registers.patch
index 70aac7a..ac5367e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-testmode-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 4f5ff04c48922ddbbffa73965f086b1b0c2a2e68 Mon Sep 17 00:00:00 2001
+From f07a42b3a9a2fe75a265b3cc138405f2c2c414d1 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1111/1129] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1111/1131] mt76: testmode: rework testmode init registers
 
 ---
  mac80211.c        |   3 +-
@@ -17,7 +17,7 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 7fe7f68a..19d9efb3 100644
+index 7fe7f68..19d9efb 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -775,7 +775,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -31,7 +31,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index beea57d5..4822ffb7 100644
+index beea57d..4822ffb 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -637,6 +637,8 @@ struct mt76_testmode_ops {
@@ -61,7 +61,7 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18ae3acb..18d6c669 100644
+index 18ae3ac..18d6c66 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1188,6 +1188,7 @@ enum {
@@ -73,7 +73,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index eaadd331..2e97db7b 100644
+index eaadd33..2e97db7 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -85,7 +85,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index afa558c9..07de3cbd 100644
+index afa558c..07de3cb 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
@@ -105,7 +105,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index c8e478a5..d6a05f13 100644
+index c8e478a..d6a05f1 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -48,6 +48,7 @@ enum reg_rev {
@@ -153,7 +153,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0d76ae31..46939191 100644
+index 0d76ae3..4693919 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -378,7 +378,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac30..a1c54c89 100644
+index 5573ac3..a1c54c8 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -429,7 +429,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 0accc71a..1d0d5d30 100644
+index 0accc71..1d0d5d3 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -453,7 +453,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d8..89613266 100644
+index 5e2792d..8961326 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
@@ -474,5 +474,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
index 6f358d1..224cf40 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1112-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 54cc888e7dcd2b5855dc7c0a0f7a19a2703b1735 Mon Sep 17 00:00:00 2001
+From 56318cae7730f769586e633fa4495bce15a9c5c9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1112/1129] mt76: testmode: additional supports
+Subject: [PATCH 1112/1131] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -27,7 +27,7 @@
  19 files changed, 1963 insertions(+), 147 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index fc24b353..dc8d8882 100644
+index fc24b35..dc8d888 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -539,8 +539,7 @@ free:
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index 19d9efb3..2e0e011d 100644
+index 19d9efb..2e0e011 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,7 +71,7 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 4822ffb7..58258e19 100644
+index 4822ffb..58258e1 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -635,6 +635,21 @@ struct mt76_testmode_ops {
@@ -233,7 +233,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index cf6ec55f..291a7c12 100644
+index cf6ec55..291a7c1 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
@@ -255,7 +255,7 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18d6c669..a8ce98c9 100644
+index 18d6c66..a8ce98c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -994,6 +994,7 @@ enum {
@@ -275,10 +275,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 172bdcf2..3f0a9d93 100644
+index 00ddab7..e044f50 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -674,7 +674,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -687,7 +687,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -288,7 +288,7 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index fc7b7903..0746e4b3 100644
+index fc7b790..0746e4b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -628,16 +628,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -361,10 +361,10 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3d309bc0..8527b90a 100644
+index 2c4e392..4c3d822 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -227,7 +227,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mvif->phy = phy;
  	mvif->mt76.band_idx = phy->mt76->band_idx;
  
@@ -374,7 +374,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ec306f01..d4336f69 100644
+index 7728e82..85450ea 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -383,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -415,7 +415,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 2e97db7b..4d86c7f1 100644
+index 2e97db7..4d86c7f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -472,7 +472,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 07de3cbd..26881fdc 100644
+index 07de3cb..26881fd 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
@@ -492,10 +492,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 415fe82a..6206c7f5 100644
+index 9fdb80b..4336f20 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -315,6 +315,9 @@ struct mt7915_phy {
+@@ -320,6 +320,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -505,7 +505,7 @@
  	} test;
  #endif
  
-@@ -414,6 +417,14 @@ struct mt7915_dev {
+@@ -419,6 +422,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -520,7 +520,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -585,7 +596,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -590,7 +601,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -529,7 +529,7 @@
  int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -622,6 +633,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -628,6 +639,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -538,7 +538,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index d6a05f13..e8768488 100644
+index d6a05f1..e876848 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -559,7 +559,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 46939191..e0ba088f 100644
+index 4693919..e0ba088 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1898,7 +1898,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c89..01b08e9e 100644
+index a1c54c8..01b08e9 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2213,7 +2213,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1d0d5d30..7a9ed543 100644
+index 1d0d5d3..7a9ed54 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2680,7 +2680,7 @@
  		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
  		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 89613266..57949f2b 100644
+index 8961326..57949f2 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2785,7 +2785,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f69089..6e36ab27 100644
+index e3f6908..6e36ab2 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2911,7 +2911,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 1f309d05..6d55566f 100644
+index 1f309d0..6d55566 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -250,8 +250,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
@@ -2925,5 +2925,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
index 68bc681..fd6e693 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1113-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 42421ff7f8ef7bbc45a050c6f7590981862d91bd Mon Sep 17 00:00:00 2001
+From f0f90b38ccb883ab57ea2b0581dc3b2c20e9ffe1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1113/1129] mt76: testmode: add pre-cal support
+Subject: [PATCH 1113/1131] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 0a88048b..cb6ff17a 100644
+index 0a88048..cb6ff17 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,7 +37,7 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 58258e19..89c85709 100644
+index 58258e1..89c8570 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -636,6 +636,7 @@ struct mt76_testmode_ops {
@@ -49,7 +49,7 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a8ce98c9..f42946ec 100644
+index a8ce98c..f42946e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -990,6 +990,7 @@ enum {
@@ -61,7 +61,7 @@
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index f3e56817..88aaa16a 100644
+index f3e5681..88aaa16 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
@@ -114,7 +114,7 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d4336f69..92bae4f7 100644
+index 85450ea..8e3217b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -387,6 +387,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6206c7f5..ed1469d6 100644
+index 4336f20..b6c9fc5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -401,6 +401,10 @@ struct mt7915_dev {
+@@ -406,6 +406,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -634,6 +638,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -640,6 +644,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index e0ba088f..a9e57e4b 100644
+index e0ba088..a9e57e4 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -667,7 +667,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9e..d500987d 100644
+index 01b08e9..d500987 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -735,7 +735,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index 7a9ed543..82b8e983 100644
+index 7a9ed54..82b8e98 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -768,7 +768,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 57949f2b..e2190e72 100644
+index 57949f2..e2190e7 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -824,7 +824,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 6e36ab27..1be1ffd6 100644
+index 6e36ab2..1be1ffd 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
@@ -843,5 +843,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
index c388f49..1323f90 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1114-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 1853a51568f7d4523d623941689df571fd9aeee1 Mon Sep 17 00:00:00 2001
+From af09d1fafb170c7b5eefc20bf9c5349bccd51fcb Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1114/1129] mt76: testmode: add iBF command mode support
+Subject: [PATCH 1114/1131] mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index a9e57e4b..99582d9c 100644
+index a9e57e4..99582d9 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -105,7 +105,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index 82b8e983..aa874a83 100644
+index 82b8e98..aa874a8 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -530,6 +530,42 @@ out:
@@ -164,7 +164,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index e2190e72..5d1fe793 100644
+index e2190e7..5d1fe79 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
@@ -179,7 +179,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 1be1ffd6..47fc69f9 100644
+index 1be1ffd..47fc69f 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
@@ -239,5 +239,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 8c03a50..afda4a7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From e57d8aba69628acfc9ed8ba2d5c67f5faaa31d4e Mon Sep 17 00:00:00 2001
+From 494d1623eb89553db1ed58fa6b8966a29ca96e3c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1115/1129] mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1115/1131] mt76: testmode: add ZWDFS test mode support
 
 Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -19,7 +19,7 @@
  10 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 89c85709..2bacc1b4 100644
+index 89c8570..2bacc1b 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -719,6 +719,15 @@ struct mt76_testmode_data {
@@ -39,7 +39,7 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f42946ec..7853e074 100644
+index f42946e..7853e07 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1190,6 +1190,7 @@ enum {
@@ -59,7 +59,7 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 92bae4f7..87d2c0de 100644
+index 8e3217b..b8243e1 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2636,6 +2636,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
@@ -70,7 +70,7 @@
  		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4466,3 +4467,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4474,3 +4475,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -140,7 +140,7 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 4d86c7f1..9a485249 100644
+index 4d86c7f..9a48524 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -628,6 +628,52 @@ struct csi_data {
@@ -197,10 +197,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ed1469d6..26bcb4e5 100644
+index b6c9fc5..d845206 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -303,6 +303,7 @@ struct mt7915_phy {
+@@ -308,6 +308,7 @@ struct mt7915_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -208,7 +208,7 @@
  
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
-@@ -752,6 +753,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -758,6 +759,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -219,7 +219,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e8768488..f4b57099 100644
+index e876848..f4b5709 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -1194,6 +1194,8 @@ enum offs_rev {
@@ -232,7 +232,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 99582d9c..2ae6c07f 100644
+index 99582d9..2ae6c07 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -503,7 +503,7 @@
  
  static int
 diff --git a/testmode.c b/testmode.c
-index aa874a83..b19b872a 100644
+index aa874a8..b19b872 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -24,6 +24,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -567,7 +567,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index 5d1fe793..27a00953 100644
+index 5d1fe79..27a0095 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -63,6 +63,20 @@
@@ -635,7 +635,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index 47fc69f9..6f07eed0 100644
+index 47fc69f..6f07eed 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -46,6 +46,14 @@ static const char * const testmode_txbf_act[] = {
@@ -682,5 +682,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
new file mode 100644
index 0000000..0ada55c
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
@@ -0,0 +1,1909 @@
+From f6c9069fc14f2c0749a8a55fbb55ad020f16838c Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 15 Dec 2022 19:45:18 +0800
+Subject: [PATCH 1116/1131] mt76: testmode: add iBF/eBF cal and cert commands
+ with golden
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt76.h               |   4 +
+ mt76_connac_mcu.c    |   3 +
+ mt7915/mac.c         |   4 +-
+ mt7915/main.c        |  54 ++---
+ mt7915/mcu.c         |  29 ++-
+ mt7915/mcu.h         | 172 ++++++++++++++++
+ mt7915/mmio.c        |   2 +
+ mt7915/mt7915.h      |  14 +-
+ mt7915/mtk_debugfs.c |  35 ++++
+ mt7915/mtk_mcu.c     | 246 ++++++++++++++++++++++-
+ mt7915/regs.h        |   4 +
+ mt7915/testmode.c    | 458 ++++++++++++++++++++++++++++---------------
+ mt7915/testmode.h    | 134 +------------
+ testmode.c           |   1 +
+ testmode.h           |   9 +
+ tools/fields.c       |   9 +
+ 16 files changed, 855 insertions(+), 323 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index 2bacc1b..c6aefbf 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -681,6 +681,7 @@ struct mt76_testmode_data {
+ 
+ 	struct list_head tm_entry_list;
+ 	struct mt76_wcid *cur_entry;
++	struct ieee80211_vif *second_vif;
+ 	u8 entry_num;
+ 	union {
+ 		struct mt76_testmode_entry_data ed;
+@@ -709,6 +710,9 @@ struct mt76_testmode_data {
+ 
+ 	u8 txbf_act;
+ 	u16 txbf_param[8];
++	bool is_txbf_dut;
++	bool bf_en;
++	bool ebf;
+ 
+ 	u32 tx_pending;
+ 	u32 tx_queued;
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 291a7c1..14ce09e 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -2756,6 +2756,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
+ 	struct bss_info_basic *bss;
+ 	struct tlv *tlv;
++	struct mt76_testmode_data *td = &phy->test;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
+ 	bss = (struct bss_info_basic *)tlv;
+@@ -2815,6 +2816,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 		bss->dtim_period = vif->bss_conf.dtim_period;
+ 		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
+ 							 chandef->chan->band, NULL);
++	} else if (td->bf_en) {
++		memcpy(bss->bssid, vif->addr, ETH_ALEN);
+ 	} else {
+ 		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
+ 	}
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 0746e4b..013dfbd 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -753,8 +753,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ 		val |= MT_TXD6_LDPC;
+ 
+ 	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
+-	if (phy->test.bf_en)
++	if (td->bf_en && !td->ebf)
+ 		val |= MT_TXD6_TX_IBF | MT_TXD6_TX_EBF;
++	else if (td->bf_en && td->ebf)
++		val |= MT_TXD6_TX_EBF;
+ 
+ 	txwi[6] |= cpu_to_le32(val);
+ #endif
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 4c3d822..a347e77 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
+ 	}
+ }
+ 
+-static int mt7915_add_interface(struct ieee80211_hw *hw,
+-				struct ieee80211_vif *vif)
++int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en)
+ {
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+-	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+-	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct mt7915_dev *dev = phy->dev;
+ 	struct mt76_txq *mtxq;
+ 	bool ext_phy = phy != &dev->phy;
+ 	int idx, ret = 0;
+ 
+-	mutex_lock(&dev->mt76.mutex);
+-
+-	mt76_testmode_reset(phy->mt76, true);
+-
+-	if (vif->type == NL80211_IFTYPE_MONITOR &&
+-	    is_zero_ether_addr(vif->addr))
+-		phy->monitor_vif = vif;
++	/* To differentiate the mac address of TXD and TXCMD interface */
++	vif->addr[0] |= bf_en;
+ 
+ 	mvif->mt76.idx = __ffs64(~dev->mt76.vif_mask);
+-	if (mvif->mt76.idx >= (MT7915_MAX_INTERFACES << dev->dbdc_support)) {
+-		ret = -ENOSPC;
+-		goto out;
+-	}
++	if (mvif->mt76.idx >= (MT7915_MAX_INTERFACES << dev->dbdc_support))
++		return -ENOSPC;
+ 
+ 	idx = get_omac_idx(vif->type, phy->omac_mask);
+-	if (idx < 0) {
+-		ret = -ENOSPC;
+-		goto out;
+-	}
++	if (idx < 0)
++		return -ENOSPC;
++
+ 	mvif->mt76.omac_idx = idx;
+ 	mvif->phy = phy;
+ 	mvif->mt76.band_idx = phy->mt76->band_idx;
+ 
+-	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP && vif->type != NL80211_IFTYPE_MONITOR);
++	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP &&
++			      vif->type != NL80211_IFTYPE_MONITOR) || bf_en;
+ 	if (ext_phy)
+ 		mvif->mt76.wmm_idx += 2;
+ 
+ 	ret = mt7915_mcu_add_dev_info(phy, vif, true);
+ 	if (ret)
+-		goto out;
++		return ret;
+ 
+ 	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
+ 	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
+@@ -279,7 +270,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	mt7915_mcu_add_sta(dev, vif, NULL, true);
+ 	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
+ 
+-out:
++	return ret;
++}
++
++static int mt7915_add_interface(struct ieee80211_hw *hw,
++				struct ieee80211_vif *vif)
++{
++	struct mt7915_dev *dev = mt7915_hw_dev(hw);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	int ret = 0;
++
++	mutex_lock(&dev->mt76.mutex);
++
++	mt76_testmode_reset(phy->mt76, true);
++
++	if (vif->type == NL80211_IFTYPE_MONITOR &&
++	    is_zero_ether_addr(vif->addr))
++		phy->monitor_vif = vif;
++
++	ret = mt7915_init_vif(phy, vif, false);
++
+ 	mutex_unlock(&dev->mt76.mutex);
+ 
+ 	return ret;
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index b8243e1..5d41ebf 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -193,6 +193,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 	int ret;
+ 
+ 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
++
+ 	if (ret)
+ 		return ret;
+ 
+@@ -383,10 +384,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	case MCU_EXT_EVENT_BCC_NOTIFY:
+ 		mt7915_mcu_rx_bcc_notify(dev, skb);
+ 		break;
+-#ifdef CONFIG_NL80211_TESTMODE
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
+ 	case MCU_EXT_EVENT_BF_STATUS_READ:
+-		mt7915_tm_txbf_status_read(dev, skb);
++		mt7915_mcu_txbf_status_read(dev, skb);
+ 		break;
++#endif
++#ifdef CONFIG_NL80211_TESTMODE
+ 	case MCU_EXT_EVENT_RF_TEST:
+ 		mt7915_tm_rf_test_event(dev, skb);
+ 		break;
+@@ -673,11 +676,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
+ 	if (enable)
+ 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
+ 
+-	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
+-				      mvif->sta.wcid.idx, enable);
++	if (vif->type == NL80211_IFTYPE_MONITOR) {
++		struct mt76_testmode_data *td = &phy->mt76->test;
++		struct mt76_wcid *wcid;
++
++		if (!td->aid || list_empty(&td->tm_entry_list))
++			wcid = &mvif->sta.wcid;
++		else
++			wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
+ 
+-	if (vif->type == NL80211_IFTYPE_MONITOR)
++		mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
++					      wcid->idx, enable);
+ 		goto out;
++	}
++
++	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
++				      mvif->sta.wcid.idx, enable);
+ 
+ 	if (enable) {
+ 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
+@@ -3403,6 +3417,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+ 
+ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+ {
++#define MT_BF_PROCESSING	4
+ 	struct {
+ 		u8 action;
+ 		union {
+@@ -3429,7 +3444,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+ 		.action = action,
+ 	};
+ 
+-#define MT_BF_PROCESSING	4
+ 	switch (action) {
+ 	case MT_BF_SOUNDING_ON:
+ 		req.snd.snd_mode = MT_BF_PROCESSING;
+@@ -4347,6 +4361,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
+ 		req.he_opt = v2;
+ 		req.glo_opt = v3;
+ 		break;
++	case BF_SND_CFG_INF:
++		req.inf = v1;
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 9a48524..a30f52d 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -475,10 +475,12 @@ enum {
+ };
+ 
+ enum {
++	MT_BF_SOUNDING_OFF = 0,
+ 	MT_BF_SOUNDING_ON = 1,
+ 	MT_BF_DATA_PACKET_APPLY = 2,
+ 	MT_BF_PFMU_TAG_READ = 5,
+ 	MT_BF_PFMU_TAG_WRITE = 6,
++	MT_BF_STA_REC_READ = 13,
+ 	MT_BF_PHASE_CAL = 14,
+ 	MT_BF_IBF_PHASE_COMP = 15,
+ 	MT_BF_PROFILE_WRITE_ALL = 17,
+@@ -486,6 +488,176 @@ enum {
+ 	MT_BF_MODULE_UPDATE = 25
+ };
+ 
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
++struct mt7915_pfmu_tag1 {
++	__le32 pfmu_idx:10;
++	__le32 ebf:1;
++	__le32 data_bw:2;
++	__le32 lm:2;
++	__le32 is_mu:1;
++	__le32 nr:3, nc:3;
++	__le32 codebook:2;
++	__le32 ngroup:2;
++	__le32 _rsv:2;
++	__le32 invalid_prof:1;
++	__le32 rmsd:3;
++
++	__le32 col_id1:6, row_id1:10;
++	__le32 col_id2:6, row_id2:10;
++	__le32 col_id3:6, row_id3:10;
++	__le32 col_id4:6, row_id4:10;
++
++	__le32 ru_start_id:7;
++	__le32 _rsv1:1;
++	__le32 ru_end_id:7;
++	__le32 _rsv2:1;
++	__le32 mob_cal_en:1;
++	__le32 _rsv3:15;
++
++	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
++	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
++
++	__le32 _rsv4;
++} __packed;
++
++struct mt7915_pfmu_tag2 {
++	__le32 smart_ant:24;
++	__le32 se_idx:5;
++	__le32 _rsv:3;
++
++	__le32 _rsv1:8;
++	__le32 rmsd_thres:3;
++	__le32 _rsv2:5;
++	__le32 ibf_timeout:8;
++	__le32 _rsv3:8;
++
++	__le32 _rsv4:16;
++	__le32 ibf_data_bw:2;
++	__le32 ibf_nc:3;
++	__le32 ibf_nr:3;
++	__le32 ibf_ru:8;
++
++	__le32 mob_delta_t:8;
++	__le32 mob_lq_result:7;
++	__le32 _rsv5:1;
++	__le32 _rsv6:16;
++
++	__le32 _rsv7;
++} __packed;
++
++struct mt7915_pfmu_tag {
++	struct mt7915_pfmu_tag1 t1;
++	struct mt7915_pfmu_tag2 t2;
++};
++
++struct mt7915_bf_status_hdr {
++	u8 format_id;
++	u8 bw;
++	u16 subcarrier_idx;
++	bool bfer;
++	u8 rsv[3];
++} __packed;
++
++struct mt7915_bf_status {
++	struct mt7915_bf_status_hdr hdr;
++	u8 buf[1000];
++} __packed;
++
++struct mt7915_txbf_phase_out {
++	u8 c0_l;
++	u8 c1_l;
++	u8 c2_l;
++	u8 c3_l;
++	u8 c0_m;
++	u8 c1_m;
++	u8 c2_m;
++	u8 c3_m;
++	u8 c0_h;
++	u8 c1_h;
++	u8 c2_h;
++	u8 c3_h;
++	u8 c0_uh;
++	u8 c1_uh;
++	u8 c2_uh;
++	u8 c3_uh;
++};
++
++struct mt7915_txbf_phase {
++	u8 status;
++	struct {
++		u8 r0_uh;
++		u8 r0_h;
++		u8 r0_m;
++		u8 r0_l;
++		u8 r0_ul;
++		u8 r1_uh;
++		u8 r1_h;
++		u8 r1_m;
++		u8 r1_l;
++		u8 r1_ul;
++		u8 r2_uh;
++		u8 r2_h;
++		u8 r2_m;
++		u8 r2_l;
++		u8 r2_ul;
++		u8 r3_uh;
++		u8 r3_h;
++		u8 r3_m;
++		u8 r3_l;
++		u8 r3_ul;
++		u8 r2_uh_sx2;
++		u8 r2_h_sx2;
++		u8 r2_m_sx2;
++		u8 r2_l_sx2;
++		u8 r2_ul_sx2;
++		u8 r3_uh_sx2;
++		u8 r3_h_sx2;
++		u8 r3_m_sx2;
++		u8 r3_l_sx2;
++		u8 r3_ul_sx2;
++		u8 m_t0_h;
++		u8 m_t1_h;
++		u8 m_t2_h;
++		u8 m_t2_h_sx2;
++		u8 r0_reserved;
++		u8 r1_reserved;
++		u8 r2_reserved;
++		u8 r3_reserved;
++		u8 r2_sx2_reserved;
++		u8 r3_sx2_reserved;
++	} phase;
++};
++
++struct mt7915_pfmu_data {
++	__le16 subc_idx;
++	__le16 phi11;
++	__le16 phi21;
++	__le16 phi31;
++};
++
++struct mt7915_ibf_cal_info {
++	u8 format_id;
++	u8 group_l_m_n;
++	u8 group;
++	bool sx2;
++	u8 status;
++	u8 cal_type;
++	u8 _rsv[2];
++	u8 buf[1000];
++} __packed;
++
++enum {
++	IBF_PHASE_CAL_UNSPEC,
++	IBF_PHASE_CAL_NORMAL,
++	IBF_PHASE_CAL_VERIFY,
++	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
++	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
++};
++
++#define MT7915_TXBF_SUBCAR_NUM	64
++
++#endif
++
+ enum {
+ 	MURU_SET_ARB_OP_MODE = 14,
+ 	MURU_SET_PLATFORM_TYPE = 25,
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 26881fd..c1b421d 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -131,6 +131,7 @@ static const u32 mt7915_offs[] = {
+ 	[MDP_BNRCFR1]		= 0x074,
+ 	[ARB_DRNGR0]		= 0x194,
+ 	[ARB_SCR]		= 0x080,
++	[ARB_TQSAXM0]		= 0x030,
+ 	[RMAC_MIB_AIRTIME14]	= 0x3b8,
+ 	[AGG_AALCR0]		= 0x048,
+ 	[AGG_AWSCR0]		= 0x05c,
+@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
+ 	[MDP_BNRCFR1]		= 0x094,
+ 	[ARB_DRNGR0]		= 0x1e0,
+ 	[ARB_SCR]		= 0x000,
++	[ARB_TQSAXM0]		= 0x180,
+ 	[RMAC_MIB_AIRTIME14]	= 0x0398,
+ 	[AGG_AALCR0]		= 0x028,
+ 	[AGG_AWSCR0]		= 0x030,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index d845206..ab1efe6 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -322,7 +322,6 @@ struct mt7915_phy {
+ 
+ 		u8 spe_idx;
+ 
+-		bool bf_en;
+ 		bool bf_ever_en;
+ 	} test;
+ #endif
+@@ -427,7 +426,7 @@ struct mt7915_dev {
+ 	void __iomem *dcm;
+ 	void __iomem *sku;
+ 
+-#ifdef CONFIG_NL80211_TESTMODE
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
+ 	struct {
+ 		void *txbf_phase_cal;
+ 		void *txbf_pfmu_data;
+@@ -566,6 +565,7 @@ void mt7915_dma_prefetch(struct mt7915_dev *dev);
+ void mt7915_dma_cleanup(struct mt7915_dev *dev);
+ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+ int mt7915_txbf_init(struct mt7915_dev *dev);
++int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en);
+ void mt7915_init_txpower(struct mt7915_dev *dev,
+ 			 struct ieee80211_supported_band *sband);
+ void mt7915_reset(struct mt7915_dev *dev);
+@@ -644,8 +644,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_exit(struct mt7915_dev *dev);
+-int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
++
++#ifdef CONFIG_NL80211_TESTMODE
+ void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
++#endif
+ 
+ static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
+ {
+@@ -782,4 +784,10 @@ enum {
+ 
+ #endif
+ 
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
++int mt7915_mcu_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
++int mt7915_mcu_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx, bool bfer);
++int mt7915_mcu_txbf_sta_rec_read(struct mt7915_dev *dev, u16 wlan_idx);
++#endif
++
+ #endif
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 583bc19..a2ceb6f 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2831,6 +2831,36 @@ mt7915_txpower_level_set(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
+ 			 mt7915_txpower_level_set, "%lld\n");
+ 
++static int
++mt7915_txbf_pfmu_tag_read(void *data, u64 val)
++{
++	struct mt7915_phy *phy = data;
++	u8 pfmu_idx = (u8)val;
++
++	pr_info("%s: %d pfmu_tag cmd sent out ---\n", __func__, __LINE__);
++	mt7915_mcu_txbf_profile_tag_read(phy, pfmu_idx, true);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txbf_pfmu_tag_idx, NULL,
++			 mt7915_txbf_pfmu_tag_read, "%llx\n");
++
++static int
++mt7915_txbf_sta_rec_read(void *data, u64 val)
++{
++	struct mt7915_dev *dev = data;
++	u16 wlan_idx = (u16)val;
++
++	pr_info("%s: %d sta_rec cmd sent out ---\n", __func__, __LINE__);
++	mt7915_mcu_txbf_sta_rec_read(dev, wlan_idx);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txbf_sta_rec, NULL,
++			 mt7915_txbf_sta_rec_read, "%llx\n");
++
+ /* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
+ static int
+ mt7915_wa_set(void *data, u64 val)
+@@ -2969,6 +2999,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ 	debugfs_create_file("txpower_level", 0400, dir, dev,
+ 			    &fops_txpower_level);
+ 
++	debugfs_create_file("txbf_pfmu_tag_idx", 0600, dir, phy,
++			    &fops_txbf_pfmu_tag_idx);
++	debugfs_create_file("txbf_sta_rec", 0600, dir, dev,
++			    &fops_txbf_sta_rec);
++
+ 	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
+ 
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
+diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
+index 143dae2..906c872 100644
+--- a/mt7915/mtk_mcu.c
++++ b/mt7915/mtk_mcu.c
+@@ -1,9 +1,10 @@
+ #include <linux/firmware.h>
+ #include <linux/fs.h>
+-#include<linux/inet.h>
++#include <linux/inet.h>
+ #include "mt7915.h"
+ #include "mcu.h"
+ #include "mac.h"
++#include "testmode.h"
+ 
+ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
+ {
+@@ -49,3 +50,246 @@ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
+ 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
+ 				 sizeof(req), true);
+ }
++
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
++static void mt7915_txbf_dump_pfmu_tag(struct mt7915_dev *dev, struct mt7915_pfmu_tag *tag)
++{
++	u32 *raw_t1 = (u32 *)&tag->t1;
++	u32 *raw_t2 = (u32 *)&tag->t2;
++
++	dev_info(dev->mt76.dev, "=================== TXBf Profile Tag1 Info ==================\n");
++	dev_info(dev->mt76.dev,
++		 "DW0 = 0x%08x, DW1 = 0x%08x, DW2 = 0x%08x\n",
++		 raw_t1[0], raw_t1[1], raw_t1[2]);
++	dev_info(dev->mt76.dev,
++		 "DW4 = 0x%08x, DW5 = 0x%08x, DW6 = 0x%08x\n\n",
++		 raw_t1[3], raw_t1[4], raw_t1[5]);
++	dev_info(dev->mt76.dev, "PFMU ID = %d              Invalid status = %d\n",
++		 tag->t1.pfmu_idx, tag->t1.invalid_prof);
++	dev_info(dev->mt76.dev, "iBf/eBf = %d\n\n", tag->t1.ebf);
++	dev_info(dev->mt76.dev, "DBW   = %d\n", tag->t1.data_bw);
++	dev_info(dev->mt76.dev, "SU/MU = %d\n", tag->t1.is_mu);
++	dev_info(dev->mt76.dev, "RMSD  = %d\n", tag->t1.rmsd);
++	dev_info(dev->mt76.dev,
++		 "nrow = %d, ncol = %d, ng = %d, LM = %d, CodeBook = %d MobCalEn = %d\n",
++		 tag->t1.nr, tag->t1.nc, tag->t1.ngroup, tag->t1.lm, tag->t1.codebook,
++		 tag->t1.mob_cal_en);
++	dev_info(dev->mt76.dev, "RU start = %d, RU end = %d\n",
++		 tag->t1.ru_start_id, tag->t1.ru_end_id);
++	dev_info(dev->mt76.dev, "Mem Col1 = %d, Mem Row1 = %d, Mem Col2 = %d, Mem Row2 = %d\n",
++		 tag->t1.col_id1, tag->t1.row_id1, tag->t1.col_id2, tag->t1.row_id2);
++	dev_info(dev->mt76.dev, "Mem Col3 = %d, Mem Row3 = %d, Mem Col4 = %d, Mem Row4 = %d\n\n",
++		 tag->t1.col_id3, tag->t1.row_id3, tag->t1.col_id4, tag->t1.row_id4);
++	dev_info(dev->mt76.dev,
++		 "STS0_SNR = 0x%02x, STS1_SNR = 0x%02x, STS2_SNR = 0x%02x, STS3_SNR = 0x%02x\n",
++		 tag->t1.snr_sts0, tag->t1.snr_sts1, tag->t1.snr_sts2, tag->t1.snr_sts3);
++	dev_info(dev->mt76.dev,
++		 "STS4_SNR = 0x%02x, STS5_SNR = 0x%02x, STS6_SNR = 0x%02x, STS7_SNR = 0x%02x\n",
++		 tag->t1.snr_sts4, tag->t1.snr_sts5, tag->t1.snr_sts6, tag->t1.snr_sts7);
++	dev_info(dev->mt76.dev, "=============================================================\n");
++
++	dev_info(dev->mt76.dev, "=================== TXBf Profile Tag2 Info ==================\n");
++	dev_info(dev->mt76.dev,
++		 "DW0 = 0x%08x, DW1 = 0x%08x, DW2 = 0x%08x\n",
++		 raw_t2[0], raw_t2[1], raw_t2[2]);
++	dev_info(dev->mt76.dev,
++		 "DW3 = 0x%08x, DW4 = 0x%08x, DW5 = 0x%08x\n\n",
++		 raw_t2[3], raw_t2[4], raw_t2[5]);
++	dev_info(dev->mt76.dev, "Smart antenna ID = 0x%x,  SE index = %d\n",
++		 tag->t2.smart_ant, tag->t2.se_idx);
++	dev_info(dev->mt76.dev, "RMSD threshold = %d\n", tag->t2.rmsd_thres);
++	dev_info(dev->mt76.dev, "Timeout = 0x%x\n", tag->t2.ibf_timeout);
++	dev_info(dev->mt76.dev, "Desired BW = %d, Desired Ncol = %d, Desired Nrow = %d\n",
++		 tag->t2.ibf_data_bw, tag->t2.ibf_nc, tag->t2.ibf_nr);
++	dev_info(dev->mt76.dev, "Desired RU Allocation = %d\n", tag->t2.ibf_ru);
++	dev_info(dev->mt76.dev, "Mobility DeltaT = %d, Mobility LQ = %d\n",
++		 tag->t2.mob_delta_t, tag->t2.mob_lq_result);
++	dev_info(dev->mt76.dev, "=============================================================\n");
++}
++
++static void mt7915_txbf_dump_sta_rec(struct mt7915_dev *dev, struct sta_rec_bf *sta_info)
++{
++	dev_info(dev->mt76.dev, "===================== BF Station Record =====================\n");
++	dev_info(dev->mt76.dev, "pfmu           = %d\n", sta_info->pfmu);
++	dev_info(dev->mt76.dev, "su_mu          = %d\n", sta_info->su_mu);
++	dev_info(dev->mt76.dev, "bf_cap         = %d\n", sta_info->bf_cap);
++	dev_info(dev->mt76.dev, "sounding_phy   = %d\n", sta_info->sounding_phy);
++	dev_info(dev->mt76.dev, "ndpa_rate      = %d\n", sta_info->ndpa_rate);
++	dev_info(dev->mt76.dev, "ndp_rate       = %d\n", sta_info->ndp_rate);
++	dev_info(dev->mt76.dev, "rept_poll_rate = %d\n", sta_info->rept_poll_rate);
++	dev_info(dev->mt76.dev, "tx_mode        = %d\n", sta_info->tx_mode);
++	dev_info(dev->mt76.dev, "ncol           = %d\n", sta_info->ncol);
++	dev_info(dev->mt76.dev, "nrow           = %d\n", sta_info->nrow);
++	dev_info(dev->mt76.dev, "bw             = %d\n", sta_info->bw);
++	dev_info(dev->mt76.dev, "mem_total      = %d\n", sta_info->mem_total);
++	dev_info(dev->mt76.dev, "mem_20m        = %d\n", sta_info->mem_20m);
++	dev_info(dev->mt76.dev, "mem_row0       = %d\n", sta_info->mem[0].row);
++	dev_info(dev->mt76.dev, "mem_col0       = %d\n", sta_info->mem[0].col);
++	dev_info(dev->mt76.dev, "mem_row1       = %d\n", sta_info->mem[1].row);
++	dev_info(dev->mt76.dev, "mem_col1       = %d\n", sta_info->mem[1].col);
++	dev_info(dev->mt76.dev, "mem_row2       = %d\n", sta_info->mem[2].row);
++	dev_info(dev->mt76.dev, "mem_col2       = %d\n", sta_info->mem[2].col);
++	dev_info(dev->mt76.dev, "mem_row3       = %d\n", sta_info->mem[3].row);
++	dev_info(dev->mt76.dev, "mem_col3       = %d\n", sta_info->mem[3].col);
++	dev_info(dev->mt76.dev, "smart_ant      = 0x%x\n", sta_info->smart_ant);
++	dev_info(dev->mt76.dev, "se_idx         = %d\n", sta_info->se_idx);
++	dev_info(dev->mt76.dev, "auto_sounding  = %d\n", sta_info->auto_sounding);
++	dev_info(dev->mt76.dev, "ibf_timeout    = 0x%x\n", sta_info->ibf_timeout);
++	dev_info(dev->mt76.dev, "ibf_dbw        = %d\n", sta_info->ibf_dbw);
++	dev_info(dev->mt76.dev, "ibf_ncol       = %d\n", sta_info->ibf_ncol);
++	dev_info(dev->mt76.dev, "ibf_nrow       = %d\n", sta_info->ibf_nrow);
++	dev_info(dev->mt76.dev, "nrow_gt_bw80   = %d\n", sta_info->nrow_gt_bw80);
++	dev_info(dev->mt76.dev, "ncol_gt_bw80   = %d\n", sta_info->ncol_gt_bw80);
++	dev_info(dev->mt76.dev, "ru_start_idx   = %d\n", sta_info->ru_start_idx);
++	dev_info(dev->mt76.dev, "trigger_su     = %d\n", sta_info->trigger_su);
++	dev_info(dev->mt76.dev, "trigger_mu     = %d\n", sta_info->trigger_mu);
++	dev_info(dev->mt76.dev, "ng16_su        = %d\n", sta_info->ng16_su);
++	dev_info(dev->mt76.dev, "ng16_mu        = %d\n", sta_info->ng16_mu);
++	dev_info(dev->mt76.dev, "codebook42_su  = %d\n", sta_info->codebook42_su);
++	dev_info(dev->mt76.dev, "codebook75_mu  = %d\n", sta_info->codebook75_mu);
++	dev_info(dev->mt76.dev, "he_ltf         = %d\n", sta_info->he_ltf);
++	dev_info(dev->mt76.dev, "=============================================================\n");
++}
++
++static void mt7915_txbf_dump_cal_phase(struct mt7915_dev *dev,
++				       struct mt7915_txbf_phase *phase, int group)
++{
++	dev_info(dev->mt76.dev, "Group %d and Group M\n", group);
++	dev_info(dev->mt76.dev, "m_t0_h = %d\n", phase->phase.m_t0_h);
++	dev_info(dev->mt76.dev, "m_t1_h = %d\n", phase->phase.m_t1_h);
++	dev_info(dev->mt76.dev, "m_t2_h = %d\n", phase->phase.m_t2_h);
++
++	dev_info(dev->mt76.dev, "r0_uh = %d\n", phase->phase.r0_uh);
++	dev_info(dev->mt76.dev, "r0_h = %d\n", phase->phase.r0_h);
++	dev_info(dev->mt76.dev, "r0_m = %d\n", phase->phase.r0_m);
++	dev_info(dev->mt76.dev, "r0_l = %d\n", phase->phase.r0_l);
++
++	dev_info(dev->mt76.dev, "r1_uh = %d\n", phase->phase.r1_uh);
++	dev_info(dev->mt76.dev, "r1_h = %d\n", phase->phase.r1_h);
++	dev_info(dev->mt76.dev, "r1_m = %d\n", phase->phase.r1_m);
++	dev_info(dev->mt76.dev, "r1_l = %d\n", phase->phase.r1_l);
++
++	dev_info(dev->mt76.dev, "r2_uh = %d\n", phase->phase.r2_uh);
++	dev_info(dev->mt76.dev, "r2_h = %d\n", phase->phase.r2_h);
++	dev_info(dev->mt76.dev, "r2_m = %d\n", phase->phase.r2_m);
++	dev_info(dev->mt76.dev, "r2_l = %d\n", phase->phase.r2_l);
++
++	dev_info(dev->mt76.dev, "r3_uh = %d\n", phase->phase.r3_uh);
++	dev_info(dev->mt76.dev, "r3_h = %d\n", phase->phase.r3_h);
++	dev_info(dev->mt76.dev, "r3_m = %d\n", phase->phase.r3_m);
++	dev_info(dev->mt76.dev, "r3_l = %d\n", phase->phase.r3_l);
++	dev_info(dev->mt76.dev, "r3_ul = %d\n", phase->phase.r3_ul);
++}
++
++int mt7915_mcu_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++#define BF_PFMU_TAG	16
++#define BF_STA_REC	20
++#define BF_CAL_PHASE	21
++#define GROUP_M		1
++	u8 format_id;
++
++	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
++	format_id = *(u8 *)skb->data;
++
++	if (format_id == BF_PFMU_TAG) {
++		struct mt7915_pfmu_tag *pfmu_tag;
++
++		skb_pull(skb, 8);
++		pfmu_tag = (struct mt7915_pfmu_tag *)skb->data;
++		mt7915_txbf_dump_pfmu_tag(dev, pfmu_tag);
++		if (dev->test.txbf_pfmu_tag)
++			memcpy(dev->test.txbf_pfmu_tag, pfmu_tag, sizeof(struct mt7915_pfmu_tag));
++	} else if (format_id == BF_STA_REC) {
++		struct sta_rec_bf *sta_rec;
++
++		skb_pull(skb, sizeof(struct mt7915_bf_status_hdr));
++		/* padding 4 byte since bf_status->buf does not contain tag & len */
++		skb_push(skb, 4);
++		sta_rec = (struct sta_rec_bf *)skb->data;
++
++		mt7915_txbf_dump_sta_rec(dev, sta_rec);
++	} else if (format_id == BF_CAL_PHASE) {
++		u8 phase_out_len = sizeof(struct mt7915_txbf_phase_out);
++		struct mt7915_ibf_cal_info *cal;
++		struct mt7915_txbf_phase_out phase_out;
++		struct mt7915_txbf_phase *phase =
++			(struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
++
++		cal = (struct mt7915_ibf_cal_info *)skb->data;
++		memcpy(&phase_out, cal->buf, phase_out_len);
++		switch (cal->cal_type) {
++		case IBF_PHASE_CAL_NORMAL:
++		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
++			/* Only calibrate group M */
++			if (cal->group_l_m_n != GROUP_M)
++				break;
++			phase = &phase[cal->group];
++			memcpy(&phase->phase, cal->buf + phase_out_len, sizeof(phase->phase));
++			phase->status = cal->status;
++
++			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
++			mt7915_txbf_dump_cal_phase(dev, phase, cal->group);
++			break;
++		case IBF_PHASE_CAL_VERIFY:
++		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
++			dev_info(dev->mt76.dev, "Verification result = %d\n", cal->status);
++			break;
++		default:
++			break;
++		}
++
++		dev_info(dev->mt76.dev, "c0_h = %d, c1_h = %d, c2_h = %d\n",
++			 phase_out.c0_h, phase_out.c1_h, phase_out.c2_h);
++		dev_info(dev->mt76.dev, "c0_m = %d, c1_m = %d, c2_m = %d\n",
++			 phase_out.c0_m, phase_out.c1_m, phase_out.c2_m);
++		dev_info(dev->mt76.dev, "c0_l = %d, c1_l = %d, c2_l = %d\n",
++			 phase_out.c0_l, phase_out.c1_l, phase_out.c2_l);
++		dev_info(dev->mt76.dev, "c3_m = %d, c3_h = %d\n", phase_out.c3_m, phase_out.c3_h);
++	}
++
++	wake_up(&dev->mt76.tx_wait);
++
++	return 0;
++}
++
++int mt7915_mcu_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx, bool bfer)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 format_id;
++		u8 pfmu_idx;
++		bool bfer;
++		u8 dbdc_idx;
++	} __packed req = {
++		.format_id = MT_BF_PFMU_TAG_READ,
++		.pfmu_idx = pfmu_idx,
++		.bfer = bfer,
++		.dbdc_idx = phy->mt76->band_idx,
++	};
++	struct mt7915_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++
++	/* Reset to 0 for mt7915_tm_txbf_profile_tag_write wait_event */
++	tag->t1.pfmu_idx = 0;
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), true);
++}
++
++int mt7915_mcu_txbf_sta_rec_read(struct mt7915_dev *dev, u16 wlan_idx)
++{
++	struct {
++		u8 action;
++		u8 wlan_idx_lo;
++		u8 wlan_idx_hi;
++		u8 rsv[5];
++	} __packed req = {
++		.action = MT_BF_STA_REC_READ,
++		.wlan_idx_lo = to_wcid_lo(wlan_idx),
++		.wlan_idx_hi = to_wcid_hi(wlan_idx),
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), true);
++}
++#endif
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index f4b5709..007fd4d 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -61,6 +61,7 @@ enum offs_rev {
+ 	MDP_BNRCFR1,
+ 	ARB_DRNGR0,
+ 	ARB_SCR,
++	ARB_TQSAXM0,
+ 	RMAC_MIB_AIRTIME14,
+ 	AGG_AALCR0,
+ 	AGG_AWSCR0,
+@@ -530,6 +531,9 @@ enum offs_rev {
+ #define MT_ARB_DRNGR0(_band, _n)	MT_WF_ARB(_band, (__OFFS(ARB_DRNGR0) +	\
+ 							  (_n) * 4))
+ 
++#define MT_ARB_TQSAXM0(_band)		MT_WF_ARB(_band, __OFFS(ARB_TQSAXM0))
++#define MT_ARB_TQSAXM_ALTX_START_MASK	GENMASK(12, 8)
++
+ /* RMAC: band 0(0x820e5000), band 1(0x820f5000) */
+ #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
+ #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 2ae6c07..70382b9 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -53,6 +53,8 @@ struct reg_band {
+ static struct reg_band reg_backup_list[TM_REG_MAX_ID];
+ 
+ static void mt7915_tm_update_entry(struct mt7915_phy *phy);
++static int mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode, bool bf_sounding);
++static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy, struct mt76_wcid *wcid);
+ 
+ static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
+ {
+@@ -73,6 +75,25 @@ static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
+ 	return width_to_bw[width];
+ }
+ 
++static u8 mt7915_tm_rate_to_phy(u8 tx_rate_mode)
++{
++	static const u8 rate_to_phy[] = {
++		[MT76_TM_TX_MODE_CCK] = MT_PHY_TYPE_CCK,
++		[MT76_TM_TX_MODE_OFDM] = MT_PHY_TYPE_OFDM,
++		[MT76_TM_TX_MODE_HT] = MT_PHY_TYPE_HT,
++		[MT76_TM_TX_MODE_VHT] = MT_PHY_TYPE_VHT,
++		[MT76_TM_TX_MODE_HE_SU] = MT_PHY_TYPE_HE_SU,
++		[MT76_TM_TX_MODE_HE_EXT_SU] = MT_PHY_TYPE_HE_EXT_SU,
++		[MT76_TM_TX_MODE_HE_TB] = MT_PHY_TYPE_HE_TB,
++		[MT76_TM_TX_MODE_HE_MU] = MT_PHY_TYPE_HE_MU,
++	};
++
++	if (tx_rate_mode > MT76_TM_TX_MODE_MAX)
++		return -EINVAL;
++
++	return rate_to_phy[tx_rate_mode];
++}
++
+ static void
+ mt7915_tm_update_channel(struct mt7915_phy *phy)
+ {
+@@ -273,17 +294,33 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ 	struct mt7915_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct sk_buff *skb;
+ 	struct sta_rec_bf *bf;
+ 	struct tlv *tlv;
+-	u8 ndp_rate;
++	u8 ndp_rate, ndpa_rate, rept_poll_rate, bf_bw;
++
++	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_SU) {
++		rept_poll_rate = 0x49;
++		ndpa_rate = 0x49;
++		ndp_rate = 0;
++	} else if (td->tx_rate_mode == MT76_TM_TX_MODE_VHT) {
++		rept_poll_rate = 0x9;
++		ndpa_rate = 0x9;
++		ndp_rate = 0;
++	} else {
++		rept_poll_rate = 0;
++		ndpa_rate = 0;
++		if (nr == 1)
++			ndp_rate = 8;
++		else if (nr == 2)
++			ndp_rate = 16;
++		else
++			ndp_rate = 24;
++	}
+ 
+-	if (nr == 1)
+-		ndp_rate = 8;
+-	else if (nr == 2)
+-		ndp_rate = 16;
+-	else
+-		ndp_rate = 24;
++	/* TODO: check 160Hz */
++	bf_bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
+ 
+ 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
+ 					    &msta->wcid);
+@@ -299,8 +336,11 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 	bf->ncol = nc;
+ 	bf->nrow = nr;
+ 	bf->ndp_rate = ndp_rate;
++	bf->ndpa_rate = ndpa_rate;
++	bf->rept_poll_rate = rept_poll_rate;
++	bf->bw = bf_bw;
+ 	bf->ibf_timeout = 0xff;
+-	bf->tx_mode = MT_PHY_TYPE_HT;
++	bf->tx_mode = mt7915_tm_rate_to_phy(td->tx_rate_mode);
+ 
+ 	if (ebf) {
+ 		bf->mem[0].row = 0;
+@@ -353,11 +393,8 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+ 	}
+ 
+ 	memcpy(sta->addr, ed->addr[0], ETH_ALEN);
+-	if (phy->test.bf_en) {
+-		u8 addr[ETH_ALEN] = {0x00, 0x11, 0x11, 0x11, 0x11, 0x11};
+-
+-		memcpy(sta->addr, addr, ETH_ALEN);
+-	}
++	if (td->bf_en)
++		memcpy(sta->addr, td->addr[0], ETH_ALEN);
+ 
+ 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
+ 		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
+@@ -382,6 +419,14 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+ 	list_add_tail(&msta->wcid.list, &td->tm_entry_list);
+ 	td->entry_num++;
+ 
++	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, true);
++
++	if (td->bf_en) {
++		mt7915_tm_set_ipg_params(phy, td->tx_ipg, td->tx_rate_mode, true);
++		mt7915_tm_set_tam_arb(phy, td->bf_en, 0);
++		mt7915_tm_txbf_set_rate(phy, &msta->wcid);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -451,7 +496,7 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+ 	struct mt76_testmode_entry_data *ed, tmp;
+ 	struct mt76_wcid *wcid, *last;
+ 
+-	if (!td->aid || phy->test.bf_en)
++	if (!td->aid || td->bf_en)
+ 		return;
+ 
+ 	memcpy(&tmp, &td->ed, sizeof(tmp));
+@@ -472,20 +517,30 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+ static int
+ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+ {
++#define EBF_BBP_RX_OFFSET	0x10280
++#define EBF_BBP_RX_ENABLE	(BIT(0) | BIT(15))
++#define WF1			BIT(1)
++#define WF2			BIT(2)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt7915_dev *dev = phy->dev;
++	struct mt76_phy *mphy = phy->mt76;
+ 	bool enable = val[0];
+ 	void *phase_cal, *pfmu_data, *pfmu_tag;
+-	u8 addr[ETH_ALEN] = {0x00, 0x22, 0x22, 0x22, 0x22, 0x22};
++	u8 sub_addr = td->is_txbf_dut ? TXBF_DUT_MAC_SUBADDR : TXBF_GOLDEN_MAC_SUBADDR;
++	u8 peer_addr = td->is_txbf_dut ? TXBF_GOLDEN_MAC_SUBADDR : TXBF_DUT_MAC_SUBADDR;
++	u8 bss_addr = TXBF_DUT_MAC_SUBADDR;
++	u8 addr[ETH_ALEN] = {0x00, sub_addr, sub_addr, sub_addr, sub_addr, sub_addr};
++	u8 bssid[ETH_ALEN] = {0x00, bss_addr, bss_addr, bss_addr, bss_addr, bss_addr};
++	u8 peer_addrs[ETH_ALEN] = {0x00, peer_addr, peer_addr, peer_addr, peer_addr, peer_addr};
+ 
+ 	if (!enable) {
+-		phy->test.bf_en = 0;
++		td->bf_en = 0;
+ 		return 0;
+ 	}
+ 
+ 	if (!dev->test.txbf_phase_cal) {
+ 		phase_cal = devm_kzalloc(dev->mt76.dev,
+-					 sizeof(struct mt7915_tm_txbf_phase) *
++					 sizeof(struct mt7915_txbf_phase) *
+ 					 MAX_PHASE_GROUP_NUM,
+ 					 GFP_KERNEL);
+ 		if (!phase_cal)
+@@ -495,7 +550,10 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+ 	}
+ 
+ 	if (!dev->test.txbf_pfmu_data) {
+-		pfmu_data = devm_kzalloc(dev->mt76.dev, 512, GFP_KERNEL);
++		pfmu_data = devm_kzalloc(dev->mt76.dev,
++					 sizeof(struct mt7915_pfmu_data) *
++					 MT7915_TXBF_SUBCAR_NUM,
++					 GFP_KERNEL);
+ 		if (!pfmu_data)
+ 			return -ENOMEM;
+ 
+@@ -504,21 +562,77 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+ 
+ 	if (!dev->test.txbf_pfmu_tag) {
+ 		pfmu_tag = devm_kzalloc(dev->mt76.dev,
+-					sizeof(struct mt7915_tm_pfmu_tag), GFP_KERNEL);
++					sizeof(struct mt7915_pfmu_tag), GFP_KERNEL);
+ 		if (!pfmu_tag)
+ 			return -ENOMEM;
+ 
+ 		dev->test.txbf_pfmu_tag = pfmu_tag;
+ 	}
+ 
++	td->bf_en = 1;
++	memcpy(td->addr[0], peer_addrs, ETH_ALEN);
++	memcpy(td->addr[1], addr, ETH_ALEN);
++	memcpy(td->addr[2], bssid, ETH_ALEN);
+ 	memcpy(phy->monitor_vif->addr, addr, ETH_ALEN);
+ 	mt7915_mcu_add_dev_info(phy, phy->monitor_vif, true);
+ 
+-	td->tx_rate_mode = MT76_TM_TX_MODE_HT;
+-	td->tx_mpdu_len = 1024;
+-	td->tx_rate_sgi = 0;
+-	td->tx_ipg = 100;
+-	phy->test.bf_en = 1;
++	/* Add second interface in wtbl for using TXCMD to transmit sounding */
++	td->second_vif = kzalloc(sizeof(*td->second_vif) + sizeof(struct mt7915_vif), GFP_KERNEL);
++	memcpy(td->second_vif, phy->monitor_vif, sizeof(*td->second_vif));
++	mt7915_init_vif(phy, td->second_vif, td->bf_en);
++
++	if (td->ebf && !td->is_txbf_dut) {
++		bool is_160hz = val[1];
++
++		/* Turn On BBP CR for RX */
++		mt76_set(dev, EBF_BBP_RX_OFFSET, EBF_BBP_RX_ENABLE);
++		dev_info(dev->mt76.dev, "Set BBP RX CR = %x\n", mt76_rr(dev, EBF_BBP_RX_OFFSET));
++
++		/* Set TX antenna mask of golden: default use WF0 only */
++		td->tx_antenna_mask = 1;
++		if (is_mt7915(&dev->mt76)) {
++			/* Add WF1/WF2 for dbdc/single band in BW 160 */
++			td->tx_antenna_mask |= is_160hz & (dev->dbdc_support ? WF1 : WF2);
++			/* Shift to WF2/WF3 for dbdc band 1 */
++			td->tx_antenna_mask <<= 2 * phy->mt76->band_idx;
++		}
++	} else if (td->ebf && td->is_txbf_dut) {
++		/* Enable ETxBF Capability */
++		dev->ibf = false;
++		mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
++		/* Set TX antenna mask of DUT */
++		td->tx_antenna_mask = mphy->chainmask >> (dev->chainshift * phy->mt76->band_idx);
++		td->tx_spe_idx = phy->mt76->band_idx ? 25 : 24;
++		/* Shift to WF2/WF3 for dbdc band 1, Nss = 2 */
++		if ((hweight8(td->tx_antenna_mask) == 2) && phy->mt76->band_idx)
++			td->tx_antenna_mask <<= 2;
++	} else {
++		if (td->is_txbf_dut) {
++			int nss;
++
++			/* Enable ITxBF Capability */
++			dev->ibf = true;
++			mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
++			td->tx_antenna_mask = mphy->chainmask >> (dev->chainshift *
++								  phy->mt76->band_idx);
++			nss = hweight8(td->tx_antenna_mask);
++			if (nss > 1 && nss <= 4)
++				td->tx_rate_idx = 15 + 8 * (nss - 2);
++			else
++				td->tx_rate_idx = 31;
++		} else {
++			td->tx_antenna_mask  = 1;
++			mt76_set(dev, EBF_BBP_RX_OFFSET, EBF_BBP_RX_ENABLE);
++			dev_info(dev->mt76.dev, "Set BBP RX CR = %x\n",
++				 mt76_rr(dev, EBF_BBP_RX_OFFSET));
++		}
++		td->tx_rate_mode = MT76_TM_TX_MODE_HT;
++		td->tx_mpdu_len = 1024;
++		td->tx_rate_sgi = 0;
++		td->tx_ipg = 100;
++	}
++
++	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, true);
+ 
+ 	return mt7915_tm_set_trx(phy, TM_MAC_TX, true);
+ }
+@@ -545,8 +659,7 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+ 		.read_from_e2p = val[3],
+ 		.disable = val[4],
+ 	};
+-	struct mt7915_tm_txbf_phase *phase =
+-		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	struct mt7915_txbf_phase *phase = (struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
+ 
+ 	wait_event_timeout(dev->mt76.tx_wait, phase[val[2]].status != 0, HZ);
+ 	memcpy(req.buf, &phase[val[2]].phase, sizeof(req.buf));
+@@ -559,32 +672,9 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+ 				 sizeof(req), true);
+ }
+ 
+-static int
+-mt7915_tm_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx)
+-{
+-	struct mt7915_dev *dev = phy->dev;
+-	struct {
+-		u8 format_id;
+-		u8 pfmu_idx;
+-		bool bfer;
+-		u8 dbdc_idx;
+-	} __packed req = {
+-		.format_id = MT_BF_PFMU_TAG_READ,
+-		.pfmu_idx = pfmu_idx,
+-		.bfer = 1,
+-		.dbdc_idx = phy != &dev->phy,
+-	};
+-	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
+-
+-	tag->t1.pfmu_idx = 0;
+-
+-	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
+-				 sizeof(req), true);
+-}
+-
+ static int
+ mt7915_tm_txbf_profile_tag_write(struct mt7915_phy *phy, u8 pfmu_idx,
+-				 struct mt7915_tm_pfmu_tag *tag)
++				 struct mt7915_pfmu_tag *tag)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct {
+@@ -611,8 +701,6 @@ static int
+ mt7915_tm_txbf_apply_tx(struct mt7915_phy *phy, u16 wlan_idx, bool ebf,
+ 			bool ibf, bool phase_cal)
+ {
+-#define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
+-#define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct {
+ 		u8 category;
+@@ -641,14 +729,15 @@ static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt76_testmode_entry_data *ed = mt76_testmode_entry_data(phy->mt76, wcid);
++	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct ieee80211_sta *sta = wcid_to_sta(wcid);
+ 	struct sta_phy rate = {};
+ 
+ 	if (!sta)
+ 		return 0;
+ 
+-	rate.type = MT_PHY_TYPE_HT;
+-	rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
++	rate.type = mt7915_tm_rate_to_phy(td->tx_rate_mode);
++	rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);		/* TODO: check 160Hz */
+ 	rate.nss = ed->tx_rate_nss;
+ 	rate.mcs = ed->tx_rate_idx;
+ 	rate.ldpc = (rate.bw || ed->tx_rate_ldpc) * GENMASK(2, 0);
+@@ -662,13 +751,14 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+ {
+ 	bool bf_on = val[0], update = val[3];
+ 	/* u16 wlan_idx = val[2]; */
+-	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt76_wcid *wcid;
+ 
+ 	if (bf_on) {
+ 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+-		mt7915_tm_txbf_profile_tag_read(phy, 2);
++		mt7915_mcu_txbf_profile_tag_read(phy, 2, true);
+ 		tag->t1.invalid_prof = false;
+ 		mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
+ 
+@@ -683,7 +773,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+ 		} else {
+ 			phy->test.bf_ever_en = false;
+ 
+-			mt7915_tm_txbf_profile_tag_read(phy, 2);
++			mt7915_mcu_txbf_profile_tag_read(phy, 2, true);
+ 			tag->t1.invalid_prof = true;
+ 			mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
+ 		}
+@@ -698,6 +788,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+ static int
+ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ {
++#define MT_ARB_IBF_ENABLE	(BIT(0) | GENMASK(9, 8))
+ 	static const u8 mode_to_lm[] = {
+ 		[MT76_TM_TX_MODE_CCK] = 0,
+ 		[MT76_TM_TX_MODE_OFDM] = 0,
+@@ -711,7 +802,8 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt76_wcid *wcid;
+ 	struct ieee80211_vif *vif = phy->monitor_vif;
+-	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
+ 	u8 pfmu_idx = val[0], nc = val[2], nr;
+ 	bool is_atenl = val[6];
+ 	int ret;
+@@ -729,11 +821,15 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	tag->t1.nr = nr;
+ 	tag->t1.nc = nc;
+ 	tag->t1.invalid_prof = true;
+-
+-	tag->t1.snr_sts4 = 0xc0;
+-	tag->t1.snr_sts5 = 0xff;
+-	tag->t1.snr_sts6 = 0xff;
+-	tag->t1.snr_sts7 = 0xff;
++	tag->t1.data_bw = mt7915_tm_chan_bw(phy->mt76->chandef.width); /* TODO: check 160Hz */
++	tag->t2.se_idx = td->tx_spe_idx;
++
++	if (is_atenl) {
++		tag->t1.snr_sts4 = 0xc0;
++		tag->t1.snr_sts5 = 0xff;
++		tag->t1.snr_sts6 = 0xff;
++		tag->t1.snr_sts7 = 0xff;
++	}
+ 
+ 	if (ebf) {
+ 		tag->t1.row_id1 = 0;
+@@ -761,6 +857,19 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	if (ret)
+ 		return ret;
+ 
++	if (td->ebf) {
++		mt76_set(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx), MT_ARB_TQSAXM_ALTX_START_MASK);
++		dev_info(dev->mt76.dev, "Set TX queue start CR for AX management (0x%x) = 0x%x\n",
++			 MT_ARB_TQSAXM0(phy->mt76->band_idx),
++			 mt76_rr(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx)));
++	} else if (!td->ebf && ebf) {
++		/* iBF's ebf profile update */
++		mt76_set(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx), MT_ARB_IBF_ENABLE);
++		dev_info(dev->mt76.dev, "Set TX queue start CR for AX management (0x%x) = 0x%x\n",
++			 MT_ARB_TQSAXM0(phy->mt76->band_idx),
++			 mt76_rr(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx)));
++	}
++
+ 	if (!ebf && is_atenl)
+ 		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
+ 
+@@ -778,7 +887,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 		u8 category;
+ 		u8 group_l_m_n;
+ 		u8 group;
+-		bool sx2;
++		bool dbdc_idx;
+ 		u8 cal_type;
+ 		u8 lna_gain_level;
+ 		u8 _rsv[2];
+@@ -786,12 +895,12 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 		.category = MT_BF_PHASE_CAL,
+ 		.group = val[0],
+ 		.group_l_m_n = val[1],
+-		.sx2 = val[2],
++		.dbdc_idx = phy->mt76->band_idx,
+ 		.cal_type = val[3],
+ 		.lna_gain_level = val[4],
+ 	};
+-	struct mt7915_tm_txbf_phase *phase =
+-		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	struct mt7915_txbf_phase *phase =
++		(struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
+ 
+ 	phase[req.group].status = 0;
+ 
+@@ -799,53 +908,10 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 				 sizeof(req), true);
+ }
+ 
+-int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
+-{
+-#define BF_PFMU_TAG	16
+-#define BF_CAL_PHASE	21
+-	u8 format_id;
+-
+-	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
+-	format_id = *(u8 *)skb->data;
+-
+-	if (format_id == BF_PFMU_TAG) {
+-		struct mt7915_tm_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
+-
+-		skb_pull(skb, 8);
+-		memcpy(tag, skb->data, sizeof(struct mt7915_tm_pfmu_tag));
+-	} else if (format_id == BF_CAL_PHASE) {
+-		struct mt7915_tm_ibf_cal_info *cal;
+-		struct mt7915_tm_txbf_phase *phase =
+-			(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
+-
+-		cal = (struct mt7915_tm_ibf_cal_info *)skb->data;
+-		switch (cal->cal_type) {
+-		case IBF_PHASE_CAL_NORMAL:
+-		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
+-			if (cal->group_l_m_n != GROUP_M)
+-				break;
+-			phase = &phase[cal->group];
+-			memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
+-			phase->status = cal->status;
+-			/* for passing iTest script */
+-			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
+-			break;
+-		case IBF_PHASE_CAL_VERIFY:
+-		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
+-			break;
+-		default:
+-			break;
+-		}
+-	}
+-
+-	wake_up(&dev->mt76.tx_wait);
+-
+-	return 0;
+-}
+-
+ static int
+ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ {
++#define MT7915_TXBF_PFMU_DATA_LEN	(MT7915_TXBF_SUBCAR_NUM * sizeof(struct mt7915_pfmu_data))
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	u16 pfmu_idx = val[0];
+ 	u16 subc_id = val[1];
+@@ -854,9 +920,9 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 	u16 angle31 = val[4];
+ 	u16 angle41 = val[5];
+ 	s16 phi11 = 0, phi21 = 0, phi31 = 0;
+-	struct mt7915_tm_pfmu_data *pfmu_data;
++	struct mt7915_pfmu_data *pfmu_data;
+ 
+-	if (subc_id > 63)
++	if (subc_id > MT7915_TXBF_SUBCAR_NUM - 1)
+ 		return -EINVAL;
+ 
+ 	if (td->tx_antenna_mask == 2) {
+@@ -870,7 +936,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 		phi31 = (s16)(angle41 - angle31);
+ 	}
+ 
+-	pfmu_data = (struct mt7915_tm_pfmu_data *)phy->dev->test.txbf_pfmu_data;
++	pfmu_data = (struct mt7915_pfmu_data *)phy->dev->test.txbf_pfmu_data;
+ 	pfmu_data = &pfmu_data[subc_id];
+ 
+ 	if (subc_id < 32)
+@@ -880,21 +946,21 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 	pfmu_data->phi11 = cpu_to_le16(phi11);
+ 	pfmu_data->phi21 = cpu_to_le16(phi21);
+ 	pfmu_data->phi31 = cpu_to_le16(phi31);
+-	if (subc_id == 63) {
++	if (subc_id == MT7915_TXBF_SUBCAR_NUM - 1) {
+ 		struct mt7915_dev *dev = phy->dev;
+ 		struct {
+ 			u8 format_id;
+ 			u8 pfmu_idx;
+ 			u8 dbdc_idx;
+ 			u8 _rsv;
+-			u8 buf[512];
++			u8 buf[MT7915_TXBF_PFMU_DATA_LEN];
+ 		} __packed req = {
+ 			.format_id = MT_BF_PROFILE_WRITE_ALL,
+ 			.pfmu_idx = pfmu_idx,
+ 			.dbdc_idx = phy != &dev->phy,
+ 		};
+ 
+-		memcpy(req.buf, dev->test.txbf_pfmu_data, 512);
++		memcpy(req.buf, dev->test.txbf_pfmu_data, MT7915_TXBF_PFMU_DATA_LEN);
+ 
+ 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
+ 					 &req, sizeof(req), true);
+@@ -906,7 +972,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ static int
+ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+ {
+-	struct mt7915_tm_txbf_phase *phase, *p;
++	struct mt7915_txbf_phase *phase, *p;
+ 	struct mt7915_dev *dev = phy->dev;
+ 	u8 *eeprom = dev->mt76.eeprom.data;
+ 	u16 offset;
+@@ -916,7 +982,7 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+ 	is_7976 = mt7915_check_adie(dev, false) || is_mt7916(&dev->mt76);
+ 	offset = is_7976 ? 0x60a : 0x651;
+ 
+-	phase = (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	phase = (struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
+ 	for (i = 0; i < MAX_PHASE_GROUP_NUM; i++) {
+ 		p = &phase[i];
+ 
+@@ -931,17 +997,75 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+ 	return 0;
+ }
+ 
++static int
++mt7915_tm_trigger_sounding(struct mt7915_phy *phy, u16 *val, bool en)
++{
++	struct mt7915_dev *dev = phy->dev;
++	u8 sounding_mode = val[0];
++	u8 MU_num = val[1];
++	u32 sounding_interval = (u32)val[2] << 2;	/* input unit: 4ms */
++	enum sounding_mode {
++		SU_SOUNDING,
++		MU_SOUNDING,
++		SU_PERIODIC_SOUNDING,
++		MU_PERIODIC_SOUNDING,
++		BF_PROCESSING,
++		TXCMD_NONTB_SU_SOUNDING,
++		TXCMD_VHT_MU_SOUNDING,
++		TXCMD_TB_PER_BRP_SOUNDING,
++		TXCMD_TB_SOUNDING,
++
++		/* keep last */
++		NUM_SOUNDING_MODE,
++		SOUNDING_MODE_MAX = NUM_SOUNDING_MODE - 1,
++	};
++	struct {
++		u8 cmd_category_id;
++		u8 sounding_mode;
++		u8 MU_num;
++		u8 rsv;
++		u8 wlan_idx[4];
++		u32 sounding_interval;		/* unit: ms */
++	} __packed req = {
++		.cmd_category_id = en ? MT_BF_SOUNDING_ON : MT_BF_SOUNDING_OFF,
++		.sounding_mode = sounding_mode,
++		.MU_num = MU_num,
++		.sounding_interval = cpu_to_le32(sounding_interval),
++		.wlan_idx[0] = val[3],
++		.wlan_idx[1] = val[4],
++		.wlan_idx[2] = val[5],
++		.wlan_idx[3] = val[6],
++	};
++
++	if (sounding_mode > SOUNDING_MODE_MAX)
++		return -EINVAL;
++
++	/* Enable Tx MAC HW before trigger sounding */
++	if (en)
++		mt7915_tm_set_trx(phy, TM_MAC_TX, true);
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
++				 &req, sizeof(req), true);
++}
++
+ static int
+ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ {
++#define TXBF_IS_DUT_MASK	BIT(0)
++#define TXBF_EBF_MASK		BIT(1)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	u16 *val = td->txbf_param;
+ 
+-	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
+-		td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5]);
++	dev_info(phy->dev->mt76.dev, "ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
++		 td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5], val[6]);
+ 
+ 	switch (td->txbf_act) {
++	case MT76_TM_TXBF_ACT_GOLDEN_INIT:
+ 	case MT76_TM_TXBF_ACT_INIT:
++	case MT76_TM_TX_EBF_ACT_GOLDEN_INIT:
++	case MT76_TM_TX_EBF_ACT_INIT:
++		td->ebf = !!u32_get_bits(td->txbf_act, TXBF_EBF_MASK);
++		td->is_txbf_dut = !!u32_get_bits(td->txbf_act, TXBF_IS_DUT_MASK);
+ 		return mt7915_tm_txbf_init(phy, val);
+ 	case MT76_TM_TXBF_ACT_UPDATE_CH:
+ 		mt7915_tm_update_channel(phy);
+@@ -967,6 +1091,36 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ 
+ 		return mt7915_tm_txbf_apply_tx(phy, wlan_idx, ebf, ibf, phase_cal);
+ 	}
++	case MT76_TM_TXBF_ACT_TRIGGER_SOUNDING:
++		return mt7915_tm_trigger_sounding(phy, val, true);
++	case MT76_TM_TXBF_ACT_STOP_SOUNDING:
++		memset(val, 0, sizeof(td->txbf_param));
++		return mt7915_tm_trigger_sounding(phy, val, false);
++	case MT76_TM_TXBF_ACT_PROFILE_TAG_READ:
++	case MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE:
++	case MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID: {
++		u8 pfmu_idx = val[0];
++		bool bfer = !!val[1];
++		struct mt7915_dev *dev = phy->dev;
++		struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
++
++		if (!tag) {
++			dev_err(dev->mt76.dev,
++				"pfmu tag is not initialized!\n");
++			return 0;
++		}
++
++		if (td->txbf_act == MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE)
++			return mt7915_tm_txbf_profile_tag_write(phy, pfmu_idx, tag);
++		else if (td->txbf_act == MT76_TM_TXBF_ACT_PROFILE_TAG_READ)
++			return mt7915_mcu_txbf_profile_tag_read(phy, pfmu_idx, bfer);
++
++		tag->t1.invalid_prof = !!val[0];
++
++		return 0;
++	}
++	case MT76_TM_TXBF_ACT_STA_REC_READ:
++		return mt7915_mcu_txbf_sta_rec_read(phy->dev, val[0]);
+ 	default:
+ 		break;
+ 	};
+@@ -1186,9 +1340,10 @@ mt7915_tm_set_ipi(struct mt7915_phy *phy)
+ 
+ static int
+ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+-		      u16 cw_max, u16 txop, u8 tx_cmd)
++		      u16 cw_max, u16 txop, u8 tx_cmd, bool bf_sounding)
+ {
+-	struct mt7915_vif *mvif = (struct mt7915_vif *)phy->monitor_vif->drv_priv;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_vif *mvif;
+ 	struct mt7915_mcu_tx req = {
+ 		.valid = true,
+ 		.mode = tx_cmd,
+@@ -1196,6 +1351,9 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+ 	};
+ 	struct edca *e = &req.edca[0];
+ 
++	mvif = bf_sounding ? (struct mt7915_vif *)td->second_vif->drv_priv :
++			     (struct mt7915_vif *)phy->monitor_vif->drv_priv;
++
+ 	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
+ 	e->set = WMM_PARAM_SET;
+ 
+@@ -1208,17 +1366,19 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+ }
+ 
+ static int
+-mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
++mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode, bool bf_sounding)
+ {
+ #define TM_DEFAULT_SIFS	10
+ #define TM_MAX_SIFS	127
+ #define TM_MAX_AIFSN	0xf
+ #define TM_MIN_AIFSN	0x1
+ #define BBP_PROC_TIME	1500
++#define TM_DEFAULT_CW	1
+ 	struct mt7915_dev *dev = phy->dev;
+ 	u8 sig_ext = (mode == MT76_TM_TX_MODE_CCK) ? 0 : 6;
+ 	u8 slot_time = 9, sifs = TM_DEFAULT_SIFS;
+ 	u8 aifsn = TM_MIN_AIFSN;
++	bool tx_cmd;
+ 	u8 band = phy->mt76->band_idx;
+ 	u32 i2t_time, tr2t_time, txv_time;
+ 	u16 cw = 0;
+@@ -1232,6 +1392,7 @@ mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
+ 	ipg -= sig_ext;
+ 
+ 	if (ipg <= (TM_MAX_SIFS + slot_time)) {
++		cw = TM_DEFAULT_CW;
+ 		sifs = ipg - slot_time;
+ 	} else {
+ 		u32 val = (ipg + slot_time) / slot_time;
+@@ -1267,10 +1428,12 @@ done:
+ 
+ 	mt7915_tm_set_slot_time(phy, slot_time, sifs);
+ 
++	/* HE MU data and iBF/eBF sounding packet use TXCMD */
++	tx_cmd = (mode == MT76_TM_TX_MODE_HE_MU) || bf_sounding;
++
+ 	return mt7915_tm_set_wmm_qid(phy,
+ 				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
+-				     aifsn, cw, cw, 0,
+-				     mode == MT76_TM_TX_MODE_HE_MU);
++				     aifsn, cw, cw, 0, tx_cmd, bf_sounding);
+ }
+ 
+ static int
+@@ -1469,7 +1632,7 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ 
+ 		phy->mt76->test.aid = 0;
+ 		phy->mt76->test.tx_mpdu_len = 0;
+-		phy->test.bf_en = 0;
++		phy->mt76->test.bf_en = 0;
+ 		mt7915_tm_set_entry(phy);
+ 	} else {
+ 		INIT_DELAYED_WORK(&phy->ipi_work, mt7915_tm_ipi_work);
+@@ -1654,7 +1817,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
+ 		u8 duty_cycle = td->tx_duty_cycle;
+ 
+-		if (!phy->test.bf_en)
++		if (!td->bf_en)
+ 			mt7915_tm_update_channel(phy);
+ 
+ 		if (td->tx_spe_idx)
+@@ -1669,7 +1832,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 			if (duty_cycle < 100)
+ 				tx_time = duty_cycle * ipg / (100 - duty_cycle);
+ 		}
+-		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
++		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode, false);
+ 		mt7915_tm_set_tx_len(phy, tx_time);
+ 
+ 		if (ipg)
+@@ -1688,6 +1851,9 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 		mt7915_tm_tx_frames_mu(phy, en);
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
++
++	if (td->bf_en)
++		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ }
+ 
+ static int
+@@ -1779,7 +1945,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+ 
+ 	if (en) {
+-		if (!phy->test.bf_en)
++		if (!td->bf_en || !td->is_txbf_dut)
+ 			mt7915_tm_update_channel(phy);
+ 		if (td->aid)
+ 			mt7915_tm_set_rx_user_idx(phy, td->aid);
+@@ -1796,6 +1962,9 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ 		mt7915_tm_set_muru_aid(phy, en ? td->aid : 0xf800);
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
++
++	if (td->bf_en)
++		mt7915_tm_set_trx(phy, TM_MAC_TX, en);
+ }
+ 
+ static int
+@@ -1855,34 +2024,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+ 		rate_idx = sband->bitrates[idx].hw_value & 0xff;
+ 	}
+ 
+-	switch (td->tx_rate_mode) {
+-	case MT76_TM_TX_MODE_CCK:
+-		mode = MT_PHY_TYPE_CCK;
+-		break;
+-	case MT76_TM_TX_MODE_OFDM:
+-		mode = MT_PHY_TYPE_OFDM;
+-		break;
+-	case MT76_TM_TX_MODE_HT:
+-		mode = MT_PHY_TYPE_HT;
+-		break;
+-	case MT76_TM_TX_MODE_VHT:
+-		mode = MT_PHY_TYPE_VHT;
+-		break;
+-	case MT76_TM_TX_MODE_HE_SU:
+-		mode = MT_PHY_TYPE_HE_SU;
+-		break;
+-	case MT76_TM_TX_MODE_HE_EXT_SU:
+-		mode = MT_PHY_TYPE_HE_EXT_SU;
+-		break;
+-	case MT76_TM_TX_MODE_HE_TB:
+-		mode = MT_PHY_TYPE_HE_TB;
+-		break;
+-	case MT76_TM_TX_MODE_HE_MU:
+-		mode = MT_PHY_TYPE_HE_MU;
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
++	mode = mt7915_tm_rate_to_phy(td->tx_rate_mode);
+ 
+ 	rateval =  mode << 6 | rate_idx;
+ 	tx_cont->rateval = cpu_to_le16(rateval);
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index d500987..1982369 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -311,137 +311,7 @@ struct mt7915_tm_muru {
+ 
+ #define MAX_PHASE_GROUP_NUM	9
+ 
+-struct mt7915_tm_txbf_phase {
+-	u8 status;
+-	struct {
+-		u8 r0_uh;
+-		u8 r0_h;
+-		u8 r0_m;
+-		u8 r0_l;
+-		u8 r0_ul;
+-		u8 r1_uh;
+-		u8 r1_h;
+-		u8 r1_m;
+-		u8 r1_l;
+-		u8 r1_ul;
+-		u8 r2_uh;
+-		u8 r2_h;
+-		u8 r2_m;
+-		u8 r2_l;
+-		u8 r2_ul;
+-		u8 r3_uh;
+-		u8 r3_h;
+-		u8 r3_m;
+-		u8 r3_l;
+-		u8 r3_ul;
+-		u8 r2_uh_sx2;
+-		u8 r2_h_sx2;
+-		u8 r2_m_sx2;
+-		u8 r2_l_sx2;
+-		u8 r2_ul_sx2;
+-		u8 r3_uh_sx2;
+-		u8 r3_h_sx2;
+-		u8 r3_m_sx2;
+-		u8 r3_l_sx2;
+-		u8 r3_ul_sx2;
+-		u8 m_t0_h;
+-		u8 m_t1_h;
+-		u8 m_t2_h;
+-		u8 m_t2_h_sx2;
+-		u8 r0_reserved;
+-		u8 r1_reserved;
+-		u8 r2_reserved;
+-		u8 r3_reserved;
+-		u8 r2_sx2_reserved;
+-		u8 r3_sx2_reserved;
+-	} phase;
+-};
+-
+-struct mt7915_tm_pfmu_tag1 {
+-	__le32 pfmu_idx:10;
+-	__le32 ebf:1;
+-	__le32 data_bw:2;
+-	__le32 lm:2;
+-	__le32 is_mu:1;
+-	__le32 nr:3, nc:3;
+-	__le32 codebook:2;
+-	__le32 ngroup:2;
+-	__le32 _rsv:2;
+-	__le32 invalid_prof:1;
+-	__le32 rmsd:3;
+-
+-	__le32 col_id1:6, row_id1:10;
+-	__le32 col_id2:6, row_id2:10;
+-	__le32 col_id3:6, row_id3:10;
+-	__le32 col_id4:6, row_id4:10;
+-
+-	__le32 ru_start_id:7;
+-	__le32 _rsv1:1;
+-	__le32 ru_end_id:7;
+-	__le32 _rsv2:1;
+-	__le32 mob_cal_en:1;
+-	__le32 _rsv3:15;
+-
+-	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
+-	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
+-
+-	__le32 _rsv4;
+-} __packed;
+-
+-struct mt7915_tm_pfmu_tag2 {
+-	__le32 smart_ant:24;
+-	__le32 se_idx:5;
+-	__le32 _rsv:3;
+-
+-	__le32 _rsv1:8;
+-	__le32 rmsd_thres:3;
+-	__le32 _rsv2:5;
+-	__le32 ibf_timeout:8;
+-	__le32 _rsv3:8;
+-
+-	__le32 _rsv4:16;
+-	__le32 ibf_data_bw:2;
+-	__le32 ibf_nc:3;
+-	__le32 ibf_nr:3;
+-	__le32 ibf_ru:8;
+-
+-	__le32 mob_delta_t:8;
+-	__le32 mob_lq_result:7;
+-	__le32 _rsv5:1;
+-	__le32 _rsv6:16;
+-
+-	__le32 _rsv7;
+-} __packed;
+-
+-struct mt7915_tm_pfmu_tag {
+-	struct mt7915_tm_pfmu_tag1 t1;
+-	struct mt7915_tm_pfmu_tag2 t2;
+-};
+-
+-struct mt7915_tm_pfmu_data {
+-	__le16 subc_idx;
+-	__le16 phi11;
+-	__le16 phi21;
+-	__le16 phi31;
+-};
+-
+-struct mt7915_tm_ibf_cal_info {
+-	u8 format_id;
+-	u8 group_l_m_n;
+-	u8 group;
+-	bool sx2;
+-	u8 status;
+-	u8 cal_type;
+-	u8 _rsv[2];
+-	u8 buf[1000];
+-} __packed;
+-
+-enum {
+-	IBF_PHASE_CAL_UNSPEC,
+-	IBF_PHASE_CAL_NORMAL,
+-	IBF_PHASE_CAL_VERIFY,
+-	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
+-	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
+-};
++#define TXBF_DUT_MAC_SUBADDR		0x22
++#define TXBF_GOLDEN_MAC_SUBADDR		0x11
+ 
+ #endif
+diff --git a/testmode.c b/testmode.c
+index b19b872..ed5ceee 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -191,6 +191,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
+ 
+ 	hdr = __skb_put_zero(head, sizeof(*hdr));
+ 	hdr->frame_control = cpu_to_le16(fc);
++
+ 	memcpy(hdr->addr1, addr[0], ETH_ALEN);
+ 	memcpy(hdr->addr2, addr[1], ETH_ALEN);
+ 	memcpy(hdr->addr3, addr[2], ETH_ALEN);
+diff --git a/testmode.h b/testmode.h
+index 27a0095..e1ebbd5 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -299,7 +299,10 @@ enum mt76_testmode_cfg {
+ };
+ 
+ enum mt76_testmode_txbf_act {
++	MT76_TM_TXBF_ACT_GOLDEN_INIT,
+ 	MT76_TM_TXBF_ACT_INIT,
++	MT76_TM_TX_EBF_ACT_GOLDEN_INIT,
++	MT76_TM_TX_EBF_ACT_INIT,
+ 	MT76_TM_TXBF_ACT_UPDATE_CH,
+ 	MT76_TM_TXBF_ACT_PHASE_COMP,
+ 	MT76_TM_TXBF_ACT_TX_PREP,
+@@ -310,6 +313,12 @@ enum mt76_testmode_txbf_act {
+ 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
+ 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
+ 	MT76_TM_TXBF_ACT_E2P_UPDATE,
++	MT76_TM_TXBF_ACT_TRIGGER_SOUNDING,
++	MT76_TM_TXBF_ACT_STOP_SOUNDING,
++	MT76_TM_TXBF_ACT_PROFILE_TAG_READ,
++	MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE,
++	MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID,
++	MT76_TM_TXBF_ACT_STA_REC_READ,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_TXBF_ACT,
+diff --git a/tools/fields.c b/tools/fields.c
+index 6f07eed..7211ec5 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -33,7 +33,10 @@ static const char * const testmode_tx_mode[] = {
+ };
+ 
+ static const char * const testmode_txbf_act[] = {
++	[MT76_TM_TXBF_ACT_GOLDEN_INIT] = "golden_init",
+ 	[MT76_TM_TXBF_ACT_INIT] = "init",
++	[MT76_TM_TX_EBF_ACT_GOLDEN_INIT] = "ebf_golden_init",
++	[MT76_TM_TX_EBF_ACT_INIT] = "ebf_init",
+ 	[MT76_TM_TXBF_ACT_UPDATE_CH] = "update_ch",
+ 	[MT76_TM_TXBF_ACT_PHASE_COMP] = "phase_comp",
+ 	[MT76_TM_TXBF_ACT_TX_PREP] = "tx_prep",
+@@ -44,6 +47,12 @@ static const char * const testmode_txbf_act[] = {
+ 	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL] = "prof_update",
+ 	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD] = "prof_update_all",
+ 	[MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
++	[MT76_TM_TXBF_ACT_TRIGGER_SOUNDING] = "trigger_sounding",
++	[MT76_TM_TXBF_ACT_STOP_SOUNDING] = "stop_sounding",
++	[MT76_TM_TXBF_ACT_PROFILE_TAG_READ] = "pfmu_tag_read",
++	[MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE] = "pfmu_tag_write",
++	[MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID] = "set_invalid_prof",
++	[MT76_TM_TXBF_ACT_STA_REC_READ] = "sta_rec_read",
+ };
+ 
+ static const char * const testmode_offchan_bw[] = {
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
similarity index 69%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index c49d31d..f98553d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,17 +1,17 @@
-From a0e8ed2e87607c70f76eed181a921ba9cf7d66c0 Mon Sep 17 00:00:00 2001
+From c85d663c58c549c8b969cb8ba349b52e40078cd3 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1116/1129] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1117/1131] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8527b90a..0396031c 100644
+index a347e77..eae1377 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -671,6 +671,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -692,6 +692,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy;
  #endif
  	int ret, idx;
@@ -19,7 +19,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -694,6 +695,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -715,6 +716,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
similarity index 74%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 5e49ca7..337aada 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From 107c786501f44f62a41c8e01b2a4662fbaaa2926 Mon Sep 17 00:00:00 2001
+From 314e5ed3acb7b58da8c147b0eab01a9aae602042 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1117/1129] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1118/1131] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 87d2c0de..11732993 100644
+index 5d41ebf..2d363c4 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3789,7 +3789,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3811,7 +3811,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
@@ -24,5 +24,5 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
index f144c24..91cae3d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,7 +1,7 @@
-From 676531d63f5206049fea3ee2301fab7a70a18d76 Mon Sep 17 00:00:00 2001
+From de4cc865ca394c97a70776fa4de4e88357958136 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1118/1129] mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1119/1131] mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 2e0e011d..de9ef237 100644
+index 2e0e011..de9ef23 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -435,7 +435,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -21,5 +21,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index f7686bf..f9150ab 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 6ba6a1fa68f9ef87d3357e94b688e534210baa0d Mon Sep 17 00:00:00 2001
+From 1c8eaa4d0f729d9de4cb78f16a22dc6cdb095c32 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1119/1129] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1120/1131] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 24efa280..7bdd4d52 100644
+index a796289..55ba90a 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 88aaa16a..fdae347e 100644
+index 88aaa16..fdae347 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 11732993..ca2e4029 100644
+index 2d363c4..4c64655 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2903,7 +2903,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2917,7 +2917,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2941,9 +2942,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2955,9 +2956,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2951,34 +2952,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2965,34 +2966,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3010,24 +3046,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3024,24 +3060,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
index 4f555c1..02d0bba 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From 5955454208b5eb059911bc1c559d05e33d5d8e7c Mon Sep 17 00:00:00 2001
+From fb4643dc44ac917180b758d7ae0f5cc8e9c48450 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1120/1129] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1121/1131] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 26bcb4e5..66695d5b 100644
+index ab1efe6..e977e5c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c7551848..77d71e48 100644
+index c755184..77d71e4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf9..719b851f 100644
+index a8e4ebf..719b851 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
index e45911f..30520ce 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
@@ -1,7 +1,7 @@
-From 5a91524be285d368d1616a47df541a1c14314846 Mon Sep 17 00:00:00 2001
+From ad63e1c0ab57d38a943dc1ead54efb153c82ff21 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1121/1129] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1122/1131] mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
@@ -16,7 +16,7 @@
  7 files changed, 264 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 7853e074..88bfd09f 100644
+index 7853e07..88bfd09 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1200,6 +1200,7 @@ enum {
@@ -28,10 +28,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0396031c..94b7a651 100644
+index eae1377..09cf35c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -458,6 +458,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -479,6 +479,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  			mutex_unlock(&dev->mt76.mutex);
  		}
  #endif
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ca2e4029..7507344a 100644
+index 4c64655..dddab7d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4568,3 +4568,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4593,3 +4593,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -122,10 +122,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9a485249..33e33d89 100644
+index a30f52d..391aed9 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -885,6 +885,27 @@ enum {
+@@ -1057,6 +1057,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -154,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 66695d5b..5bffcff5 100644
+index e977e5c..4c370bb 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -753,7 +753,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -761,7 +761,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -168,7 +168,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..2484e25f 100644
+index 77d71e4..2484e25 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -325,7 +325,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851f..72319717 100644
+index 719b851..7231971 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -2,6 +2,7 @@
@@ -376,5 +376,5 @@
  
  enum mtk_capi_control_changed {
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
deleted file mode 100644
index 24c978f..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1122-mt76-mt7915-implement-bin-file-mode.patch
+++ /dev/null
@@ -1,325 +0,0 @@
-From 42cce8dd635255ae8652b6ed34d598d95ef599be Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1122/1129] mt76: mt7915: implement bin file mode
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- eeprom.c             | 18 +++++++++++++++
- mt76.h               |  1 +
- mt7915/eeprom.c      | 53 ++++++++++++++++++++------------------------
- mt7915/eeprom.h      | 44 ++++++++++++++++++++++++++++++++++++
- mt7915/mt7915.h      | 17 +++++++++++---
- mt7915/mtk_debugfs.c | 41 ++++++++++++++++++++++++++++++++++
- 6 files changed, 142 insertions(+), 32 deletions(-)
-
-diff --git a/eeprom.c b/eeprom.c
-index cb6ff17a..aac70efb 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -104,6 +104,24 @@ out_put_node:
- }
- EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
- 
-+bool mt76_check_bin_file_mode(struct mt76_dev *dev)
-+{
-+	struct device_node *np = dev->dev->of_node;
-+	const __be32 *bin_file_mode;
-+	bool ret = false;
-+
-+	if (!np)
-+		return false;
-+
-+	bin_file_mode = of_get_property(np, "bin_file_mode", NULL);
-+	if (bin_file_mode && be32_to_cpu(*bin_file_mode))
-+		ret = true;
-+
-+	of_node_put(np);
-+	return ret;
-+}
-+EXPORT_SYMBOL_GPL(mt76_check_bin_file_mode);
-+
- void
- mt76_eeprom_override(struct mt76_phy *phy)
- {
-diff --git a/mt76.h b/mt76.h
-index 2bacc1b4..d102333b 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -1029,6 +1029,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
- int mt76_eeprom_init(struct mt76_dev *dev, int len);
- void mt76_eeprom_override(struct mt76_phy *phy);
- int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
-+bool mt76_check_bin_file_mode(struct mt76_dev *dev);
- 
- struct mt76_queue *
- mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 7bdd4d52..64a7750b 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -42,33 +42,6 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
- 	}
- }
- 
--static char *mt7915_eeprom_name(struct mt7915_dev *dev)
--{
--	switch (mt76_chip(&dev->mt76)) {
--	case 0x7915:
--		return dev->dbdc_support ?
--		       MT7915_EEPROM_DEFAULT_DBDC : MT7915_EEPROM_DEFAULT;
--	case 0x7986:
--		switch (mt7915_check_adie(dev, true)) {
--		case MT7976_ONE_ADIE_DBDC:
--			return MT7986_EEPROM_MT7976_DEFAULT_DBDC;
--		case MT7975_ONE_ADIE:
--			return MT7986_EEPROM_MT7975_DEFAULT;
--		case MT7976_ONE_ADIE:
--			return MT7986_EEPROM_MT7976_DEFAULT;
--		case MT7975_DUAL_ADIE:
--			return MT7986_EEPROM_MT7975_DUAL_DEFAULT;
--		case MT7976_DUAL_ADIE:
--			return MT7986_EEPROM_MT7976_DUAL_DEFAULT;
--		default:
--			break;
--		}
--		return NULL;
--	default:
--		return MT7916_EEPROM_DEFAULT;
--	}
--}
--
- static int
- mt7915_eeprom_load_default(struct mt7915_dev *dev)
- {
-@@ -81,7 +54,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
- 		return ret;
- 
- 	if (!fw || !fw->data) {
--		dev_err(dev->mt76.dev, "Invalid default bin\n");
-+		if (dev->bin_file_mode)
-+			dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
-+		else
-+			dev_err(dev->mt76.dev, "Invalid default bin\n");
- 		ret = -EINVAL;
- 		goto out;
- 	}
-@@ -106,6 +82,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 
- 	if (ret) {
- 		dev->flash_mode = true;
-+		dev->eeprom_mode = FLASH_MODE;
- 	} else {
- 		u8 free_block_num;
- 		u32 block_num, i;
-@@ -126,6 +103,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 			if (ret < 0)
- 				return ret;
- 		}
-+
-+		dev->eeprom_mode = EFUSE_MODE;
- 	}
- 
- 	return mt7915_check_eeprom(dev);
-@@ -231,12 +210,28 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
- {
- 	int ret;
- 
--	ret = mt7915_eeprom_load(dev);
-+	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
-+
-+	if (dev->bin_file_mode) {
-+		dev->mt76.eeprom.size = mt7915_eeprom_size(dev);
-+		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
-+						     GFP_KERNEL);
-+		if (!dev->mt76.eeprom.data)
-+			return -ENOMEM;
-+		ret = mt7915_eeprom_load_default(dev);
-+		dev->eeprom_mode = BIN_FILE_MODE;
-+	} else {
-+		ret = mt7915_eeprom_load(dev);
-+	}
-+
- 	if (ret < 0) {
- 		if (ret != -EINVAL)
- 			return ret;
- 
- 		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
-+		dev->bin_file_mode = false;
-+		dev->eeprom_mode = DEFAULT_BIN_MODE;
-+
- 		ret = mt7915_eeprom_load_default(dev);
- 		if (ret)
- 			return ret;
-diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index fdae347e..f228926b 100644
---- a/mt7915/eeprom.h
-+++ b/mt7915/eeprom.h
-@@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
- 	MAX_SKU_RATE_GROUP_NUM,
- };
- 
-+enum mt7915_eeprom_mode {
-+	DEFAULT_BIN_MODE,
-+	EFUSE_MODE,
-+	FLASH_MODE,
-+	BIN_FILE_MODE,
-+};
-+
- static inline int
- mt7915_get_channel_group_5g(int channel, bool is_7976)
- {
-@@ -184,6 +191,43 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
- 	}
- }
- 
-+static inline char *mt7915_eeprom_name(struct mt7915_dev *dev)
-+{
-+	switch (mt76_chip(&dev->mt76)) {
-+	case 0x7915:
-+		if (dev->bin_file_mode)
-+			return dev->dbdc_support ?
-+				MT7915_BIN_FILE_DBDC : MT7915_BIN_FILE;
-+		else
-+			return dev->dbdc_support ?
-+				MT7915_EEPROM_DEFAULT_DBDC : MT7915_EEPROM_DEFAULT;
-+	case 0x7986:
-+		switch (mt7915_check_adie(dev, true)) {
-+		case MT7976_ONE_ADIE_DBDC:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7976_DBDC : MT7986_EEPROM_MT7976_DEFAULT_DBDC;
-+		case MT7975_ONE_ADIE:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7975 : MT7986_EEPROM_MT7975_DEFAULT;
-+		case MT7976_ONE_ADIE:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7976 : MT7986_EEPROM_MT7976_DEFAULT;
-+		case MT7975_DUAL_ADIE:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7975_DUAL : MT7986_EEPROM_MT7975_DUAL_DEFAULT;
-+		case MT7976_DUAL_ADIE:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7976_DUAL : MT7986_EEPROM_MT7976_DUAL_DEFAULT;
-+		default:
-+			break;
-+		}
-+		return NULL;
-+	default:
-+		return dev->bin_file_mode ?
-+			MT7916_BIN_FILE : MT7916_EEPROM_DEFAULT;
-+	}
-+}
-+
- extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
- 
- #endif
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5bffcff5..239eef58 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -42,15 +42,24 @@
- #define MT7986_ROM_PATCH		"mediatek/mt7986_rom_patch.bin"
- #define MT7986_ROM_PATCH_MT7975		"mediatek/mt7986_rom_patch_mt7975.bin"
- 
--#define MT7915_EEPROM_DEFAULT		"mediatek/mt7915_eeprom.bin"
--#define MT7915_EEPROM_DEFAULT_DBDC	"mediatek/mt7915_eeprom_dbdc.bin"
--#define MT7916_EEPROM_DEFAULT		"mediatek/mt7916_eeprom.bin"
-+#define MT7915_EEPROM_DEFAULT			"mediatek/mt7915_eeprom.bin"
-+#define MT7915_EEPROM_DEFAULT_DBDC		"mediatek/mt7915_eeprom_dbdc.bin"
-+#define MT7916_EEPROM_DEFAULT			"mediatek/mt7916_eeprom.bin"
- #define MT7986_EEPROM_MT7975_DEFAULT		"mediatek/mt7986_eeprom_mt7975.bin"
- #define MT7986_EEPROM_MT7975_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7975_dual.bin"
- #define MT7986_EEPROM_MT7976_DEFAULT		"mediatek/mt7986_eeprom_mt7976.bin"
- #define MT7986_EEPROM_MT7976_DEFAULT_DBDC	"mediatek/mt7986_eeprom_mt7976_dbdc.bin"
- #define MT7986_EEPROM_MT7976_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7976_dual.bin"
- 
-+#define MT7915_BIN_FILE				"mediatek/mt7915_binfile.bin"
-+#define MT7915_BIN_FILE_DBDC			"mediatek/mt7915_binfile_dbdc.bin"
-+#define MT7916_BIN_FILE				"mediatek/mt7916_binfile.bin"
-+#define MT7986_BIN_FILE_MT7975			"mediatek/mt7986_binfile_mt7975.bin"
-+#define MT7986_BIN_FILE_MT7975_DUAL		"mediatek/mt7986_binfile_mt7975_dual.bin"
-+#define MT7986_BIN_FILE_MT7976			"mediatek/mt7986_binfile_mt7976.bin"
-+#define MT7986_BIN_FILE_MT7976_DBDC		"mediatek/mt7986_binfile_mt7976_dbdc.bin"
-+#define MT7986_BIN_FILE_MT7976_DUAL		"mediatek/mt7986_binfile_mt7976_dual.bin"
-+
- #define MT7915_EEPROM_SIZE		3584
- #define MT7916_EEPROM_SIZE		4096
- 
-@@ -396,6 +405,8 @@ struct mt7915_dev {
- 
- 	bool dbdc_support;
- 	bool flash_mode;
-+	bool bin_file_mode;
-+	u8 eeprom_mode;
- 	bool muru_debug;
- 	bool ibf;
- 
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index d96f222a..376e5f89 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -3,6 +3,7 @@
- #include "mt7915_debug.h"
- #include "mac.h"
- #include "mcu.h"
-+#include "eeprom.h"
- 
- #ifdef MTK_DEBUG
- #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
-@@ -2893,6 +2894,44 @@ mt7915_wa_debug(void *data, u64 val)
- DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
- 			 "0x%llx\n");
- 
-+static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	struct mt76_dev *mdev = &dev->mt76;
-+#ifdef CONFIG_NL80211_TESTMODE
-+	const char *mtd_name = mdev->test_mtd.name;
-+	u32 mtd_offset = mdev->test_mtd.offset;
-+#else
-+	const char *mtd_name = NULL;
-+	u32 mtd_offset;
-+#endif
-+
-+	seq_printf(s, "Current eeprom mode:\n");
-+
-+	switch (dev->eeprom_mode) {
-+	case DEFAULT_BIN_MODE:
-+		seq_printf(s, "   default bin mode\n   filename = %s\n", mt7915_eeprom_name(dev));
-+		break;
-+	case EFUSE_MODE:
-+		seq_printf(s, "   efuse mode\n");
-+		break;
-+	case FLASH_MODE:
-+		if (mtd_name)
-+			seq_printf(s, "   flash mode\n   mtd name = %s\n   flash offset = 0x%x\n",
-+				   mtd_name, mtd_offset);
-+		else
-+			seq_printf(s, "   flash mode\n");
-+		break;
-+	case BIN_FILE_MODE:
-+		seq_printf(s, "   bin file mode\n   filename = %s\n", mt7915_eeprom_name(dev));
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- {
- 	struct mt7915_dev *dev = phy->dev;
-@@ -2973,6 +3012,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
- 				    mt7915_dump_version);
- 
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
-+				    mt7915_show_eeprom_mode);
- 	return 0;
- }
- #endif
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-implement-bin-file-mode.patch
new file mode 100644
index 0000000..c45c696
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-implement-bin-file-mode.patch
@@ -0,0 +1,273 @@
+From e1076c547c69fa1424341b87c1e14abed29cab07 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 7 Jul 2022 11:09:59 +0800
+Subject: [PATCH 1123/1131] mt76: mt7915: implement bin file mode
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ eeprom.c             | 20 ++++++++++++++++++++
+ mt76.h               |  3 +++
+ mt7915/eeprom.c      | 36 +++++++++++++++++++++++++++++++++---
+ mt7915/eeprom.h      |  7 +++++++
+ mt7915/mt7915.h      |  9 ++++++---
+ mt7915/mtk_debugfs.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 6 files changed, 110 insertions(+), 6 deletions(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index cb6ff17..05b6dfa 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -104,6 +104,26 @@ out_put_node:
+ }
+ EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
+ 
++bool mt76_check_bin_file_mode(struct mt76_dev *dev)
++{
++	struct device_node *np = dev->dev->of_node;
++	const char *bin_file_name = NULL;
++
++	if (!np)
++		return false;
++
++	of_property_read_string(np, "bin_file_name", &bin_file_name);
++
++	dev->bin_file_name = bin_file_name;
++	if (dev->bin_file_name)
++		dev_info(dev->dev, "Using bin file %s\n", dev->bin_file_name);
++
++	of_node_put(np);
++
++	return dev->bin_file_name ? true : false;
++}
++EXPORT_SYMBOL_GPL(mt76_check_bin_file_mode);
++
+ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+diff --git a/mt76.h b/mt76.h
+index c6aefbf..9b6e806 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -894,9 +894,11 @@ struct mt76_dev {
+ 		struct mt76_sdio sdio;
+ 	};
+ 
++	/* for mtk internal */
+ 	struct mt76_connac2_patch_hdr *patch_hdr;
+ 	struct mt76_connac2_fw_trailer *wm_hdr;
+ 	struct mt76_connac2_fw_trailer *wa_hdr;
++	const char *bin_file_name;
+ };
+ 
+ struct mt76_power_limits {
+@@ -1033,6 +1035,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+ int mt76_eeprom_init(struct mt76_dev *dev, int len);
+ void mt76_eeprom_override(struct mt76_phy *phy);
+ int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
++bool mt76_check_bin_file_mode(struct mt76_dev *dev);
+ 
+ struct mt76_queue *
+ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index 55ba90a..54803e8 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -45,8 +45,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+ 	}
+ }
+ 
+-static char *mt7915_eeprom_name(struct mt7915_dev *dev)
++const char *mt7915_eeprom_name(struct mt7915_dev *dev)
+ {
++	if (dev->bin_file_mode)
++		return dev->mt76.bin_file_name;
++
+ 	switch (mt76_chip(&dev->mt76)) {
+ 	case 0x7915:
+ 		return dev->dbdc_support ?
+@@ -84,7 +87,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
+ 		return ret;
+ 
+ 	if (!fw || !fw->data) {
+-		dev_err(dev->mt76.dev, "Invalid default bin\n");
++		if (dev->bin_file_mode)
++			dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
++		else
++			dev_err(dev->mt76.dev, "Invalid default bin\n");
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+@@ -109,6 +115,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ 
+ 	if (ret) {
+ 		dev->flash_mode = true;
++		dev->eeprom_mode = FLASH_MODE;
+ 	} else {
+ 		u8 free_block_num;
+ 		u32 block_num, i;
+@@ -129,6 +136,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ 			if (ret < 0)
+ 				return ret;
+ 		}
++
++		dev->eeprom_mode = EFUSE_MODE;
+ 	}
+ 
+ 	return mt7915_check_eeprom(dev);
+@@ -234,12 +243,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+ {
+ 	int ret;
+ 
+-	ret = mt7915_eeprom_load(dev);
++	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
++	if (dev->bin_file_mode) {
++		dev->mt76.eeprom.size = mt7915_eeprom_size(dev);
++		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
++						     GFP_KERNEL);
++		if (!dev->mt76.eeprom.data)
++			return -ENOMEM;
++		ret = mt7915_eeprom_load_default(dev);
++		if (ret)
++			return ret;
++
++		ret = mt7915_check_eeprom(dev);
++		if (ret)
++			return ret;
++		dev->eeprom_mode = BIN_FILE_MODE;
++	} else {
++		ret = mt7915_eeprom_load(dev);
++	}
++
+ 	if (ret < 0) {
+ 		if (ret != -EINVAL)
+ 			return ret;
+ 
+ 		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
++		dev->bin_file_mode = false;
++		dev->eeprom_mode = DEFAULT_BIN_MODE;
++
+ 		ret = mt7915_eeprom_load_default(dev);
+ 		if (ret)
+ 			return ret;
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index fdae347..9056d78 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
+ 	MAX_SKU_RATE_GROUP_NUM,
+ };
+ 
++enum mt7915_eeprom_mode {
++	DEFAULT_BIN_MODE,
++	EFUSE_MODE,
++	FLASH_MODE,
++	BIN_FILE_MODE,
++};
++
+ static inline int
+ mt7915_get_channel_group_5g(int channel, bool is_7976)
+ {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 4c370bb..e5cfc77 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -42,9 +42,9 @@
+ #define MT7986_ROM_PATCH		"mediatek/mt7986_rom_patch.bin"
+ #define MT7986_ROM_PATCH_MT7975		"mediatek/mt7986_rom_patch_mt7975.bin"
+ 
+-#define MT7915_EEPROM_DEFAULT		"mediatek/mt7915_eeprom.bin"
+-#define MT7915_EEPROM_DEFAULT_DBDC	"mediatek/mt7915_eeprom_dbdc.bin"
+-#define MT7916_EEPROM_DEFAULT		"mediatek/mt7916_eeprom.bin"
++#define MT7915_EEPROM_DEFAULT			"mediatek/mt7915_eeprom.bin"
++#define MT7915_EEPROM_DEFAULT_DBDC		"mediatek/mt7915_eeprom_dbdc.bin"
++#define MT7916_EEPROM_DEFAULT			"mediatek/mt7916_eeprom.bin"
+ #define MT7986_EEPROM_MT7975_DEFAULT		"mediatek/mt7986_eeprom_mt7975.bin"
+ #define MT7986_EEPROM_MT7975_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7975_dual.bin"
+ #define MT7986_EEPROM_MT7976_DEFAULT		"mediatek/mt7986_eeprom_mt7976.bin"
+@@ -400,6 +400,8 @@ struct mt7915_dev {
+ 
+ 	bool dbdc_support;
+ 	bool flash_mode;
++	bool bin_file_mode;
++	u8 eeprom_mode;
+ 	bool muru_debug;
+ 	bool ibf;
+ 
+@@ -774,6 +776,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
+ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
+ void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
+ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
++const char *mt7915_eeprom_name(struct mt7915_dev *dev);
+ 
+ #define PKT_BIN_DEBUG_MAGIC	0xc8763123
+ enum {
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index a2ceb6f..7567666 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -3,6 +3,7 @@
+ #include "mt7915_debug.h"
+ #include "mac.h"
+ #include "mcu.h"
++#include "eeprom.h"
+ 
+ #ifdef MTK_DEBUG
+ #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
+@@ -2924,6 +2925,44 @@ mt7915_wa_debug(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
+ 			 "0x%llx\n");
+ 
++static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	struct mt76_dev *mdev = &dev->mt76;
++#ifdef CONFIG_NL80211_TESTMODE
++	const char *mtd_name = mdev->test_mtd.name;
++	u32 mtd_offset = mdev->test_mtd.offset;
++#else
++	const char *mtd_name = NULL;
++	u32 mtd_offset;
++#endif
++
++	seq_printf(s, "Current eeprom mode:\n");
++
++	switch (dev->eeprom_mode) {
++	case DEFAULT_BIN_MODE:
++		seq_printf(s, "   default bin mode\n   filename = %s\n", mt7915_eeprom_name(dev));
++		break;
++	case EFUSE_MODE:
++		seq_printf(s, "   efuse mode\n");
++		break;
++	case FLASH_MODE:
++		if (mtd_name)
++			seq_printf(s, "   flash mode\n   mtd name = %s\n   flash offset = 0x%x\n",
++				   mtd_name, mtd_offset);
++		else
++			seq_printf(s, "   flash mode\n");
++		break;
++	case BIN_FILE_MODE:
++		seq_printf(s, "   bin file mode\n   filename = %s\n", mt7915_eeprom_name(dev));
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+@@ -3009,6 +3048,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
+ 				    mt7915_dump_version);
+ 
++	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
++				    mt7915_show_eeprom_mode);
+ 	return 0;
+ }
+ #endif
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-initialize-wcid.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-initialize-wcid.patch
index 0231a99..96667f7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1123-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 9dc6af1c44883efd578f9a081264c43210e8e5b8 Mon Sep 17 00:00:00 2001
+From a266db484a5bccd64c282b7f7dfbdf4be126758f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1123/1129] mt76: mt7915: initialize wcid
+Subject: [PATCH 1124/1131] mt76: mt7915: initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0746e4b3..22dd66e3 100644
+index 013dfbd..9d4cfa1 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1030,7 +1030,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1032,7 +1032,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-Add-hemu-dump-support.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-Add-hemu-dump-support.patch
index ca5b014..3fbaa30 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-Add-hemu-dump-support.patch
@@ -1,7 +1,7 @@
-From eb8e083501dbca6db418cb2538cd1e50c51abde9 Mon Sep 17 00:00:00 2001
+From eff1dd335c92e3d6d9033b50363d41d902025e83 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1124/1129] mt76: mt7915: Add hemu dump support
+Subject: [PATCH 1125/1131] mt76: mt7915: Add hemu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 26 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 2484e25f..f7becce9 100644
+index 2484e25..f7becce 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -60,7 +60,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 72319717..c19ffe72 100644
+index 7231971..c19ffe7 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
@@ -72,5 +72,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 1f2fe5b..de93232 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,7 +1,7 @@
-From e58fab916807bd40d8f3e7169e7a3e8df306878e Mon Sep 17 00:00:00 2001
+From 1ed70aaeef64eb65d10c9af9f0ad30f079eab0ea Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1125/1129] mt76: mt7915: add vendor subcmd three wire (PTA)
+Subject: [PATCH 1126/1131] mt76: mt7915: add vendor subcmd three wire (PTA)
  ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
@@ -16,7 +16,7 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 88bfd09f..5cff1a45 100644
+index 88bfd09..5cff1a4 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1199,7 +1199,7 @@ enum {
@@ -29,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7507344a..5791cb29 100644
+index dddab7d..36a33f6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4250,37 +4250,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4272,37 +4272,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,10 +94,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 33e33d89..08476eb6 100644
+index 391aed9..025a03b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -674,6 +674,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -846,6 +846,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -134,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 239eef58..22454b54 100644
+index e5cfc77..b9b86b8 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -756,6 +756,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -755,6 +755,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index f7becce9..fb760e17 100644
+index f7becce..fb760e1 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -229,7 +229,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index c19ffe72..d96e5c23 100644
+index c19ffe7..d96e5c2 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,6 +12,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -268,5 +268,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 0b8f9b8..dcdb65c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 0a8c65105444a20637c868e376a322924b2429f2 Mon Sep 17 00:00:00 2001
+From f90d366773f3e1eec3a00b9191326963816c2708 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1126/1129] mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1127/1131] mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index fb760e17..22af66d5 100644
+index fb760e1..22af66d 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
@@ -100,7 +100,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index d96e5c23..949c8853 100644
+index d96e5c2..949c885 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,7 +12,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -141,5 +141,5 @@
 +
  #endif
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
similarity index 83%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index 526fda5..4d374c0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,7 +1,7 @@
-From 1116673d44b71df37e01407ee6ebca0b6cc9f338 Mon Sep 17 00:00:00 2001
+From 0374780c5201fd70824eea091a416557020d5734 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1127/1129] mt76: mt7915: add E3 re-bonding for low yield rate
+Subject: [PATCH 1128/1131] mt76: mt7915: add E3 re-bonding for low yield rate
  issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,10 +12,10 @@
  3 files changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 64a7750b..efa9c173 100644
+index 54803e8..849275e 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -99,7 +99,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -132,7 +132,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  		/* read eeprom data from efuse */
  		block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
  		for (i = 0; i < block_num; i++) {
@@ -24,7 +24,7 @@
  			if (ret < 0)
  				return ret;
  		}
-@@ -206,6 +206,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+@@ -239,6 +239,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  	dev->chainshift = hweight8(dev->mphy.chainmask);
  }
  
@@ -54,7 +54,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
-@@ -237,6 +260,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -275,6 +298,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  			return ret;
  	}
  
@@ -64,10 +64,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5791cb29..785c3c10 100644
+index 36a33f6..cb47ae6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2822,7 +2822,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+@@ -2836,7 +2836,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
  				 &req, sizeof(req), true);
  }
  
@@ -76,7 +76,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2840,8 +2840,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2854,8 +2854,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -95,10 +95,10 @@
  
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 22454b54..2d3769c6 100644
+index b9b86b8..ab81d41 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -561,6 +561,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -556,6 +556,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
@@ -106,7 +106,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev);
  void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  				struct mt7915_phy *phy);
-@@ -614,7 +615,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -610,7 +611,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
  int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
@@ -116,5 +116,5 @@
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
index 8d969ee..6dd6422 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,7 +1,7 @@
-From d0c879de4b067613307926ec75f0dd99081a3ef6 Mon Sep 17 00:00:00 2001
+From 8f5d24612f329ef1388fa2a7611993dd4144040e Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1128/1129] mt76: mt7915: support on off SW ACI through debugfs
+Subject: [PATCH 1129/1131] mt76: mt7915: support on off SW ACI through debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
@@ -11,7 +11,7 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5cff1a45..98b00747 100644
+index 5cff1a4..98b0074 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1201,6 +1201,7 @@ enum {
@@ -23,10 +23,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 376e5f89..846dc5e3 100644
+index 7567666..19cc8cb 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2932,6 +2932,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -2963,6 +2963,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -52,7 +52,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3014,6 +3033,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3050,6 +3069,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
@@ -62,5 +62,5 @@
  }
  #endif
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index 4bf0dc1..925cc85 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,7 +1,7 @@
-From c213af98be4f1ebe14930ce180a0c33b9180a339 Mon Sep 17 00:00:00 2001
+From 0a2eb27dac0f869ae5a9d6468acc13fb76fdf5f2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1129/1129] mt76: mt7915: add bf backoff limit table support
+Subject: [PATCH 1130/1131] mt76: mt7915: add bf backoff limit table support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -14,10 +14,10 @@
  6 files changed, 203 insertions(+), 37 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index aac70efb..6290156f 100644
+index 05b6dfa..d161264 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -308,7 +308,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -310,7 +310,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	if (!mcs_rates)
  		mcs_rates = 10;
  
@@ -27,7 +27,7 @@
  
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
-@@ -361,6 +362,28 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -363,6 +364,28 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  				     ARRAY_SIZE(dest->ru), val, len,
  				     target_power, txs_delta, &max_power);
  
@@ -57,10 +57,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
 diff --git a/mt76.h b/mt76.h
-index d102333b..01baceaf 100644
+index 9b6e806..c81ece0 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -900,6 +900,14 @@ struct mt76_power_limits {
+@@ -906,6 +906,14 @@ struct mt76_power_limits {
  	s8 ofdm[8];
  	s8 mcs[4][10];
  	s8 ru[7][12];
@@ -76,7 +76,7 @@
  
  struct mt76_ethtool_worker_info {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f1f3f2f3..3ef2148b 100644
+index f1f3f2f..3ef2148 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1024,7 +1024,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -188,10 +188,10 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 785c3c10..4b7ad450 100644
+index cb47ae6..d380811 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3259,7 +3259,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3281,7 +3281,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	int ret;
  	s8 txpower_sku[MT7915_SKU_RATE_NUM];
  
@@ -201,7 +201,7 @@
  	if (ret)
  		return ret;
  
-@@ -3301,51 +3302,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3323,51 +3324,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  {
@@ -260,10 +260,14 @@
 +		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
 +		skb_put_zero(skb, 2);  /* padding */
 +	}
-+
+ 
+-		for (j = 0; j < min_t(u8, mcs_num, len); j++)
+-			req.txpower_sku[idx + j] = la[j];
 +	/* he */
 +	skb_put_data(skb, &la.ru[0], sizeof(la.ru));
-+
+ 
+-		la += mcs_num;
+-		idx += len;
 +	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 +				    MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
 +	if (ret)
@@ -272,16 +276,12 @@
 +	/* only set per-path power table when it's configured */
 +	if (!la.path.ofdm[0])
 +		return 0;
- 
--		for (j = 0; j < min_t(u8, mcs_num, len); j++)
--			req.txpower_sku[idx + j] = la[j];
++
 +	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 +				 sizeof(hdr) + MT7915_SKU_PATH_NUM);
 +	if (!skb)
 +		return -ENOMEM;
- 
--		la += mcs_num;
--		idx += len;
++
 +	hdr.limit_type = TX_POWER_LIMIT_TABLE_PATH;
 +	skb_put_data(skb, &hdr, sizeof(hdr));
 +	skb_put_data(skb, &la.path.cck, sizeof(la.path.cck));
@@ -314,7 +314,7 @@
 -				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
 -				 sizeof(req), true);
 +	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
-+ 				     MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
++				     MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
  }
  
 -int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
@@ -325,7 +325,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3354,10 +3402,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3376,10 +3424,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -337,7 +337,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3367,9 +3414,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3389,9 +3436,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -356,7 +356,7 @@
  
  	dev_kfree_skb(skb);
  
-@@ -3411,9 +3464,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3433,9 +3486,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.band_idx = phy->mt76->band_idx,
  		.sku_enable = enable,
  	};
@@ -371,12 +371,12 @@
  	pr_info("%s: enable = %d\n", __func__, enable);
  
 +	req.format_id = TX_POWER_LIMIT_PATH_ENABLE;
-+ 
++
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 08476eb6..d110e210 100644
+index 025a03b..b33e671 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -446,12 +446,18 @@ enum {
@@ -399,10 +399,10 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2d3769c6..2e6519e7 100644
+index ab81d41..f5ac92e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -73,6 +73,7 @@
+@@ -64,6 +64,7 @@
  #define MT7915_CDEV_THROTTLE_MAX	99
  
  #define MT7915_SKU_RATE_NUM		161
@@ -410,7 +410,7 @@
  
  #define MT7915_MAX_TWT_AGRT		16
  #define MT7915_MAX_STA_TWT_AGRT		8
-@@ -624,7 +625,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+@@ -620,7 +621,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
  int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
@@ -421,5 +421,5 @@
  int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  				 struct ieee80211_vif *vif,
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1131-mt76-mt7915-amsdu-set-and-get-control.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/1131-mt76-mt7915-amsdu-set-and-get-control.patch
index a10e878..af5b7cb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1131-mt76-mt7915-amsdu-set-and-get-control.patch
@@ -1,7 +1,7 @@
-From 0656e6d8dbeec9f83a1f20a0013112b814a0c4f0 Mon Sep 17 00:00:00 2001
+From fab73eabb07885ee8a29bb875c1f0911fd348cf6 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH] [mt76]amsdu set and get control
+Subject: [PATCH 1131/1131] mt76: mt7915: amsdu set and get control
 
 ---
  mt7915/mac.c    | 10 ++++++++++
@@ -11,10 +11,10 @@
  4 files changed, 54 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3bbe757..0ef0fab 100644
+index 9d4cfa1..a0df785 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -2072,6 +2072,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2053,6 +2053,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -32,10 +32,10 @@
  void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0fb1de3..8ee553a 100644
+index f5ac92e..5cc1924 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -820,6 +820,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -746,6 +746,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
  
 -- 
-2.32.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
old mode 100755
new mode 100644
index 74bc9e6..6b63567
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From aa48497ccb0236e8724d8434be06055e31297e93 Mon Sep 17 00:00:00 2001
+From 2b4b610ac1e30c0b20d1882bc9612ca1639cb66b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 3001/3012] mt76: mt7915: wed: add wed tx support
+Subject: [PATCH 3001/3013] mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 8ba883b0..f70987dd 100644
+index 8ba883b..f70987d 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -24,10 +24,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 22dd66e3..5373777a 100644
+index a0df785..0984357 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -889,9 +889,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -891,9 +891,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -39,7 +39,7 @@
  }
  
  static void
-@@ -1007,6 +1007,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1009,6 +1009,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -47,7 +47,7 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1062,12 +1063,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1064,12 +1065,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -65,10 +65,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 94b7a651..370bfad7 100644
+index 09cf35c..2dd78ca 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1512,14 +1512,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1533,14 +1533,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -86,7 +86,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 26881fdc..ac574722 100644
+index c1b421d..04411e7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -11,7 +11,7 @@
@@ -98,7 +98,7 @@
  module_param(wed_enable, bool, 0644);
  MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
  
-@@ -580,7 +580,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -582,7 +582,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  
  	spin_lock_bh(&dev->mt76.token_lock);
@@ -107,7 +107,7 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  
  	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-@@ -790,6 +790,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -792,6 +792,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
@@ -116,5 +116,5 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
old mode 100755
new mode 100644
index b3442f4..d1bbe98
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
@@ -1,7 +1,7 @@
-From 2d158600e7c9b18069111d5935e9dbaf8c9277f3 Mon Sep 17 00:00:00 2001
+From b49d4ef99775b7942b4f56e2f0e4d7c303ce415c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 17:51:26 +0800
-Subject: [PATCH 3002/3012] mt76: mt7915: wed: add wds support when wed is
+Subject: [PATCH 3002/3013] mt76: mt7915: wed: add wds support when wed is
  enabled
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 81 insertions(+), 8 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 01baceaf..7b222e73 100644
+index c81ece0..cba11f6 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -60,6 +60,12 @@ enum mt76_wed_type {
@@ -32,10 +32,10 @@
  	u32 (*rr)(struct mt76_dev *dev, u32 offset);
  	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 370bfad7..75c78b8e 100644
+index 2dd78ca..eef4c3b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -675,8 +675,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -696,8 +696,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -52,7 +52,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1148,6 +1155,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1169,6 +1176,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -66,7 +66,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1519,8 +1533,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1540,8 +1554,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -81,10 +81,10 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 4b7ad450..bdfb71e2 100644
+index d380811..f494d9f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2350,8 +2350,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2364,8 +2364,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -105,7 +105,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d110e210..edb8b510 100644
+index b33e671..f2f88cc 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -284,6 +284,7 @@ enum {
@@ -117,7 +117,7 @@
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 diff --git a/util.c b/util.c
-index 58196442..5cd5ede0 100644
+index 5819644..5cd5ede 100644
 --- a/util.c
 +++ b/util.c
 @@ -42,9 +42,14 @@ bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
@@ -185,7 +185,7 @@
  int mt76_get_min_avg_rssi(struct mt76_dev *dev, bool ext_phy)
  {
 diff --git a/util.h b/util.h
-index 260965dd..99b7263c 100644
+index 260965d..99b7263 100644
 --- a/util.h
 +++ b/util.h
 @@ -27,7 +27,12 @@ enum {
@@ -203,5 +203,5 @@
  static inline void
  mt76_wcid_mask_set(u32 *mask, int idx)
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
old mode 100755
new mode 100644
index 0185209..f5d7847
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,7 +1,7 @@
-From ca14459b70818a138fa83ec38bfc91bce44b645c Mon Sep 17 00:00:00 2001
+From 7ecab7986d569ef1483785fbf52a34dfe78f8ec6 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 12:05:06 +0800
-Subject: [PATCH 3003/3012] mt76: connac: wed: add wed rx copy skb
+Subject: [PATCH 3003/3013] mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,7 +9,7 @@
  1 file changed, 18 insertions(+), 5 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index dc8d8882..53c7528f 100644
+index dc8d888..53c7528 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -386,9 +386,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -66,5 +66,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
old mode 100755
new mode 100644
index 0dc64bc..de8b136
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -1,7 +1,7 @@
-From 9c13748447e65404ad43c95b11479b71557851d8 Mon Sep 17 00:00:00 2001
+From bc37972dcfff183622582c44cb2908b903f9a624 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3012] mt76: mt7915: wed: add fill receive path to report
+Subject: [PATCH 3004/3013] mt76: mt7915: wed: add fill receive path to report
  wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0e08bde6..d8571642 100644
+index eef4c3b..7dd3973 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1544,6 +1544,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1565,6 +1565,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -38,7 +38,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1596,5 +1614,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1617,5 +1635,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
@@ -46,5 +46,5 @@
  #endif
  };
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
old mode 100755
new mode 100644
index 3222bb1..4cba14f
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -1,7 +1,7 @@
-From 5a4e0813aaaf66a658c9907b7834cb61e10ae682 Mon Sep 17 00:00:00 2001
+From e5379ae3f072fa04b43c777ed725bfb1f542142c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:07:46 +0800
-Subject: [PATCH 3005/3012] mt76: mt7915: wed: add ser support when wed on
+Subject: [PATCH 3005/3013] mt76: mt7915: wed: add ser support when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 76 insertions(+), 14 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 53c7528f..35beec72 100644
+index 53c7528..35beec7 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -109,7 +109,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 53c6ce25..4b9bc7f4 100644
+index 53c6ce2..4b9bc7f 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -56,5 +56,6 @@ enum mt76_mcu_evt_type {
@@ -120,10 +120,10 @@
  
  #endif
 diff --git a/mt76.h b/mt76.h
-index 7b222e73..75975cb5 100644
+index cba11f6..369e1e4 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1395,6 +1395,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1401,6 +1401,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,7 +132,7 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index e3fa0649..1ae6c339 100644
+index e3fa064..1ae6c33 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -4,6 +4,7 @@
@@ -211,10 +211,10 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5373777a..d5df73db 100644
+index 0984357..0d0ae7a 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -894,6 +894,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -896,6 +896,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  	return MT_TXD_TXP_BUF_SIZE;
  }
  
@@ -233,7 +233,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1633,6 +1645,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1635,6 +1647,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -247,10 +247,10 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index ac574722..ecc38e05 100644
+index 04411e7..e0761e8 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -617,6 +617,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -619,6 +619,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  		mt76_put_rxwi(&dev->mt76, t);
  	}
  
@@ -259,7 +259,7 @@
  	if (!wed->rx_buf_ring.rx_page.va)
  		return;
  
-@@ -782,6 +784,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -784,6 +786,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.init_rx_buf = mt7915_mmio_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7915_mmio_wed_release_rx_buf;
  	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
@@ -268,10 +268,10 @@
  	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2e6519e7..f9c02912 100644
+index 5cc1924..89c13db 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -559,6 +559,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -554,6 +554,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -280,5 +280,5 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
old mode 100755
new mode 100644
index 58d589d..3f720c6
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -1,7 +1,7 @@
-From 2c9f6ad4b961b736f60003d50b3e145c7b33a79d Mon Sep 17 00:00:00 2001
+From ff22ef4a4d68412999df62ca05c012c05ffdbf81 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3006/3012] mt76: mt7915: wed: enable red per-band token drop
+Subject: [PATCH 3006/3013] mt76: mt7915: wed: enable red per-band token drop
  for HW Path
 
 Limit the number of token used by each band. If a band uses too many token,
@@ -10,16 +10,17 @@
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
- mt7915/mcu.c    | 57 ++++++++++++++++++++++++++++++++++++++++---------
+ mt7915/mcu.c    | 56 ++++++++++++++++++++++++++++++++++++++++---------
  mt7915/mcu.h    |  1 +
- mt7915/mt7915.h |  3 ++-
- 3 files changed, 50 insertions(+), 11 deletions(-)
+ mt7915/mmio.c   |  2 +-
+ mt7915/mt7915.h |  4 +++-
+ 4 files changed, 51 insertions(+), 12 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index bdfb71e2..daa0006b 100644
+index f494d9f..5b2ae77 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2360,8 +2360,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2374,8 +2374,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  						dev->mt76.mmio.wed.rev_id, 0);
  		if (ret)
  			return ret;
@@ -37,7 +38,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2371,12 +2380,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2385,12 +2394,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -51,7 +52,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4508,6 +4512,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4533,6 +4537,34 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -60,7 +61,6 @@
 +static int mt7915_red_set_watermark(struct mt7915_dev *dev)
 +{
 +#define RED_GLOBAL_TOKEN_WATERMARK 2
-+#define TOTAL_HW_TOKEN_SIZE 8192
 +	struct {
 +		__le32 args[3];
 +
@@ -77,8 +77,8 @@
 +		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
 +		.len = cpu_to_le16(sizeof(req) - 12),
 +
-+		.high_mark = cpu_to_le16(TOTAL_HW_TOKEN_SIZE - 256),
-+		.low_mark = cpu_to_le16(TOTAL_HW_TOKEN_SIZE - 256 - 1536),
++		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
++		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
 +	};
 +
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
@@ -87,7 +87,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4518,17 +4551,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4543,17 +4575,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -114,7 +114,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index edb8b510..7963a700 100644
+index f2f88cc..572cc16 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -285,6 +285,7 @@ enum {
@@ -125,11 +125,32 @@
  #ifdef MTK_DEBUG
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index e0761e8..b29fe7a 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -759,7 +759,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
+ 		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
+ 	}
+-	wed->wlan.nbuf = 4096;
++	wed->wlan.nbuf = MT7915_HW_TOKEN_SIZE;
+ 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
+ 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
+ 	wed->wlan.txfree_tbit = is_mt7986(&dev->mt76) ? 2 : 1;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f9c02912..819cec99 100644
+index 89c13db..5b0f1fc 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -771,13 +771,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -56,6 +56,7 @@
+ 
+ #define MT7915_EEPROM_BLOCK_SIZE	16
+ #define MT7915_TOKEN_SIZE		8192
++#define MT7915_HW_TOKEN_SIZE		4096
+ 
+ #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
+ #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
+@@ -771,13 +772,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
@@ -146,5 +167,5 @@
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
old mode 100755
new mode 100644
index 52127c6..2fc10e1
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
@@ -1,7 +1,7 @@
-From f30bc7032eeb4a32393bdec69e719e3a1c9ceeae Mon Sep 17 00:00:00 2001
+From 9611e7a61942a25473151c8bdb0dd27fc173677e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH 3007/3012] mt76: mt7915: wed: update mt7916 trinfo when hw
+Subject: [PATCH 3007/3013] mt76: mt7915: wed: update mt7916 trinfo when hw
  path enable
 
 ---
@@ -10,7 +10,7 @@
  2 files changed, 23 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-index ecdc02ab..0a1ee808 100644
+index ecdc02a..0a1ee80 100644
 --- a/mt7915/mt7915_debug.h
 +++ b/mt7915/mt7915_debug.h
 @@ -133,6 +133,8 @@ enum dbg_reg_rev {
@@ -57,7 +57,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 846dc5e3..3365f3f3 100644
+index 19cc8cb..919cae4 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -856,12 +856,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
@@ -87,5 +87,5 @@
  	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
  	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
old mode 100755
new mode 100644
index 0309f74..9ee6f18
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -1,7 +1,7 @@
-From 82ba992b09e55d1291387351cc9dc0da0c6cb66b Mon Sep 17 00:00:00 2001
+From 973e2baf6322ac8b8d51efb1985b34f14a0c6f7b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 3008/3012] mt76: mt7915: wed: find rx token by physical
+Subject: [PATCH 3008/3013] mt76: mt7915: wed: find rx token by physical
  address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -13,7 +13,7 @@
  1 file changed, 20 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index 35beec72..327ed3bc 100644
+index 35beec7..327ed3b 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -376,10 +376,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -48,5 +48,5 @@
  			return NULL;
  
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
old mode 100755
new mode 100644
index 8d47adc..f1aa262
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -1,7 +1,7 @@
-From 7b8d03a4a4996e29c178a870c29b8ba7bd45c6d6 Mon Sep 17 00:00:00 2001
+From e3b19ec951ae28a023bdd132b0881f3da76b702f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 25 Nov 2022 14:37:58 +0800
-Subject: [PATCH 3009/3012] mt76: mt7915: wed: drop scatter and gather frame
+Subject: [PATCH 3009/3013] mt76: mt7915: wed: drop scatter and gather frame
 
 The scatter and gather frame may be incorrect because WED and WO may
 send frames to host driver interleaved.
@@ -14,7 +14,7 @@
  3 files changed, 11 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index 327ed3bc..0914266a 100644
+index 327ed3b..0914266 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -420,6 +420,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -34,7 +34,7 @@
  	} else {
  		buf = e->buf;
 diff --git a/dma.h b/dma.h
-index 4b9bc7f4..ce8ac426 100644
+index 4b9bc7f..ce8ac42 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -19,6 +19,7 @@
@@ -46,7 +46,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index b107516d..5bdf03f2 100644
+index 369e1e4..b10a16f 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -30,6 +30,7 @@
@@ -58,5 +58,5 @@
  #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
  				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
old mode 100755
new mode 100644
index 56903c1..8ddac8b
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,22 +1,22 @@
-From 40d816ec96c946c37635205f6f4a28795be5ffc0 Mon Sep 17 00:00:00 2001
+From c6cac9182a78e63ce5c768ae3c4f44c333d3660f Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3010/3012] mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 3010/3013] mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
  mt76_connac_mcu.h    |   2 +
  mt7915/debugfs.c     | 405 +++++++++++++++++++++++++++++++++++++++++++
  mt7915/init.c        |  39 +++++
- mt7915/main.c        |  16 ++
+ mt7915/main.c        |  15 ++
  mt7915/mcu.c         | 165 ++++++++++++++++++
  mt7915/mt7915.h      |  68 ++++++++
  mt7915/mtk_debugfs.c | 133 +++++++++++++-
- 7 files changed, 827 insertions(+), 1 deletion(-)
+ 7 files changed, 826 insertions(+), 1 deletion(-)
  mode change 100644 => 100755 mt7915/init.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 98b00747..239643b9 100644
+index 98b0074..239643b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1159,6 +1159,7 @@ enum {
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 3ef2148b..b178036c 100644
+index 3ef2148..b178036 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -468,10 +468,10 @@
 diff --git a/mt7915/init.c b/mt7915/init.c
 old mode 100644
 new mode 100755
-index 3f0a9d93..b9216233
+index e044f50..ef752e1
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -550,10 +550,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -563,10 +563,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  	}
  }
  
@@ -518,7 +518,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -575,6 +611,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -588,6 +624,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		mt7915_mac_init_band(dev, i);
  
  	mt7915_init_led_mux(dev);
@@ -529,29 +529,28 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 31cac5e1..a8e722f1 100644
+index 7dd3973..c87f04b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -199,6 +199,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -209,6 +209,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ 	struct mt7915_dev *dev = phy->dev;
 +	struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
-@@ -268,6 +269,10 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	int idx, ret = 0;
+@@ -270,6 +271,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
-+	if (mt7915_is_atf_default_on(wiphy, dev)) {
++	if (mt7915_is_atf_default_on(wiphy, dev))
 +		mt7915_mcu_set_vow_band(dev, mvif);
-+	}
 +
- out:
- 	mutex_unlock(&dev->mt76.mutex);
+ 	return ret;
+ }
  
-@@ -670,6 +675,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -691,6 +695,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -559,7 +558,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy;
  #endif
-@@ -721,6 +727,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -742,6 +747,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		mt7915_mcu_set_mimo(phy, 0);
  	}
  #endif
@@ -577,10 +576,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index daa0006b..3db8e436 100644
+index 5b2ae77..029d7e3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3511,6 +3511,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3533,6 +3533,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -751,12 +750,12 @@
 +
  int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  {
- 	struct {
+ #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 819cec99..ed293e70 100644
+index 5b0f1fc..30e878f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -130,6 +130,58 @@ struct mt7915_twt_flow {
+@@ -127,6 +127,58 @@ struct mt7915_twt_flow {
  
  DECLARE_EWMA(avg_signal, 10, 8)
  
@@ -815,7 +814,7 @@
  struct mt7915_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -151,6 +203,7 @@ struct mt7915_sta {
+@@ -148,6 +200,7 @@ struct mt7915_sta {
  		u8 flowid_mask;
  		struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
  	} twt;
@@ -823,7 +822,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -465,6 +518,8 @@ struct mt7915_dev {
+@@ -461,6 +514,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -832,7 +831,7 @@
  };
  
  enum {
-@@ -497,6 +552,15 @@ enum mt7915_rdd_cmd {
+@@ -493,6 +548,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -848,7 +847,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -624,6 +688,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -621,6 +685,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -860,7 +859,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 3365f3f3..a8ffefd4 100644
+index 919cae4..c8df2d0 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1301,7 +1301,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
@@ -1011,5 +1010,5 @@
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
old mode 100755
new mode 100644
index fd0f0b6..bc013c7
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
@@ -1,7 +1,7 @@
-From 6a67d8e3c682c1f4332c2a45e0e4214c54605e67 Mon Sep 17 00:00:00 2001
+From cd6fa73880e4e69622f5e4f0ee30b0c3a60cc797 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 2 Dec 2022 17:17:06 +0800
-Subject: [PATCH 3011/3012] mt76: mt7915: wed: add mt7916 2 pcie support when
+Subject: [PATCH 3011/3013] mt76: mt7915: wed: add mt7916 2 pcie support when
  wed on
 
 It should use bit 23 in interrupt mask for wfdma band1 data
@@ -15,7 +15,7 @@
  3 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 1ae6c339..36260085 100644
+index 1ae6c33..3626008 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -88,8 +88,12 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
@@ -34,10 +34,10 @@
  				   MT7916_RXQ_MCU_WA_MAIN);
  			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3db8e436..2a689e92 100644
+index 029d7e3..387967d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2351,7 +2351,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2365,7 +2365,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  		return ret;
  
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
@@ -48,10 +48,10 @@
  						0, 0, 0);
  		else
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index ecc38e05..992beca3 100644
+index b29fe7a..4bc8e8c 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -964,13 +964,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
+@@ -966,13 +966,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
  	struct mt7915_dev *dev = dev_instance;
  	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
  
@@ -71,5 +71,5 @@
  	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
  		return IRQ_NONE;
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
old mode 100755
new mode 100644
index dc594ef..93bf1a4
--- a/recipes-wifi/linux-mt76/files/patches-3.x/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
@@ -1,4 +1,4 @@
-From c326d38bf0da40d6b0ccbd13de2bb267398598d0 Mon Sep 17 00:00:00 2001
+From 3841127f712794f45b9078215feaa8221ed18851 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Wed, 14 Dec 2022 17:19:00 +0800
 Subject: [PATCH 3012/3013] mt76: mt7915: wed: add rxwi for further in chip rro
@@ -16,7 +16,7 @@
  7 files changed, 86 insertions(+), 78 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 0914266a..7ef272e2 100644
+index 0914266..7ef272e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -263,7 +263,7 @@
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
 diff --git a/mac80211.c b/mac80211.c
-index de9ef237..818f4f0c 100644
+index de9ef23..818f4f0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -597,7 +597,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -283,7 +283,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index f1795778..42364b81 100644
+index b10a16f..631c4cc 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -166,6 +166,7 @@ struct mt76_queue_entry {
@@ -322,7 +322,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  
-@@ -805,7 +812,6 @@ struct mt76_dev {
+@@ -809,7 +816,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -330,7 +330,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1394,8 +1400,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1400,8 +1406,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -341,7 +341,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1541,9 +1547,9 @@ struct mt76_txwi_cache *
+@@ -1547,9 +1553,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -354,7 +354,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 36260085..9cbd3625 100644
+index 3626008..9cbd362 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -492,7 +492,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -374,10 +374,10 @@
  
  		/* rx data queue for band1 */
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 992beca3..ba728dd0 100644
+index 4bc8e8c..09b3973 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -603,18 +603,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -605,18 +605,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  	for (i = 0; i < dev->mt76.rx_token_size; i++) {
@@ -403,7 +403,7 @@
  	}
  
  	mt76_free_pending_rxwi(&dev->mt76);
-@@ -639,7 +639,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -641,7 +641,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  				sizeof(struct skb_shared_info));
  
  	for (i = 0; i < size; i++) {
@@ -412,7 +412,7 @@
  		dma_addr_t phy_addr;
  		int token;
  		void *ptr;
-@@ -658,7 +658,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -660,7 +660,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  		}
  
  		desc->buf0 = cpu_to_le32(phy_addr);
@@ -421,7 +421,7 @@
  		if (token < 0) {
  			dma_unmap_single(dev->mt76.dma_dev, phy_addr,
  					 wed->wlan.rx_size, DMA_TO_DEVICE);
-@@ -786,7 +786,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -788,7 +788,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
  	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
  
@@ -430,7 +430,7 @@
  
  	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -992,6 +992,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -994,6 +994,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  				SURVEY_INFO_TIME_RX |
  				SURVEY_INFO_TIME_BSS_RX,
  		.token_size = MT7915_TOKEN_SIZE,
@@ -439,19 +439,19 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ed293e70..6def0596 100644
+index 30e878f..58ed90b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -65,6 +65,7 @@
- 
+@@ -57,6 +57,7 @@
  #define MT7915_EEPROM_BLOCK_SIZE	16
  #define MT7915_TOKEN_SIZE		8192
+ #define MT7915_HW_TOKEN_SIZE		4096
 +#define MT7915_RX_TOKEN_SIZE		4096
  
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index 6d55566f..a72b7779 100644
+index 6d55566..a72b777 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -756,16 +756,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
@@ -496,5 +496,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch b/recipes-wifi/linux-mt76/files/patches-3.x/3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch
new file mode 100644
index 0000000..4399ad0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch
@@ -0,0 +1,86 @@
+From 164ff4c03d6f221bbb8b7dac87be102e1deab87c Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 16 Dec 2022 12:16:40 +0800
+Subject: [PATCH 3013/3013] mt76: mt7915: wed: fix potential memory leakage
+
+release rx queue pages in mt7915_mmio_wed_release_rx_buf.
+recycle rxwi when mt76_dma_add_buf() call fails.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c         | 16 ++++++++++------
+ mt7915/mmio.c | 15 +++++++++++++++
+ 2 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index 7ef272e..0925daf 100644
+--- a/dma.c
++++ b/dma.c
+@@ -633,9 +633,11 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ 		qbuf.len = len - offset;
+ 		qbuf.skip_unmap = false;
+ 		if (mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL, r) < 0) {
++			mt76_put_rxwi(dev, r);
+ 			dma_unmap_single(dev->dma_dev, addr, len,
+ 					 DMA_FROM_DEVICE);
+-			skb_free_frag(buf);
++			if (!skip_alloc)
++				skb_free_frag(buf);
+ 			break;
+ 		}
+ 		frames++;
+@@ -758,12 +760,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ 	} while (1);
+ 	spin_unlock_bh(&q->lock);
+ 
+-	if (!q->rx_page.va)
+-		return;
++	if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) != MT76_WED_Q_RX) {
++		if (!q->rx_page.va)
++			return;
+ 
+-	page = virt_to_page(q->rx_page.va);
+-	__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
+-	memset(&q->rx_page, 0, sizeof(q->rx_page));
++		page = virt_to_page(q->rx_page.va);
++		__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++		memset(&q->rx_page, 0, sizeof(q->rx_page));
++	}
+ }
+ 
+ static void
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 09b3973..419338c 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -621,12 +621,27 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+ 
+ 	mt76_free_pending_rxwi(&dev->mt76);
+ 
++	mt76_for_each_q_rx(&dev->mt76, i) {
++		if (FIELD_GET(MT_QFLAG_WED_TYPE,
++			      dev->mt76.q_rx[i].flags) == MT76_WED_Q_RX) {
++			struct mt76_queue *q = &dev->mt76.q_rx[i];
++
++			if (!q->rx_page.va)
++				continue;
++
++			page = virt_to_page(q->rx_page.va);
++			__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++			memset(&q->rx_page, 0, sizeof(q->rx_page));
++		}
++	}
++
+ 	if (!wed->rx_buf_ring.rx_page.va)
+ 		return;
+ 
+ 	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
+ 	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
+ 	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
++
+ }
+ 
+ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-revert-get_of_mac_addr.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-revert-get_of_mac_addr.patch
index c284213..24765d3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-revert-get_of_mac_addr.patch
@@ -1,17 +1,17 @@
-From 393196a25088287cd0e7d6b96ccaae65d44cd25e Mon Sep 17 00:00:00 2001
+From 244af26d38efede627e99cdc3acdb0f6f15f48fb Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:51:46 +0800
-Subject: [PATCH 4000/4002] mt76: revert get_of_mac_addr
+Subject: [PATCH 4001/4003] mt76: revert get_of_mac_addr
 
 ---
  eeprom.c | 8 +++++++-
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 6290156..306c641 100644
+index d161264..1f29cf9 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -126,9 +126,15 @@ void
+@@ -128,9 +128,15 @@ void
  mt76_eeprom_override(struct mt76_phy *phy)
  {
  	struct mt76_dev *dev = phy->dev;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-include-header-files-for-module-param.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-include-header-files-for-module-param.patch
index 02d22be..12b4622 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/4002-mt76-include-header-files-for-module-param.patch
@@ -1,7 +1,7 @@
-From 651309c679bcab8d573a64c5504aeb6fbdb228fb Mon Sep 17 00:00:00 2001
+From 7d95234bbc996b0fcfb9500a24b600d769f819d4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:38:13 +0800
-Subject: [PATCH 4001/4002] mt76: include header files for module param
+Subject: [PATCH 4002/4003] mt76: include header files for module param
 
 ---
  mcu.c             | 1 +
@@ -35,7 +35,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 291a7c1..5649377 100644
+index 14ce09e..d406013 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -47,7 +47,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1cdb9d4..69f1a0d 100644
+index 387967d..88ce44f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index 1c27c78..fd3b6f2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -4,6 +4,8 @@
     file://0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch \
     file://0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch \
     file://0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch \
+    file://0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch \
+    file://0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
     file://1003-mt76-mt7915-air-monitor-support.patch \
@@ -13,26 +15,27 @@
     file://1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
     file://1008-mt76-mt7915-drop-undefined-action-frame.patch \
     file://1009-mt76-mt7915-add-fw_version-dump.patch \
-    file://1111-mt76-mt7915-rework-testmode-init-registers.patch \
+    file://1111-mt76-testmode-rework-testmode-init-registers.patch \
     file://1112-mt76-testmode-additional-supports.patch \
     file://1113-mt76-testmode-add-pre-cal-support.patch \
     file://1114-mt76-testmode-add-iBF-command-mode-support.patch \
     file://1115-mt76-testmode-add-ZWDFS-test-mode-support.patch \
-    file://1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
-    file://1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch \
-    file://1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
-    file://1120-mt76-mt7915-add-phy-capability-vendor-command.patch \
-    file://1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch \
-    file://1122-mt76-mt7915-implement-bin-file-mode.patch \
-    file://1123-mt76-mt7915-initialize-wcid.patch \
-    file://1124-mt76-mt7915-Add-hemu-dump-support.patch \
-    file://1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
-    file://1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
-    file://1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
-    file://1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
-    file://1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
-    file://1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch \
+    file://1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch \
+    file://1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
+    file://1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
+    file://1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch \
+    file://1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
+    file://1121-mt76-mt7915-add-phy-capability-vendor-command.patch \
+    file://1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch \
+    file://1123-mt76-mt7915-implement-bin-file-mode.patch \
+    file://1124-mt76-mt7915-initialize-wcid.patch \
+    file://1125-mt76-mt7915-Add-hemu-dump-support.patch \
+    file://1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
+    file://1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
+    file://1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
+    file://1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
+    file://1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
+    file://1131-mt76-mt7915-amsdu-set-and-get-control.patch \
     file://3001-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch \
     file://3003-mt76-connac-wed-add-wed-rx-copy-skb.patch \
@@ -45,7 +48,8 @@
     file://3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch \
     file://3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
     file://3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch \
-    file://4000-mt76-revert-get_of_mac_addr.patch \
-    file://4001-mt76-include-header-files-for-module-param.patch \
-    file://4002-mt76-revert-for-backports-5.15-wireless-stack.patch \
+    file://3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch \
+    file://4001-mt76-revert-get_of_mac_addr.patch \
+    file://4002-mt76-include-header-files-for-module-param.patch \
+    file://4003-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
index c4c2b78..c0aa8f7 100644
--- a/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0001-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_throttl.patch
@@ -1,7 +1,7 @@
-From 00cd9ac2311cf4b66ab7c3d6eb3593b52bea1bec Mon Sep 17 00:00:00 2001
+From 8e713a822b50ac009c97a257dde21897400de02d Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 2 Dec 2022 10:16:49 +0800
-Subject: [PATCH 1/4] wifi: mt76: mt7915: call
+Subject: [PATCH 1/6] wifi: mt76: mt7915: call
  mt7915_mcu_set_thermal_throttling() only after init_work
 
 Enable thermal management by default shall not be executed during mcu
@@ -17,7 +17,7 @@
  2 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6fd5c63e..a03d0b3b 100644
+index 6fd5c63..a03d0b3 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -201,8 +201,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
@@ -31,7 +31,7 @@
  
  static void mt7915_led_set_config(struct led_classdev *led_cdev,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0511d6a5..98af032e 100644
+index 0511d6a..98af032 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -57,6 +57,12 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -48,5 +48,5 @@
  					     phy->mt76->band_idx);
  	if (ret)
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
index 618a14e..9e6c27f 100644
--- a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch
@@ -1,7 +1,7 @@
-From 906bad79c7beb43c81a80fdb97898ebb977e527a Mon Sep 17 00:00:00 2001
+From 38da46e9edb3f699df3f57525b445690338857dc Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 5 Dec 2022 14:09:18 +0800
-Subject: [PATCH 2/4] wifi: mt76: mt7915: rework
+Subject: [PATCH 2/6] wifi: mt76: mt7915: rework
  mt7915_mcu_set_thermal_throttling
 
 This patch includes 2 changes:
@@ -22,7 +22,7 @@
  4 files changed, 37 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index a03d0b3b..df3a35d5 100644
+index a03d0b3..df3a35d 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -134,9 +134,6 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,
@@ -36,7 +36,7 @@
  		return 0;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 98af032e..7589af4b 100644
+index 98af032..7589af4 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -60,6 +60,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -52,7 +52,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 35441dcb..7c14a189 100644
+index 35441dc..7c14a18 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3077,6 +3077,29 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy)
@@ -135,7 +135,7 @@
  				 &req, sizeof(req), false);
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6351feba..855779f8 100644
+index 6351feb..855779f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -543,6 +543,7 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy);
@@ -147,5 +147,5 @@
  			   struct ieee80211_sta *sta, struct rate_info *rate);
  int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
index f1c0093..91a258f 100644
--- a/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch
@@ -1,7 +1,7 @@
-From 2cd5969305cc6ba22a1a3ffc45f46758d09bbd1e Mon Sep 17 00:00:00 2001
+From 728ee842b9f9819251e4dd4a2779ee337b003321 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 12 Dec 2022 11:30:37 +0800
-Subject: [PATCH 3/4] wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
+Subject: [PATCH 3/6] wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
 
 Call mt7915_mcu_set_thermal_protect() through
 mt7915_thermal_temp_store() to update firmware trigger/restore temp
@@ -16,7 +16,7 @@
  2 files changed, 19 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index df3a35d5..98655e4d 100644
+index df3a35d..98655e4 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -83,9 +83,23 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev,
@@ -55,7 +55,7 @@
  	return 0;
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 855779f8..e58650bb 100644
+index 855779f..e58650b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -70,6 +70,9 @@
@@ -69,5 +69,5 @@
  struct mt7915_sta;
  struct mt7915_dfs_pulse;
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
index 8f9fa45..2334dd5 100644
--- a/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch
@@ -1,7 +1,7 @@
-From 30bd3547690ec1463b34c726577ae821e92a4390 Mon Sep 17 00:00:00 2001
+From 52c2b1c1b68a4bf886a86a39f9d2a489de0b3914 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 12 Dec 2022 13:18:49 +0800
-Subject: [PATCH 4/4] wifi: mt76: mt7915: add error message in
+Subject: [PATCH 4/6] wifi: mt76: mt7915: add error message in
  mt7915_thermal_set_cur_throttle_state()
 
 Add dev_err so that it is easier to see invalid setting while looking at
@@ -16,7 +16,7 @@
  2 files changed, 9 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 98655e4d..b23a2fb8 100644
+index 98655e4..b23a2fb 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -145,8 +145,11 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,
@@ -61,7 +61,7 @@
  {
  	struct mt7915_phy *phy2;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e58650bb..942d70c5 100644
+index e58650b..942d70c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -72,6 +72,8 @@
@@ -74,5 +74,5 @@
  struct mt7915_vif;
  struct mt7915_sta;
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch
new file mode 100644
index 0000000..2385ac3
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch
@@ -0,0 +1,29 @@
+From d2d8c86a980592caefe1993cbb0a75136de3ec8d Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Thu, 15 Dec 2022 17:15:49 +0800
+Subject: [PATCH 5/6] wifi: mt76: mt7915: set sku initial value to zero
+
+Set sku initial value to prevent mcu get an invalid value before mcu starts
+to run.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/soc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/mt7915/soc.c b/mt7915/soc.c
+index 686c9bb..2ac0a0f 100644
+--- a/mt7915/soc.c
++++ b/mt7915/soc.c
+@@ -883,6 +883,8 @@ static int mt7986_wmac_wm_enable(struct mt7915_dev *dev, bool enable)
+ {
+ 	u32 cur;
+ 
++	mt76_wr(dev, MT_CONNINFRA_SKU_DEC_ADDR, 0);
++
+ 	mt76_rmw_field(dev, MT7986_TOP_WM_RESET,
+ 		       MT7986_TOP_WM_RESET_MASK, enable);
+ 	if (!enable)
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch
new file mode 100644
index 0000000..6a9cebe
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch
@@ -0,0 +1,43 @@
+From e6b4dcb07b02fea725d11d364fabb0f801423edd Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 8 Dec 2022 15:54:19 +0800
+Subject: [PATCH 6/6] wifi: mt76: mt7915: add chip id condition in
+ mt7915_check_eeprom()
+
+When flash mode is enabled, and the eeprom data in the flash is not for
+the current chipset, it'll still be checked valid, and the default
+eeprom bin won't be loaded.
+(e.g., mt7915 NIC inserted with mt7916 eeprom data in the flash.)
+
+Fix this kind of case by adding chip id into consideration in
+mt7915_check_eeprom().
+
+Reported-by: Cheng-Ji Li <cheng-ji.li@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7915/eeprom.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index 24efa28..a796289 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -33,11 +33,14 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+ 	u8 *eeprom = dev->mt76.eeprom.data;
+ 	u16 val = get_unaligned_le16(eeprom);
+ 
++#define CHECK_EEPROM_ERR(match)	(match ? 0 : -EINVAL)
+ 	switch (val) {
+ 	case 0x7915:
++		return CHECK_EEPROM_ERR(is_mt7915(&dev->mt76));
+ 	case 0x7916:
++		return CHECK_EEPROM_ERR(is_mt7916(&dev->mt76));
+ 	case 0x7986:
+-		return 0;
++		return CHECK_EEPROM_ERR(is_mt7986(&dev->mt76));
+ 	default:
+ 		return -EINVAL;
+ 	}
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 18417be..4696cf4 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,7 +1,7 @@
-From 53904fff8723ca80699e95efeb4b3fe9ededafbd Mon Sep 17 00:00:00 2001
+From 896f096e8d6f31674edf48b1523814d81c059291 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1001/1042] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    7 +
@@ -13,10 +13,10 @@
  mt7915/mcu.h          |    4 +
  mt7915/mt7915.h       |   44 +
  mt7915/mt7915_debug.h | 1350 +++++++++++++++++++
- mt7915/mtk_debugfs.c  | 2925 +++++++++++++++++++++++++++++++++++++++++
+ mt7915/mtk_debugfs.c  | 2926 +++++++++++++++++++++++++++++++++++++++++
  mt7915/mtk_mcu.c      |   51 +
  tools/fwlog.c         |   44 +-
- 12 files changed, 4568 insertions(+), 13 deletions(-)
+ 12 files changed, 4569 insertions(+), 13 deletions(-)
  create mode 100644 mt7915/mt7915_debug.h
  create mode 100644 mt7915/mtk_debugfs.c
  create mode 100644 mt7915/mtk_mcu.c
@@ -243,10 +243,10 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0511d6a..b44507f 100644
+index 7589af4..f6edab6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -62,7 +62,11 @@ int mt7915_run(struct ieee80211_hw *hw)
+@@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
  	if (ret)
  		goto out;
  
@@ -259,7 +259,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 35441dc..56e5ea5 100644
+index 7c14a18..644e6a8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -274,7 +274,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3323,6 +3328,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3331,6 +3336,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -283,7 +283,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3760,6 +3767,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3768,6 +3775,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -327,7 +327,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
  	struct {
-@@ -3788,3 +3832,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3796,3 +3840,22 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -366,7 +366,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6351feb..7c129f7 100644
+index 942d70c..afe2ec7 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -377,7 +377,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -367,6 +368,29 @@ struct mt7915_dev {
+@@ -372,6 +373,29 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -407,7 +407,7 @@
  };
  
  enum {
-@@ -644,4 +668,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -650,4 +674,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
@@ -1790,10 +1790,10 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..747a901
+index 0000000..53f98d1
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
-@@ -0,0 +1,2925 @@
+@@ -0,0 +1,2926 @@
 +#include<linux/inet.h>
 +#include "mt7915.h"
 +#include "mt7915_debug.h"
@@ -4177,7 +4177,8 @@
 +
 +	if (txd->txd_2 & MT_TXD2_FIX_RATE) {
 +		/* Fixed BandWidth mode [2:0] */
-+		printk("\t\tbw = %ld\n", FIELD_GET(MT_TXD6_BW, txd->txd_6));
++		printk("\t\tbw = %ld\n",
++		       FIELD_GET(MT_TXD6_BW, txd->txd_6) | (txd->txd_6 & MT_TXD6_FIXED_BW));
 +
 +		/* DYN_BW [3] */
 +		printk("\t\tdyn_bw = %d\n", (txd->txd_6 & MT_TXD6_DYN_BW) ? 1 : 0);
diff --git a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index ed75241..10e5f57 100644
--- a/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,7 +1,7 @@
-From 06233088901511040fafaba99f8e6f85faf63557 Mon Sep 17 00:00:00 2001
+From fb6a20679c1b404d3e06e79f1c83e8014ead7dc4 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
-Subject: [PATCH 1002/1042] mt76: mt7915: csi: implement csi support
+Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -53,10 +53,10 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6fd5c63..79080ae 100644
+index b23a2fb..844a92f 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -645,6 +645,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+@@ -658,6 +658,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
  	/* init wiphy according to mphy and phy */
  	mt7915_init_wiphy(phy);
  
@@ -69,7 +69,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1151,6 +1157,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1164,6 +1170,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -95,7 +95,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1159,6 +1184,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1172,6 +1197,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -106,7 +106,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1171,6 +1200,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1184,6 +1213,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -117,7 +117,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1212,6 +1245,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1224,6 +1257,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -131,7 +131,7 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 56e5ea5..f483d44 100644
+index 644e6a8..788f3fb 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
@@ -157,7 +157,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3767,6 +3776,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3775,6 +3784,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -352,10 +352,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 7c129f7..8bb6d09 100644
+index afe2ec7..53e1315 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -288,6 +288,20 @@ struct mt7915_phy {
+@@ -293,6 +293,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -376,7 +376,7 @@
  };
  
  struct mt7915_dev {
-@@ -668,6 +682,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -674,6 +688,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index 95ba41a..a6203f9 100644
--- a/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,7 +1,7 @@
-From 348d91e6cd920a4728d71711e9279596837b4a85 Mon Sep 17 00:00:00 2001
+From e2209fc24e4bbaf715da173844888195192d2c36 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
-Subject: [PATCH 1003/1042] mt76: mt7915: air monitor support
+Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
 
 ---
  mt76_connac_mcu.h |   2 +
@@ -41,10 +41,10 @@
  		status->flag |= RX_FLAG_8023;
  		mt7915_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b44507f..33db720 100644
+index f6edab6..04f248f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -691,6 +691,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -702,6 +702,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8bb6d09..33ca8e8 100644
+index 53e1315..29082b6 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -244,6 +244,35 @@ struct mt7915_hif {
+@@ -249,6 +249,35 @@ struct mt7915_hif {
  	int irq;
  };
  
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -301,6 +330,8 @@ struct mt7915_phy {
+@@ -306,6 +335,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -686,6 +717,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -692,6 +723,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
diff --git a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 3c804e0..c59c29c 100644
--- a/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,7 +1,7 @@
-From fb6b74ae5596a63325eaa024cf2ca4abdc9ba67e Mon Sep 17 00:00:00 2001
+From 6e393c35dff8447e3f1cb95fa8e17ff573786b83 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
-Subject: [PATCH 1004/1042] mt76: mt7915: add support for muru_onoff via
+Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
  debugfs
 
 ---
@@ -12,10 +12,10 @@
  4 files changed, 48 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 79080ae..172bdcf 100644
+index 844a92f..00ddab7 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -680,6 +680,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -693,6 +693,7 @@ static void mt7915_init_work(struct work_struct *work)
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
  	mt7915_txbf_init(dev);
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f483d44..e0e25a9 100644
+index 788f3fb..ce07eee 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -876,13 +876,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -65,10 +65,10 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 747a901..176937a 100644
+index 53f98d1..2719a8d 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
+@@ -2481,6 +2481,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -107,7 +107,7 @@
  static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -2859,6 +2891,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2860,6 +2892,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch b/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
index 636f0a6..887416d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1005-mt76-mt7915-certification-patches.patch
@@ -1,7 +1,7 @@
-From 0e5f3fbc65dd09924683c8c5e6ba62f60cbd2843 Mon Sep 17 00:00:00 2001
+From d907288c5570f0677e9c968672d428fe27fe1fde Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
-Subject: [PATCH 1005/1042] mt76: mt7915: certification patches
+Subject: [PATCH 1005/1009] mt76: mt7915: certification patches
 
 ---
  mt76_connac_mcu.h    |   1 +
@@ -76,10 +76,10 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 33db720..3d309bc 100644
+index 04f248f..2c4e392 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -667,6 +667,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -678,6 +678,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -89,7 +89,7 @@
  	int ret, idx;
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-@@ -694,7 +697,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -705,7 +708,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #ifdef CONFIG_MTK_VENDOR
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
@@ -109,10 +109,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e0e25a9..4e36910 100644
+index ce07eee..c459258 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3881,6 +3881,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3889,6 +3889,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -820,10 +820,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 33ca8e8..415fe82 100644
+index 29082b6..9fdb80b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -714,6 +714,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -720,6 +720,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -844,10 +844,10 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 176937a..e24b4d7 100644
+index 2719a8d..b03ae39 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+@@ -2487,7 +2487,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
  
         *val = dev->dbg.muru_onoff;
  
@@ -857,7 +857,7 @@
                 !!(dev->dbg.muru_onoff & MUMIMO_UL),
                 !!(dev->dbg.muru_onoff & MUMIMO_DL),
                 !!(dev->dbg.muru_onoff & OFDMA_UL),
-@@ -2499,8 +2500,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+@@ -2500,8 +2501,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
  {
         struct mt7915_dev *dev = data;
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 23681ef..16a6e86 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,7 +1,7 @@
-From 9427ac3e09d513858340177b70927f17cacd709c Mon Sep 17 00:00:00 2001
+From 4a702a59295eac2b9ff96f95d4233d8389af3445 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
-Subject: [PATCH 1006/1042] mt76: mt7915:add support for runtime set in-band
+Subject: [PATCH 1006/1009] mt76: mt7915: add support for runtime set in-band
  discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 4e36910..47dee76 100644
+index c459258..3baed2c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1993,8 +1993,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
diff --git a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 0d0a199..14ba128 100644
--- a/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,7 +1,7 @@
-From 19680b3e37b2fbee253100ff02f6aabf9c8025f6 Mon Sep 17 00:00:00 2001
+From b84df4fe11ae05b26b79293435e18503646a368d Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
-Subject: [PATCH 1007/1042] mt76: mt7915: add mt76 vendor muru onoff command
+Subject: [PATCH 1007/1009] mt76: mt7915: add mt76 vendor muru onoff command
 
 ---
  mt7915/mcu.c    |  7 +++++++
@@ -11,10 +11,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 47dee76..ec306f0 100644
+index 3baed2c..7728e82 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3900,6 +3900,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3908,6 +3908,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
diff --git a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch
index 0f987a7..ca530b8 100644
--- a/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1008-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,7 +1,7 @@
-From fbc8ac0d6765825b5db2917b094c8327a547f1f6 Mon Sep 17 00:00:00 2001
+From 8d4b1752e1a575f0b888c703604b5ea7706b5184 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 1008/1042] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 1008/1009] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
diff --git a/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
index d17456e..8fa4904 100644
--- a/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,7 +1,7 @@
-From 52bdf313f5aa51dc7617fd32ca35267fd6b1a8f6 Mon Sep 17 00:00:00 2001
+From c130c667f1179d03f63f175a3a0eac9208464625 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH 1009/1042] mt76: mt7915: add fw_version dump
+Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
 
 ---
  mt76.h               |  4 ++++
@@ -59,10 +59,10 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e24b4d7..766b278 100644
+index b03ae39..583bc19 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
+@@ -2722,6 +2722,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -85,7 +85,7 @@
  /*usage: <en> <num> <len>
  	en: BIT(16) 0: sw amsdu  1: hw amsdu
  	num: GENMASK(15, 8) range 1-8
-@@ -2954,6 +2970,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2955,6 +2971,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
diff --git a/recipes-wifi/linux-mt76/files/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch
deleted file mode 100644
index 70aac7a..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch
+++ /dev/null
@@ -1,478 +0,0 @@
-From 4f5ff04c48922ddbbffa73965f086b1b0c2a2e68 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1111/1129] mt76: mt7915: rework testmode init registers
-
----
- mac80211.c        |   3 +-
- mt76.h            |   5 ++
- mt76_connac_mcu.h |   1 +
- mt7915/mcu.h      |   1 +
- mt7915/mmio.c     |   2 +
- mt7915/regs.h     |  16 +++++-
- mt7915/testmode.c | 134 +++++++++++++++++++++++++++++++++++-----------
- mt7915/testmode.h |  28 ++++++++++
- testmode.c        |   6 ++-
- testmode.h        |   3 ++
- 10 files changed, 164 insertions(+), 35 deletions(-)
-
-diff --git a/mac80211.c b/mac80211.c
-index 7fe7f68a..19d9efb3 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -775,7 +775,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
- 	}
- 
- #ifdef CONFIG_NL80211_TESTMODE
--	if (phy->test.state == MT76_TM_STATE_RX_FRAMES) {
-+	if (!(phy->test.flag & MT_TM_FW_RX_COUNT) &&
-+	    phy->test.state == MT76_TM_STATE_RX_FRAMES) {
- 		phy->test.rx_stats.packets[q]++;
- 		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
- 			phy->test.rx_stats.fcs_error[q]++;
-diff --git a/mt76.h b/mt76.h
-index beea57d5..4822ffb7 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -637,6 +637,8 @@ struct mt76_testmode_ops {
- 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
- };
- 
-+#define MT_TM_FW_RX_COUNT	BIT(0)
-+
- struct mt76_testmode_data {
- 	enum mt76_testmode_state state;
- 
-@@ -668,6 +670,8 @@ struct mt76_testmode_data {
- 
- 	u8 addr[3][ETH_ALEN];
- 
-+	u8 flag;
-+
- 	u32 tx_pending;
- 	u32 tx_queued;
- 	u16 tx_queued_limit;
-@@ -675,6 +679,7 @@ struct mt76_testmode_data {
- 	struct {
- 		u64 packets[__MT_RXQ_MAX];
- 		u64 fcs_error[__MT_RXQ_MAX];
-+		u64 len_mismatch;
- 	} rx_stats;
- };
- 
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18ae3acb..18d6c669 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1188,6 +1188,7 @@ enum {
- 	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
- 	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
- 	MCU_EXT_CMD_MURU_CTRL = 0x9f,
-+	MCU_EXT_CMD_RX_STAT = 0xa4,
- 	MCU_EXT_CMD_SET_SPR = 0xa8,
- 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
- 	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index eaadd331..2e97db7b 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -9,6 +9,7 @@
- enum {
- 	MCU_ATE_SET_TRX = 0x1,
- 	MCU_ATE_SET_FREQ_OFFSET = 0xa,
-+	MCU_ATE_SET_PHY_COUNT = 0x11,
- 	MCU_ATE_SET_SLOT_TIME = 0x13,
- 	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
- };
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index afa558c9..07de3cbd 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
- };
- 
- static const u32 mt7915_offs[] = {
-+	[TMAC_TCR2]		= 0x05c,
- 	[TMAC_CDTR]		= 0x090,
- 	[TMAC_ODTR]		= 0x094,
- 	[TMAC_ATCR]		= 0x098,
-@@ -192,6 +193,7 @@ static const u32 mt7915_offs[] = {
- };
- 
- static const u32 mt7916_offs[] = {
-+	[TMAC_TCR2]		= 0x004,
- 	[TMAC_CDTR]		= 0x0c8,
- 	[TMAC_ODTR]		= 0x0cc,
- 	[TMAC_ATCR]		= 0x00c,
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index c8e478a5..d6a05f13 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -48,6 +48,7 @@ enum reg_rev {
- };
- 
- enum offs_rev {
-+	TMAC_TCR2,
- 	TMAC_CDTR,
- 	TMAC_ODTR,
- 	TMAC_ATCR,
-@@ -198,6 +199,12 @@ enum offs_rev {
- #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
- #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
- 
-+#define MT_MDP_TOP_DBG_WDT_CTRL			MT_MDP(0x0d0)
-+#define MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK	BIT(7)
-+
-+#define MT_MDP_TOP_DBG_CTRL			MT_MDP(0x0dc)
-+#define MT_MDP_TOP_DBG_CTRL_ENQ_MODE		BIT(30)
-+
- /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
- #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
- #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -206,6 +213,9 @@ enum offs_rev {
- #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
- #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
- 
-+#define MT_TMAC_TCR2(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_TCR2))
-+#define MT_TMAC_TCR2_SCH_DET_DIS	BIT(19)
-+
- #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
-  #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
- #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -485,8 +495,10 @@ enum offs_rev {
- #define MT_AGG_PCR0_VHT_PROT		BIT(13)
- #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
- 
--#define MT_AGG_PCR1_RTS0_NUM_THRES	GENMASK(31, 23)
--#define MT_AGG_PCR1_RTS0_LEN_THRES	GENMASK(19, 0)
-+#define MT_AGG_PCR1_RTS0_NUM_THRES		GENMASK(31, 23)
-+#define MT_AGG_PCR1_RTS0_LEN_THRES		GENMASK(19, 0)
-+#define MT_AGG_PCR1_RTS0_NUM_THRES_MT7916	GENMASK(29, 24)
-+#define MT_AGG_PCR1_RTS0_LEN_THRES_MT7916	GENMASK(22, 0)
- 
- #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
- #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0d76ae31..46939191 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -30,7 +30,7 @@ struct reg_band {
- 		{ _list.band[0] = MT_##_reg(0, _idx);	\
- 		  _list.band[1] = MT_##_reg(1, _idx); }
- 
--#define TM_REG_MAX_ID	17
-+#define TM_REG_MAX_ID	20
- static struct reg_band reg_backup_list[TM_REG_MAX_ID];
- 
- 
-@@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
- 				 sizeof(req), false);
- }
- 
-+static int
-+mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct mt7915_tm_cmd req = {
-+		.testmode_en = 1,
-+		.param_idx = MCU_ATE_SET_PHY_COUNT,
-+		.param.cfg.enable = control,
-+		.param.cfg.band = phy != &dev->phy,
-+	};
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-+				 sizeof(req), false);
-+}
-+
- static int
- mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
- {
-@@ -336,7 +351,7 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
- {
- 	int n_regs = ARRAY_SIZE(reg_backup_list);
- 	struct mt7915_dev *dev = phy->dev;
--	u32 *b = phy->test.reg_backup;
-+	u32 *b = phy->test.reg_backup, val;
- 	u8 band = phy->mt76->band_idx;
- 	int i;
- 
-@@ -349,18 +364,28 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
- 	REG_BAND(reg_backup_list[6], AGG_MRCR);
- 	REG_BAND(reg_backup_list[7], TMAC_TFCR0);
- 	REG_BAND(reg_backup_list[8], TMAC_TCR0);
--	REG_BAND(reg_backup_list[9], AGG_ATCR1);
--	REG_BAND(reg_backup_list[10], AGG_ATCR3);
--	REG_BAND(reg_backup_list[11], TMAC_TRCR0);
--	REG_BAND(reg_backup_list[12], TMAC_ICR0);
--	REG_BAND_IDX(reg_backup_list[13], ARB_DRNGR0, 0);
--	REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 1);
--	REG_BAND(reg_backup_list[15], WF_RFCR);
--	REG_BAND(reg_backup_list[16], WF_RFCR1);
-+	REG_BAND(reg_backup_list[9], TMAC_TCR2);
-+	REG_BAND(reg_backup_list[10], AGG_ATCR1);
-+	REG_BAND(reg_backup_list[11], AGG_ATCR3);
-+	REG_BAND(reg_backup_list[12], TMAC_TRCR0);
-+	REG_BAND(reg_backup_list[13], TMAC_ICR0);
-+	REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 0);
-+	REG_BAND_IDX(reg_backup_list[15], ARB_DRNGR0, 1);
-+	REG_BAND(reg_backup_list[16], WF_RFCR);
-+	REG_BAND(reg_backup_list[17], WF_RFCR1);
-+
-+	if (is_mt7916(&dev->mt76)) {
-+		reg_backup_list[18].band[band] = MT_MDP_TOP_DBG_WDT_CTRL;
-+		reg_backup_list[19].band[band] = MT_MDP_TOP_DBG_CTRL;
-+	}
- 
- 	if (phy->mt76->test.state == MT76_TM_STATE_OFF) {
--		for (i = 0; i < n_regs; i++)
--			mt76_wr(dev, reg_backup_list[i].band[band], b[i]);
-+		for (i = 0; i < n_regs; i++) {
-+			u8 reg = reg_backup_list[i].band[band];
-+
-+			if (reg)
-+				mt76_wr(dev, reg, b[i]);
-+		}
- 		return;
- 	}
- 
-@@ -380,8 +405,13 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
- 		   MT_AGG_PCR0_BW40_PROT | MT_AGG_PCR0_BW80_PROT);
- 	mt76_set(dev, MT_AGG_PCR0(band, 0), MT_AGG_PCR0_PTA_WIN_DIS);
- 
--	mt76_wr(dev, MT_AGG_PCR0(band, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
--		MT_AGG_PCR1_RTS0_LEN_THRES);
-+	if (is_mt7915(&dev->mt76))
-+		val = MT_AGG_PCR1_RTS0_NUM_THRES | MT_AGG_PCR1_RTS0_LEN_THRES;
-+	else
-+		val = MT_AGG_PCR1_RTS0_NUM_THRES_MT7916 |
-+		      MT_AGG_PCR1_RTS0_LEN_THRES_MT7916;
-+
-+	mt76_wr(dev, MT_AGG_PCR0(band, 1), val);
- 
- 	mt76_clear(dev, MT_AGG_MRCR(band), MT_AGG_MRCR_BAR_CNT_LIMIT |
- 		   MT_AGG_MRCR_LAST_RTS_CTS_RN | MT_AGG_MRCR_RTS_FAIL_LIMIT |
-@@ -394,10 +424,19 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
- 
- 	mt76_wr(dev, MT_TMAC_TFCR0(band), 0);
- 	mt76_clear(dev, MT_TMAC_TCR0(band), MT_TMAC_TCR0_TBTT_STOP_CTRL);
-+	mt76_set(dev, MT_TMAC_TCR2(band), MT_TMAC_TCR2_SCH_DET_DIS);
- 
- 	/* config rx filter for testmode rx */
- 	mt76_wr(dev, MT_WF_RFCR(band), 0xcf70a);
- 	mt76_wr(dev, MT_WF_RFCR1(band), 0);
-+
-+	if (is_mt7916(&dev->mt76)) {
-+		/* enable MDP Tx block mode */
-+		mt76_clear(dev, MT_MDP_TOP_DBG_WDT_CTRL,
-+			   MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK);
-+		mt76_clear(dev, MT_MDP_TOP_DBG_CTRL,
-+			   MT_MDP_TOP_DBG_CTRL_ENQ_MODE);
-+	}
- }
- 
- static void
-@@ -417,6 +456,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
- 	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
- 	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
- 
-+	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
-+
- 	if (!en)
- 		mt7915_tm_set_tam_arb(phy, en, 0);
- }
-@@ -479,18 +520,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
- }
- 
-+static int
-+mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
-+{
-+#define CMD_RX_STAT_BAND	0x3
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	struct mt7915_tm_rx_stat_band *rs_band;
-+	struct mt7915_dev *dev = phy->dev;
-+	struct sk_buff *skb;
-+	struct {
-+		u8 format_id;
-+		u8 band;
-+		u8 _rsv[2];
-+	} __packed req = {
-+		.format_id = CMD_RX_STAT_BAND,
-+		.band = phy->mt76->band_idx,
-+	};
-+	int ret;
-+
-+	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(RX_STAT),
-+					&req, sizeof(req), true, &skb);
-+	if (ret)
-+		return ret;
-+
-+	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
-+	/* pr_info("mdrdy_cnt = %d\n", le32_to_cpu(rs_band->mdrdy_cnt)); */
-+	/* pr_info("fcs_err = %d\n", le16_to_cpu(rs_band->fcs_err)); */
-+	/* pr_info("len_mismatch = %d\n", le16_to_cpu(rs_band->len_mismatch)); */
-+	/* pr_info("fcs_ok = %d\n", le16_to_cpu(rs_band->fcs_succ)); */
-+
-+	if (!clear) {
-+		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
-+
-+		td->rx_stats.packets[q] += le32_to_cpu(rs_band->mdrdy_cnt);
-+		td->rx_stats.fcs_error[q] += le16_to_cpu(rs_band->fcs_err);
-+		td->rx_stats.len_mismatch += le16_to_cpu(rs_band->len_mismatch);
-+	}
-+
-+	dev_kfree_skb(skb);
-+
-+	return 0;
-+}
-+
- static void
- mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
- {
- 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
- 
- 	if (en) {
--		struct mt7915_dev *dev = phy->dev;
--
- 		mt7915_tm_update_channel(phy);
- 
- 		/* read-clear */
--		mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
-+		mt7915_tm_get_rx_stats(phy, true);
-+
-+		/* clear fw count */
-+		mt7915_tm_set_phy_count(phy, 0);
-+		mt7915_tm_set_phy_count(phy, 1);
-+
- 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
- 	}
- }
-@@ -721,12 +807,8 @@ static int
- mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
- {
- 	struct mt7915_phy *phy = mphy->priv;
--	struct mt7915_dev *dev = phy->dev;
--	enum mt76_rxq_id q;
- 	void *rx, *rssi;
--	u16 fcs_err;
- 	int i;
--	u32 cnt;
- 
- 	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
- 	if (!rx)
-@@ -770,15 +852,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
- 
- 	nla_nest_end(msg, rx);
- 
--	cnt = mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
--	fcs_err = is_mt7915(&dev->mt76) ? FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK, cnt) :
--		FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK_MT7916, cnt);
--
--	q = phy->mt76->band_idx ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
--	mphy->test.rx_stats.packets[q] += fcs_err;
--	mphy->test.rx_stats.fcs_error[q] += fcs_err;
--
--	return 0;
-+	return mt7915_tm_get_rx_stats(phy, false);
- }
- 
- const struct mt76_testmode_ops mt7915_testmode_ops = {
-diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac30..a1c54c89 100644
---- a/mt7915/testmode.h
-+++ b/mt7915/testmode.h
-@@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
- 	u8 rsv;
- };
- 
-+struct mt7915_tm_cfg {
-+	u8 enable;
-+	u8 band;
-+	u8 _rsv[2];
-+};
-+
- struct mt7915_tm_cmd {
- 	u8 testmode_en;
- 	u8 param_idx;
-@@ -43,6 +49,7 @@ struct mt7915_tm_cmd {
- 		struct mt7915_tm_freq_offset freq;
- 		struct mt7915_tm_slot_time slot;
- 		struct mt7915_tm_clean_txq clean;
-+		struct mt7915_tm_cfg cfg;
- 		u8 test[72];
- 	} param;
- } __packed;
-@@ -102,4 +109,25 @@ enum {
- 	TAM_ARB_OP_MODE_FORCE_SU = 5,
- };
- 
-+struct mt7915_tm_rx_stat_band {
-+	u8 category;
-+
-+	/* mac */
-+	__le16 fcs_err;
-+	__le16 len_mismatch;
-+	__le16 fcs_succ;
-+	__le32 mdrdy_cnt;
-+	/* phy */
-+	__le16 fcs_err_cck;
-+	__le16 fcs_err_ofdm;
-+	__le16 pd_cck;
-+	__le16 pd_ofdm;
-+	__le16 sig_err_cck;
-+	__le16 sfd_err_cck;
-+	__le16 sig_err_ofdm;
-+	__le16 tag_err_ofdm;
-+	__le16 mdrdy_cnt_cck;
-+	__le16 mdrdy_cnt_ofdm;
-+};
-+
- #endif
-diff --git a/testmode.c b/testmode.c
-index 0accc71a..1d0d5d30 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
--	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
--			   &td->tx_antenna_mask, 0, 0xff) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask, 1, 0xff) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
- 			   &td->tx_duty_cycle, 0, 99) ||
-@@ -560,6 +559,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
- 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
- 			      MT76_TM_STATS_ATTR_PAD) ||
- 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
-+			      MT76_TM_STATS_ATTR_PAD) ||
-+	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
-+			      td->rx_stats.len_mismatch,
- 			      MT76_TM_STATS_ATTR_PAD))
- 		return -EMSGSIZE;
- 
-diff --git a/testmode.h b/testmode.h
-index 5e2792d8..89613266 100644
---- a/testmode.h
-+++ b/testmode.h
-@@ -101,6 +101,8 @@ enum mt76_testmode_attr {
-  * @MT76_TM_STATS_ATTR_RX_FCS_ERROR: number of rx packets with FCS error (u64)
-  * @MT76_TM_STATS_ATTR_LAST_RX: information about the last received packet
-  *	see &enum mt76_testmode_rx_attr
-+ * @MT76_TM_STATS_ATTR_RX_LEN_MISMATCH: number of rx packets with length
-+ *	mismatch error (u64)
-  */
- enum mt76_testmode_stats_attr {
- 	MT76_TM_STATS_ATTR_UNSPEC,
-@@ -113,6 +115,7 @@ enum mt76_testmode_stats_attr {
- 	MT76_TM_STATS_ATTR_RX_PACKETS,
- 	MT76_TM_STATS_ATTR_RX_FCS_ERROR,
- 	MT76_TM_STATS_ATTR_LAST_RX,
-+	MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
- 
- 	/* keep last */
- 	NUM_MT76_TM_STATS_ATTRS,
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-rework-testmode-init-registers.patch
similarity index 96%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
copy to recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-rework-testmode-init-registers.patch
index 70aac7a..ac5367e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1111-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1111-mt76-testmode-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 4f5ff04c48922ddbbffa73965f086b1b0c2a2e68 Mon Sep 17 00:00:00 2001
+From f07a42b3a9a2fe75a265b3cc138405f2c2c414d1 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1111/1129] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1111/1131] mt76: testmode: rework testmode init registers
 
 ---
  mac80211.c        |   3 +-
@@ -17,7 +17,7 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 7fe7f68a..19d9efb3 100644
+index 7fe7f68..19d9efb 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -775,7 +775,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -31,7 +31,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index beea57d5..4822ffb7 100644
+index beea57d..4822ffb 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -637,6 +637,8 @@ struct mt76_testmode_ops {
@@ -61,7 +61,7 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18ae3acb..18d6c669 100644
+index 18ae3ac..18d6c66 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1188,6 +1188,7 @@ enum {
@@ -73,7 +73,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index eaadd331..2e97db7b 100644
+index eaadd33..2e97db7 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -85,7 +85,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index afa558c9..07de3cbd 100644
+index afa558c..07de3cb 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
@@ -105,7 +105,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index c8e478a5..d6a05f13 100644
+index c8e478a..d6a05f1 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -48,6 +48,7 @@ enum reg_rev {
@@ -153,7 +153,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0d76ae31..46939191 100644
+index 0d76ae3..4693919 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -378,7 +378,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac30..a1c54c89 100644
+index 5573ac3..a1c54c8 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -429,7 +429,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 0accc71a..1d0d5d30 100644
+index 0accc71..1d0d5d3 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -453,7 +453,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d8..89613266 100644
+index 5e2792d..8961326 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
@@ -474,5 +474,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch
index 6f358d1..224cf40 100644
--- a/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1112-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 54cc888e7dcd2b5855dc7c0a0f7a19a2703b1735 Mon Sep 17 00:00:00 2001
+From 56318cae7730f769586e633fa4495bce15a9c5c9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1112/1129] mt76: testmode: additional supports
+Subject: [PATCH 1112/1131] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -27,7 +27,7 @@
  19 files changed, 1963 insertions(+), 147 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index fc24b353..dc8d8882 100644
+index fc24b35..dc8d888 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -539,8 +539,7 @@ free:
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index 19d9efb3..2e0e011d 100644
+index 19d9efb..2e0e011 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,7 +71,7 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 4822ffb7..58258e19 100644
+index 4822ffb..58258e1 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -635,6 +635,21 @@ struct mt76_testmode_ops {
@@ -233,7 +233,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index cf6ec55f..291a7c12 100644
+index cf6ec55..291a7c1 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
@@ -255,7 +255,7 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18d6c669..a8ce98c9 100644
+index 18d6c66..a8ce98c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -994,6 +994,7 @@ enum {
@@ -275,10 +275,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 172bdcf2..3f0a9d93 100644
+index 00ddab7..e044f50 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -674,7 +674,7 @@ static void mt7915_init_work(struct work_struct *work)
+@@ -687,7 +687,7 @@ static void mt7915_init_work(struct work_struct *work)
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
  				 init_work);
  
@@ -288,7 +288,7 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index fc7b7903..0746e4b3 100644
+index fc7b790..0746e4b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -628,16 +628,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -361,10 +361,10 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3d309bc0..8527b90a 100644
+index 2c4e392..4c3d822 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -227,7 +227,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mvif->phy = phy;
  	mvif->mt76.band_idx = phy->mt76->band_idx;
  
@@ -374,7 +374,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ec306f01..d4336f69 100644
+index 7728e82..85450ea 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -383,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -415,7 +415,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 2e97db7b..4d86c7f1 100644
+index 2e97db7..4d86c7f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -472,7 +472,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 07de3cbd..26881fdc 100644
+index 07de3cb..26881fd 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
@@ -492,10 +492,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 415fe82a..6206c7f5 100644
+index 9fdb80b..4336f20 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -315,6 +315,9 @@ struct mt7915_phy {
+@@ -320,6 +320,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -505,7 +505,7 @@
  	} test;
  #endif
  
-@@ -414,6 +417,14 @@ struct mt7915_dev {
+@@ -419,6 +422,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -520,7 +520,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -585,7 +596,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -590,7 +601,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -529,7 +529,7 @@
  int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -622,6 +633,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -628,6 +639,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -538,7 +538,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index d6a05f13..e8768488 100644
+index d6a05f1..e876848 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -559,7 +559,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 46939191..e0ba088f 100644
+index 4693919..e0ba088 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1898,7 +1898,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c89..01b08e9e 100644
+index a1c54c8..01b08e9 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2213,7 +2213,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1d0d5d30..7a9ed543 100644
+index 1d0d5d3..7a9ed54 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2680,7 +2680,7 @@
  		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
  		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 89613266..57949f2b 100644
+index 8961326..57949f2 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2785,7 +2785,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f69089..6e36ab27 100644
+index e3f6908..6e36ab2 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2911,7 +2911,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 1f309d05..6d55566f 100644
+index 1f309d0..6d55566 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -250,8 +250,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
@@ -2925,5 +2925,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch
index 68bc681..fd6e693 100644
--- a/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1113-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 42421ff7f8ef7bbc45a050c6f7590981862d91bd Mon Sep 17 00:00:00 2001
+From f0f90b38ccb883ab57ea2b0581dc3b2c20e9ffe1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1113/1129] mt76: testmode: add pre-cal support
+Subject: [PATCH 1113/1131] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 0a88048b..cb6ff17a 100644
+index 0a88048..cb6ff17 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,7 +37,7 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 58258e19..89c85709 100644
+index 58258e1..89c8570 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -636,6 +636,7 @@ struct mt76_testmode_ops {
@@ -49,7 +49,7 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a8ce98c9..f42946ec 100644
+index a8ce98c..f42946e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -990,6 +990,7 @@ enum {
@@ -61,7 +61,7 @@
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index f3e56817..88aaa16a 100644
+index f3e5681..88aaa16 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
@@ -114,7 +114,7 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d4336f69..92bae4f7 100644
+index 85450ea..8e3217b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -387,6 +387,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6206c7f5..ed1469d6 100644
+index 4336f20..b6c9fc5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -401,6 +401,10 @@ struct mt7915_dev {
+@@ -406,6 +406,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -634,6 +638,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -640,6 +644,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index e0ba088f..a9e57e4b 100644
+index e0ba088..a9e57e4 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -667,7 +667,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9e..d500987d 100644
+index 01b08e9..d500987 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -735,7 +735,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index 7a9ed543..82b8e983 100644
+index 7a9ed54..82b8e98 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -768,7 +768,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 57949f2b..e2190e72 100644
+index 57949f2..e2190e7 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -824,7 +824,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 6e36ab27..1be1ffd6 100644
+index 6e36ab2..1be1ffd 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
@@ -843,5 +843,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
index c388f49..1323f90 100644
--- a/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 1853a51568f7d4523d623941689df571fd9aeee1 Mon Sep 17 00:00:00 2001
+From af09d1fafb170c7b5eefc20bf9c5349bccd51fcb Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1114/1129] mt76: testmode: add iBF command mode support
+Subject: [PATCH 1114/1131] mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index a9e57e4b..99582d9c 100644
+index a9e57e4..99582d9 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -105,7 +105,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index 82b8e983..aa874a83 100644
+index 82b8e98..aa874a8 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -530,6 +530,42 @@ out:
@@ -164,7 +164,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index e2190e72..5d1fe793 100644
+index e2190e7..5d1fe79 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
@@ -179,7 +179,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 1be1ffd6..47fc69f9 100644
+index 1be1ffd..47fc69f 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
@@ -239,5 +239,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 8c03a50..afda4a7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From e57d8aba69628acfc9ed8ba2d5c67f5faaa31d4e Mon Sep 17 00:00:00 2001
+From 494d1623eb89553db1ed58fa6b8966a29ca96e3c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1115/1129] mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1115/1131] mt76: testmode: add ZWDFS test mode support
 
 Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -19,7 +19,7 @@
  10 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 89c85709..2bacc1b4 100644
+index 89c8570..2bacc1b 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -719,6 +719,15 @@ struct mt76_testmode_data {
@@ -39,7 +39,7 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f42946ec..7853e074 100644
+index f42946e..7853e07 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1190,6 +1190,7 @@ enum {
@@ -59,7 +59,7 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 92bae4f7..87d2c0de 100644
+index 8e3217b..b8243e1 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2636,6 +2636,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
@@ -70,7 +70,7 @@
  		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4466,3 +4467,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4474,3 +4475,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -140,7 +140,7 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 4d86c7f1..9a485249 100644
+index 4d86c7f..9a48524 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -628,6 +628,52 @@ struct csi_data {
@@ -197,10 +197,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ed1469d6..26bcb4e5 100644
+index b6c9fc5..d845206 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -303,6 +303,7 @@ struct mt7915_phy {
+@@ -308,6 +308,7 @@ struct mt7915_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -208,7 +208,7 @@
  
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
-@@ -752,6 +753,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -758,6 +759,9 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
  
@@ -219,7 +219,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e8768488..f4b57099 100644
+index e876848..f4b5709 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -1194,6 +1194,8 @@ enum offs_rev {
@@ -232,7 +232,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 99582d9c..2ae6c07f 100644
+index 99582d9..2ae6c07 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -503,7 +503,7 @@
  
  static int
 diff --git a/testmode.c b/testmode.c
-index aa874a83..b19b872a 100644
+index aa874a8..b19b872 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -24,6 +24,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -567,7 +567,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index 5d1fe793..27a00953 100644
+index 5d1fe79..27a0095 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -63,6 +63,20 @@
@@ -635,7 +635,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index 47fc69f9..6f07eed0 100644
+index 47fc69f..6f07eed 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -46,6 +46,14 @@ static const char * const testmode_txbf_act[] = {
@@ -682,5 +682,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
deleted file mode 100644
index c49d31d..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From a0e8ed2e87607c70f76eed181a921ba9cf7d66c0 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1116/1129] mt76: mt7915: init rssi in WTBL when add station
-
----
- mt7915/main.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 8527b90a..0396031c 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -671,6 +671,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7915_phy *phy;
- #endif
- 	int ret, idx;
-+	u32 addr;
- 
- 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
- 	if (idx < 0)
-@@ -694,6 +695,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	if (ret)
- 		return ret;
- 
-+	addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 30);
-+	mt76_rmw_field(dev, addr, GENMASK(7, 0), 0xa0);
-+
- #ifdef CONFIG_MTK_VENDOR
- 	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
- #endif
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch b/recipes-wifi/linux-mt76/files/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
new file mode 100644
index 0000000..0ada55c
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
@@ -0,0 +1,1909 @@
+From f6c9069fc14f2c0749a8a55fbb55ad020f16838c Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 15 Dec 2022 19:45:18 +0800
+Subject: [PATCH 1116/1131] mt76: testmode: add iBF/eBF cal and cert commands
+ with golden
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt76.h               |   4 +
+ mt76_connac_mcu.c    |   3 +
+ mt7915/mac.c         |   4 +-
+ mt7915/main.c        |  54 ++---
+ mt7915/mcu.c         |  29 ++-
+ mt7915/mcu.h         | 172 ++++++++++++++++
+ mt7915/mmio.c        |   2 +
+ mt7915/mt7915.h      |  14 +-
+ mt7915/mtk_debugfs.c |  35 ++++
+ mt7915/mtk_mcu.c     | 246 ++++++++++++++++++++++-
+ mt7915/regs.h        |   4 +
+ mt7915/testmode.c    | 458 ++++++++++++++++++++++++++++---------------
+ mt7915/testmode.h    | 134 +------------
+ testmode.c           |   1 +
+ testmode.h           |   9 +
+ tools/fields.c       |   9 +
+ 16 files changed, 855 insertions(+), 323 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index 2bacc1b..c6aefbf 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -681,6 +681,7 @@ struct mt76_testmode_data {
+ 
+ 	struct list_head tm_entry_list;
+ 	struct mt76_wcid *cur_entry;
++	struct ieee80211_vif *second_vif;
+ 	u8 entry_num;
+ 	union {
+ 		struct mt76_testmode_entry_data ed;
+@@ -709,6 +710,9 @@ struct mt76_testmode_data {
+ 
+ 	u8 txbf_act;
+ 	u16 txbf_param[8];
++	bool is_txbf_dut;
++	bool bf_en;
++	bool ebf;
+ 
+ 	u32 tx_pending;
+ 	u32 tx_queued;
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 291a7c1..14ce09e 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -2756,6 +2756,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
+ 	struct bss_info_basic *bss;
+ 	struct tlv *tlv;
++	struct mt76_testmode_data *td = &phy->test;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
+ 	bss = (struct bss_info_basic *)tlv;
+@@ -2815,6 +2816,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 		bss->dtim_period = vif->bss_conf.dtim_period;
+ 		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
+ 							 chandef->chan->band, NULL);
++	} else if (td->bf_en) {
++		memcpy(bss->bssid, vif->addr, ETH_ALEN);
+ 	} else {
+ 		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
+ 	}
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 0746e4b..013dfbd 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -753,8 +753,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ 		val |= MT_TXD6_LDPC;
+ 
+ 	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
+-	if (phy->test.bf_en)
++	if (td->bf_en && !td->ebf)
+ 		val |= MT_TXD6_TX_IBF | MT_TXD6_TX_EBF;
++	else if (td->bf_en && td->ebf)
++		val |= MT_TXD6_TX_EBF;
+ 
+ 	txwi[6] |= cpu_to_le32(val);
+ #endif
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 4c3d822..a347e77 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
+ 	}
+ }
+ 
+-static int mt7915_add_interface(struct ieee80211_hw *hw,
+-				struct ieee80211_vif *vif)
++int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en)
+ {
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+-	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+-	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct mt7915_dev *dev = phy->dev;
+ 	struct mt76_txq *mtxq;
+ 	bool ext_phy = phy != &dev->phy;
+ 	int idx, ret = 0;
+ 
+-	mutex_lock(&dev->mt76.mutex);
+-
+-	mt76_testmode_reset(phy->mt76, true);
+-
+-	if (vif->type == NL80211_IFTYPE_MONITOR &&
+-	    is_zero_ether_addr(vif->addr))
+-		phy->monitor_vif = vif;
++	/* To differentiate the mac address of TXD and TXCMD interface */
++	vif->addr[0] |= bf_en;
+ 
+ 	mvif->mt76.idx = __ffs64(~dev->mt76.vif_mask);
+-	if (mvif->mt76.idx >= (MT7915_MAX_INTERFACES << dev->dbdc_support)) {
+-		ret = -ENOSPC;
+-		goto out;
+-	}
++	if (mvif->mt76.idx >= (MT7915_MAX_INTERFACES << dev->dbdc_support))
++		return -ENOSPC;
+ 
+ 	idx = get_omac_idx(vif->type, phy->omac_mask);
+-	if (idx < 0) {
+-		ret = -ENOSPC;
+-		goto out;
+-	}
++	if (idx < 0)
++		return -ENOSPC;
++
+ 	mvif->mt76.omac_idx = idx;
+ 	mvif->phy = phy;
+ 	mvif->mt76.band_idx = phy->mt76->band_idx;
+ 
+-	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP && vif->type != NL80211_IFTYPE_MONITOR);
++	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP &&
++			      vif->type != NL80211_IFTYPE_MONITOR) || bf_en;
+ 	if (ext_phy)
+ 		mvif->mt76.wmm_idx += 2;
+ 
+ 	ret = mt7915_mcu_add_dev_info(phy, vif, true);
+ 	if (ret)
+-		goto out;
++		return ret;
+ 
+ 	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
+ 	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
+@@ -279,7 +270,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	mt7915_mcu_add_sta(dev, vif, NULL, true);
+ 	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
+ 
+-out:
++	return ret;
++}
++
++static int mt7915_add_interface(struct ieee80211_hw *hw,
++				struct ieee80211_vif *vif)
++{
++	struct mt7915_dev *dev = mt7915_hw_dev(hw);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	int ret = 0;
++
++	mutex_lock(&dev->mt76.mutex);
++
++	mt76_testmode_reset(phy->mt76, true);
++
++	if (vif->type == NL80211_IFTYPE_MONITOR &&
++	    is_zero_ether_addr(vif->addr))
++		phy->monitor_vif = vif;
++
++	ret = mt7915_init_vif(phy, vif, false);
++
+ 	mutex_unlock(&dev->mt76.mutex);
+ 
+ 	return ret;
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index b8243e1..5d41ebf 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -193,6 +193,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 	int ret;
+ 
+ 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
++
+ 	if (ret)
+ 		return ret;
+ 
+@@ -383,10 +384,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	case MCU_EXT_EVENT_BCC_NOTIFY:
+ 		mt7915_mcu_rx_bcc_notify(dev, skb);
+ 		break;
+-#ifdef CONFIG_NL80211_TESTMODE
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
+ 	case MCU_EXT_EVENT_BF_STATUS_READ:
+-		mt7915_tm_txbf_status_read(dev, skb);
++		mt7915_mcu_txbf_status_read(dev, skb);
+ 		break;
++#endif
++#ifdef CONFIG_NL80211_TESTMODE
+ 	case MCU_EXT_EVENT_RF_TEST:
+ 		mt7915_tm_rf_test_event(dev, skb);
+ 		break;
+@@ -673,11 +676,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
+ 	if (enable)
+ 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
+ 
+-	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
+-				      mvif->sta.wcid.idx, enable);
++	if (vif->type == NL80211_IFTYPE_MONITOR) {
++		struct mt76_testmode_data *td = &phy->mt76->test;
++		struct mt76_wcid *wcid;
++
++		if (!td->aid || list_empty(&td->tm_entry_list))
++			wcid = &mvif->sta.wcid;
++		else
++			wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
+ 
+-	if (vif->type == NL80211_IFTYPE_MONITOR)
++		mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
++					      wcid->idx, enable);
+ 		goto out;
++	}
++
++	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
++				      mvif->sta.wcid.idx, enable);
+ 
+ 	if (enable) {
+ 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
+@@ -3403,6 +3417,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+ 
+ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+ {
++#define MT_BF_PROCESSING	4
+ 	struct {
+ 		u8 action;
+ 		union {
+@@ -3429,7 +3444,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+ 		.action = action,
+ 	};
+ 
+-#define MT_BF_PROCESSING	4
+ 	switch (action) {
+ 	case MT_BF_SOUNDING_ON:
+ 		req.snd.snd_mode = MT_BF_PROCESSING;
+@@ -4347,6 +4361,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
+ 		req.he_opt = v2;
+ 		req.glo_opt = v3;
+ 		break;
++	case BF_SND_CFG_INF:
++		req.inf = v1;
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 9a48524..a30f52d 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -475,10 +475,12 @@ enum {
+ };
+ 
+ enum {
++	MT_BF_SOUNDING_OFF = 0,
+ 	MT_BF_SOUNDING_ON = 1,
+ 	MT_BF_DATA_PACKET_APPLY = 2,
+ 	MT_BF_PFMU_TAG_READ = 5,
+ 	MT_BF_PFMU_TAG_WRITE = 6,
++	MT_BF_STA_REC_READ = 13,
+ 	MT_BF_PHASE_CAL = 14,
+ 	MT_BF_IBF_PHASE_COMP = 15,
+ 	MT_BF_PROFILE_WRITE_ALL = 17,
+@@ -486,6 +488,176 @@ enum {
+ 	MT_BF_MODULE_UPDATE = 25
+ };
+ 
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
++struct mt7915_pfmu_tag1 {
++	__le32 pfmu_idx:10;
++	__le32 ebf:1;
++	__le32 data_bw:2;
++	__le32 lm:2;
++	__le32 is_mu:1;
++	__le32 nr:3, nc:3;
++	__le32 codebook:2;
++	__le32 ngroup:2;
++	__le32 _rsv:2;
++	__le32 invalid_prof:1;
++	__le32 rmsd:3;
++
++	__le32 col_id1:6, row_id1:10;
++	__le32 col_id2:6, row_id2:10;
++	__le32 col_id3:6, row_id3:10;
++	__le32 col_id4:6, row_id4:10;
++
++	__le32 ru_start_id:7;
++	__le32 _rsv1:1;
++	__le32 ru_end_id:7;
++	__le32 _rsv2:1;
++	__le32 mob_cal_en:1;
++	__le32 _rsv3:15;
++
++	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
++	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
++
++	__le32 _rsv4;
++} __packed;
++
++struct mt7915_pfmu_tag2 {
++	__le32 smart_ant:24;
++	__le32 se_idx:5;
++	__le32 _rsv:3;
++
++	__le32 _rsv1:8;
++	__le32 rmsd_thres:3;
++	__le32 _rsv2:5;
++	__le32 ibf_timeout:8;
++	__le32 _rsv3:8;
++
++	__le32 _rsv4:16;
++	__le32 ibf_data_bw:2;
++	__le32 ibf_nc:3;
++	__le32 ibf_nr:3;
++	__le32 ibf_ru:8;
++
++	__le32 mob_delta_t:8;
++	__le32 mob_lq_result:7;
++	__le32 _rsv5:1;
++	__le32 _rsv6:16;
++
++	__le32 _rsv7;
++} __packed;
++
++struct mt7915_pfmu_tag {
++	struct mt7915_pfmu_tag1 t1;
++	struct mt7915_pfmu_tag2 t2;
++};
++
++struct mt7915_bf_status_hdr {
++	u8 format_id;
++	u8 bw;
++	u16 subcarrier_idx;
++	bool bfer;
++	u8 rsv[3];
++} __packed;
++
++struct mt7915_bf_status {
++	struct mt7915_bf_status_hdr hdr;
++	u8 buf[1000];
++} __packed;
++
++struct mt7915_txbf_phase_out {
++	u8 c0_l;
++	u8 c1_l;
++	u8 c2_l;
++	u8 c3_l;
++	u8 c0_m;
++	u8 c1_m;
++	u8 c2_m;
++	u8 c3_m;
++	u8 c0_h;
++	u8 c1_h;
++	u8 c2_h;
++	u8 c3_h;
++	u8 c0_uh;
++	u8 c1_uh;
++	u8 c2_uh;
++	u8 c3_uh;
++};
++
++struct mt7915_txbf_phase {
++	u8 status;
++	struct {
++		u8 r0_uh;
++		u8 r0_h;
++		u8 r0_m;
++		u8 r0_l;
++		u8 r0_ul;
++		u8 r1_uh;
++		u8 r1_h;
++		u8 r1_m;
++		u8 r1_l;
++		u8 r1_ul;
++		u8 r2_uh;
++		u8 r2_h;
++		u8 r2_m;
++		u8 r2_l;
++		u8 r2_ul;
++		u8 r3_uh;
++		u8 r3_h;
++		u8 r3_m;
++		u8 r3_l;
++		u8 r3_ul;
++		u8 r2_uh_sx2;
++		u8 r2_h_sx2;
++		u8 r2_m_sx2;
++		u8 r2_l_sx2;
++		u8 r2_ul_sx2;
++		u8 r3_uh_sx2;
++		u8 r3_h_sx2;
++		u8 r3_m_sx2;
++		u8 r3_l_sx2;
++		u8 r3_ul_sx2;
++		u8 m_t0_h;
++		u8 m_t1_h;
++		u8 m_t2_h;
++		u8 m_t2_h_sx2;
++		u8 r0_reserved;
++		u8 r1_reserved;
++		u8 r2_reserved;
++		u8 r3_reserved;
++		u8 r2_sx2_reserved;
++		u8 r3_sx2_reserved;
++	} phase;
++};
++
++struct mt7915_pfmu_data {
++	__le16 subc_idx;
++	__le16 phi11;
++	__le16 phi21;
++	__le16 phi31;
++};
++
++struct mt7915_ibf_cal_info {
++	u8 format_id;
++	u8 group_l_m_n;
++	u8 group;
++	bool sx2;
++	u8 status;
++	u8 cal_type;
++	u8 _rsv[2];
++	u8 buf[1000];
++} __packed;
++
++enum {
++	IBF_PHASE_CAL_UNSPEC,
++	IBF_PHASE_CAL_NORMAL,
++	IBF_PHASE_CAL_VERIFY,
++	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
++	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
++};
++
++#define MT7915_TXBF_SUBCAR_NUM	64
++
++#endif
++
+ enum {
+ 	MURU_SET_ARB_OP_MODE = 14,
+ 	MURU_SET_PLATFORM_TYPE = 25,
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 26881fd..c1b421d 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -131,6 +131,7 @@ static const u32 mt7915_offs[] = {
+ 	[MDP_BNRCFR1]		= 0x074,
+ 	[ARB_DRNGR0]		= 0x194,
+ 	[ARB_SCR]		= 0x080,
++	[ARB_TQSAXM0]		= 0x030,
+ 	[RMAC_MIB_AIRTIME14]	= 0x3b8,
+ 	[AGG_AALCR0]		= 0x048,
+ 	[AGG_AWSCR0]		= 0x05c,
+@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
+ 	[MDP_BNRCFR1]		= 0x094,
+ 	[ARB_DRNGR0]		= 0x1e0,
+ 	[ARB_SCR]		= 0x000,
++	[ARB_TQSAXM0]		= 0x180,
+ 	[RMAC_MIB_AIRTIME14]	= 0x0398,
+ 	[AGG_AALCR0]		= 0x028,
+ 	[AGG_AWSCR0]		= 0x030,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index d845206..ab1efe6 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -322,7 +322,6 @@ struct mt7915_phy {
+ 
+ 		u8 spe_idx;
+ 
+-		bool bf_en;
+ 		bool bf_ever_en;
+ 	} test;
+ #endif
+@@ -427,7 +426,7 @@ struct mt7915_dev {
+ 	void __iomem *dcm;
+ 	void __iomem *sku;
+ 
+-#ifdef CONFIG_NL80211_TESTMODE
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
+ 	struct {
+ 		void *txbf_phase_cal;
+ 		void *txbf_pfmu_data;
+@@ -566,6 +565,7 @@ void mt7915_dma_prefetch(struct mt7915_dev *dev);
+ void mt7915_dma_cleanup(struct mt7915_dev *dev);
+ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+ int mt7915_txbf_init(struct mt7915_dev *dev);
++int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en);
+ void mt7915_init_txpower(struct mt7915_dev *dev,
+ 			 struct ieee80211_supported_band *sband);
+ void mt7915_reset(struct mt7915_dev *dev);
+@@ -644,8 +644,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_exit(struct mt7915_dev *dev);
+-int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
++
++#ifdef CONFIG_NL80211_TESTMODE
+ void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
++#endif
+ 
+ static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
+ {
+@@ -782,4 +784,10 @@ enum {
+ 
+ #endif
+ 
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
++int mt7915_mcu_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
++int mt7915_mcu_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx, bool bfer);
++int mt7915_mcu_txbf_sta_rec_read(struct mt7915_dev *dev, u16 wlan_idx);
++#endif
++
+ #endif
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 583bc19..a2ceb6f 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2831,6 +2831,36 @@ mt7915_txpower_level_set(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
+ 			 mt7915_txpower_level_set, "%lld\n");
+ 
++static int
++mt7915_txbf_pfmu_tag_read(void *data, u64 val)
++{
++	struct mt7915_phy *phy = data;
++	u8 pfmu_idx = (u8)val;
++
++	pr_info("%s: %d pfmu_tag cmd sent out ---\n", __func__, __LINE__);
++	mt7915_mcu_txbf_profile_tag_read(phy, pfmu_idx, true);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txbf_pfmu_tag_idx, NULL,
++			 mt7915_txbf_pfmu_tag_read, "%llx\n");
++
++static int
++mt7915_txbf_sta_rec_read(void *data, u64 val)
++{
++	struct mt7915_dev *dev = data;
++	u16 wlan_idx = (u16)val;
++
++	pr_info("%s: %d sta_rec cmd sent out ---\n", __func__, __LINE__);
++	mt7915_mcu_txbf_sta_rec_read(dev, wlan_idx);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txbf_sta_rec, NULL,
++			 mt7915_txbf_sta_rec_read, "%llx\n");
++
+ /* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
+ static int
+ mt7915_wa_set(void *data, u64 val)
+@@ -2969,6 +2999,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ 	debugfs_create_file("txpower_level", 0400, dir, dev,
+ 			    &fops_txpower_level);
+ 
++	debugfs_create_file("txbf_pfmu_tag_idx", 0600, dir, phy,
++			    &fops_txbf_pfmu_tag_idx);
++	debugfs_create_file("txbf_sta_rec", 0600, dir, dev,
++			    &fops_txbf_sta_rec);
++
+ 	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
+ 
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
+diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
+index 143dae2..906c872 100644
+--- a/mt7915/mtk_mcu.c
++++ b/mt7915/mtk_mcu.c
+@@ -1,9 +1,10 @@
+ #include <linux/firmware.h>
+ #include <linux/fs.h>
+-#include<linux/inet.h>
++#include <linux/inet.h>
+ #include "mt7915.h"
+ #include "mcu.h"
+ #include "mac.h"
++#include "testmode.h"
+ 
+ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
+ {
+@@ -49,3 +50,246 @@ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
+ 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
+ 				 sizeof(req), true);
+ }
++
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
++static void mt7915_txbf_dump_pfmu_tag(struct mt7915_dev *dev, struct mt7915_pfmu_tag *tag)
++{
++	u32 *raw_t1 = (u32 *)&tag->t1;
++	u32 *raw_t2 = (u32 *)&tag->t2;
++
++	dev_info(dev->mt76.dev, "=================== TXBf Profile Tag1 Info ==================\n");
++	dev_info(dev->mt76.dev,
++		 "DW0 = 0x%08x, DW1 = 0x%08x, DW2 = 0x%08x\n",
++		 raw_t1[0], raw_t1[1], raw_t1[2]);
++	dev_info(dev->mt76.dev,
++		 "DW4 = 0x%08x, DW5 = 0x%08x, DW6 = 0x%08x\n\n",
++		 raw_t1[3], raw_t1[4], raw_t1[5]);
++	dev_info(dev->mt76.dev, "PFMU ID = %d              Invalid status = %d\n",
++		 tag->t1.pfmu_idx, tag->t1.invalid_prof);
++	dev_info(dev->mt76.dev, "iBf/eBf = %d\n\n", tag->t1.ebf);
++	dev_info(dev->mt76.dev, "DBW   = %d\n", tag->t1.data_bw);
++	dev_info(dev->mt76.dev, "SU/MU = %d\n", tag->t1.is_mu);
++	dev_info(dev->mt76.dev, "RMSD  = %d\n", tag->t1.rmsd);
++	dev_info(dev->mt76.dev,
++		 "nrow = %d, ncol = %d, ng = %d, LM = %d, CodeBook = %d MobCalEn = %d\n",
++		 tag->t1.nr, tag->t1.nc, tag->t1.ngroup, tag->t1.lm, tag->t1.codebook,
++		 tag->t1.mob_cal_en);
++	dev_info(dev->mt76.dev, "RU start = %d, RU end = %d\n",
++		 tag->t1.ru_start_id, tag->t1.ru_end_id);
++	dev_info(dev->mt76.dev, "Mem Col1 = %d, Mem Row1 = %d, Mem Col2 = %d, Mem Row2 = %d\n",
++		 tag->t1.col_id1, tag->t1.row_id1, tag->t1.col_id2, tag->t1.row_id2);
++	dev_info(dev->mt76.dev, "Mem Col3 = %d, Mem Row3 = %d, Mem Col4 = %d, Mem Row4 = %d\n\n",
++		 tag->t1.col_id3, tag->t1.row_id3, tag->t1.col_id4, tag->t1.row_id4);
++	dev_info(dev->mt76.dev,
++		 "STS0_SNR = 0x%02x, STS1_SNR = 0x%02x, STS2_SNR = 0x%02x, STS3_SNR = 0x%02x\n",
++		 tag->t1.snr_sts0, tag->t1.snr_sts1, tag->t1.snr_sts2, tag->t1.snr_sts3);
++	dev_info(dev->mt76.dev,
++		 "STS4_SNR = 0x%02x, STS5_SNR = 0x%02x, STS6_SNR = 0x%02x, STS7_SNR = 0x%02x\n",
++		 tag->t1.snr_sts4, tag->t1.snr_sts5, tag->t1.snr_sts6, tag->t1.snr_sts7);
++	dev_info(dev->mt76.dev, "=============================================================\n");
++
++	dev_info(dev->mt76.dev, "=================== TXBf Profile Tag2 Info ==================\n");
++	dev_info(dev->mt76.dev,
++		 "DW0 = 0x%08x, DW1 = 0x%08x, DW2 = 0x%08x\n",
++		 raw_t2[0], raw_t2[1], raw_t2[2]);
++	dev_info(dev->mt76.dev,
++		 "DW3 = 0x%08x, DW4 = 0x%08x, DW5 = 0x%08x\n\n",
++		 raw_t2[3], raw_t2[4], raw_t2[5]);
++	dev_info(dev->mt76.dev, "Smart antenna ID = 0x%x,  SE index = %d\n",
++		 tag->t2.smart_ant, tag->t2.se_idx);
++	dev_info(dev->mt76.dev, "RMSD threshold = %d\n", tag->t2.rmsd_thres);
++	dev_info(dev->mt76.dev, "Timeout = 0x%x\n", tag->t2.ibf_timeout);
++	dev_info(dev->mt76.dev, "Desired BW = %d, Desired Ncol = %d, Desired Nrow = %d\n",
++		 tag->t2.ibf_data_bw, tag->t2.ibf_nc, tag->t2.ibf_nr);
++	dev_info(dev->mt76.dev, "Desired RU Allocation = %d\n", tag->t2.ibf_ru);
++	dev_info(dev->mt76.dev, "Mobility DeltaT = %d, Mobility LQ = %d\n",
++		 tag->t2.mob_delta_t, tag->t2.mob_lq_result);
++	dev_info(dev->mt76.dev, "=============================================================\n");
++}
++
++static void mt7915_txbf_dump_sta_rec(struct mt7915_dev *dev, struct sta_rec_bf *sta_info)
++{
++	dev_info(dev->mt76.dev, "===================== BF Station Record =====================\n");
++	dev_info(dev->mt76.dev, "pfmu           = %d\n", sta_info->pfmu);
++	dev_info(dev->mt76.dev, "su_mu          = %d\n", sta_info->su_mu);
++	dev_info(dev->mt76.dev, "bf_cap         = %d\n", sta_info->bf_cap);
++	dev_info(dev->mt76.dev, "sounding_phy   = %d\n", sta_info->sounding_phy);
++	dev_info(dev->mt76.dev, "ndpa_rate      = %d\n", sta_info->ndpa_rate);
++	dev_info(dev->mt76.dev, "ndp_rate       = %d\n", sta_info->ndp_rate);
++	dev_info(dev->mt76.dev, "rept_poll_rate = %d\n", sta_info->rept_poll_rate);
++	dev_info(dev->mt76.dev, "tx_mode        = %d\n", sta_info->tx_mode);
++	dev_info(dev->mt76.dev, "ncol           = %d\n", sta_info->ncol);
++	dev_info(dev->mt76.dev, "nrow           = %d\n", sta_info->nrow);
++	dev_info(dev->mt76.dev, "bw             = %d\n", sta_info->bw);
++	dev_info(dev->mt76.dev, "mem_total      = %d\n", sta_info->mem_total);
++	dev_info(dev->mt76.dev, "mem_20m        = %d\n", sta_info->mem_20m);
++	dev_info(dev->mt76.dev, "mem_row0       = %d\n", sta_info->mem[0].row);
++	dev_info(dev->mt76.dev, "mem_col0       = %d\n", sta_info->mem[0].col);
++	dev_info(dev->mt76.dev, "mem_row1       = %d\n", sta_info->mem[1].row);
++	dev_info(dev->mt76.dev, "mem_col1       = %d\n", sta_info->mem[1].col);
++	dev_info(dev->mt76.dev, "mem_row2       = %d\n", sta_info->mem[2].row);
++	dev_info(dev->mt76.dev, "mem_col2       = %d\n", sta_info->mem[2].col);
++	dev_info(dev->mt76.dev, "mem_row3       = %d\n", sta_info->mem[3].row);
++	dev_info(dev->mt76.dev, "mem_col3       = %d\n", sta_info->mem[3].col);
++	dev_info(dev->mt76.dev, "smart_ant      = 0x%x\n", sta_info->smart_ant);
++	dev_info(dev->mt76.dev, "se_idx         = %d\n", sta_info->se_idx);
++	dev_info(dev->mt76.dev, "auto_sounding  = %d\n", sta_info->auto_sounding);
++	dev_info(dev->mt76.dev, "ibf_timeout    = 0x%x\n", sta_info->ibf_timeout);
++	dev_info(dev->mt76.dev, "ibf_dbw        = %d\n", sta_info->ibf_dbw);
++	dev_info(dev->mt76.dev, "ibf_ncol       = %d\n", sta_info->ibf_ncol);
++	dev_info(dev->mt76.dev, "ibf_nrow       = %d\n", sta_info->ibf_nrow);
++	dev_info(dev->mt76.dev, "nrow_gt_bw80   = %d\n", sta_info->nrow_gt_bw80);
++	dev_info(dev->mt76.dev, "ncol_gt_bw80   = %d\n", sta_info->ncol_gt_bw80);
++	dev_info(dev->mt76.dev, "ru_start_idx   = %d\n", sta_info->ru_start_idx);
++	dev_info(dev->mt76.dev, "trigger_su     = %d\n", sta_info->trigger_su);
++	dev_info(dev->mt76.dev, "trigger_mu     = %d\n", sta_info->trigger_mu);
++	dev_info(dev->mt76.dev, "ng16_su        = %d\n", sta_info->ng16_su);
++	dev_info(dev->mt76.dev, "ng16_mu        = %d\n", sta_info->ng16_mu);
++	dev_info(dev->mt76.dev, "codebook42_su  = %d\n", sta_info->codebook42_su);
++	dev_info(dev->mt76.dev, "codebook75_mu  = %d\n", sta_info->codebook75_mu);
++	dev_info(dev->mt76.dev, "he_ltf         = %d\n", sta_info->he_ltf);
++	dev_info(dev->mt76.dev, "=============================================================\n");
++}
++
++static void mt7915_txbf_dump_cal_phase(struct mt7915_dev *dev,
++				       struct mt7915_txbf_phase *phase, int group)
++{
++	dev_info(dev->mt76.dev, "Group %d and Group M\n", group);
++	dev_info(dev->mt76.dev, "m_t0_h = %d\n", phase->phase.m_t0_h);
++	dev_info(dev->mt76.dev, "m_t1_h = %d\n", phase->phase.m_t1_h);
++	dev_info(dev->mt76.dev, "m_t2_h = %d\n", phase->phase.m_t2_h);
++
++	dev_info(dev->mt76.dev, "r0_uh = %d\n", phase->phase.r0_uh);
++	dev_info(dev->mt76.dev, "r0_h = %d\n", phase->phase.r0_h);
++	dev_info(dev->mt76.dev, "r0_m = %d\n", phase->phase.r0_m);
++	dev_info(dev->mt76.dev, "r0_l = %d\n", phase->phase.r0_l);
++
++	dev_info(dev->mt76.dev, "r1_uh = %d\n", phase->phase.r1_uh);
++	dev_info(dev->mt76.dev, "r1_h = %d\n", phase->phase.r1_h);
++	dev_info(dev->mt76.dev, "r1_m = %d\n", phase->phase.r1_m);
++	dev_info(dev->mt76.dev, "r1_l = %d\n", phase->phase.r1_l);
++
++	dev_info(dev->mt76.dev, "r2_uh = %d\n", phase->phase.r2_uh);
++	dev_info(dev->mt76.dev, "r2_h = %d\n", phase->phase.r2_h);
++	dev_info(dev->mt76.dev, "r2_m = %d\n", phase->phase.r2_m);
++	dev_info(dev->mt76.dev, "r2_l = %d\n", phase->phase.r2_l);
++
++	dev_info(dev->mt76.dev, "r3_uh = %d\n", phase->phase.r3_uh);
++	dev_info(dev->mt76.dev, "r3_h = %d\n", phase->phase.r3_h);
++	dev_info(dev->mt76.dev, "r3_m = %d\n", phase->phase.r3_m);
++	dev_info(dev->mt76.dev, "r3_l = %d\n", phase->phase.r3_l);
++	dev_info(dev->mt76.dev, "r3_ul = %d\n", phase->phase.r3_ul);
++}
++
++int mt7915_mcu_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++#define BF_PFMU_TAG	16
++#define BF_STA_REC	20
++#define BF_CAL_PHASE	21
++#define GROUP_M		1
++	u8 format_id;
++
++	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
++	format_id = *(u8 *)skb->data;
++
++	if (format_id == BF_PFMU_TAG) {
++		struct mt7915_pfmu_tag *pfmu_tag;
++
++		skb_pull(skb, 8);
++		pfmu_tag = (struct mt7915_pfmu_tag *)skb->data;
++		mt7915_txbf_dump_pfmu_tag(dev, pfmu_tag);
++		if (dev->test.txbf_pfmu_tag)
++			memcpy(dev->test.txbf_pfmu_tag, pfmu_tag, sizeof(struct mt7915_pfmu_tag));
++	} else if (format_id == BF_STA_REC) {
++		struct sta_rec_bf *sta_rec;
++
++		skb_pull(skb, sizeof(struct mt7915_bf_status_hdr));
++		/* padding 4 byte since bf_status->buf does not contain tag & len */
++		skb_push(skb, 4);
++		sta_rec = (struct sta_rec_bf *)skb->data;
++
++		mt7915_txbf_dump_sta_rec(dev, sta_rec);
++	} else if (format_id == BF_CAL_PHASE) {
++		u8 phase_out_len = sizeof(struct mt7915_txbf_phase_out);
++		struct mt7915_ibf_cal_info *cal;
++		struct mt7915_txbf_phase_out phase_out;
++		struct mt7915_txbf_phase *phase =
++			(struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
++
++		cal = (struct mt7915_ibf_cal_info *)skb->data;
++		memcpy(&phase_out, cal->buf, phase_out_len);
++		switch (cal->cal_type) {
++		case IBF_PHASE_CAL_NORMAL:
++		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
++			/* Only calibrate group M */
++			if (cal->group_l_m_n != GROUP_M)
++				break;
++			phase = &phase[cal->group];
++			memcpy(&phase->phase, cal->buf + phase_out_len, sizeof(phase->phase));
++			phase->status = cal->status;
++
++			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
++			mt7915_txbf_dump_cal_phase(dev, phase, cal->group);
++			break;
++		case IBF_PHASE_CAL_VERIFY:
++		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
++			dev_info(dev->mt76.dev, "Verification result = %d\n", cal->status);
++			break;
++		default:
++			break;
++		}
++
++		dev_info(dev->mt76.dev, "c0_h = %d, c1_h = %d, c2_h = %d\n",
++			 phase_out.c0_h, phase_out.c1_h, phase_out.c2_h);
++		dev_info(dev->mt76.dev, "c0_m = %d, c1_m = %d, c2_m = %d\n",
++			 phase_out.c0_m, phase_out.c1_m, phase_out.c2_m);
++		dev_info(dev->mt76.dev, "c0_l = %d, c1_l = %d, c2_l = %d\n",
++			 phase_out.c0_l, phase_out.c1_l, phase_out.c2_l);
++		dev_info(dev->mt76.dev, "c3_m = %d, c3_h = %d\n", phase_out.c3_m, phase_out.c3_h);
++	}
++
++	wake_up(&dev->mt76.tx_wait);
++
++	return 0;
++}
++
++int mt7915_mcu_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx, bool bfer)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 format_id;
++		u8 pfmu_idx;
++		bool bfer;
++		u8 dbdc_idx;
++	} __packed req = {
++		.format_id = MT_BF_PFMU_TAG_READ,
++		.pfmu_idx = pfmu_idx,
++		.bfer = bfer,
++		.dbdc_idx = phy->mt76->band_idx,
++	};
++	struct mt7915_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++
++	/* Reset to 0 for mt7915_tm_txbf_profile_tag_write wait_event */
++	tag->t1.pfmu_idx = 0;
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), true);
++}
++
++int mt7915_mcu_txbf_sta_rec_read(struct mt7915_dev *dev, u16 wlan_idx)
++{
++	struct {
++		u8 action;
++		u8 wlan_idx_lo;
++		u8 wlan_idx_hi;
++		u8 rsv[5];
++	} __packed req = {
++		.action = MT_BF_STA_REC_READ,
++		.wlan_idx_lo = to_wcid_lo(wlan_idx),
++		.wlan_idx_hi = to_wcid_hi(wlan_idx),
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), true);
++}
++#endif
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index f4b5709..007fd4d 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -61,6 +61,7 @@ enum offs_rev {
+ 	MDP_BNRCFR1,
+ 	ARB_DRNGR0,
+ 	ARB_SCR,
++	ARB_TQSAXM0,
+ 	RMAC_MIB_AIRTIME14,
+ 	AGG_AALCR0,
+ 	AGG_AWSCR0,
+@@ -530,6 +531,9 @@ enum offs_rev {
+ #define MT_ARB_DRNGR0(_band, _n)	MT_WF_ARB(_band, (__OFFS(ARB_DRNGR0) +	\
+ 							  (_n) * 4))
+ 
++#define MT_ARB_TQSAXM0(_band)		MT_WF_ARB(_band, __OFFS(ARB_TQSAXM0))
++#define MT_ARB_TQSAXM_ALTX_START_MASK	GENMASK(12, 8)
++
+ /* RMAC: band 0(0x820e5000), band 1(0x820f5000) */
+ #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
+ #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 2ae6c07..70382b9 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -53,6 +53,8 @@ struct reg_band {
+ static struct reg_band reg_backup_list[TM_REG_MAX_ID];
+ 
+ static void mt7915_tm_update_entry(struct mt7915_phy *phy);
++static int mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode, bool bf_sounding);
++static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy, struct mt76_wcid *wcid);
+ 
+ static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
+ {
+@@ -73,6 +75,25 @@ static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
+ 	return width_to_bw[width];
+ }
+ 
++static u8 mt7915_tm_rate_to_phy(u8 tx_rate_mode)
++{
++	static const u8 rate_to_phy[] = {
++		[MT76_TM_TX_MODE_CCK] = MT_PHY_TYPE_CCK,
++		[MT76_TM_TX_MODE_OFDM] = MT_PHY_TYPE_OFDM,
++		[MT76_TM_TX_MODE_HT] = MT_PHY_TYPE_HT,
++		[MT76_TM_TX_MODE_VHT] = MT_PHY_TYPE_VHT,
++		[MT76_TM_TX_MODE_HE_SU] = MT_PHY_TYPE_HE_SU,
++		[MT76_TM_TX_MODE_HE_EXT_SU] = MT_PHY_TYPE_HE_EXT_SU,
++		[MT76_TM_TX_MODE_HE_TB] = MT_PHY_TYPE_HE_TB,
++		[MT76_TM_TX_MODE_HE_MU] = MT_PHY_TYPE_HE_MU,
++	};
++
++	if (tx_rate_mode > MT76_TM_TX_MODE_MAX)
++		return -EINVAL;
++
++	return rate_to_phy[tx_rate_mode];
++}
++
+ static void
+ mt7915_tm_update_channel(struct mt7915_phy *phy)
+ {
+@@ -273,17 +294,33 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ 	struct mt7915_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct sk_buff *skb;
+ 	struct sta_rec_bf *bf;
+ 	struct tlv *tlv;
+-	u8 ndp_rate;
++	u8 ndp_rate, ndpa_rate, rept_poll_rate, bf_bw;
++
++	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_SU) {
++		rept_poll_rate = 0x49;
++		ndpa_rate = 0x49;
++		ndp_rate = 0;
++	} else if (td->tx_rate_mode == MT76_TM_TX_MODE_VHT) {
++		rept_poll_rate = 0x9;
++		ndpa_rate = 0x9;
++		ndp_rate = 0;
++	} else {
++		rept_poll_rate = 0;
++		ndpa_rate = 0;
++		if (nr == 1)
++			ndp_rate = 8;
++		else if (nr == 2)
++			ndp_rate = 16;
++		else
++			ndp_rate = 24;
++	}
+ 
+-	if (nr == 1)
+-		ndp_rate = 8;
+-	else if (nr == 2)
+-		ndp_rate = 16;
+-	else
+-		ndp_rate = 24;
++	/* TODO: check 160Hz */
++	bf_bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
+ 
+ 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
+ 					    &msta->wcid);
+@@ -299,8 +336,11 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 	bf->ncol = nc;
+ 	bf->nrow = nr;
+ 	bf->ndp_rate = ndp_rate;
++	bf->ndpa_rate = ndpa_rate;
++	bf->rept_poll_rate = rept_poll_rate;
++	bf->bw = bf_bw;
+ 	bf->ibf_timeout = 0xff;
+-	bf->tx_mode = MT_PHY_TYPE_HT;
++	bf->tx_mode = mt7915_tm_rate_to_phy(td->tx_rate_mode);
+ 
+ 	if (ebf) {
+ 		bf->mem[0].row = 0;
+@@ -353,11 +393,8 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+ 	}
+ 
+ 	memcpy(sta->addr, ed->addr[0], ETH_ALEN);
+-	if (phy->test.bf_en) {
+-		u8 addr[ETH_ALEN] = {0x00, 0x11, 0x11, 0x11, 0x11, 0x11};
+-
+-		memcpy(sta->addr, addr, ETH_ALEN);
+-	}
++	if (td->bf_en)
++		memcpy(sta->addr, td->addr[0], ETH_ALEN);
+ 
+ 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
+ 		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
+@@ -382,6 +419,14 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+ 	list_add_tail(&msta->wcid.list, &td->tm_entry_list);
+ 	td->entry_num++;
+ 
++	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, true);
++
++	if (td->bf_en) {
++		mt7915_tm_set_ipg_params(phy, td->tx_ipg, td->tx_rate_mode, true);
++		mt7915_tm_set_tam_arb(phy, td->bf_en, 0);
++		mt7915_tm_txbf_set_rate(phy, &msta->wcid);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -451,7 +496,7 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+ 	struct mt76_testmode_entry_data *ed, tmp;
+ 	struct mt76_wcid *wcid, *last;
+ 
+-	if (!td->aid || phy->test.bf_en)
++	if (!td->aid || td->bf_en)
+ 		return;
+ 
+ 	memcpy(&tmp, &td->ed, sizeof(tmp));
+@@ -472,20 +517,30 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+ static int
+ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+ {
++#define EBF_BBP_RX_OFFSET	0x10280
++#define EBF_BBP_RX_ENABLE	(BIT(0) | BIT(15))
++#define WF1			BIT(1)
++#define WF2			BIT(2)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt7915_dev *dev = phy->dev;
++	struct mt76_phy *mphy = phy->mt76;
+ 	bool enable = val[0];
+ 	void *phase_cal, *pfmu_data, *pfmu_tag;
+-	u8 addr[ETH_ALEN] = {0x00, 0x22, 0x22, 0x22, 0x22, 0x22};
++	u8 sub_addr = td->is_txbf_dut ? TXBF_DUT_MAC_SUBADDR : TXBF_GOLDEN_MAC_SUBADDR;
++	u8 peer_addr = td->is_txbf_dut ? TXBF_GOLDEN_MAC_SUBADDR : TXBF_DUT_MAC_SUBADDR;
++	u8 bss_addr = TXBF_DUT_MAC_SUBADDR;
++	u8 addr[ETH_ALEN] = {0x00, sub_addr, sub_addr, sub_addr, sub_addr, sub_addr};
++	u8 bssid[ETH_ALEN] = {0x00, bss_addr, bss_addr, bss_addr, bss_addr, bss_addr};
++	u8 peer_addrs[ETH_ALEN] = {0x00, peer_addr, peer_addr, peer_addr, peer_addr, peer_addr};
+ 
+ 	if (!enable) {
+-		phy->test.bf_en = 0;
++		td->bf_en = 0;
+ 		return 0;
+ 	}
+ 
+ 	if (!dev->test.txbf_phase_cal) {
+ 		phase_cal = devm_kzalloc(dev->mt76.dev,
+-					 sizeof(struct mt7915_tm_txbf_phase) *
++					 sizeof(struct mt7915_txbf_phase) *
+ 					 MAX_PHASE_GROUP_NUM,
+ 					 GFP_KERNEL);
+ 		if (!phase_cal)
+@@ -495,7 +550,10 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+ 	}
+ 
+ 	if (!dev->test.txbf_pfmu_data) {
+-		pfmu_data = devm_kzalloc(dev->mt76.dev, 512, GFP_KERNEL);
++		pfmu_data = devm_kzalloc(dev->mt76.dev,
++					 sizeof(struct mt7915_pfmu_data) *
++					 MT7915_TXBF_SUBCAR_NUM,
++					 GFP_KERNEL);
+ 		if (!pfmu_data)
+ 			return -ENOMEM;
+ 
+@@ -504,21 +562,77 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+ 
+ 	if (!dev->test.txbf_pfmu_tag) {
+ 		pfmu_tag = devm_kzalloc(dev->mt76.dev,
+-					sizeof(struct mt7915_tm_pfmu_tag), GFP_KERNEL);
++					sizeof(struct mt7915_pfmu_tag), GFP_KERNEL);
+ 		if (!pfmu_tag)
+ 			return -ENOMEM;
+ 
+ 		dev->test.txbf_pfmu_tag = pfmu_tag;
+ 	}
+ 
++	td->bf_en = 1;
++	memcpy(td->addr[0], peer_addrs, ETH_ALEN);
++	memcpy(td->addr[1], addr, ETH_ALEN);
++	memcpy(td->addr[2], bssid, ETH_ALEN);
+ 	memcpy(phy->monitor_vif->addr, addr, ETH_ALEN);
+ 	mt7915_mcu_add_dev_info(phy, phy->monitor_vif, true);
+ 
+-	td->tx_rate_mode = MT76_TM_TX_MODE_HT;
+-	td->tx_mpdu_len = 1024;
+-	td->tx_rate_sgi = 0;
+-	td->tx_ipg = 100;
+-	phy->test.bf_en = 1;
++	/* Add second interface in wtbl for using TXCMD to transmit sounding */
++	td->second_vif = kzalloc(sizeof(*td->second_vif) + sizeof(struct mt7915_vif), GFP_KERNEL);
++	memcpy(td->second_vif, phy->monitor_vif, sizeof(*td->second_vif));
++	mt7915_init_vif(phy, td->second_vif, td->bf_en);
++
++	if (td->ebf && !td->is_txbf_dut) {
++		bool is_160hz = val[1];
++
++		/* Turn On BBP CR for RX */
++		mt76_set(dev, EBF_BBP_RX_OFFSET, EBF_BBP_RX_ENABLE);
++		dev_info(dev->mt76.dev, "Set BBP RX CR = %x\n", mt76_rr(dev, EBF_BBP_RX_OFFSET));
++
++		/* Set TX antenna mask of golden: default use WF0 only */
++		td->tx_antenna_mask = 1;
++		if (is_mt7915(&dev->mt76)) {
++			/* Add WF1/WF2 for dbdc/single band in BW 160 */
++			td->tx_antenna_mask |= is_160hz & (dev->dbdc_support ? WF1 : WF2);
++			/* Shift to WF2/WF3 for dbdc band 1 */
++			td->tx_antenna_mask <<= 2 * phy->mt76->band_idx;
++		}
++	} else if (td->ebf && td->is_txbf_dut) {
++		/* Enable ETxBF Capability */
++		dev->ibf = false;
++		mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
++		/* Set TX antenna mask of DUT */
++		td->tx_antenna_mask = mphy->chainmask >> (dev->chainshift * phy->mt76->band_idx);
++		td->tx_spe_idx = phy->mt76->band_idx ? 25 : 24;
++		/* Shift to WF2/WF3 for dbdc band 1, Nss = 2 */
++		if ((hweight8(td->tx_antenna_mask) == 2) && phy->mt76->band_idx)
++			td->tx_antenna_mask <<= 2;
++	} else {
++		if (td->is_txbf_dut) {
++			int nss;
++
++			/* Enable ITxBF Capability */
++			dev->ibf = true;
++			mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
++			td->tx_antenna_mask = mphy->chainmask >> (dev->chainshift *
++								  phy->mt76->band_idx);
++			nss = hweight8(td->tx_antenna_mask);
++			if (nss > 1 && nss <= 4)
++				td->tx_rate_idx = 15 + 8 * (nss - 2);
++			else
++				td->tx_rate_idx = 31;
++		} else {
++			td->tx_antenna_mask  = 1;
++			mt76_set(dev, EBF_BBP_RX_OFFSET, EBF_BBP_RX_ENABLE);
++			dev_info(dev->mt76.dev, "Set BBP RX CR = %x\n",
++				 mt76_rr(dev, EBF_BBP_RX_OFFSET));
++		}
++		td->tx_rate_mode = MT76_TM_TX_MODE_HT;
++		td->tx_mpdu_len = 1024;
++		td->tx_rate_sgi = 0;
++		td->tx_ipg = 100;
++	}
++
++	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, true);
+ 
+ 	return mt7915_tm_set_trx(phy, TM_MAC_TX, true);
+ }
+@@ -545,8 +659,7 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+ 		.read_from_e2p = val[3],
+ 		.disable = val[4],
+ 	};
+-	struct mt7915_tm_txbf_phase *phase =
+-		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	struct mt7915_txbf_phase *phase = (struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
+ 
+ 	wait_event_timeout(dev->mt76.tx_wait, phase[val[2]].status != 0, HZ);
+ 	memcpy(req.buf, &phase[val[2]].phase, sizeof(req.buf));
+@@ -559,32 +672,9 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+ 				 sizeof(req), true);
+ }
+ 
+-static int
+-mt7915_tm_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx)
+-{
+-	struct mt7915_dev *dev = phy->dev;
+-	struct {
+-		u8 format_id;
+-		u8 pfmu_idx;
+-		bool bfer;
+-		u8 dbdc_idx;
+-	} __packed req = {
+-		.format_id = MT_BF_PFMU_TAG_READ,
+-		.pfmu_idx = pfmu_idx,
+-		.bfer = 1,
+-		.dbdc_idx = phy != &dev->phy,
+-	};
+-	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
+-
+-	tag->t1.pfmu_idx = 0;
+-
+-	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
+-				 sizeof(req), true);
+-}
+-
+ static int
+ mt7915_tm_txbf_profile_tag_write(struct mt7915_phy *phy, u8 pfmu_idx,
+-				 struct mt7915_tm_pfmu_tag *tag)
++				 struct mt7915_pfmu_tag *tag)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct {
+@@ -611,8 +701,6 @@ static int
+ mt7915_tm_txbf_apply_tx(struct mt7915_phy *phy, u16 wlan_idx, bool ebf,
+ 			bool ibf, bool phase_cal)
+ {
+-#define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
+-#define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct {
+ 		u8 category;
+@@ -641,14 +729,15 @@ static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt76_testmode_entry_data *ed = mt76_testmode_entry_data(phy->mt76, wcid);
++	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct ieee80211_sta *sta = wcid_to_sta(wcid);
+ 	struct sta_phy rate = {};
+ 
+ 	if (!sta)
+ 		return 0;
+ 
+-	rate.type = MT_PHY_TYPE_HT;
+-	rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
++	rate.type = mt7915_tm_rate_to_phy(td->tx_rate_mode);
++	rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);		/* TODO: check 160Hz */
+ 	rate.nss = ed->tx_rate_nss;
+ 	rate.mcs = ed->tx_rate_idx;
+ 	rate.ldpc = (rate.bw || ed->tx_rate_ldpc) * GENMASK(2, 0);
+@@ -662,13 +751,14 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+ {
+ 	bool bf_on = val[0], update = val[3];
+ 	/* u16 wlan_idx = val[2]; */
+-	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt76_wcid *wcid;
+ 
+ 	if (bf_on) {
+ 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+-		mt7915_tm_txbf_profile_tag_read(phy, 2);
++		mt7915_mcu_txbf_profile_tag_read(phy, 2, true);
+ 		tag->t1.invalid_prof = false;
+ 		mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
+ 
+@@ -683,7 +773,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+ 		} else {
+ 			phy->test.bf_ever_en = false;
+ 
+-			mt7915_tm_txbf_profile_tag_read(phy, 2);
++			mt7915_mcu_txbf_profile_tag_read(phy, 2, true);
+ 			tag->t1.invalid_prof = true;
+ 			mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
+ 		}
+@@ -698,6 +788,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+ static int
+ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ {
++#define MT_ARB_IBF_ENABLE	(BIT(0) | GENMASK(9, 8))
+ 	static const u8 mode_to_lm[] = {
+ 		[MT76_TM_TX_MODE_CCK] = 0,
+ 		[MT76_TM_TX_MODE_OFDM] = 0,
+@@ -711,7 +802,8 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt76_wcid *wcid;
+ 	struct ieee80211_vif *vif = phy->monitor_vif;
+-	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
+ 	u8 pfmu_idx = val[0], nc = val[2], nr;
+ 	bool is_atenl = val[6];
+ 	int ret;
+@@ -729,11 +821,15 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	tag->t1.nr = nr;
+ 	tag->t1.nc = nc;
+ 	tag->t1.invalid_prof = true;
+-
+-	tag->t1.snr_sts4 = 0xc0;
+-	tag->t1.snr_sts5 = 0xff;
+-	tag->t1.snr_sts6 = 0xff;
+-	tag->t1.snr_sts7 = 0xff;
++	tag->t1.data_bw = mt7915_tm_chan_bw(phy->mt76->chandef.width); /* TODO: check 160Hz */
++	tag->t2.se_idx = td->tx_spe_idx;
++
++	if (is_atenl) {
++		tag->t1.snr_sts4 = 0xc0;
++		tag->t1.snr_sts5 = 0xff;
++		tag->t1.snr_sts6 = 0xff;
++		tag->t1.snr_sts7 = 0xff;
++	}
+ 
+ 	if (ebf) {
+ 		tag->t1.row_id1 = 0;
+@@ -761,6 +857,19 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	if (ret)
+ 		return ret;
+ 
++	if (td->ebf) {
++		mt76_set(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx), MT_ARB_TQSAXM_ALTX_START_MASK);
++		dev_info(dev->mt76.dev, "Set TX queue start CR for AX management (0x%x) = 0x%x\n",
++			 MT_ARB_TQSAXM0(phy->mt76->band_idx),
++			 mt76_rr(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx)));
++	} else if (!td->ebf && ebf) {
++		/* iBF's ebf profile update */
++		mt76_set(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx), MT_ARB_IBF_ENABLE);
++		dev_info(dev->mt76.dev, "Set TX queue start CR for AX management (0x%x) = 0x%x\n",
++			 MT_ARB_TQSAXM0(phy->mt76->band_idx),
++			 mt76_rr(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx)));
++	}
++
+ 	if (!ebf && is_atenl)
+ 		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
+ 
+@@ -778,7 +887,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 		u8 category;
+ 		u8 group_l_m_n;
+ 		u8 group;
+-		bool sx2;
++		bool dbdc_idx;
+ 		u8 cal_type;
+ 		u8 lna_gain_level;
+ 		u8 _rsv[2];
+@@ -786,12 +895,12 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 		.category = MT_BF_PHASE_CAL,
+ 		.group = val[0],
+ 		.group_l_m_n = val[1],
+-		.sx2 = val[2],
++		.dbdc_idx = phy->mt76->band_idx,
+ 		.cal_type = val[3],
+ 		.lna_gain_level = val[4],
+ 	};
+-	struct mt7915_tm_txbf_phase *phase =
+-		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	struct mt7915_txbf_phase *phase =
++		(struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
+ 
+ 	phase[req.group].status = 0;
+ 
+@@ -799,53 +908,10 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 				 sizeof(req), true);
+ }
+ 
+-int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
+-{
+-#define BF_PFMU_TAG	16
+-#define BF_CAL_PHASE	21
+-	u8 format_id;
+-
+-	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
+-	format_id = *(u8 *)skb->data;
+-
+-	if (format_id == BF_PFMU_TAG) {
+-		struct mt7915_tm_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
+-
+-		skb_pull(skb, 8);
+-		memcpy(tag, skb->data, sizeof(struct mt7915_tm_pfmu_tag));
+-	} else if (format_id == BF_CAL_PHASE) {
+-		struct mt7915_tm_ibf_cal_info *cal;
+-		struct mt7915_tm_txbf_phase *phase =
+-			(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
+-
+-		cal = (struct mt7915_tm_ibf_cal_info *)skb->data;
+-		switch (cal->cal_type) {
+-		case IBF_PHASE_CAL_NORMAL:
+-		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
+-			if (cal->group_l_m_n != GROUP_M)
+-				break;
+-			phase = &phase[cal->group];
+-			memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
+-			phase->status = cal->status;
+-			/* for passing iTest script */
+-			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
+-			break;
+-		case IBF_PHASE_CAL_VERIFY:
+-		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
+-			break;
+-		default:
+-			break;
+-		}
+-	}
+-
+-	wake_up(&dev->mt76.tx_wait);
+-
+-	return 0;
+-}
+-
+ static int
+ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ {
++#define MT7915_TXBF_PFMU_DATA_LEN	(MT7915_TXBF_SUBCAR_NUM * sizeof(struct mt7915_pfmu_data))
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	u16 pfmu_idx = val[0];
+ 	u16 subc_id = val[1];
+@@ -854,9 +920,9 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 	u16 angle31 = val[4];
+ 	u16 angle41 = val[5];
+ 	s16 phi11 = 0, phi21 = 0, phi31 = 0;
+-	struct mt7915_tm_pfmu_data *pfmu_data;
++	struct mt7915_pfmu_data *pfmu_data;
+ 
+-	if (subc_id > 63)
++	if (subc_id > MT7915_TXBF_SUBCAR_NUM - 1)
+ 		return -EINVAL;
+ 
+ 	if (td->tx_antenna_mask == 2) {
+@@ -870,7 +936,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 		phi31 = (s16)(angle41 - angle31);
+ 	}
+ 
+-	pfmu_data = (struct mt7915_tm_pfmu_data *)phy->dev->test.txbf_pfmu_data;
++	pfmu_data = (struct mt7915_pfmu_data *)phy->dev->test.txbf_pfmu_data;
+ 	pfmu_data = &pfmu_data[subc_id];
+ 
+ 	if (subc_id < 32)
+@@ -880,21 +946,21 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 	pfmu_data->phi11 = cpu_to_le16(phi11);
+ 	pfmu_data->phi21 = cpu_to_le16(phi21);
+ 	pfmu_data->phi31 = cpu_to_le16(phi31);
+-	if (subc_id == 63) {
++	if (subc_id == MT7915_TXBF_SUBCAR_NUM - 1) {
+ 		struct mt7915_dev *dev = phy->dev;
+ 		struct {
+ 			u8 format_id;
+ 			u8 pfmu_idx;
+ 			u8 dbdc_idx;
+ 			u8 _rsv;
+-			u8 buf[512];
++			u8 buf[MT7915_TXBF_PFMU_DATA_LEN];
+ 		} __packed req = {
+ 			.format_id = MT_BF_PROFILE_WRITE_ALL,
+ 			.pfmu_idx = pfmu_idx,
+ 			.dbdc_idx = phy != &dev->phy,
+ 		};
+ 
+-		memcpy(req.buf, dev->test.txbf_pfmu_data, 512);
++		memcpy(req.buf, dev->test.txbf_pfmu_data, MT7915_TXBF_PFMU_DATA_LEN);
+ 
+ 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
+ 					 &req, sizeof(req), true);
+@@ -906,7 +972,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ static int
+ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+ {
+-	struct mt7915_tm_txbf_phase *phase, *p;
++	struct mt7915_txbf_phase *phase, *p;
+ 	struct mt7915_dev *dev = phy->dev;
+ 	u8 *eeprom = dev->mt76.eeprom.data;
+ 	u16 offset;
+@@ -916,7 +982,7 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+ 	is_7976 = mt7915_check_adie(dev, false) || is_mt7916(&dev->mt76);
+ 	offset = is_7976 ? 0x60a : 0x651;
+ 
+-	phase = (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	phase = (struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
+ 	for (i = 0; i < MAX_PHASE_GROUP_NUM; i++) {
+ 		p = &phase[i];
+ 
+@@ -931,17 +997,75 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+ 	return 0;
+ }
+ 
++static int
++mt7915_tm_trigger_sounding(struct mt7915_phy *phy, u16 *val, bool en)
++{
++	struct mt7915_dev *dev = phy->dev;
++	u8 sounding_mode = val[0];
++	u8 MU_num = val[1];
++	u32 sounding_interval = (u32)val[2] << 2;	/* input unit: 4ms */
++	enum sounding_mode {
++		SU_SOUNDING,
++		MU_SOUNDING,
++		SU_PERIODIC_SOUNDING,
++		MU_PERIODIC_SOUNDING,
++		BF_PROCESSING,
++		TXCMD_NONTB_SU_SOUNDING,
++		TXCMD_VHT_MU_SOUNDING,
++		TXCMD_TB_PER_BRP_SOUNDING,
++		TXCMD_TB_SOUNDING,
++
++		/* keep last */
++		NUM_SOUNDING_MODE,
++		SOUNDING_MODE_MAX = NUM_SOUNDING_MODE - 1,
++	};
++	struct {
++		u8 cmd_category_id;
++		u8 sounding_mode;
++		u8 MU_num;
++		u8 rsv;
++		u8 wlan_idx[4];
++		u32 sounding_interval;		/* unit: ms */
++	} __packed req = {
++		.cmd_category_id = en ? MT_BF_SOUNDING_ON : MT_BF_SOUNDING_OFF,
++		.sounding_mode = sounding_mode,
++		.MU_num = MU_num,
++		.sounding_interval = cpu_to_le32(sounding_interval),
++		.wlan_idx[0] = val[3],
++		.wlan_idx[1] = val[4],
++		.wlan_idx[2] = val[5],
++		.wlan_idx[3] = val[6],
++	};
++
++	if (sounding_mode > SOUNDING_MODE_MAX)
++		return -EINVAL;
++
++	/* Enable Tx MAC HW before trigger sounding */
++	if (en)
++		mt7915_tm_set_trx(phy, TM_MAC_TX, true);
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
++				 &req, sizeof(req), true);
++}
++
+ static int
+ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ {
++#define TXBF_IS_DUT_MASK	BIT(0)
++#define TXBF_EBF_MASK		BIT(1)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	u16 *val = td->txbf_param;
+ 
+-	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
+-		td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5]);
++	dev_info(phy->dev->mt76.dev, "ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
++		 td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5], val[6]);
+ 
+ 	switch (td->txbf_act) {
++	case MT76_TM_TXBF_ACT_GOLDEN_INIT:
+ 	case MT76_TM_TXBF_ACT_INIT:
++	case MT76_TM_TX_EBF_ACT_GOLDEN_INIT:
++	case MT76_TM_TX_EBF_ACT_INIT:
++		td->ebf = !!u32_get_bits(td->txbf_act, TXBF_EBF_MASK);
++		td->is_txbf_dut = !!u32_get_bits(td->txbf_act, TXBF_IS_DUT_MASK);
+ 		return mt7915_tm_txbf_init(phy, val);
+ 	case MT76_TM_TXBF_ACT_UPDATE_CH:
+ 		mt7915_tm_update_channel(phy);
+@@ -967,6 +1091,36 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ 
+ 		return mt7915_tm_txbf_apply_tx(phy, wlan_idx, ebf, ibf, phase_cal);
+ 	}
++	case MT76_TM_TXBF_ACT_TRIGGER_SOUNDING:
++		return mt7915_tm_trigger_sounding(phy, val, true);
++	case MT76_TM_TXBF_ACT_STOP_SOUNDING:
++		memset(val, 0, sizeof(td->txbf_param));
++		return mt7915_tm_trigger_sounding(phy, val, false);
++	case MT76_TM_TXBF_ACT_PROFILE_TAG_READ:
++	case MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE:
++	case MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID: {
++		u8 pfmu_idx = val[0];
++		bool bfer = !!val[1];
++		struct mt7915_dev *dev = phy->dev;
++		struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
++
++		if (!tag) {
++			dev_err(dev->mt76.dev,
++				"pfmu tag is not initialized!\n");
++			return 0;
++		}
++
++		if (td->txbf_act == MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE)
++			return mt7915_tm_txbf_profile_tag_write(phy, pfmu_idx, tag);
++		else if (td->txbf_act == MT76_TM_TXBF_ACT_PROFILE_TAG_READ)
++			return mt7915_mcu_txbf_profile_tag_read(phy, pfmu_idx, bfer);
++
++		tag->t1.invalid_prof = !!val[0];
++
++		return 0;
++	}
++	case MT76_TM_TXBF_ACT_STA_REC_READ:
++		return mt7915_mcu_txbf_sta_rec_read(phy->dev, val[0]);
+ 	default:
+ 		break;
+ 	};
+@@ -1186,9 +1340,10 @@ mt7915_tm_set_ipi(struct mt7915_phy *phy)
+ 
+ static int
+ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+-		      u16 cw_max, u16 txop, u8 tx_cmd)
++		      u16 cw_max, u16 txop, u8 tx_cmd, bool bf_sounding)
+ {
+-	struct mt7915_vif *mvif = (struct mt7915_vif *)phy->monitor_vif->drv_priv;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_vif *mvif;
+ 	struct mt7915_mcu_tx req = {
+ 		.valid = true,
+ 		.mode = tx_cmd,
+@@ -1196,6 +1351,9 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+ 	};
+ 	struct edca *e = &req.edca[0];
+ 
++	mvif = bf_sounding ? (struct mt7915_vif *)td->second_vif->drv_priv :
++			     (struct mt7915_vif *)phy->monitor_vif->drv_priv;
++
+ 	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
+ 	e->set = WMM_PARAM_SET;
+ 
+@@ -1208,17 +1366,19 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+ }
+ 
+ static int
+-mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
++mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode, bool bf_sounding)
+ {
+ #define TM_DEFAULT_SIFS	10
+ #define TM_MAX_SIFS	127
+ #define TM_MAX_AIFSN	0xf
+ #define TM_MIN_AIFSN	0x1
+ #define BBP_PROC_TIME	1500
++#define TM_DEFAULT_CW	1
+ 	struct mt7915_dev *dev = phy->dev;
+ 	u8 sig_ext = (mode == MT76_TM_TX_MODE_CCK) ? 0 : 6;
+ 	u8 slot_time = 9, sifs = TM_DEFAULT_SIFS;
+ 	u8 aifsn = TM_MIN_AIFSN;
++	bool tx_cmd;
+ 	u8 band = phy->mt76->band_idx;
+ 	u32 i2t_time, tr2t_time, txv_time;
+ 	u16 cw = 0;
+@@ -1232,6 +1392,7 @@ mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
+ 	ipg -= sig_ext;
+ 
+ 	if (ipg <= (TM_MAX_SIFS + slot_time)) {
++		cw = TM_DEFAULT_CW;
+ 		sifs = ipg - slot_time;
+ 	} else {
+ 		u32 val = (ipg + slot_time) / slot_time;
+@@ -1267,10 +1428,12 @@ done:
+ 
+ 	mt7915_tm_set_slot_time(phy, slot_time, sifs);
+ 
++	/* HE MU data and iBF/eBF sounding packet use TXCMD */
++	tx_cmd = (mode == MT76_TM_TX_MODE_HE_MU) || bf_sounding;
++
+ 	return mt7915_tm_set_wmm_qid(phy,
+ 				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
+-				     aifsn, cw, cw, 0,
+-				     mode == MT76_TM_TX_MODE_HE_MU);
++				     aifsn, cw, cw, 0, tx_cmd, bf_sounding);
+ }
+ 
+ static int
+@@ -1469,7 +1632,7 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ 
+ 		phy->mt76->test.aid = 0;
+ 		phy->mt76->test.tx_mpdu_len = 0;
+-		phy->test.bf_en = 0;
++		phy->mt76->test.bf_en = 0;
+ 		mt7915_tm_set_entry(phy);
+ 	} else {
+ 		INIT_DELAYED_WORK(&phy->ipi_work, mt7915_tm_ipi_work);
+@@ -1654,7 +1817,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
+ 		u8 duty_cycle = td->tx_duty_cycle;
+ 
+-		if (!phy->test.bf_en)
++		if (!td->bf_en)
+ 			mt7915_tm_update_channel(phy);
+ 
+ 		if (td->tx_spe_idx)
+@@ -1669,7 +1832,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 			if (duty_cycle < 100)
+ 				tx_time = duty_cycle * ipg / (100 - duty_cycle);
+ 		}
+-		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
++		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode, false);
+ 		mt7915_tm_set_tx_len(phy, tx_time);
+ 
+ 		if (ipg)
+@@ -1688,6 +1851,9 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 		mt7915_tm_tx_frames_mu(phy, en);
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
++
++	if (td->bf_en)
++		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ }
+ 
+ static int
+@@ -1779,7 +1945,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+ 
+ 	if (en) {
+-		if (!phy->test.bf_en)
++		if (!td->bf_en || !td->is_txbf_dut)
+ 			mt7915_tm_update_channel(phy);
+ 		if (td->aid)
+ 			mt7915_tm_set_rx_user_idx(phy, td->aid);
+@@ -1796,6 +1962,9 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ 		mt7915_tm_set_muru_aid(phy, en ? td->aid : 0xf800);
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
++
++	if (td->bf_en)
++		mt7915_tm_set_trx(phy, TM_MAC_TX, en);
+ }
+ 
+ static int
+@@ -1855,34 +2024,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+ 		rate_idx = sband->bitrates[idx].hw_value & 0xff;
+ 	}
+ 
+-	switch (td->tx_rate_mode) {
+-	case MT76_TM_TX_MODE_CCK:
+-		mode = MT_PHY_TYPE_CCK;
+-		break;
+-	case MT76_TM_TX_MODE_OFDM:
+-		mode = MT_PHY_TYPE_OFDM;
+-		break;
+-	case MT76_TM_TX_MODE_HT:
+-		mode = MT_PHY_TYPE_HT;
+-		break;
+-	case MT76_TM_TX_MODE_VHT:
+-		mode = MT_PHY_TYPE_VHT;
+-		break;
+-	case MT76_TM_TX_MODE_HE_SU:
+-		mode = MT_PHY_TYPE_HE_SU;
+-		break;
+-	case MT76_TM_TX_MODE_HE_EXT_SU:
+-		mode = MT_PHY_TYPE_HE_EXT_SU;
+-		break;
+-	case MT76_TM_TX_MODE_HE_TB:
+-		mode = MT_PHY_TYPE_HE_TB;
+-		break;
+-	case MT76_TM_TX_MODE_HE_MU:
+-		mode = MT_PHY_TYPE_HE_MU;
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
++	mode = mt7915_tm_rate_to_phy(td->tx_rate_mode);
+ 
+ 	rateval =  mode << 6 | rate_idx;
+ 	tx_cont->rateval = cpu_to_le16(rateval);
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index d500987..1982369 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -311,137 +311,7 @@ struct mt7915_tm_muru {
+ 
+ #define MAX_PHASE_GROUP_NUM	9
+ 
+-struct mt7915_tm_txbf_phase {
+-	u8 status;
+-	struct {
+-		u8 r0_uh;
+-		u8 r0_h;
+-		u8 r0_m;
+-		u8 r0_l;
+-		u8 r0_ul;
+-		u8 r1_uh;
+-		u8 r1_h;
+-		u8 r1_m;
+-		u8 r1_l;
+-		u8 r1_ul;
+-		u8 r2_uh;
+-		u8 r2_h;
+-		u8 r2_m;
+-		u8 r2_l;
+-		u8 r2_ul;
+-		u8 r3_uh;
+-		u8 r3_h;
+-		u8 r3_m;
+-		u8 r3_l;
+-		u8 r3_ul;
+-		u8 r2_uh_sx2;
+-		u8 r2_h_sx2;
+-		u8 r2_m_sx2;
+-		u8 r2_l_sx2;
+-		u8 r2_ul_sx2;
+-		u8 r3_uh_sx2;
+-		u8 r3_h_sx2;
+-		u8 r3_m_sx2;
+-		u8 r3_l_sx2;
+-		u8 r3_ul_sx2;
+-		u8 m_t0_h;
+-		u8 m_t1_h;
+-		u8 m_t2_h;
+-		u8 m_t2_h_sx2;
+-		u8 r0_reserved;
+-		u8 r1_reserved;
+-		u8 r2_reserved;
+-		u8 r3_reserved;
+-		u8 r2_sx2_reserved;
+-		u8 r3_sx2_reserved;
+-	} phase;
+-};
+-
+-struct mt7915_tm_pfmu_tag1 {
+-	__le32 pfmu_idx:10;
+-	__le32 ebf:1;
+-	__le32 data_bw:2;
+-	__le32 lm:2;
+-	__le32 is_mu:1;
+-	__le32 nr:3, nc:3;
+-	__le32 codebook:2;
+-	__le32 ngroup:2;
+-	__le32 _rsv:2;
+-	__le32 invalid_prof:1;
+-	__le32 rmsd:3;
+-
+-	__le32 col_id1:6, row_id1:10;
+-	__le32 col_id2:6, row_id2:10;
+-	__le32 col_id3:6, row_id3:10;
+-	__le32 col_id4:6, row_id4:10;
+-
+-	__le32 ru_start_id:7;
+-	__le32 _rsv1:1;
+-	__le32 ru_end_id:7;
+-	__le32 _rsv2:1;
+-	__le32 mob_cal_en:1;
+-	__le32 _rsv3:15;
+-
+-	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
+-	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
+-
+-	__le32 _rsv4;
+-} __packed;
+-
+-struct mt7915_tm_pfmu_tag2 {
+-	__le32 smart_ant:24;
+-	__le32 se_idx:5;
+-	__le32 _rsv:3;
+-
+-	__le32 _rsv1:8;
+-	__le32 rmsd_thres:3;
+-	__le32 _rsv2:5;
+-	__le32 ibf_timeout:8;
+-	__le32 _rsv3:8;
+-
+-	__le32 _rsv4:16;
+-	__le32 ibf_data_bw:2;
+-	__le32 ibf_nc:3;
+-	__le32 ibf_nr:3;
+-	__le32 ibf_ru:8;
+-
+-	__le32 mob_delta_t:8;
+-	__le32 mob_lq_result:7;
+-	__le32 _rsv5:1;
+-	__le32 _rsv6:16;
+-
+-	__le32 _rsv7;
+-} __packed;
+-
+-struct mt7915_tm_pfmu_tag {
+-	struct mt7915_tm_pfmu_tag1 t1;
+-	struct mt7915_tm_pfmu_tag2 t2;
+-};
+-
+-struct mt7915_tm_pfmu_data {
+-	__le16 subc_idx;
+-	__le16 phi11;
+-	__le16 phi21;
+-	__le16 phi31;
+-};
+-
+-struct mt7915_tm_ibf_cal_info {
+-	u8 format_id;
+-	u8 group_l_m_n;
+-	u8 group;
+-	bool sx2;
+-	u8 status;
+-	u8 cal_type;
+-	u8 _rsv[2];
+-	u8 buf[1000];
+-} __packed;
+-
+-enum {
+-	IBF_PHASE_CAL_UNSPEC,
+-	IBF_PHASE_CAL_NORMAL,
+-	IBF_PHASE_CAL_VERIFY,
+-	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
+-	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
+-};
++#define TXBF_DUT_MAC_SUBADDR		0x22
++#define TXBF_GOLDEN_MAC_SUBADDR		0x11
+ 
+ #endif
+diff --git a/testmode.c b/testmode.c
+index b19b872..ed5ceee 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -191,6 +191,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
+ 
+ 	hdr = __skb_put_zero(head, sizeof(*hdr));
+ 	hdr->frame_control = cpu_to_le16(fc);
++
+ 	memcpy(hdr->addr1, addr[0], ETH_ALEN);
+ 	memcpy(hdr->addr2, addr[1], ETH_ALEN);
+ 	memcpy(hdr->addr3, addr[2], ETH_ALEN);
+diff --git a/testmode.h b/testmode.h
+index 27a0095..e1ebbd5 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -299,7 +299,10 @@ enum mt76_testmode_cfg {
+ };
+ 
+ enum mt76_testmode_txbf_act {
++	MT76_TM_TXBF_ACT_GOLDEN_INIT,
+ 	MT76_TM_TXBF_ACT_INIT,
++	MT76_TM_TX_EBF_ACT_GOLDEN_INIT,
++	MT76_TM_TX_EBF_ACT_INIT,
+ 	MT76_TM_TXBF_ACT_UPDATE_CH,
+ 	MT76_TM_TXBF_ACT_PHASE_COMP,
+ 	MT76_TM_TXBF_ACT_TX_PREP,
+@@ -310,6 +313,12 @@ enum mt76_testmode_txbf_act {
+ 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
+ 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
+ 	MT76_TM_TXBF_ACT_E2P_UPDATE,
++	MT76_TM_TXBF_ACT_TRIGGER_SOUNDING,
++	MT76_TM_TXBF_ACT_STOP_SOUNDING,
++	MT76_TM_TXBF_ACT_PROFILE_TAG_READ,
++	MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE,
++	MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID,
++	MT76_TM_TXBF_ACT_STA_REC_READ,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_TXBF_ACT,
+diff --git a/tools/fields.c b/tools/fields.c
+index 6f07eed..7211ec5 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -33,7 +33,10 @@ static const char * const testmode_tx_mode[] = {
+ };
+ 
+ static const char * const testmode_txbf_act[] = {
++	[MT76_TM_TXBF_ACT_GOLDEN_INIT] = "golden_init",
+ 	[MT76_TM_TXBF_ACT_INIT] = "init",
++	[MT76_TM_TX_EBF_ACT_GOLDEN_INIT] = "ebf_golden_init",
++	[MT76_TM_TX_EBF_ACT_INIT] = "ebf_init",
+ 	[MT76_TM_TXBF_ACT_UPDATE_CH] = "update_ch",
+ 	[MT76_TM_TXBF_ACT_PHASE_COMP] = "phase_comp",
+ 	[MT76_TM_TXBF_ACT_TX_PREP] = "tx_prep",
+@@ -44,6 +47,12 @@ static const char * const testmode_txbf_act[] = {
+ 	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL] = "prof_update",
+ 	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD] = "prof_update_all",
+ 	[MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
++	[MT76_TM_TXBF_ACT_TRIGGER_SOUNDING] = "trigger_sounding",
++	[MT76_TM_TXBF_ACT_STOP_SOUNDING] = "stop_sounding",
++	[MT76_TM_TXBF_ACT_PROFILE_TAG_READ] = "pfmu_tag_read",
++	[MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE] = "pfmu_tag_write",
++	[MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID] = "set_invalid_prof",
++	[MT76_TM_TXBF_ACT_STA_REC_READ] = "sta_rec_read",
+ };
+ 
+ static const char * const testmode_offchan_bw[] = {
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
similarity index 69%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
copy to recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index c49d31d..f98553d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,17 +1,17 @@
-From a0e8ed2e87607c70f76eed181a921ba9cf7d66c0 Mon Sep 17 00:00:00 2001
+From c85d663c58c549c8b969cb8ba349b52e40078cd3 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1116/1129] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1117/1131] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8527b90a..0396031c 100644
+index a347e77..eae1377 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -671,6 +671,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -692,6 +692,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy;
  #endif
  	int ret, idx;
@@ -19,7 +19,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -694,6 +695,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -715,6 +716,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
deleted file mode 100644
index 5e49ca7..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 107c786501f44f62a41c8e01b2a4662fbaaa2926 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1117/1129] mt76: mt7915: reduce TWT SP sent to FW for cert
-
-Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/mcu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 87d2c0de..11732993 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3789,7 +3789,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
- 		.own_mac_idx = mvif->mt76.omac_idx,
- 		.flowid = flow->id,
- 		.peer_id = cpu_to_le16(flow->wcid),
--		.duration = flow->duration,
-+		.duration = (flow->duration * 7) >> 3,
- 		.bss_idx = mvif->mt76.idx,
- 		.start_tsf = cpu_to_le64(flow->tsf),
- 		.mantissa = flow->mantissa,
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
similarity index 74%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
copy to recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index 5e49ca7..337aada 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From 107c786501f44f62a41c8e01b2a4662fbaaa2926 Mon Sep 17 00:00:00 2001
+From 314e5ed3acb7b58da8c147b0eab01a9aae602042 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1117/1129] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1118/1131] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 87d2c0de..11732993 100644
+index 5d41ebf..2d363c4 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3789,7 +3789,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3811,7 +3811,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
@@ -24,5 +24,5 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/recipes-wifi/linux-mt76/files/patches/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
rename to recipes-wifi/linux-mt76/files/patches/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
index f144c24..91cae3d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,7 +1,7 @@
-From 676531d63f5206049fea3ee2301fab7a70a18d76 Mon Sep 17 00:00:00 2001
+From de4cc865ca394c97a70776fa4de4e88357958136 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1118/1129] mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1119/1131] mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 2e0e011d..de9ef237 100644
+index 2e0e011..de9ef23 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -435,7 +435,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -21,5 +21,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
deleted file mode 100644
index f7686bf..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ /dev/null
@@ -1,202 +0,0 @@
-From 6ba6a1fa68f9ef87d3357e94b688e534210baa0d Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1119/1129] mt76: mt7915: add mt7986 and mt7916 pre-calibration
-
-Add pre-calibration for mt7986 and mt7916. It has different data size
-with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
-respectively. DPD cal needs 300k.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/eeprom.c | 15 +++++------
- mt7915/eeprom.h |  1 +
- mt7915/mcu.c    | 72 ++++++++++++++++++++++++++++++++++++-------------
- 3 files changed, 62 insertions(+), 26 deletions(-)
-
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 24efa280..7bdd4d52 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
- {
- 	struct mt76_dev *mdev = &dev->mt76;
- 	u8 *eeprom = mdev->eeprom.data;
--	u32 val = eeprom[MT_EE_DO_PRE_CAL];
--	u32 offs;
-+	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
-+	u32 size, val = eeprom[offs];
- 
--	if (!dev->flash_mode)
-+	if (!dev->flash_mode || !val)
- 		return 0;
- 
--	if (val != (MT_EE_WIFI_CAL_DPD | MT_EE_WIFI_CAL_GROUP))
--		return 0;
-+	size = mt7915_get_cal_group_size(dev) +
-+	       (is_mt7915(&dev->mt76) ? MT_EE_CAL_DPD_SIZE_V1 : MT_EE_CAL_DPD_SIZE_V2);
- 
--	val = MT_EE_CAL_GROUP_SIZE + MT_EE_CAL_DPD_SIZE;
--	dev->cal = devm_kzalloc(mdev->dev, val, GFP_KERNEL);
-+	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
- 	if (!dev->cal)
- 		return -ENOMEM;
- 
- 	offs = is_mt7915(&dev->mt76) ? MT_EE_PRECAL : MT_EE_PRECAL_V2;
- 
--	return mt76_get_of_eeprom(mdev, dev->cal, offs, val);
-+	return mt76_get_of_eeprom(mdev, dev->cal, offs, size);
- }
- 
- static int mt7915_check_eeprom(struct mt7915_dev *dev)
-diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 88aaa16a..fdae347e 100644
---- a/mt7915/eeprom.h
-+++ b/mt7915/eeprom.h
-@@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
- 	MT_EE_DDIE_FT_VERSION =	0x050,
- 	MT_EE_DO_PRE_CAL =	0x062,
- 	MT_EE_WIFI_CONF =	0x190,
-+	MT_EE_DO_PRE_CAL_V2 =	0x19a,
- 	MT_EE_RATE_DELTA_2G =	0x252,
- 	MT_EE_RATE_DELTA_5G =	0x29d,
- 	MT_EE_TX0_POWER_2G =	0x2fc,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 11732993..ca2e4029 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2903,7 +2903,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
- int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
- {
- 	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
--	u32 total = MT_EE_CAL_GROUP_SIZE;
-+	u32 total = mt7915_get_cal_group_size(dev);
-+	u32 offs = is_mt7915(&dev->mt76) ? MT_EE_DO_PRE_CAL : MT_EE_DO_PRE_CAL_V2;
- 
- 	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
- 		return 0;
-@@ -2941,9 +2942,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
- 	return -1;
- }
- 
--static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
-+static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
- {
--	static const u16 freq_list[] = {
-+	const u16 freq_list_v1[] = {
- 		5180, 5200, 5220, 5240,
- 		5260, 5280, 5300, 5320,
- 		5500, 5520, 5540, 5560,
-@@ -2951,34 +2952,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
- 		5660, 5680, 5700, 5745,
- 		5765, 5785, 5805, 5825
- 	};
--	int offset_2g = ARRAY_SIZE(freq_list);
-+	const u16 freq_list_v2[] = {
-+		/* 6G BW20*/
-+		5955, 5975, 5995, 6015,
-+		6035, 6055, 6075, 6095,
-+		6115, 6135, 6155, 6175,
-+		6195, 6215, 6235, 6255,
-+		6275, 6295, 6315, 6335,
-+		6355, 6375, 6395, 6415,
-+		6435, 6455, 6475, 6495,
-+		6515, 6535, 6555, 6575,
-+		6595, 6615, 6635, 6655,
-+		6675, 6695, 6715, 6735,
-+		6755, 6775, 6795, 6815,
-+		6835, 6855, 6875, 6895,
-+		6915, 6935, 6955, 6975,
-+		6995, 7015, 7035, 7055,
-+		7075, 7095, 7115,
-+		/* 6G BW160 */
-+		6025, 6185, 6345, 6505,
-+		6665, 6825, 6985,
-+		/* 5G BW20 */
-+		5180, 5200, 5220, 5240,
-+		5260, 5280, 5300, 5320,
-+		5500, 5520, 5540, 5560,
-+		5580, 5600, 5620, 5640,
-+		5660, 5680, 5700, 5720,
-+		5745, 5765, 5785, 5805,
-+		5825, 5845, 5865, 5885,
-+		/* 5G BW160 */
-+		5250, 5570, 5815
-+	};
-+	const u16 *freq_list = freq_list_v1;
-+	int n_freqs = ARRAY_SIZE(freq_list_v1);
- 	int idx;
- 
-+	if (!is_mt7915(&dev->mt76)) {
-+		freq_list = freq_list_v2;
-+		n_freqs = ARRAY_SIZE(freq_list_v2);
-+	}
-+
- 	if (freq < 4000) {
- 		if (freq < 2432)
--			return offset_2g;
-+			return n_freqs;
- 		if (freq < 2457)
--			return offset_2g + 1;
-+			return n_freqs + 1;
- 
--		return offset_2g + 2;
-+		return n_freqs + 2;
- 	}
- 
--	if (bw == NL80211_CHAN_WIDTH_80P80 || bw == NL80211_CHAN_WIDTH_160)
-+	if (bw == NL80211_CHAN_WIDTH_80P80)
- 		return -1;
- 
- 	if (bw != NL80211_CHAN_WIDTH_20) {
--		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
--					   freq + 10);
-+		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq + 10);
- 		if (idx >= 0)
- 			return idx;
- 
--		idx = mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list),
--					   freq - 10);
-+		idx = mt7915_find_freq_idx(freq_list, n_freqs, freq - 10);
- 		if (idx >= 0)
- 			return idx;
- 	}
- 
--	return mt7915_find_freq_idx(freq_list, ARRAY_SIZE(freq_list), freq);
-+	return mt7915_find_freq_idx(freq_list, n_freqs, freq);
- }
- 
- int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3010,24 +3046,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
- 	if (!(eep[offs] & dpd_mask))
- 		return 0;
- 
--	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
-+	idx = mt7915_dpd_freq_idx(dev, center_freq, chandef->width);
- 	if (idx < 0)
- 		return -EINVAL;
- 
- 	/* Items: Tx DPD, Tx Flatness */
--	idx = idx * 2;
--	cal += MT_EE_CAL_GROUP_SIZE;
-+	idx = idx * cal_num;
-+	cal += mt7915_get_cal_group_size(dev) + (idx * MT_EE_CAL_UNIT);
- 
--	while (total--) {
-+	while (cal_num--) {
- 		int ret;
- 
--		cal += (idx * MT_EE_CAL_UNIT);
- 		ret = mt7915_mcu_set_pre_cal(dev, idx, cal, MT_EE_CAL_UNIT,
- 					     MCU_EXT_CMD(DPD_PRE_CAL_INFO));
- 		if (ret)
- 			return ret;
- 
- 		idx++;
-+		cal += MT_EE_CAL_UNIT;
- 	}
- 
- 	return 0;
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
similarity index 91%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
copy to recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index f7686bf..f9150ab 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 6ba6a1fa68f9ef87d3357e94b688e534210baa0d Mon Sep 17 00:00:00 2001
+From 1c8eaa4d0f729d9de4cb78f16a22dc6cdb095c32 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1119/1129] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1120/1131] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 24efa280..7bdd4d52 100644
+index a796289..55ba90a 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 88aaa16a..fdae347e 100644
+index 88aaa16..fdae347 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 11732993..ca2e4029 100644
+index 2d363c4..4c64655 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2903,7 +2903,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2917,7 +2917,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2941,9 +2942,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2955,9 +2956,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2951,34 +2952,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2965,34 +2966,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3010,24 +3046,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3024,24 +3060,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
deleted file mode 100644
index 4f555c1..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From 5955454208b5eb059911bc1c559d05e33d5d8e7c Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
-Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1120/1129] mt76: mt7915: add phy capability vendor command
-
----
- mt7915/mt7915.h |  1 +
- mt7915/vendor.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h | 25 ++++++++++++++++++++++++
- 3 files changed, 78 insertions(+)
-
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 26bcb4e5..66695d5b 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -11,6 +11,7 @@
- 
- #define MTK_DEBUG 1
- #define MT7915_MAX_INTERFACES		19
-+#define MT7915_MAX_BSS			16
- #define MT7915_WTBL_SIZE		288
- #define MT7916_WTBL_SIZE		544
- #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c7551848..77d71e48 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
- 	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF] = { .type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+phy_capa_ctrl_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_CTRL] = {
-+	[MTK_VENDOR_ATTR_PHY_CAPA_CTRL_SET] = { .type = NLA_NESTED },
-+	[MTK_VENDOR_ATTR_PHY_CAPA_CTRL_DUMP] = { .type = NLA_NESTED },
-+};
-+
-+static const struct nla_policy
-+phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
-+	[MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_BSS] = { .type = NLA_U16 },
-+	[MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA] = { .type = NLA_U16 },
-+};
-+
- struct csi_null_tone {
- 	u8 start;
- 	u8 end;
-@@ -974,6 +986,35 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
- 	return 0;
- }
- 
-+static int
-+mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	void *a;
-+	int len = 0;
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	a = nla_nest_start(skb, MTK_VENDOR_ATTR_PHY_CAPA_CTRL_DUMP);
-+
-+	if (nla_put_u16(skb,
-+	    MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_BSS, MT7915_MAX_BSS) ||
-+	    nla_put_u16(skb,
-+	    MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA, MT7915_WTBL_STA))
-+		return -ENOMEM;
-+	len += 2;
-+
-+	nla_nest_end(skb, a);
-+
-+	return len;
-+}
-+
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -1031,6 +1072,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.doit = mt7915_vendor_hemu_ctrl,
- 		.policy = hemu_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.dumpit = mt7915_vendor_phy_capa_ctrl_dump,
-+		.policy = phy_capa_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf9..719b851f 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
- 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
-+	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
- };
- 
- enum mtk_capi_control_changed {
-@@ -149,4 +150,28 @@ enum mtk_vendor_attr_mnt_dump {
- 		NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
- };
- 
-+enum mtk_vendor_attr_phy_capa_ctrl {
-+	MTK_VENDOR_ATTR_PHY_CAPA_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_PHY_CAPA_CTRL_SET,
-+	MTK_VENDOR_ATTR_PHY_CAPA_CTRL_DUMP,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_PHY_CAPA_CTRL,
-+	MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_PHY_CAPA_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_phy_capa_dump {
-+	MTK_VENDOR_ATTR_PHY_CAPA_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_BSS,
-+	MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP,
-+	MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP - 1
-+};
-+
- #endif
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
similarity index 94%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
copy to recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
index 4f555c1..02d0bba 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From 5955454208b5eb059911bc1c559d05e33d5d8e7c Mon Sep 17 00:00:00 2001
+From fb4643dc44ac917180b758d7ae0f5cc8e9c48450 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1120/1129] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1121/1131] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 26bcb4e5..66695d5b 100644
+index ab1efe6..e977e5c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c7551848..77d71e48 100644
+index c755184..77d71e4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf9..719b851f 100644
+index a8e4ebf..719b851 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
deleted file mode 100644
index e45911f..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ /dev/null
@@ -1,380 +0,0 @@
-From 5a91524be285d368d1616a47df541a1c14314846 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1121/1129] mt76: mt7915: add vendor subcmd EDCCA ctrl
- enable/threshold/compensation
-
-Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
----
- mt76_connac_mcu.h |   1 +
- mt7915/main.c     |   3 ++
- mt7915/mcu.c      |  72 +++++++++++++++++++++++++
- mt7915/mcu.h      |  21 ++++++++
- mt7915/mt7915.h   |   3 +-
- mt7915/vendor.c   | 132 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h   |  33 ++++++++++++
- 7 files changed, 264 insertions(+), 1 deletion(-)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 7853e074..88bfd09f 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1200,6 +1200,7 @@ enum {
- 	MCU_EXT_CMD_SMESH_CTRL = 0xae,
- 	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
- 	MCU_EXT_CMD_CERT_CFG = 0xb7,
-+	MCU_EXT_CMD_EDCCA = 0xba,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- 	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
- };
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 0396031c..94b7a651 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -458,6 +458,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
- 			mutex_unlock(&dev->mt76.mutex);
- 		}
- #endif
-+		ret = mt7915_mcu_set_edcca(phy, EDCCA_CTRL_SET_EN, NULL, 0);
-+		if (ret)
-+			return ret;
- 		ieee80211_stop_queues(hw);
- 		ret = mt7915_set_channel(phy);
- 		if (ret)
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ca2e4029..7507344a 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -4568,3 +4568,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
- 
- 	return 0;
- }
-+
-+int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation)
-+{
-+	static const u8 ch_band[] = {
-+		[NL80211_BAND_2GHZ] = 0,
-+		[NL80211_BAND_5GHZ] = 1,
-+		[NL80211_BAND_6GHZ] = 2,
-+	};
-+	struct mt7915_dev *dev = phy->dev;
-+	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
-+	struct {
-+		u8 band_idx;
-+		u8 cmd_idx;
-+		u8 setting[3];
-+		bool record_in_fw;
-+		u8 region;
-+		s8 thres_compensation;
-+	} __packed req = {
-+		.band_idx = phy->mt76->band_idx,
-+		.cmd_idx = mode,
-+		.record_in_fw = false,
-+		.thres_compensation = compensation,
-+	};
-+
-+	if (ch_band[chandef->chan->band] == 2 && dev->mt76.region == NL80211_DFS_FCC)
-+		req.region = dev->mt76.region;
-+
-+	if (mode == EDCCA_CTRL_SET_EN) {
-+		req.setting[0] = (!value)? EDCCA_MODE_AUTO: value[0];
-+	} else if (mode == EDCCA_CTRL_SET_THERS) {
-+		req.setting[0] = value[0];
-+		req.setting[1] = value[1];
-+		req.setting[2] = value[2];
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
-+}
-+
-+
-+int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value)
-+{
-+	struct mt7915_dev *dev = phy->dev;
-+	struct {
-+		u8 band_idx;
-+		u8 cmd_idx;
-+		u8 setting[3];
-+		bool record_in_fw;
-+		u8 region;
-+		s8 thres_compensation;
-+	} __packed req = {
-+		.band_idx = phy->mt76->band_idx,
-+		.cmd_idx = mode,
-+		.record_in_fw = false,
-+	};
-+	struct sk_buff *skb;
-+	int ret;
-+	struct mt7915_mcu_edcca_info *res;
-+
-+	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req),
-+				        true, &skb);
-+	if (ret)
-+		return ret;
-+
-+	res = (struct mt7915_mcu_edcca_info *)skb->data;
-+	*value++ = res->info[0];
-+	*value++ = res->info[1];
-+	*value = res->info[2];
-+
-+	return 0;
-+}
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9a485249..33e33d89 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -885,6 +885,27 @@ enum {
-    MURU_DL_INIT,
-    MURU_UL_INIT,
- };
-+
-+enum {
-+   EDCCA_CTRL_SET_EN = 0,
-+   EDCCA_CTRL_SET_THERS,
-+   EDCCA_CTRL_GET_EN,
-+   EDCCA_CTRL_GET_THERS,
-+   EDCCA_CTRL_NUM,
-+};
-+
-+enum {
-+   EDCCA_MODE_FORCE_DISABLE,
-+   EDCCA_MODE_AUTO,
-+};
-+
-+struct mt7915_mcu_edcca_info {
-+	u8 cmd_idx;
-+	u8 band_idx;
-+	u8 info[3];
-+	u8 fginit;
-+	u8 rsv[2];
-+};
- #endif
- 
- #endif
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 66695d5b..5bffcff5 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -753,7 +753,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
- int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
- 				  struct ieee80211_sta *sta);
- #endif
--
-+int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
-+int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
- int mt7915_mcu_ipi_hist_ctrl(struct mt7915_phy *phy, void *data, u8 cmd, bool wait_resp);
- int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
- 
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..2484e25f 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
- 	[MTK_VENDOR_ATTR_PHY_CAPA_DUMP_MAX_SUPPORTED_STA] = { .type = NLA_U16 },
- };
- 
-+static const struct nla_policy
-+edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE] = { .type = NLA_S8 },
-+};
-+
-+static const struct nla_policy
-+edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
-+       [MTK_VENDOR_ATTR_EDCCA_DUMP_MODE] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL] = { .type = NLA_U8 },
-+       [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
-+};
-+
- struct csi_null_tone {
- 	u8 start;
- 	u8 end;
-@@ -1015,6 +1033,108 @@ mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
- 	return len;
- }
- 
-+static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
-+				  struct wireless_dev *wdev,
-+				  const void *data,
-+				  int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
-+	int err;
-+	u8 edcca_mode;
-+	s8 edcca_compensation;
-+	u8 edcca_value[EDCCA_THRES_NUM] = {0};
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_EDCCA_CTRL_MAX, data, data_len,
-+			edcca_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE])
-+		return -EINVAL;
-+
-+	edcca_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE]);
-+	if (edcca_mode == EDCCA_CTRL_SET_EN) {
-+		if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] ||
-+			!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE]) {
-+			return -EINVAL;
-+		}
-+		edcca_value[0] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL]);
-+		edcca_compensation =
-+			nla_get_s8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE]);
-+
-+		err = mt7915_mcu_set_edcca(phy, edcca_mode, edcca_value,
-+					   edcca_compensation);
-+		if (err)
-+			return err;
-+	} else if (edcca_mode == EDCCA_CTRL_SET_THERS) {
-+		if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] ||
-+		    !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL] ||
-+		    !tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL]) {
-+			return -EINVAL;
-+		}
-+		edcca_value[0] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL]);
-+		edcca_value[1] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL]);
-+		edcca_value[2] =
-+			nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL]);
-+		err = mt7915_mcu_set_edcca(phy, edcca_mode, edcca_value,
-+					   edcca_compensation);
-+		if (err)
-+			return err;
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL];
-+	int len = EDCCA_THRES_NUM;
-+	int err;
-+	u8 edcca_mode;
-+	s8 value[EDCCA_THRES_NUM];
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_EDCCA_CTRL_MAX, data, data_len,
-+			edcca_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE])
-+		return -EINVAL;
-+
-+	edcca_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE]);
-+	if (edcca_mode ==  EDCCA_CTRL_GET_EN || edcca_mode == EDCCA_CTRL_GET_THERS) {
-+		err = mt7915_mcu_get_edcca(phy, edcca_mode, value);
-+	} else {
-+		return -EINVAL;
-+	}
-+
-+	if (err)
-+		return err;
-+
-+	if (nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL, value[0]) ||
-+	    nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL, value[1]) ||
-+	    nla_put_u8(skb, MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL, value[2]))
-+		return -ENOMEM;
-+
-+	return len;
-+}
-+
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -1083,6 +1203,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.dumpit = mt7915_vendor_phy_capa_ctrl_dump,
- 		.policy = phy_capa_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_PHY_CAPA_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_edcca_ctrl,
-+		.dumpit = mt7915_vendor_edcca_ctrl_dump,
-+		.policy = edcca_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851f..72319717 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -2,6 +2,7 @@
- #define __MT7915_VENDOR_H
- 
- #define MTK_NL80211_VENDOR_ID	0x0ce7
-+#define EDCCA_THRES_NUM 3
- 
- enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
-@@ -10,6 +11,38 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
- 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
-+	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
-+};
-+
-+
-+enum mtk_vendor_attr_edcca_ctrl {
-+        MTK_VENDOR_ATTR_EDCCA_THRESHOLD_INVALID = 0,
-+
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_MODE,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_SEC20_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_SEC40_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_SEC80_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_COMPENSATE,
-+
-+        /* keep last */
-+        NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL,
-+        MTK_VENDOR_ATTR_EDCCA_CTRL_MAX =
-+                NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_edcca_dump {
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
-+
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_MODE,
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_PRI20_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_SEC40_VAL,
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL,
-+
-+        /* keep last */
-+        NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP,
-+        MTK_VENDOR_ATTR_EDCCA_DUMP_MAX =
-+                NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
- };
- 
- enum mtk_capi_control_changed {
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
similarity index 94%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
copy to recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
index e45911f..30520ce 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
@@ -1,7 +1,7 @@
-From 5a91524be285d368d1616a47df541a1c14314846 Mon Sep 17 00:00:00 2001
+From ad63e1c0ab57d38a943dc1ead54efb153c82ff21 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1121/1129] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1122/1131] mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
@@ -16,7 +16,7 @@
  7 files changed, 264 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 7853e074..88bfd09f 100644
+index 7853e07..88bfd09 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1200,6 +1200,7 @@ enum {
@@ -28,10 +28,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0396031c..94b7a651 100644
+index eae1377..09cf35c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -458,6 +458,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -479,6 +479,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  			mutex_unlock(&dev->mt76.mutex);
  		}
  #endif
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ca2e4029..7507344a 100644
+index 4c64655..dddab7d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4568,3 +4568,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4593,3 +4593,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -122,10 +122,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9a485249..33e33d89 100644
+index a30f52d..391aed9 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -885,6 +885,27 @@ enum {
+@@ -1057,6 +1057,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -154,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 66695d5b..5bffcff5 100644
+index e977e5c..4c370bb 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -753,7 +753,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -761,7 +761,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -168,7 +168,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..2484e25f 100644
+index 77d71e4..2484e25 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -325,7 +325,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851f..72319717 100644
+index 719b851..7231971 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -2,6 +2,7 @@
@@ -376,5 +376,5 @@
  
  enum mtk_capi_control_changed {
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
deleted file mode 100644
index 24c978f..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
+++ /dev/null
@@ -1,325 +0,0 @@
-From 42cce8dd635255ae8652b6ed34d598d95ef599be Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1122/1129] mt76: mt7915: implement bin file mode
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- eeprom.c             | 18 +++++++++++++++
- mt76.h               |  1 +
- mt7915/eeprom.c      | 53 ++++++++++++++++++++------------------------
- mt7915/eeprom.h      | 44 ++++++++++++++++++++++++++++++++++++
- mt7915/mt7915.h      | 17 +++++++++++---
- mt7915/mtk_debugfs.c | 41 ++++++++++++++++++++++++++++++++++
- 6 files changed, 142 insertions(+), 32 deletions(-)
-
-diff --git a/eeprom.c b/eeprom.c
-index cb6ff17a..aac70efb 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -104,6 +104,24 @@ out_put_node:
- }
- EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
- 
-+bool mt76_check_bin_file_mode(struct mt76_dev *dev)
-+{
-+	struct device_node *np = dev->dev->of_node;
-+	const __be32 *bin_file_mode;
-+	bool ret = false;
-+
-+	if (!np)
-+		return false;
-+
-+	bin_file_mode = of_get_property(np, "bin_file_mode", NULL);
-+	if (bin_file_mode && be32_to_cpu(*bin_file_mode))
-+		ret = true;
-+
-+	of_node_put(np);
-+	return ret;
-+}
-+EXPORT_SYMBOL_GPL(mt76_check_bin_file_mode);
-+
- void
- mt76_eeprom_override(struct mt76_phy *phy)
- {
-diff --git a/mt76.h b/mt76.h
-index 2bacc1b4..d102333b 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -1029,6 +1029,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
- int mt76_eeprom_init(struct mt76_dev *dev, int len);
- void mt76_eeprom_override(struct mt76_phy *phy);
- int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
-+bool mt76_check_bin_file_mode(struct mt76_dev *dev);
- 
- struct mt76_queue *
- mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 7bdd4d52..64a7750b 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -42,33 +42,6 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
- 	}
- }
- 
--static char *mt7915_eeprom_name(struct mt7915_dev *dev)
--{
--	switch (mt76_chip(&dev->mt76)) {
--	case 0x7915:
--		return dev->dbdc_support ?
--		       MT7915_EEPROM_DEFAULT_DBDC : MT7915_EEPROM_DEFAULT;
--	case 0x7986:
--		switch (mt7915_check_adie(dev, true)) {
--		case MT7976_ONE_ADIE_DBDC:
--			return MT7986_EEPROM_MT7976_DEFAULT_DBDC;
--		case MT7975_ONE_ADIE:
--			return MT7986_EEPROM_MT7975_DEFAULT;
--		case MT7976_ONE_ADIE:
--			return MT7986_EEPROM_MT7976_DEFAULT;
--		case MT7975_DUAL_ADIE:
--			return MT7986_EEPROM_MT7975_DUAL_DEFAULT;
--		case MT7976_DUAL_ADIE:
--			return MT7986_EEPROM_MT7976_DUAL_DEFAULT;
--		default:
--			break;
--		}
--		return NULL;
--	default:
--		return MT7916_EEPROM_DEFAULT;
--	}
--}
--
- static int
- mt7915_eeprom_load_default(struct mt7915_dev *dev)
- {
-@@ -81,7 +54,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
- 		return ret;
- 
- 	if (!fw || !fw->data) {
--		dev_err(dev->mt76.dev, "Invalid default bin\n");
-+		if (dev->bin_file_mode)
-+			dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
-+		else
-+			dev_err(dev->mt76.dev, "Invalid default bin\n");
- 		ret = -EINVAL;
- 		goto out;
- 	}
-@@ -106,6 +82,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 
- 	if (ret) {
- 		dev->flash_mode = true;
-+		dev->eeprom_mode = FLASH_MODE;
- 	} else {
- 		u8 free_block_num;
- 		u32 block_num, i;
-@@ -126,6 +103,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 			if (ret < 0)
- 				return ret;
- 		}
-+
-+		dev->eeprom_mode = EFUSE_MODE;
- 	}
- 
- 	return mt7915_check_eeprom(dev);
-@@ -231,12 +210,28 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
- {
- 	int ret;
- 
--	ret = mt7915_eeprom_load(dev);
-+	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
-+
-+	if (dev->bin_file_mode) {
-+		dev->mt76.eeprom.size = mt7915_eeprom_size(dev);
-+		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
-+						     GFP_KERNEL);
-+		if (!dev->mt76.eeprom.data)
-+			return -ENOMEM;
-+		ret = mt7915_eeprom_load_default(dev);
-+		dev->eeprom_mode = BIN_FILE_MODE;
-+	} else {
-+		ret = mt7915_eeprom_load(dev);
-+	}
-+
- 	if (ret < 0) {
- 		if (ret != -EINVAL)
- 			return ret;
- 
- 		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
-+		dev->bin_file_mode = false;
-+		dev->eeprom_mode = DEFAULT_BIN_MODE;
-+
- 		ret = mt7915_eeprom_load_default(dev);
- 		if (ret)
- 			return ret;
-diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index fdae347e..f228926b 100644
---- a/mt7915/eeprom.h
-+++ b/mt7915/eeprom.h
-@@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
- 	MAX_SKU_RATE_GROUP_NUM,
- };
- 
-+enum mt7915_eeprom_mode {
-+	DEFAULT_BIN_MODE,
-+	EFUSE_MODE,
-+	FLASH_MODE,
-+	BIN_FILE_MODE,
-+};
-+
- static inline int
- mt7915_get_channel_group_5g(int channel, bool is_7976)
- {
-@@ -184,6 +191,43 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
- 	}
- }
- 
-+static inline char *mt7915_eeprom_name(struct mt7915_dev *dev)
-+{
-+	switch (mt76_chip(&dev->mt76)) {
-+	case 0x7915:
-+		if (dev->bin_file_mode)
-+			return dev->dbdc_support ?
-+				MT7915_BIN_FILE_DBDC : MT7915_BIN_FILE;
-+		else
-+			return dev->dbdc_support ?
-+				MT7915_EEPROM_DEFAULT_DBDC : MT7915_EEPROM_DEFAULT;
-+	case 0x7986:
-+		switch (mt7915_check_adie(dev, true)) {
-+		case MT7976_ONE_ADIE_DBDC:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7976_DBDC : MT7986_EEPROM_MT7976_DEFAULT_DBDC;
-+		case MT7975_ONE_ADIE:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7975 : MT7986_EEPROM_MT7975_DEFAULT;
-+		case MT7976_ONE_ADIE:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7976 : MT7986_EEPROM_MT7976_DEFAULT;
-+		case MT7975_DUAL_ADIE:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7975_DUAL : MT7986_EEPROM_MT7975_DUAL_DEFAULT;
-+		case MT7976_DUAL_ADIE:
-+			return dev->bin_file_mode ?
-+			MT7986_BIN_FILE_MT7976_DUAL : MT7986_EEPROM_MT7976_DUAL_DEFAULT;
-+		default:
-+			break;
-+		}
-+		return NULL;
-+	default:
-+		return dev->bin_file_mode ?
-+			MT7916_BIN_FILE : MT7916_EEPROM_DEFAULT;
-+	}
-+}
-+
- extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
- 
- #endif
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5bffcff5..239eef58 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -42,15 +42,24 @@
- #define MT7986_ROM_PATCH		"mediatek/mt7986_rom_patch.bin"
- #define MT7986_ROM_PATCH_MT7975		"mediatek/mt7986_rom_patch_mt7975.bin"
- 
--#define MT7915_EEPROM_DEFAULT		"mediatek/mt7915_eeprom.bin"
--#define MT7915_EEPROM_DEFAULT_DBDC	"mediatek/mt7915_eeprom_dbdc.bin"
--#define MT7916_EEPROM_DEFAULT		"mediatek/mt7916_eeprom.bin"
-+#define MT7915_EEPROM_DEFAULT			"mediatek/mt7915_eeprom.bin"
-+#define MT7915_EEPROM_DEFAULT_DBDC		"mediatek/mt7915_eeprom_dbdc.bin"
-+#define MT7916_EEPROM_DEFAULT			"mediatek/mt7916_eeprom.bin"
- #define MT7986_EEPROM_MT7975_DEFAULT		"mediatek/mt7986_eeprom_mt7975.bin"
- #define MT7986_EEPROM_MT7975_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7975_dual.bin"
- #define MT7986_EEPROM_MT7976_DEFAULT		"mediatek/mt7986_eeprom_mt7976.bin"
- #define MT7986_EEPROM_MT7976_DEFAULT_DBDC	"mediatek/mt7986_eeprom_mt7976_dbdc.bin"
- #define MT7986_EEPROM_MT7976_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7976_dual.bin"
- 
-+#define MT7915_BIN_FILE				"mediatek/mt7915_binfile.bin"
-+#define MT7915_BIN_FILE_DBDC			"mediatek/mt7915_binfile_dbdc.bin"
-+#define MT7916_BIN_FILE				"mediatek/mt7916_binfile.bin"
-+#define MT7986_BIN_FILE_MT7975			"mediatek/mt7986_binfile_mt7975.bin"
-+#define MT7986_BIN_FILE_MT7975_DUAL		"mediatek/mt7986_binfile_mt7975_dual.bin"
-+#define MT7986_BIN_FILE_MT7976			"mediatek/mt7986_binfile_mt7976.bin"
-+#define MT7986_BIN_FILE_MT7976_DBDC		"mediatek/mt7986_binfile_mt7976_dbdc.bin"
-+#define MT7986_BIN_FILE_MT7976_DUAL		"mediatek/mt7986_binfile_mt7976_dual.bin"
-+
- #define MT7915_EEPROM_SIZE		3584
- #define MT7916_EEPROM_SIZE		4096
- 
-@@ -396,6 +405,8 @@ struct mt7915_dev {
- 
- 	bool dbdc_support;
- 	bool flash_mode;
-+	bool bin_file_mode;
-+	u8 eeprom_mode;
- 	bool muru_debug;
- 	bool ibf;
- 
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index d96f222a..376e5f89 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -3,6 +3,7 @@
- #include "mt7915_debug.h"
- #include "mac.h"
- #include "mcu.h"
-+#include "eeprom.h"
- 
- #ifdef MTK_DEBUG
- #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
-@@ -2893,6 +2894,44 @@ mt7915_wa_debug(void *data, u64 val)
- DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
- 			 "0x%llx\n");
- 
-+static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
-+{
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	struct mt76_dev *mdev = &dev->mt76;
-+#ifdef CONFIG_NL80211_TESTMODE
-+	const char *mtd_name = mdev->test_mtd.name;
-+	u32 mtd_offset = mdev->test_mtd.offset;
-+#else
-+	const char *mtd_name = NULL;
-+	u32 mtd_offset;
-+#endif
-+
-+	seq_printf(s, "Current eeprom mode:\n");
-+
-+	switch (dev->eeprom_mode) {
-+	case DEFAULT_BIN_MODE:
-+		seq_printf(s, "   default bin mode\n   filename = %s\n", mt7915_eeprom_name(dev));
-+		break;
-+	case EFUSE_MODE:
-+		seq_printf(s, "   efuse mode\n");
-+		break;
-+	case FLASH_MODE:
-+		if (mtd_name)
-+			seq_printf(s, "   flash mode\n   mtd name = %s\n   flash offset = 0x%x\n",
-+				   mtd_name, mtd_offset);
-+		else
-+			seq_printf(s, "   flash mode\n");
-+		break;
-+	case BIN_FILE_MODE:
-+		seq_printf(s, "   bin file mode\n   filename = %s\n", mt7915_eeprom_name(dev));
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- {
- 	struct mt7915_dev *dev = phy->dev;
-@@ -2973,6 +3012,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
- 				    mt7915_dump_version);
- 
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
-+				    mt7915_show_eeprom_mode);
- 	return 0;
- }
- #endif
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-implement-bin-file-mode.patch b/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-implement-bin-file-mode.patch
new file mode 100644
index 0000000..c45c696
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-implement-bin-file-mode.patch
@@ -0,0 +1,273 @@
+From e1076c547c69fa1424341b87c1e14abed29cab07 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 7 Jul 2022 11:09:59 +0800
+Subject: [PATCH 1123/1131] mt76: mt7915: implement bin file mode
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ eeprom.c             | 20 ++++++++++++++++++++
+ mt76.h               |  3 +++
+ mt7915/eeprom.c      | 36 +++++++++++++++++++++++++++++++++---
+ mt7915/eeprom.h      |  7 +++++++
+ mt7915/mt7915.h      |  9 ++++++---
+ mt7915/mtk_debugfs.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 6 files changed, 110 insertions(+), 6 deletions(-)
+
+diff --git a/eeprom.c b/eeprom.c
+index cb6ff17..05b6dfa 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -104,6 +104,26 @@ out_put_node:
+ }
+ EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
+ 
++bool mt76_check_bin_file_mode(struct mt76_dev *dev)
++{
++	struct device_node *np = dev->dev->of_node;
++	const char *bin_file_name = NULL;
++
++	if (!np)
++		return false;
++
++	of_property_read_string(np, "bin_file_name", &bin_file_name);
++
++	dev->bin_file_name = bin_file_name;
++	if (dev->bin_file_name)
++		dev_info(dev->dev, "Using bin file %s\n", dev->bin_file_name);
++
++	of_node_put(np);
++
++	return dev->bin_file_name ? true : false;
++}
++EXPORT_SYMBOL_GPL(mt76_check_bin_file_mode);
++
+ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+diff --git a/mt76.h b/mt76.h
+index c6aefbf..9b6e806 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -894,9 +894,11 @@ struct mt76_dev {
+ 		struct mt76_sdio sdio;
+ 	};
+ 
++	/* for mtk internal */
+ 	struct mt76_connac2_patch_hdr *patch_hdr;
+ 	struct mt76_connac2_fw_trailer *wm_hdr;
+ 	struct mt76_connac2_fw_trailer *wa_hdr;
++	const char *bin_file_name;
+ };
+ 
+ struct mt76_power_limits {
+@@ -1033,6 +1035,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+ int mt76_eeprom_init(struct mt76_dev *dev, int len);
+ void mt76_eeprom_override(struct mt76_phy *phy);
+ int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
++bool mt76_check_bin_file_mode(struct mt76_dev *dev);
+ 
+ struct mt76_queue *
+ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index 55ba90a..54803e8 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -45,8 +45,11 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
+ 	}
+ }
+ 
+-static char *mt7915_eeprom_name(struct mt7915_dev *dev)
++const char *mt7915_eeprom_name(struct mt7915_dev *dev)
+ {
++	if (dev->bin_file_mode)
++		return dev->mt76.bin_file_name;
++
+ 	switch (mt76_chip(&dev->mt76)) {
+ 	case 0x7915:
+ 		return dev->dbdc_support ?
+@@ -84,7 +87,10 @@ mt7915_eeprom_load_default(struct mt7915_dev *dev)
+ 		return ret;
+ 
+ 	if (!fw || !fw->data) {
+-		dev_err(dev->mt76.dev, "Invalid default bin\n");
++		if (dev->bin_file_mode)
++			dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
++		else
++			dev_err(dev->mt76.dev, "Invalid default bin\n");
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+@@ -109,6 +115,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ 
+ 	if (ret) {
+ 		dev->flash_mode = true;
++		dev->eeprom_mode = FLASH_MODE;
+ 	} else {
+ 		u8 free_block_num;
+ 		u32 block_num, i;
+@@ -129,6 +136,8 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ 			if (ret < 0)
+ 				return ret;
+ 		}
++
++		dev->eeprom_mode = EFUSE_MODE;
+ 	}
+ 
+ 	return mt7915_check_eeprom(dev);
+@@ -234,12 +243,33 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+ {
+ 	int ret;
+ 
+-	ret = mt7915_eeprom_load(dev);
++	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
++	if (dev->bin_file_mode) {
++		dev->mt76.eeprom.size = mt7915_eeprom_size(dev);
++		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
++						     GFP_KERNEL);
++		if (!dev->mt76.eeprom.data)
++			return -ENOMEM;
++		ret = mt7915_eeprom_load_default(dev);
++		if (ret)
++			return ret;
++
++		ret = mt7915_check_eeprom(dev);
++		if (ret)
++			return ret;
++		dev->eeprom_mode = BIN_FILE_MODE;
++	} else {
++		ret = mt7915_eeprom_load(dev);
++	}
++
+ 	if (ret < 0) {
+ 		if (ret != -EINVAL)
+ 			return ret;
+ 
+ 		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
++		dev->bin_file_mode = false;
++		dev->eeprom_mode = DEFAULT_BIN_MODE;
++
+ 		ret = mt7915_eeprom_load_default(dev);
+ 		if (ret)
+ 			return ret;
+diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
+index fdae347..9056d78 100644
+--- a/mt7915/eeprom.h
++++ b/mt7915/eeprom.h
+@@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
+ 	MAX_SKU_RATE_GROUP_NUM,
+ };
+ 
++enum mt7915_eeprom_mode {
++	DEFAULT_BIN_MODE,
++	EFUSE_MODE,
++	FLASH_MODE,
++	BIN_FILE_MODE,
++};
++
+ static inline int
+ mt7915_get_channel_group_5g(int channel, bool is_7976)
+ {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 4c370bb..e5cfc77 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -42,9 +42,9 @@
+ #define MT7986_ROM_PATCH		"mediatek/mt7986_rom_patch.bin"
+ #define MT7986_ROM_PATCH_MT7975		"mediatek/mt7986_rom_patch_mt7975.bin"
+ 
+-#define MT7915_EEPROM_DEFAULT		"mediatek/mt7915_eeprom.bin"
+-#define MT7915_EEPROM_DEFAULT_DBDC	"mediatek/mt7915_eeprom_dbdc.bin"
+-#define MT7916_EEPROM_DEFAULT		"mediatek/mt7916_eeprom.bin"
++#define MT7915_EEPROM_DEFAULT			"mediatek/mt7915_eeprom.bin"
++#define MT7915_EEPROM_DEFAULT_DBDC		"mediatek/mt7915_eeprom_dbdc.bin"
++#define MT7916_EEPROM_DEFAULT			"mediatek/mt7916_eeprom.bin"
+ #define MT7986_EEPROM_MT7975_DEFAULT		"mediatek/mt7986_eeprom_mt7975.bin"
+ #define MT7986_EEPROM_MT7975_DUAL_DEFAULT	"mediatek/mt7986_eeprom_mt7975_dual.bin"
+ #define MT7986_EEPROM_MT7976_DEFAULT		"mediatek/mt7986_eeprom_mt7976.bin"
+@@ -400,6 +400,8 @@ struct mt7915_dev {
+ 
+ 	bool dbdc_support;
+ 	bool flash_mode;
++	bool bin_file_mode;
++	u8 eeprom_mode;
+ 	bool muru_debug;
+ 	bool ibf;
+ 
+@@ -774,6 +776,7 @@ void mt7915_dump_tmac_info(u8 *tmac_info);
+ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
+ void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
+ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable);
++const char *mt7915_eeprom_name(struct mt7915_dev *dev);
+ 
+ #define PKT_BIN_DEBUG_MAGIC	0xc8763123
+ enum {
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index a2ceb6f..7567666 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -3,6 +3,7 @@
+ #include "mt7915_debug.h"
+ #include "mac.h"
+ #include "mcu.h"
++#include "eeprom.h"
+ 
+ #ifdef MTK_DEBUG
+ #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
+@@ -2924,6 +2925,44 @@ mt7915_wa_debug(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
+ 			 "0x%llx\n");
+ 
++static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	struct mt76_dev *mdev = &dev->mt76;
++#ifdef CONFIG_NL80211_TESTMODE
++	const char *mtd_name = mdev->test_mtd.name;
++	u32 mtd_offset = mdev->test_mtd.offset;
++#else
++	const char *mtd_name = NULL;
++	u32 mtd_offset;
++#endif
++
++	seq_printf(s, "Current eeprom mode:\n");
++
++	switch (dev->eeprom_mode) {
++	case DEFAULT_BIN_MODE:
++		seq_printf(s, "   default bin mode\n   filename = %s\n", mt7915_eeprom_name(dev));
++		break;
++	case EFUSE_MODE:
++		seq_printf(s, "   efuse mode\n");
++		break;
++	case FLASH_MODE:
++		if (mtd_name)
++			seq_printf(s, "   flash mode\n   mtd name = %s\n   flash offset = 0x%x\n",
++				   mtd_name, mtd_offset);
++		else
++			seq_printf(s, "   flash mode\n");
++		break;
++	case BIN_FILE_MODE:
++		seq_printf(s, "   bin file mode\n   filename = %s\n", mt7915_eeprom_name(dev));
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+@@ -3009,6 +3048,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
+ 				    mt7915_dump_version);
+ 
++	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
++				    mt7915_show_eeprom_mode);
+ 	return 0;
+ }
+ #endif
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
deleted file mode 100644
index ca5b014..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From eb8e083501dbca6db418cb2538cd1e50c51abde9 Mon Sep 17 00:00:00 2001
-From: TomLiu <tomml.liu@mediatek.com>
-Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1124/1129] mt76: mt7915: Add hemu dump support
-
-Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
----
- mt7915/vendor.c | 25 +++++++++++++++++++++++++
- mt7915/vendor.h |  1 +
- 2 files changed, 26 insertions(+)
-
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 2484e25f..f7becce9 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
- static const struct nla_policy
- hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
- 	[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
-+	[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
- };
- 
- static const struct nla_policy
-@@ -1004,6 +1005,29 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
- 	return 0;
- }
- 
-+
-+static int
-+mt7915_vendor_hemu_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	int len = 0;
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	if (nla_put_u8(skb, MTK_VENDOR_ATTR_HEMU_CTRL_DUMP, dev->dbg.muru_onoff))
-+		return -ENOMEM;
-+	len += 1;
-+
-+	return len;
-+}
-+
-+
- static int
- mt7915_vendor_phy_capa_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
- 			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1190,6 +1214,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
- 			WIPHY_VENDOR_CMD_NEED_RUNNING,
- 		.doit = mt7915_vendor_hemu_ctrl,
-+		.dumpit = mt7915_vendor_hemu_ctrl_dump,
- 		.policy = hemu_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
- 	},
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 72319717..c19ffe72 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
- 	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
- 
- 	MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF,
-+	MTK_VENDOR_ATTR_HEMU_CTRL_DUMP,
- 
- 	/* keep last */
- 	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-initialize-wcid.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch
rename to recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-initialize-wcid.patch
index 0231a99..96667f7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1123-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1124-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 9dc6af1c44883efd578f9a081264c43210e8e5b8 Mon Sep 17 00:00:00 2001
+From a266db484a5bccd64c282b7f7dfbdf4be126758f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1123/1129] mt76: mt7915: initialize wcid
+Subject: [PATCH 1124/1131] mt76: mt7915: initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0746e4b3..22dd66e3 100644
+index 013dfbd..9d4cfa1 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1030,7 +1030,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1032,7 +1032,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch b/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-Add-hemu-dump-support.patch
similarity index 91%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
copy to recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-Add-hemu-dump-support.patch
index ca5b014..3fbaa30 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1124-mt76-mt7915-Add-hemu-dump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-Add-hemu-dump-support.patch
@@ -1,7 +1,7 @@
-From eb8e083501dbca6db418cb2538cd1e50c51abde9 Mon Sep 17 00:00:00 2001
+From eff1dd335c92e3d6d9033b50363d41d902025e83 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1124/1129] mt76: mt7915: Add hemu dump support
+Subject: [PATCH 1125/1131] mt76: mt7915: Add hemu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 26 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 2484e25f..f7becce9 100644
+index 2484e25..f7becce 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -60,7 +60,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 72319717..c19ffe72 100644
+index 7231971..c19ffe7 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
@@ -72,5 +72,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
deleted file mode 100644
index 1f2fe5b..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ /dev/null
@@ -1,272 +0,0 @@
-From e58fab916807bd40d8f3e7169e7a3e8df306878e Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1125/1129] mt76: mt7915: add vendor subcmd three wire (PTA)
- ctrl
-
-Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt76_connac_mcu.h |  2 +-
- mt7915/mcu.c      | 50 ++++++++++++++++++++++-------------------------
- mt7915/mcu.h      | 29 +++++++++++++++++++++++++++
- mt7915/mt7915.h   |  1 +
- mt7915/vendor.c   | 44 ++++++++++++++++++++++++++++++++++++++++-
- mt7915/vendor.h   | 14 +++++++++++++
- 6 files changed, 111 insertions(+), 29 deletions(-)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 88bfd09f..5cff1a45 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1199,7 +1199,7 @@ enum {
- 	/* for vendor csi and air monitor */
- 	MCU_EXT_CMD_SMESH_CTRL = 0xae,
- 	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
--	MCU_EXT_CMD_CERT_CFG = 0xb7,
-+	MCU_EXT_CMD_SET_CFG = 0xb7,
- 	MCU_EXT_CMD_EDCCA = 0xba,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- 	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7507344a..5791cb29 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -4250,37 +4250,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
- 			&req, sizeof(req), false);
- }
- 
--void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type)
-+int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type)
- {
--#define CFGINFO_CERT_CFG 4
- 	struct mt7915_dev *dev = phy->dev;
--	struct {
--		struct basic_info{
--			u8 dbdc_idx;
--			u8 rsv[3];
--			__le32 tlv_num;
--			u8 tlv_buf[0];
--		} hdr;
--		struct cert_cfg{
--			__le16 tag;
--			__le16 length;
--			u8 cert_program;
--			u8 rsv[3];
--		} tlv;
--	} req = {
--		.hdr = {
--			.dbdc_idx = phy != &dev->phy,
--			.tlv_num = cpu_to_le32(1),
--		},
--		.tlv = {
--			.tag = cpu_to_le16(CFGINFO_CERT_CFG),
--			.length = cpu_to_le16(sizeof(struct cert_cfg)),
--			.cert_program = type, /* 1: CAPI Enable */
--		}
-+	struct cfg_basic_info req = {
-+		.dbdc_idx = phy != &dev->phy,
-+		.tlv_num = cpu_to_le32(1),
- 	};
-+	int tlv_len;
-+
-+	switch (cfg_info) {
-+	case CFGINFO_CERT_CFG:
-+		tlv_len = sizeof(struct cert_cfg);
-+		req.cert.tag = cpu_to_le16(cfg_info);
-+		req.cert.length = cpu_to_le16(tlv_len);
-+		req.cert.cert_program = type;
-+		break;
-+	case CFGINFO_3WIRE_EN_CFG:
-+		tlv_len = sizeof(struct three_wire_cfg);
-+		req.three_wire.tag = cpu_to_le16(cfg_info);
-+		req.three_wire.length = cpu_to_le16(tlv_len);
-+		req.three_wire.three_wire_en = type;
-+		break;
-+	default:
-+		return -EOPNOTSUPP;
-+	}
- 
--	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CERT_CFG),
--			  &req, sizeof(req), false);
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SET_CFG), &req, sizeof(req), false);
- }
- 
- void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 33e33d89..08476eb6 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -674,6 +674,35 @@ struct mt7915_mcu_rdd_ipi_scan {
- 	u8 tx_assert_time;						/* unit: us */
- } __packed;
- 
-+struct cert_cfg {
-+	__le16 tag;
-+	__le16 length;
-+	u8 cert_program;
-+	u8 rsv[3];
-+} __packed;
-+
-+struct three_wire_cfg {
-+	__le16 tag;
-+	__le16 length;
-+	u8 three_wire_en;
-+	u8 rsv[3];
-+} __packed;
-+
-+struct cfg_basic_info {
-+	u8 dbdc_idx;
-+	u8 rsv[3];
-+	__le32 tlv_num;
-+	union {
-+		struct cert_cfg cert;
-+		struct three_wire_cfg three_wire;
-+	};
-+} __packed;
-+
-+enum {
-+	CFGINFO_CERT_CFG = 4,
-+	CFGINFO_3WIRE_EN_CFG = 10,
-+};
-+
- /* MURU */
- #define OFDMA_DL                       BIT(0)
- #define OFDMA_UL                       BIT(1)
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 239eef58..22454b54 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -756,6 +756,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
- void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
- int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
- void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
-+int mt7915_mcu_set_cfg(struct mt7915_phy *phy, u8 cfg_info, u8 type);
- void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val);
- void mt7915_vendor_register(struct mt7915_phy *phy);
- int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index f7becce9..fb760e17 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
- 	[MTK_VENDOR_ATTR_HEMU_CTRL_DUMP] = {.type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+three_wire_ctrl_policy[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL] = {
-+	[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE] = {.type = NLA_U8 },
-+};
-+
- static const struct nla_policy
- rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
- 	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
-@@ -971,7 +976,7 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
- 			mt7915_set_wireless_vif, &val32);
- 	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]) {
- 		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
--		mt7915_mcu_set_cert(phy, val8); /* Cert Enable for OMI */
-+		mt7915_mcu_set_cfg(phy, CFGINFO_CERT_CFG, val8); /* Cert Enable for OMI */
- 		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
- 	}
- 
-@@ -1116,6 +1121,7 @@ static int mt7915_vendor_edcca_ctrl(struct wiphy *wiphy,
- 	return 0;
- }
- 
-+
- static int
- mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
- 			     struct sk_buff *skb, const void *data, int data_len,
-@@ -1159,6 +1165,31 @@ mt7915_vendor_edcca_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
- 	return len;
- }
- 
-+static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
-+				    struct wireless_dev *wdev,
-+				    const void *data,
-+				    int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL];
-+	int err;
-+	u8 three_wire_mode;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_3WIRE_CTRL_MAX, data, data_len,
-+			three_wire_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (!tb[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE])
-+		return -EINVAL;
-+
-+	three_wire_mode = nla_get_u8(tb[MTK_VENDOR_ATTR_3WIRE_CTRL_MODE]);
-+
-+	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
-+}
-+
-+
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
- 		.info = {
-@@ -1240,6 +1271,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.dumpit = mt7915_vendor_edcca_ctrl_dump,
- 		.policy = edcca_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_EDCCA_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_3wire_ctrl,
-+		.policy = three_wire_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index c19ffe72..d96e5c23 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -12,6 +12,7 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
- 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
- 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
-+	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
- };
- 
- 
-@@ -31,6 +32,7 @@ enum mtk_vendor_attr_edcca_ctrl {
-                 NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL - 1
- };
- 
-+
- enum mtk_vendor_attr_edcca_dump {
-         MTK_VENDOR_ATTR_EDCCA_DUMP_UNSPEC = 0,
- 
-@@ -45,6 +47,18 @@ enum mtk_vendor_attr_edcca_dump {
-                 NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP - 1
- };
- 
-+enum mtk_vendor_attr_3wire_ctrl {
-+	MTK_VENDOR_ATTR_3WIRE_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_3WIRE_CTRL_MODE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL,
-+	MTK_VENDOR_ATTR_3WIRE_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_3WIRE_CTRL - 1
-+};
-+
-+
- enum mtk_capi_control_changed {
- 	CAPI_RFEATURE_CHANGED		= BIT(16),
- 	CAPI_WIRELESS_CHANGED		= BIT(17),
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
deleted file mode 100644
index 0b8f9b8..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 0a8c65105444a20637c868e376a322924b2429f2 Mon Sep 17 00:00:00 2001
-From: mtk27835 <shurong.wen@mediatek.com>
-Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1126/1129] mt76: mt7915: add ibf control vendor cmd
-
-Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
----
- mt7915/vendor.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++
- mt7915/vendor.h | 25 ++++++++++++++++++-
- 2 files changed, 89 insertions(+), 1 deletion(-)
-
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index fb760e17..22af66d5 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
-        [MTK_VENDOR_ATTR_EDCCA_DUMP_SEC80_VAL] = { .type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+ibf_ctrl_policy[NUM_MTK_VENDOR_ATTRS_IBF_CTRL] = {
-+	[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE] = { .type = NLA_U8 },
-+};
-+
- struct csi_null_tone {
- 	u8 start;
- 	u8 end;
-@@ -1189,6 +1194,54 @@ static int mt7915_vendor_3wire_ctrl(struct wiphy *wiphy,
- 	return mt7915_mcu_set_cfg(phy, CFGINFO_3WIRE_EN_CFG, three_wire_mode);
- }
- 
-+static int mt7915_vendor_ibf_ctrl(struct wiphy *wiphy,
-+				  struct wireless_dev *wdev,
-+				  const void *data,
-+				  int data_len)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_IBF_CTRL];
-+	int err;
-+	u8 val;
-+
-+	err = nla_parse(tb, MTK_VENDOR_ATTR_IBF_CTRL_MAX, data, data_len,
-+			ibf_ctrl_policy, NULL);
-+	if (err)
-+		return err;
-+
-+	if (tb[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE]) {
-+		val = nla_get_u8(tb[MTK_VENDOR_ATTR_IBF_CTRL_ENABLE]);
-+
-+		dev->ibf = !!val;
-+
-+		err = mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
-+		if (err)
-+			return err;
-+	}
-+	return 0;
-+}
-+
-+static int
-+mt7915_vendor_ibf_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	if (nla_put_u8(skb, MTK_VENDOR_ATTR_IBF_DUMP_ENABLE, dev->ibf))
-+		return -ENOMEM;
-+
-+	return 1;
-+}
-+
- 
- static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 	{
-@@ -1282,6 +1335,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.doit = mt7915_vendor_3wire_ctrl,
- 		.policy = three_wire_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_3WIRE_CTRL_MAX,
-+	},
-+	{
-+		.info = {
-+			.vendor_id = MTK_NL80211_VENDOR_ID,
-+			.subcmd = MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL,
-+		},
-+		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
-+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
-+		.doit = mt7915_vendor_ibf_ctrl,
-+		.dumpit = mt7915_vendor_ibf_ctrl_dump,
-+		.policy = ibf_ctrl_policy,
-+		.maxattr = MTK_VENDOR_ATTR_IBF_CTRL_MAX,
- 	}
- };
- 
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index d96e5c23..949c8853 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -12,7 +12,8 @@ enum mtk_nl80211_vendor_subcmds {
- 	MTK_NL80211_VENDOR_SUBCMD_HEMU_CTRL = 0xc5,
- 	MTK_NL80211_VENDOR_SUBCMD_PHY_CAPA_CTRL = 0xc6,
- 	MTK_NL80211_VENDOR_SUBCMD_EDCCA_CTRL = 0xc7,
--	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8
-+	MTK_NL80211_VENDOR_SUBCMD_3WIRE_CTRL = 0xc8,
-+	MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL = 0xc9,
- };
- 
- 
-@@ -222,4 +223,26 @@ enum mtk_vendor_attr_phy_capa_dump {
- 		NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP - 1
- };
- 
-+enum mtk_vendor_attr_ibf_ctrl {
-+	MTK_VENDOR_ATTR_IBF_CTRL_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_IBF_CTRL_ENABLE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_IBF_CTRL,
-+	MTK_VENDOR_ATTR_IBF_CTRL_MAX =
-+		NUM_MTK_VENDOR_ATTRS_IBF_CTRL - 1
-+};
-+
-+enum mtk_vendor_attr_ibf_dump {
-+	MTK_VENDOR_ATTR_IBF_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_IBF_DUMP_ENABLE,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_IBF_DUMP,
-+	MTK_VENDOR_ATTR_IBF_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_IBF_DUMP - 1
-+};
-+
- #endif
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
similarity index 93%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
copy to recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 1f2fe5b..de93232 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,7 +1,7 @@
-From e58fab916807bd40d8f3e7169e7a3e8df306878e Mon Sep 17 00:00:00 2001
+From 1ed70aaeef64eb65d10c9af9f0ad30f079eab0ea Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1125/1129] mt76: mt7915: add vendor subcmd three wire (PTA)
+Subject: [PATCH 1126/1131] mt76: mt7915: add vendor subcmd three wire (PTA)
  ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
@@ -16,7 +16,7 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 88bfd09f..5cff1a45 100644
+index 88bfd09..5cff1a4 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1199,7 +1199,7 @@ enum {
@@ -29,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7507344a..5791cb29 100644
+index dddab7d..36a33f6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4250,37 +4250,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4272,37 +4272,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,10 +94,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 33e33d89..08476eb6 100644
+index 391aed9..025a03b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -674,6 +674,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -846,6 +846,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -134,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 239eef58..22454b54 100644
+index e5cfc77..b9b86b8 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -756,6 +756,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -755,6 +755,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index f7becce9..fb760e17 100644
+index f7becce..fb760e1 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -229,7 +229,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index c19ffe72..d96e5c23 100644
+index c19ffe7..d96e5c2 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,6 +12,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -268,5 +268,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
deleted file mode 100644
index 526fda5..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From 1116673d44b71df37e01407ee6ebca0b6cc9f338 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1127/1129] mt76: mt7915: add E3 re-bonding for low yield rate
- issue
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7915/eeprom.c | 27 ++++++++++++++++++++++++++-
- mt7915/mcu.c    | 13 ++++++++++---
- mt7915/mt7915.h |  3 ++-
- 3 files changed, 38 insertions(+), 5 deletions(-)
-
-diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 64a7750b..efa9c173 100644
---- a/mt7915/eeprom.c
-+++ b/mt7915/eeprom.c
-@@ -99,7 +99,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
- 		/* read eeprom data from efuse */
- 		block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
- 		for (i = 0; i < block_num; i++) {
--			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size);
-+			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size, NULL);
- 			if (ret < 0)
- 				return ret;
- 		}
-@@ -206,6 +206,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
- 	dev->chainshift = hweight8(dev->mphy.chainmask);
- }
- 
-+void mt7915_eeprom_rebonding(struct mt7915_dev *dev)
-+{
-+#define MT7976_ADIE_MASK			BIT(1)
-+#define MT7986_ADIE1_EFFUSE_OFFSET		0x1000
-+#define MT7986_ADIE1_MT7976C_OFFSET		0x270
-+#define MT7986_ADIE1_E3_OFFSET			0x271
-+	u32 adie_offset, sku = mt7915_check_adie(dev, true);
-+	u8 read_buf, *eeprom = dev->mt76.eeprom.data;
-+
-+	if (!(sku & MT7976_ADIE_MASK))
-+		return;
-+
-+	adie_offset = (sku == MT7976_DUAL_ADIE) ? MT7986_ADIE1_EFFUSE_OFFSET : 0;
-+
-+	/* 7976 A-Die, To identify MT7976C */
-+	mt7915_mcu_get_eeprom(dev, MT7986_ADIE1_MT7976C_OFFSET + adie_offset, &read_buf);
-+	eeprom[MT7986_ADIE1_MT7976C_OFFSET] = read_buf;
-+
-+	/* E3 re-binding */
-+	mt7915_mcu_get_eeprom(dev, MT7986_ADIE1_E3_OFFSET + adie_offset, &read_buf);
-+	eeprom[MT7986_ADIE1_E3_OFFSET] = read_buf;
-+}
-+
- int mt7915_eeprom_init(struct mt7915_dev *dev)
- {
- 	int ret;
-@@ -237,6 +260,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
- 			return ret;
- 	}
- 
-+	mt7915_eeprom_rebonding(dev);
-+
- 	ret = mt7915_eeprom_load_precal(dev);
- 	if (ret)
- 		return ret;
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5791cb29..785c3c10 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2822,7 +2822,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
- 				 &req, sizeof(req), true);
- }
- 
--int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
-+int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
- {
- 	struct mt7915_mcu_eeprom_info req = {
- 		.addr = cpu_to_le32(round_down(offset,
-@@ -2840,8 +2840,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
- 		return ret;
- 
- 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
--	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
--	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
-+
-+	if (read_buf) {
-+		u32 offs = offset % MT7915_EEPROM_BLOCK_SIZE;
-+		*read_buf = res->data[offs];
-+	} else {
-+		buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
-+		memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
-+	}
-+
- 	dev_kfree_skb(skb);
- 
- 	return 0;
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 22454b54..2d3769c6 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -561,6 +561,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
- 
- int mt7915_register_device(struct mt7915_dev *dev);
- void mt7915_unregister_device(struct mt7915_dev *dev);
-+void mt7915_eeprom_rebonding(struct mt7915_dev *dev);
- int mt7915_eeprom_init(struct mt7915_dev *dev);
- void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
- 				struct mt7915_phy *phy);
-@@ -614,7 +615,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
- 				   struct ieee80211_sta *sta,
- 				   void *data, u32 field);
- int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
--int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
-+int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf);
- int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
- int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
- 		       bool hdr_trans);
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
similarity index 94%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
copy to recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 0b8f9b8..dcdb65c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 0a8c65105444a20637c868e376a322924b2429f2 Mon Sep 17 00:00:00 2001
+From f90d366773f3e1eec3a00b9191326963816c2708 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1126/1129] mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1127/1131] mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index fb760e17..22af66d5 100644
+index fb760e1..22af66d 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
@@ -100,7 +100,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index d96e5c23..949c8853 100644
+index d96e5c2..949c885 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,7 +12,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -141,5 +141,5 @@
 +
  #endif
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
similarity index 83%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
copy to recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index 526fda5..4d374c0 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,7 +1,7 @@
-From 1116673d44b71df37e01407ee6ebca0b6cc9f338 Mon Sep 17 00:00:00 2001
+From 0374780c5201fd70824eea091a416557020d5734 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1127/1129] mt76: mt7915: add E3 re-bonding for low yield rate
+Subject: [PATCH 1128/1131] mt76: mt7915: add E3 re-bonding for low yield rate
  issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,10 +12,10 @@
  3 files changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 64a7750b..efa9c173 100644
+index 54803e8..849275e 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
-@@ -99,7 +99,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+@@ -132,7 +132,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
  		/* read eeprom data from efuse */
  		block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
  		for (i = 0; i < block_num; i++) {
@@ -24,7 +24,7 @@
  			if (ret < 0)
  				return ret;
  		}
-@@ -206,6 +206,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
+@@ -239,6 +239,29 @@ void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  	dev->chainshift = hweight8(dev->mphy.chainmask);
  }
  
@@ -54,7 +54,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
-@@ -237,6 +260,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -275,6 +298,8 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  			return ret;
  	}
  
@@ -64,10 +64,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5791cb29..785c3c10 100644
+index 36a33f6..cb47ae6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2822,7 +2822,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+@@ -2836,7 +2836,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
  				 &req, sizeof(req), true);
  }
  
@@ -76,7 +76,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2840,8 +2840,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2854,8 +2854,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -95,10 +95,10 @@
  
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 22454b54..2d3769c6 100644
+index b9b86b8..ab81d41 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -561,6 +561,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -556,6 +556,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
@@ -106,7 +106,7 @@
  int mt7915_eeprom_init(struct mt7915_dev *dev);
  void mt7915_eeprom_parse_hw_cap(struct mt7915_dev *dev,
  				struct mt7915_phy *phy);
-@@ -614,7 +615,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -610,7 +611,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
  int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
@@ -116,5 +116,5 @@
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  		       bool hdr_trans);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
deleted file mode 100644
index 8d969ee..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From d0c879de4b067613307926ec75f0dd99081a3ef6 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1128/1129] mt76: mt7915: support on off SW ACI through debugfs
-
-Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
----
- mt76_connac_mcu.h    |  1 +
- mt7915/mtk_debugfs.c | 21 +++++++++++++++++++++
- 2 files changed, 22 insertions(+)
-
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5cff1a45..98b00747 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1201,6 +1201,7 @@ enum {
- 	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
- 	MCU_EXT_CMD_SET_CFG = 0xb7,
- 	MCU_EXT_CMD_EDCCA = 0xba,
-+	MCU_EXT_CMD_SWLNA_ACI_CTRL = 0xc0,
- 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
- 	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
- };
-diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 376e5f89..846dc5e3 100644
---- a/mt7915/mtk_debugfs.c
-+++ b/mt7915/mtk_debugfs.c
-@@ -2932,6 +2932,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
- 	return 0;
- }
- 
-+static int
-+mt7915_sw_aci_set(void *data, u64 val)
-+{
-+#define SWLNA_ENABLE 6
-+	struct mt7915_dev *dev = data;
-+	struct {
-+		u32 subcmd;
-+		u8 enable;
-+	} req = {
-+		.subcmd = SWLNA_ENABLE,
-+		.enable = (u8) val,
-+	};
-+	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(SWLNA_ACI_CTRL), &req, sizeof(req), NULL);
-+}
-+
-+
-+DEFINE_DEBUGFS_ATTRIBUTE(fops_sw_aci, NULL,
-+			 mt7915_sw_aci_set, "%llx\n");
-+
- int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- {
- 	struct mt7915_dev *dev = phy->dev;
-@@ -3014,6 +3033,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
- 
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
- 				    mt7915_show_eeprom_mode);
-+	debugfs_create_file("sw_aci", 0600, dir, dev,
-+			    &fops_sw_aci);
- 	return 0;
- }
- #endif
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
deleted file mode 100644
index 4bf0dc1..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ /dev/null
@@ -1,425 +0,0 @@
-From c213af98be4f1ebe14930ce180a0c33b9180a339 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1129/1129] mt76: mt7915: add bf backoff limit table support
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- eeprom.c         |  25 +++++++++-
- mt76.h           |   8 +++
- mt7915/debugfs.c |  73 ++++++++++++++++++++++++++--
- mt7915/mcu.c     | 124 +++++++++++++++++++++++++++++++++++------------
- mt7915/mcu.h     |   6 +++
- mt7915/mt7915.h  |   4 +-
- 6 files changed, 203 insertions(+), 37 deletions(-)
-
-diff --git a/eeprom.c b/eeprom.c
-index aac70efb..6290156f 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -308,7 +308,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
- 	if (!mcs_rates)
- 		mcs_rates = 10;
- 
--	memset(dest, target_power, sizeof(*dest));
-+	memset(dest, target_power, sizeof(*dest) - sizeof(dest->path));
-+	memset(&dest->path, 0, sizeof(dest->path));
- 
- 	if (!IS_ENABLED(CONFIG_OF))
- 		return target_power;
-@@ -361,6 +362,28 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
- 				     ARRAY_SIZE(dest->ru), val, len,
- 				     target_power, txs_delta, &max_power);
- 
-+	val = mt76_get_of_array(np, "paths-cck", &len, ARRAY_SIZE(dest->path.cck));
-+	mt76_apply_array_limit(dest->path.cck, ARRAY_SIZE(dest->path.cck), val,
-+			       target_power, txs_delta, &max_power);
-+
-+	val = mt76_get_of_array(np, "paths-ofdm", &len, ARRAY_SIZE(dest->path.ofdm));
-+	mt76_apply_array_limit(dest->path.ofdm, ARRAY_SIZE(dest->path.ofdm), val,
-+			       target_power, txs_delta, &max_power);
-+
-+	val = mt76_get_of_array(np, "paths-ofdm-bf", &len, ARRAY_SIZE(dest->path.ofdm_bf));
-+	mt76_apply_array_limit(dest->path.ofdm_bf, ARRAY_SIZE(dest->path.ofdm_bf), val,
-+			       target_power, txs_delta, &max_power);
-+
-+	val = mt76_get_of_array(np, "paths-ru", &len, ARRAY_SIZE(dest->path.ru[0]) + 1);
-+	mt76_apply_multi_array_limit(dest->path.ru[0], ARRAY_SIZE(dest->path.ru[0]),
-+				     ARRAY_SIZE(dest->path.ru), val, len,
-+				     target_power, txs_delta, &max_power);
-+
-+	val = mt76_get_of_array(np, "paths-ru-bf", &len, ARRAY_SIZE(dest->path.ru_bf[0]) + 1);
-+	mt76_apply_multi_array_limit(dest->path.ru_bf[0], ARRAY_SIZE(dest->path.ru_bf[0]),
-+				     ARRAY_SIZE(dest->path.ru_bf), val, len,
-+				     target_power, txs_delta, &max_power);
-+
- 	return max_power;
- }
- EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
-diff --git a/mt76.h b/mt76.h
-index d102333b..01baceaf 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -900,6 +900,14 @@ struct mt76_power_limits {
- 	s8 ofdm[8];
- 	s8 mcs[4][10];
- 	s8 ru[7][12];
-+
-+	struct {
-+		s8 cck[4];
-+		s8 ofdm[4];
-+		s8 ofdm_bf[4];
-+		s8 ru[7][10];
-+		s8 ru_bf[7][10];
-+	} path;
- };
- 
- struct mt76_ethtool_worker_info {
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f1f3f2f3..3ef2148b 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -1024,7 +1024,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
- 	if (!buf)
- 		return -ENOMEM;
- 
--	ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr));
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr), TX_POWER_INFO_RATE);
- 	if (ret)
- 		goto out;
- 
-@@ -1134,7 +1134,7 @@ mt7915_rate_txpower_set(struct file *file, const char __user *user_buf,
- 
- 	mutex_lock(&dev->mt76.mutex);
- 	ret = mt7915_mcu_get_txpower_sku(phy, req.txpower_sku,
--					 sizeof(req.txpower_sku));
-+					 sizeof(req.txpower_sku), TX_POWER_INFO_RATE);
- 	if (ret)
- 		goto out;
- 
-@@ -1176,7 +1176,7 @@ out:
- 	return ret ? ret : count;
- }
- 
--static const struct file_operations mt7915_rate_txpower_fops = {
-+static const struct file_operations mt7915_txpower_fops = {
- 	.write = mt7915_rate_txpower_set,
- 	.read = mt7915_rate_txpower_get,
- 	.open = simple_open,
-@@ -1184,6 +1184,69 @@ static const struct file_operations mt7915_rate_txpower_fops = {
- 	.llseek = default_llseek,
- };
- 
-+static int
-+mt7915_path_txpower_show(struct seq_file *file)
-+{
-+	struct mt7915_phy *phy = file->private;
-+	s8 txpower[MT7915_SKU_PATH_NUM], *buf = txpower;
-+	int ret;
-+
-+#define PATH_POWER_SHOW(_name, _len, _skip) do {				\
-+		if (_skip) {						\
-+			buf -= 1;					\
-+			*buf = 0;					\
-+		}							\
-+		mt76_seq_puts_array(file, _name, buf, _len);		\
-+		buf += _len;						\
-+	} while(0)
-+
-+	seq_printf(file, "\n%*c", 11, ' ');
-+	seq_printf(file, "1T1S/2T1S/3T1S/4T1S/2T2S/3T2S/4T2S/3T3S/4T3S/4T4S\n");
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpower, sizeof(txpower),
-+					 TX_POWER_INFO_PATH);
-+	if (ret)
-+		return ret;
-+
-+	PATH_POWER_SHOW("CCK", 4, 0);
-+	PATH_POWER_SHOW("OFDM", 4, 0);
-+	PATH_POWER_SHOW("BF-OFDM", 4, 1);
-+
-+	PATH_POWER_SHOW("HT20", 10, 0);
-+	PATH_POWER_SHOW("BF-HT20", 10, 1);
-+	PATH_POWER_SHOW("HT40", 10, 0);
-+	PATH_POWER_SHOW("BF-HT40", 10, 1);
-+
-+	PATH_POWER_SHOW("RU242", 10, 0);
-+	PATH_POWER_SHOW("BF-RU242", 10, 1);
-+	PATH_POWER_SHOW("RU484", 10, 0);
-+	PATH_POWER_SHOW("BF-RU484", 10, 1);
-+	PATH_POWER_SHOW("RU996", 10, 0);
-+	PATH_POWER_SHOW("BF-RU996", 10, 1);
-+	PATH_POWER_SHOW("RU2x996", 10, 0);
-+	PATH_POWER_SHOW("BF-RU2x996", 10, 1);
-+	PATH_POWER_SHOW("RU26", 10, 0);
-+	PATH_POWER_SHOW("BF-RU26", 10, 0);
-+	PATH_POWER_SHOW("RU52", 10, 0);
-+	PATH_POWER_SHOW("BF-RU52", 10, 0);
-+	PATH_POWER_SHOW("RU106", 10, 0);
-+	PATH_POWER_SHOW("BF-RU106", 10, 0);
-+#undef PATH_POWER_SHOW
-+
-+	return 0;
-+}
-+
-+static int
-+mt7915_txpower_path_show(struct seq_file *file, void *data)
-+{
-+	struct mt7915_phy *phy = file->private;
-+
-+	seq_printf(file, "\nBand %d\n", phy != &phy->dev->phy);
-+
-+	return mt7915_path_txpower_show(file);
-+}
-+
-+DEFINE_SHOW_ATTRIBUTE(mt7915_txpower_path);
-+
- static int
- mt7915_twt_stats(struct seq_file *s, void *data)
- {
-@@ -1270,7 +1333,9 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
- 	debugfs_create_file("implicit_txbf", 0600, dir, dev,
- 			    &fops_implicit_txbf);
- 	debugfs_create_file("txpower_sku", 0400, dir, phy,
--			    &mt7915_rate_txpower_fops);
-+			    &mt7915_txpower_fops);
-+	debugfs_create_file("txpower_path", 0400, dir, phy,
-+			    &mt7915_txpower_path_fops);
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
- 				    mt7915_twt_stats);
- 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 785c3c10..4b7ad450 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3259,7 +3259,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
- 	int ret;
- 	s8 txpower_sku[MT7915_SKU_RATE_NUM];
- 
--	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku));
-+	ret = mt7915_mcu_get_txpower_sku(phy, txpower_sku, sizeof(txpower_sku),
-+					 TX_POWER_INFO_RATE);
- 	if (ret)
- 		return ret;
- 
-@@ -3301,51 +3302,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
- 
- int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
- {
-+#define TX_POWER_LIMIT_TABLE_RATE	0
-+#define TX_POWER_LIMIT_TABLE_PATH	1
- 	struct mt7915_dev *dev = phy->dev;
- 	struct mt76_phy *mphy = phy->mt76;
- 	struct ieee80211_hw *hw = mphy->hw;
--	struct mt7915_mcu_txpower_sku req = {
-+	struct mt7915_sku_val {
-+		u8 format_id;
-+		u8 limit_type;
-+		u8 band_idx;
-+	} __packed hdr = {
- 		.format_id = TX_POWER_LIMIT_TABLE,
-+		.limit_type = TX_POWER_LIMIT_TABLE_RATE,
- 		.band_idx = phy->mt76->band_idx,
- 	};
--	struct mt76_power_limits limits_array;
--	s8 *la = (s8 *)&limits_array;
--	int i, idx;
--	int tx_power;
-+	int i, ret, tx_power;
-+	const u8 *len = mt7915_sku_group_len;
-+	struct mt76_power_limits la = {};
-+	struct sk_buff *skb;
- 
- 	tx_power = mt7915_get_power_bound(phy, hw->conf.power_level);
- 	tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
--					      &limits_array, tx_power);
-+					      &la, tx_power);
- 	mphy->txpower_cur = tx_power;
- 
--	for (i = 0, idx = 0; i < ARRAY_SIZE(mt7915_sku_group_len); i++) {
--		u8 mcs_num, len = mt7915_sku_group_len[i];
--		int j;
-+	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
-+				 sizeof(hdr) + MT7915_SKU_RATE_NUM);
-+	if (!skb)
-+		return -ENOMEM;
- 
--		if (i >= SKU_HT_BW20 && i <= SKU_VHT_BW160) {
--			mcs_num = 10;
-+	skb_put_data(skb, &hdr, sizeof(hdr));
-+	skb_put_data(skb, &la.cck, len[SKU_CCK] + len[SKU_OFDM]);
-+	skb_put_data(skb, &la.mcs[0], len[SKU_HT_BW20]);
-+	skb_put_data(skb, &la.mcs[1], len[SKU_HT_BW40]);
- 
--			if (i == SKU_HT_BW20 || i == SKU_VHT_BW20)
--				la = (s8 *)&limits_array + 12;
--		} else {
--			mcs_num = len;
--		}
-+	/* vht */
-+	for (i = 0; i < 4; i++) {
-+		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
-+		skb_put_zero(skb, 2);  /* padding */
-+	}
-+
-+	/* he */
-+	skb_put_data(skb, &la.ru[0], sizeof(la.ru));
-+
-+	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
-+				    MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
-+	if (ret)
-+		return ret;
-+
-+	/* only set per-path power table when it's configured */
-+	if (!la.path.ofdm[0])
-+		return 0;
- 
--		for (j = 0; j < min_t(u8, mcs_num, len); j++)
--			req.txpower_sku[idx + j] = la[j];
-+	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
-+				 sizeof(hdr) + MT7915_SKU_PATH_NUM);
-+	if (!skb)
-+		return -ENOMEM;
- 
--		la += mcs_num;
--		idx += len;
-+	hdr.limit_type = TX_POWER_LIMIT_TABLE_PATH;
-+	skb_put_data(skb, &hdr, sizeof(hdr));
-+	skb_put_data(skb, &la.path.cck, sizeof(la.path.cck));
-+	skb_put_data(skb, &la.path.ofdm, sizeof(la.path.ofdm));
-+	skb_put_data(skb, &la.path.ofdm_bf[1], sizeof(la.path.ofdm_bf) - 1);
-+
-+	/* HT20 and HT40 */
-+	skb_put_data(skb, &la.path.ru[0], sizeof(la.path.ru[0]));
-+	skb_put_data(skb, &la.path.ru_bf[0][1], sizeof(la.path.ru_bf[0]) - 1);
-+	skb_put_data(skb, &la.path.ru[1], sizeof(la.path.ru[1]));
-+	skb_put_data(skb, &la.path.ru_bf[1][1], sizeof(la.path.ru_bf[1]) - 1);
-+
-+	/* start from non-bf and bf fields of
-+	 * BW20/RU242, BW40/RU484, BW80/RU996, BW160/RU2x996,
-+	 * RU26, RU52, and RU106
-+	 */
-+	for (i = 7; i < 21; i++) {
-+		bool bf = !(i % 2);
-+		u8 idx = (i - 7) / 2;
-+		s8 *buf = bf ? la.path.ru_bf[idx] : la.path.ru[idx];
-+
-+		/* The non-bf fields of RU26 to RU106 are special cases */
-+		if (bf && i < 15)
-+			skb_put_data(skb, buf + 1, 9);
-+		else
-+			skb_put_data(skb, buf, 10);
- 	}
- 
--	return mt76_mcu_send_msg(&dev->mt76,
--				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
--				 sizeof(req), true);
-+	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
-+ 				     MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
- }
- 
--int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
-+int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
-+			       u8 category)
- {
--#define RATE_POWER_INFO	2
- 	struct mt7915_dev *dev = phy->dev;
- 	struct {
- 		u8 format_id;
-@@ -3354,10 +3402,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
- 		u8 _rsv;
- 	} __packed req = {
- 		.format_id = TX_POWER_LIMIT_INFO,
--		.category = RATE_POWER_INFO,
-+		.category = category,
- 		.band_idx = phy->mt76->band_idx,
- 	};
--	s8 txpower_sku[MT7915_SKU_RATE_NUM][2];
- 	struct sk_buff *skb;
- 	int ret, i;
- 
-@@ -3367,9 +3414,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
- 	if (ret)
- 		return ret;
- 
--	memcpy(txpower_sku, skb->data + 4, sizeof(txpower_sku));
--	for (i = 0; i < len; i++)
--		txpower[i] = txpower_sku[i][req.band_idx];
-+	if (category == TX_POWER_INFO_RATE) {
-+		s8 res[MT7915_SKU_RATE_NUM][2];
-+
-+		memcpy(res, skb->data + 4, sizeof(res));
-+		for (i = 0; i < len; i++)
-+			txpower[i] = res[i][req.band_idx];
-+	} else if (category == TX_POWER_INFO_PATH) {
-+		memcpy(txpower, skb->data + 4, len);
-+	}
- 
- 	dev_kfree_skb(skb);
- 
-@@ -3411,9 +3464,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
- 		.band_idx = phy->mt76->band_idx,
- 		.sku_enable = enable,
- 	};
-+	int ret;
-+
-+	ret = mt76_mcu_send_msg(&dev->mt76,
-+				MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
-+				sizeof(req), true);
-+	if (ret)
-+		return ret;
- 
- 	pr_info("%s: enable = %d\n", __func__, enable);
- 
-+	req.format_id = TX_POWER_LIMIT_PATH_ENABLE;
-+ 
- 	return mt76_mcu_send_msg(&dev->mt76,
- 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
- 				 sizeof(req), true);
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 08476eb6..d110e210 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -446,12 +446,18 @@ enum {
- 
- enum {
- 	TX_POWER_LIMIT_ENABLE,
-+	TX_POWER_LIMIT_PATH_ENABLE = 0x3,
- 	TX_POWER_LIMIT_TABLE = 0x4,
- 	TX_POWER_LIMIT_INFO = 0x7,
- 	TX_POWER_LIMIT_FRAME = 0x11,
- 	TX_POWER_LIMIT_FRAME_MIN = 0x12,
- };
- 
-+enum {
-+	TX_POWER_INFO_PATH = 1,
-+	TX_POWER_INFO_RATE,
-+};
-+
- enum {
- 	SPR_ENABLE = 0x1,
- 	SPR_ENABLE_SD = 0x3,
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2d3769c6..2e6519e7 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -73,6 +73,7 @@
- #define MT7915_CDEV_THROTTLE_MAX	99
- 
- #define MT7915_SKU_RATE_NUM		161
-+#define MT7915_SKU_PATH_NUM		185
- 
- #define MT7915_MAX_TWT_AGRT		16
- #define MT7915_MAX_STA_TWT_AGRT		8
-@@ -624,7 +625,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
- int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
- int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
- int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
--int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len);
-+int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
-+			       u8 category);
- int mt7915_mcu_set_txpower_frame_min(struct mt7915_phy *phy, s8 txpower);
- int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
- 				 struct ieee80211_vif *vif,
--- 
-2.25.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
similarity index 82%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
copy to recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
index 8d969ee..6dd6422 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,7 +1,7 @@
-From d0c879de4b067613307926ec75f0dd99081a3ef6 Mon Sep 17 00:00:00 2001
+From 8f5d24612f329ef1388fa2a7611993dd4144040e Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1128/1129] mt76: mt7915: support on off SW ACI through debugfs
+Subject: [PATCH 1129/1131] mt76: mt7915: support on off SW ACI through debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
@@ -11,7 +11,7 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5cff1a45..98b00747 100644
+index 5cff1a4..98b0074 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1201,6 +1201,7 @@ enum {
@@ -23,10 +23,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 376e5f89..846dc5e3 100644
+index 7567666..19cc8cb 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2932,6 +2932,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -2963,6 +2963,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -52,7 +52,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3014,6 +3033,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3050,6 +3069,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
@@ -62,5 +62,5 @@
  }
  #endif
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch
deleted file mode 100644
index a10e878..0000000
--- a/recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From 0656e6d8dbeec9f83a1f20a0013112b814a0c4f0 Mon Sep 17 00:00:00 2001
-From: TomLiu <tomml.liu@mediatek.com>
-Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH] [mt76]amsdu set and get control
-
----
- mt7915/mac.c    | 10 ++++++++++
- mt7915/mt7915.h |  1 +
- mt7915/vendor.c | 31 +++++++++++++++++++++++++++++++
- mt7915/vendor.h | 12 ++++++++++++
- 4 files changed, 54 insertions(+)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3bbe757..0ef0fab 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -2072,6 +2072,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
- 	phy->trb_ts = trb;
- }
- 
-+void mt7915_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en) {
-+	struct mt76_phy *mphy = hw->priv;
-+	struct mt76_dev *mdev = mphy->dev;
-+
-+	if (en)
-+		ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
-+	else
-+		ieee80211_hw_clear(hw, SUPPORTS_AMSDU_IN_AMPDU);
-+}
-+
- #ifdef CONFIG_MTK_VENDOR
- void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
- {
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0fb1de3..8ee553a 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -820,6 +820,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
- 			 bool pci, int *irq);
- 
- #ifdef CONFIG_MTK_VENDOR
-+void mt7915_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
- void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta);
- void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
- void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
-diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 22af66d..a1f526c 100644
---- a/mt7915/vendor.c
-+++ b/mt7915/vendor.c
-@@ -30,10 +30,16 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA] = {.type = NLA_U8 },
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO] = {.type = NLA_U8 },
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE] = {.type = NLA_U16 },
-+	[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU] = {.type = NLA_U8 },
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA] = {.type = NLA_U8 },
- 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
- };
- 
-+static const struct nla_policy
-+wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
-+	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
-+};
-+
- static const struct nla_policy
- hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
- 	[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
-@@ -983,11 +989,35 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
- 		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
- 		mt7915_mcu_set_cfg(phy, CFGINFO_CERT_CFG, val8); /* Cert Enable for OMI */
- 		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
-+	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]) {
-+		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]);
-+		mt7915_set_wireless_amsdu(hw, val8);
- 	}
- 
- 	return 0;
- }
- 
-+static int
-+mt7915_vendor_wireless_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
-+			     struct sk_buff *skb, const void *data, int data_len,
-+			     unsigned long *storage)
-+{
-+	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
-+	struct mt7915_phy *phy = mt7915_hw_phy(hw);
-+	struct mt7915_dev *dev = phy->dev;
-+	int len = 0;
-+	if (*storage == 1)
-+		return -ENOENT;
-+	*storage = 1;
-+
-+	if (nla_put_u8(skb,
-+	    MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU, ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU)))
-+		return -ENOMEM;
-+	len += 2;
-+
-+	return len;
-+}
-+
- static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
- 				  struct wireless_dev *wdev,
- 				  const void *data,
-@@ -1287,6 +1317,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
- 		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
- 			WIPHY_VENDOR_CMD_NEED_RUNNING,
- 		.doit = mt7915_vendor_wireless_ctrl,
-+		.dumpit = mt7915_vendor_wireless_ctrl_dump,
- 		.policy = wireless_ctrl_policy,
- 		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
- 	},
-diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 949c885..cbff910 100644
---- a/mt7915/vendor.h
-+++ b/mt7915/vendor.h
-@@ -74,6 +74,7 @@ enum mtk_vendor_attr_wireless_ctrl {
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
-+	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT = 9,
- 
- 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA, /* reserve */
-@@ -83,6 +84,17 @@ enum mtk_vendor_attr_wireless_ctrl {
- 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
- };
- 
-+enum mtk_vendor_attr_wireless_dump {
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
-+
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
-+
-+	/* keep last */
-+	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
-+	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
-+		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
-+};
-+
- enum mtk_vendor_attr_hemu_ctrl {
- 	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
- 
--- 
-2.32.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
similarity index 92%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
copy to recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index 4bf0dc1..925cc85 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,7 +1,7 @@
-From c213af98be4f1ebe14930ce180a0c33b9180a339 Mon Sep 17 00:00:00 2001
+From 0a2eb27dac0f869ae5a9d6468acc13fb76fdf5f2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1129/1129] mt76: mt7915: add bf backoff limit table support
+Subject: [PATCH 1130/1131] mt76: mt7915: add bf backoff limit table support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -14,10 +14,10 @@
  6 files changed, 203 insertions(+), 37 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index aac70efb..6290156f 100644
+index 05b6dfa..d161264 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -308,7 +308,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -310,7 +310,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	if (!mcs_rates)
  		mcs_rates = 10;
  
@@ -27,7 +27,7 @@
  
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
-@@ -361,6 +362,28 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -363,6 +364,28 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  				     ARRAY_SIZE(dest->ru), val, len,
  				     target_power, txs_delta, &max_power);
  
@@ -57,10 +57,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
 diff --git a/mt76.h b/mt76.h
-index d102333b..01baceaf 100644
+index 9b6e806..c81ece0 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -900,6 +900,14 @@ struct mt76_power_limits {
+@@ -906,6 +906,14 @@ struct mt76_power_limits {
  	s8 ofdm[8];
  	s8 mcs[4][10];
  	s8 ru[7][12];
@@ -76,7 +76,7 @@
  
  struct mt76_ethtool_worker_info {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f1f3f2f3..3ef2148b 100644
+index f1f3f2f..3ef2148 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1024,7 +1024,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -188,10 +188,10 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 785c3c10..4b7ad450 100644
+index cb47ae6..d380811 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3259,7 +3259,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3281,7 +3281,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	int ret;
  	s8 txpower_sku[MT7915_SKU_RATE_NUM];
  
@@ -201,7 +201,7 @@
  	if (ret)
  		return ret;
  
-@@ -3301,51 +3302,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3323,51 +3324,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  {
@@ -260,10 +260,14 @@
 +		skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
 +		skb_put_zero(skb, 2);  /* padding */
 +	}
-+
+ 
+-		for (j = 0; j < min_t(u8, mcs_num, len); j++)
+-			req.txpower_sku[idx + j] = la[j];
 +	/* he */
 +	skb_put_data(skb, &la.ru[0], sizeof(la.ru));
-+
+ 
+-		la += mcs_num;
+-		idx += len;
 +	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 +				    MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
 +	if (ret)
@@ -272,16 +276,12 @@
 +	/* only set per-path power table when it's configured */
 +	if (!la.path.ofdm[0])
 +		return 0;
- 
--		for (j = 0; j < min_t(u8, mcs_num, len); j++)
--			req.txpower_sku[idx + j] = la[j];
++
 +	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
 +				 sizeof(hdr) + MT7915_SKU_PATH_NUM);
 +	if (!skb)
 +		return -ENOMEM;
- 
--		la += mcs_num;
--		idx += len;
++
 +	hdr.limit_type = TX_POWER_LIMIT_TABLE_PATH;
 +	skb_put_data(skb, &hdr, sizeof(hdr));
 +	skb_put_data(skb, &la.path.cck, sizeof(la.path.cck));
@@ -314,7 +314,7 @@
 -				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
 -				 sizeof(req), true);
 +	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
-+ 				     MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
++				     MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), true);
  }
  
 -int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
@@ -325,7 +325,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3354,10 +3402,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3376,10 +3424,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -337,7 +337,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3367,9 +3414,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3389,9 +3436,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -356,7 +356,7 @@
  
  	dev_kfree_skb(skb);
  
-@@ -3411,9 +3464,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3433,9 +3486,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.band_idx = phy->mt76->band_idx,
  		.sku_enable = enable,
  	};
@@ -371,12 +371,12 @@
  	pr_info("%s: enable = %d\n", __func__, enable);
  
 +	req.format_id = TX_POWER_LIMIT_PATH_ENABLE;
-+ 
++
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 08476eb6..d110e210 100644
+index 025a03b..b33e671 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -446,12 +446,18 @@ enum {
@@ -399,10 +399,10 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2d3769c6..2e6519e7 100644
+index ab81d41..f5ac92e 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -73,6 +73,7 @@
+@@ -64,6 +64,7 @@
  #define MT7915_CDEV_THROTTLE_MAX	99
  
  #define MT7915_SKU_RATE_NUM		161
@@ -410,7 +410,7 @@
  
  #define MT7915_MAX_TWT_AGRT		16
  #define MT7915_MAX_STA_TWT_AGRT		8
-@@ -624,7 +625,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
+@@ -620,7 +621,8 @@ int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
  int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable);
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
@@ -421,5 +421,5 @@
  int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  				 struct ieee80211_vif *vif,
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch b/recipes-wifi/linux-mt76/files/patches/1131-mt76-mt7915-amsdu-set-and-get-control.patch
similarity index 92%
copy from recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch
copy to recipes-wifi/linux-mt76/files/patches/1131-mt76-mt7915-amsdu-set-and-get-control.patch
index a10e878..af5b7cb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1131-mt76-mt7915-amsdu-set-and-get-control.patch
@@ -1,7 +1,7 @@
-From 0656e6d8dbeec9f83a1f20a0013112b814a0c4f0 Mon Sep 17 00:00:00 2001
+From fab73eabb07885ee8a29bb875c1f0911fd348cf6 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH] [mt76]amsdu set and get control
+Subject: [PATCH 1131/1131] mt76: mt7915: amsdu set and get control
 
 ---
  mt7915/mac.c    | 10 ++++++++++
@@ -11,10 +11,10 @@
  4 files changed, 54 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 3bbe757..0ef0fab 100644
+index 9d4cfa1..a0df785 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -2072,6 +2072,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2053,6 +2053,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -32,10 +32,10 @@
  void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0fb1de3..8ee553a 100644
+index f5ac92e..5cc1924 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -820,6 +820,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -746,6 +746,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
  
 -- 
-2.32.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
old mode 100755
new mode 100644
index 74bc9e6..6b63567
--- a/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From aa48497ccb0236e8724d8434be06055e31297e93 Mon Sep 17 00:00:00 2001
+From 2b4b610ac1e30c0b20d1882bc9612ca1639cb66b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 3001/3012] mt76: mt7915: wed: add wed tx support
+Subject: [PATCH 3001/3013] mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 8ba883b0..f70987dd 100644
+index 8ba883b..f70987d 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -24,10 +24,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 22dd66e3..5373777a 100644
+index a0df785..0984357 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -889,9 +889,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -891,9 +891,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -39,7 +39,7 @@
  }
  
  static void
-@@ -1007,6 +1007,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1009,6 +1009,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -47,7 +47,7 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1062,12 +1063,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1064,12 +1065,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -65,10 +65,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 94b7a651..370bfad7 100644
+index 09cf35c..2dd78ca 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1512,14 +1512,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1533,14 +1533,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -86,7 +86,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 26881fdc..ac574722 100644
+index c1b421d..04411e7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -11,7 +11,7 @@
@@ -98,7 +98,7 @@
  module_param(wed_enable, bool, 0644);
  MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
  
-@@ -580,7 +580,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -582,7 +582,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  
  	spin_lock_bh(&dev->mt76.token_lock);
@@ -107,7 +107,7 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  
  	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-@@ -790,6 +790,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -792,6 +792,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
@@ -116,5 +116,5 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
old mode 100755
new mode 100644
index b3442f4..d1bbe98
--- a/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
@@ -1,7 +1,7 @@
-From 2d158600e7c9b18069111d5935e9dbaf8c9277f3 Mon Sep 17 00:00:00 2001
+From b49d4ef99775b7942b4f56e2f0e4d7c303ce415c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 17:51:26 +0800
-Subject: [PATCH 3002/3012] mt76: mt7915: wed: add wds support when wed is
+Subject: [PATCH 3002/3013] mt76: mt7915: wed: add wds support when wed is
  enabled
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 81 insertions(+), 8 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 01baceaf..7b222e73 100644
+index c81ece0..cba11f6 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -60,6 +60,12 @@ enum mt76_wed_type {
@@ -32,10 +32,10 @@
  	u32 (*rr)(struct mt76_dev *dev, u32 offset);
  	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 370bfad7..75c78b8e 100644
+index 2dd78ca..eef4c3b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -675,8 +675,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -696,8 +696,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -52,7 +52,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1148,6 +1155,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1169,6 +1176,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -66,7 +66,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1519,8 +1533,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1540,8 +1554,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -81,10 +81,10 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 4b7ad450..bdfb71e2 100644
+index d380811..f494d9f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2350,8 +2350,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2364,8 +2364,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -105,7 +105,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d110e210..edb8b510 100644
+index b33e671..f2f88cc 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -284,6 +284,7 @@ enum {
@@ -117,7 +117,7 @@
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 diff --git a/util.c b/util.c
-index 58196442..5cd5ede0 100644
+index 5819644..5cd5ede 100644
 --- a/util.c
 +++ b/util.c
 @@ -42,9 +42,14 @@ bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
@@ -185,7 +185,7 @@
  int mt76_get_min_avg_rssi(struct mt76_dev *dev, bool ext_phy)
  {
 diff --git a/util.h b/util.h
-index 260965dd..99b7263c 100644
+index 260965d..99b7263 100644
 --- a/util.h
 +++ b/util.h
 @@ -27,7 +27,12 @@ enum {
@@ -203,5 +203,5 @@
  static inline void
  mt76_wcid_mask_set(u32 *mask, int idx)
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
old mode 100755
new mode 100644
index 0185209..f5d7847
--- a/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,7 +1,7 @@
-From ca14459b70818a138fa83ec38bfc91bce44b645c Mon Sep 17 00:00:00 2001
+From 7ecab7986d569ef1483785fbf52a34dfe78f8ec6 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 12:05:06 +0800
-Subject: [PATCH 3003/3012] mt76: connac: wed: add wed rx copy skb
+Subject: [PATCH 3003/3013] mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,7 +9,7 @@
  1 file changed, 18 insertions(+), 5 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index dc8d8882..53c7528f 100644
+index dc8d888..53c7528 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -386,9 +386,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -66,5 +66,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
old mode 100755
new mode 100644
index 0dc64bc..de8b136
--- a/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -1,7 +1,7 @@
-From 9c13748447e65404ad43c95b11479b71557851d8 Mon Sep 17 00:00:00 2001
+From bc37972dcfff183622582c44cb2908b903f9a624 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3012] mt76: mt7915: wed: add fill receive path to report
+Subject: [PATCH 3004/3013] mt76: mt7915: wed: add fill receive path to report
  wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0e08bde6..d8571642 100644
+index eef4c3b..7dd3973 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1544,6 +1544,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1565,6 +1565,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -38,7 +38,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1596,5 +1614,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1617,5 +1635,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
@@ -46,5 +46,5 @@
  #endif
  };
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
old mode 100755
new mode 100644
index 3222bb1..4cba14f
--- a/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -1,7 +1,7 @@
-From 5a4e0813aaaf66a658c9907b7834cb61e10ae682 Mon Sep 17 00:00:00 2001
+From e5379ae3f072fa04b43c777ed725bfb1f542142c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:07:46 +0800
-Subject: [PATCH 3005/3012] mt76: mt7915: wed: add ser support when wed on
+Subject: [PATCH 3005/3013] mt76: mt7915: wed: add ser support when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 76 insertions(+), 14 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 53c7528f..35beec72 100644
+index 53c7528..35beec7 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -109,7 +109,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 53c6ce25..4b9bc7f4 100644
+index 53c6ce2..4b9bc7f 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -56,5 +56,6 @@ enum mt76_mcu_evt_type {
@@ -120,10 +120,10 @@
  
  #endif
 diff --git a/mt76.h b/mt76.h
-index 7b222e73..75975cb5 100644
+index cba11f6..369e1e4 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1395,6 +1395,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1401,6 +1401,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,7 +132,7 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index e3fa0649..1ae6c339 100644
+index e3fa064..1ae6c33 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -4,6 +4,7 @@
@@ -211,10 +211,10 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5373777a..d5df73db 100644
+index 0984357..0d0ae7a 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -894,6 +894,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -896,6 +896,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  	return MT_TXD_TXP_BUF_SIZE;
  }
  
@@ -233,7 +233,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1633,6 +1645,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1635,6 +1647,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -247,10 +247,10 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index ac574722..ecc38e05 100644
+index 04411e7..e0761e8 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -617,6 +617,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -619,6 +619,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  		mt76_put_rxwi(&dev->mt76, t);
  	}
  
@@ -259,7 +259,7 @@
  	if (!wed->rx_buf_ring.rx_page.va)
  		return;
  
-@@ -782,6 +784,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -784,6 +786,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.init_rx_buf = mt7915_mmio_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7915_mmio_wed_release_rx_buf;
  	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
@@ -268,10 +268,10 @@
  	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2e6519e7..f9c02912 100644
+index 5cc1924..89c13db 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -559,6 +559,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -554,6 +554,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -280,5 +280,5 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
old mode 100755
new mode 100644
index 58d589d..3f720c6
--- a/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -1,7 +1,7 @@
-From 2c9f6ad4b961b736f60003d50b3e145c7b33a79d Mon Sep 17 00:00:00 2001
+From ff22ef4a4d68412999df62ca05c012c05ffdbf81 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3006/3012] mt76: mt7915: wed: enable red per-band token drop
+Subject: [PATCH 3006/3013] mt76: mt7915: wed: enable red per-band token drop
  for HW Path
 
 Limit the number of token used by each band. If a band uses too many token,
@@ -10,16 +10,17 @@
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
- mt7915/mcu.c    | 57 ++++++++++++++++++++++++++++++++++++++++---------
+ mt7915/mcu.c    | 56 ++++++++++++++++++++++++++++++++++++++++---------
  mt7915/mcu.h    |  1 +
- mt7915/mt7915.h |  3 ++-
- 3 files changed, 50 insertions(+), 11 deletions(-)
+ mt7915/mmio.c   |  2 +-
+ mt7915/mt7915.h |  4 +++-
+ 4 files changed, 51 insertions(+), 12 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index bdfb71e2..daa0006b 100644
+index f494d9f..5b2ae77 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2360,8 +2360,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2374,8 +2374,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  						dev->mt76.mmio.wed.rev_id, 0);
  		if (ret)
  			return ret;
@@ -37,7 +38,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2371,12 +2380,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2385,12 +2394,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -51,7 +52,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4508,6 +4512,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4533,6 +4537,34 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -60,7 +61,6 @@
 +static int mt7915_red_set_watermark(struct mt7915_dev *dev)
 +{
 +#define RED_GLOBAL_TOKEN_WATERMARK 2
-+#define TOTAL_HW_TOKEN_SIZE 8192
 +	struct {
 +		__le32 args[3];
 +
@@ -77,8 +77,8 @@
 +		.cmd = RED_GLOBAL_TOKEN_WATERMARK,
 +		.len = cpu_to_le16(sizeof(req) - 12),
 +
-+		.high_mark = cpu_to_le16(TOTAL_HW_TOKEN_SIZE - 256),
-+		.low_mark = cpu_to_le16(TOTAL_HW_TOKEN_SIZE - 256 - 1536),
++		.high_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256),
++		.low_mark = cpu_to_le16(MT7915_HW_TOKEN_SIZE - 256 - 1536),
 +	};
 +
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET), &req,
@@ -87,7 +87,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4518,17 +4551,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4543,17 +4575,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -114,7 +114,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index edb8b510..7963a700 100644
+index f2f88cc..572cc16 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -285,6 +285,7 @@ enum {
@@ -125,11 +125,32 @@
  #ifdef MTK_DEBUG
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index e0761e8..b29fe7a 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -759,7 +759,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
+ 		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
+ 	}
+-	wed->wlan.nbuf = 4096;
++	wed->wlan.nbuf = MT7915_HW_TOKEN_SIZE;
+ 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
+ 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
+ 	wed->wlan.txfree_tbit = is_mt7986(&dev->mt76) ? 2 : 1;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f9c02912..819cec99 100644
+index 89c13db..5b0f1fc 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -771,13 +771,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -56,6 +56,7 @@
+ 
+ #define MT7915_EEPROM_BLOCK_SIZE	16
+ #define MT7915_TOKEN_SIZE		8192
++#define MT7915_HW_TOKEN_SIZE		4096
+ 
+ #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
+ #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
+@@ -771,13 +772,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
@@ -146,5 +167,5 @@
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
old mode 100755
new mode 100644
index 52127c6..2fc10e1
--- a/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
@@ -1,7 +1,7 @@
-From f30bc7032eeb4a32393bdec69e719e3a1c9ceeae Mon Sep 17 00:00:00 2001
+From 9611e7a61942a25473151c8bdb0dd27fc173677e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH 3007/3012] mt76: mt7915: wed: update mt7916 trinfo when hw
+Subject: [PATCH 3007/3013] mt76: mt7915: wed: update mt7916 trinfo when hw
  path enable
 
 ---
@@ -10,7 +10,7 @@
  2 files changed, 23 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-index ecdc02ab..0a1ee808 100644
+index ecdc02a..0a1ee80 100644
 --- a/mt7915/mt7915_debug.h
 +++ b/mt7915/mt7915_debug.h
 @@ -133,6 +133,8 @@ enum dbg_reg_rev {
@@ -57,7 +57,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 846dc5e3..3365f3f3 100644
+index 19cc8cb..919cae4 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -856,12 +856,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
@@ -87,5 +87,5 @@
  	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
  	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
old mode 100755
new mode 100644
index 0309f74..9ee6f18
--- a/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -1,7 +1,7 @@
-From 82ba992b09e55d1291387351cc9dc0da0c6cb66b Mon Sep 17 00:00:00 2001
+From 973e2baf6322ac8b8d51efb1985b34f14a0c6f7b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 3008/3012] mt76: mt7915: wed: find rx token by physical
+Subject: [PATCH 3008/3013] mt76: mt7915: wed: find rx token by physical
  address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -13,7 +13,7 @@
  1 file changed, 20 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index 35beec72..327ed3bc 100644
+index 35beec7..327ed3b 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -376,10 +376,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -48,5 +48,5 @@
  			return NULL;
  
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
old mode 100755
new mode 100644
index 8d47adc..f1aa262
--- a/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -1,7 +1,7 @@
-From 7b8d03a4a4996e29c178a870c29b8ba7bd45c6d6 Mon Sep 17 00:00:00 2001
+From e3b19ec951ae28a023bdd132b0881f3da76b702f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 25 Nov 2022 14:37:58 +0800
-Subject: [PATCH 3009/3012] mt76: mt7915: wed: drop scatter and gather frame
+Subject: [PATCH 3009/3013] mt76: mt7915: wed: drop scatter and gather frame
 
 The scatter and gather frame may be incorrect because WED and WO may
 send frames to host driver interleaved.
@@ -14,7 +14,7 @@
  3 files changed, 11 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index 327ed3bc..0914266a 100644
+index 327ed3b..0914266 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -420,6 +420,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -34,7 +34,7 @@
  	} else {
  		buf = e->buf;
 diff --git a/dma.h b/dma.h
-index 4b9bc7f4..ce8ac426 100644
+index 4b9bc7f..ce8ac42 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -19,6 +19,7 @@
@@ -46,7 +46,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index b107516d..5bdf03f2 100644
+index 369e1e4..b10a16f 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -30,6 +30,7 @@
@@ -58,5 +58,5 @@
  #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
  				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
old mode 100755
new mode 100644
index 56903c1..8ddac8b
--- a/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,22 +1,22 @@
-From 40d816ec96c946c37635205f6f4a28795be5ffc0 Mon Sep 17 00:00:00 2001
+From c6cac9182a78e63ce5c768ae3c4f44c333d3660f Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3010/3012] mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 3010/3013] mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
  mt76_connac_mcu.h    |   2 +
  mt7915/debugfs.c     | 405 +++++++++++++++++++++++++++++++++++++++++++
  mt7915/init.c        |  39 +++++
- mt7915/main.c        |  16 ++
+ mt7915/main.c        |  15 ++
  mt7915/mcu.c         | 165 ++++++++++++++++++
  mt7915/mt7915.h      |  68 ++++++++
  mt7915/mtk_debugfs.c | 133 +++++++++++++-
- 7 files changed, 827 insertions(+), 1 deletion(-)
+ 7 files changed, 826 insertions(+), 1 deletion(-)
  mode change 100644 => 100755 mt7915/init.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 98b00747..239643b9 100644
+index 98b0074..239643b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1159,6 +1159,7 @@ enum {
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 3ef2148b..b178036c 100644
+index 3ef2148..b178036 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -468,10 +468,10 @@
 diff --git a/mt7915/init.c b/mt7915/init.c
 old mode 100644
 new mode 100755
-index 3f0a9d93..b9216233
+index e044f50..ef752e1
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -550,10 +550,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
+@@ -563,10 +563,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
  	}
  }
  
@@ -518,7 +518,7 @@
  
  	/* config pse qid6 wfdma port selection */
  	if (!is_mt7915(&dev->mt76) && dev->hif2)
-@@ -575,6 +611,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
+@@ -588,6 +624,9 @@ void mt7915_mac_init(struct mt7915_dev *dev)
  		mt7915_mac_init_band(dev, i);
  
  	mt7915_init_led_mux(dev);
@@ -529,29 +529,28 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 31cac5e1..a8e722f1 100644
+index 7dd3973..c87f04b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -199,6 +199,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -209,6 +209,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ 	struct mt7915_dev *dev = phy->dev;
 +	struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
-@@ -268,6 +269,10 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	int idx, ret = 0;
+@@ -270,6 +271,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
-+	if (mt7915_is_atf_default_on(wiphy, dev)) {
++	if (mt7915_is_atf_default_on(wiphy, dev))
 +		mt7915_mcu_set_vow_band(dev, mvif);
-+	}
 +
- out:
- 	mutex_unlock(&dev->mt76.mutex);
+ 	return ret;
+ }
  
-@@ -670,6 +675,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -691,6 +695,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -559,7 +558,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy;
  #endif
-@@ -721,6 +727,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -742,6 +747,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		mt7915_mcu_set_mimo(phy, 0);
  	}
  #endif
@@ -577,10 +576,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index daa0006b..3db8e436 100644
+index 5b2ae77..029d7e3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3511,6 +3511,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3533,6 +3533,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -751,12 +750,12 @@
 +
  int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  {
- 	struct {
+ #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 819cec99..ed293e70 100644
+index 5b0f1fc..30e878f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -130,6 +130,58 @@ struct mt7915_twt_flow {
+@@ -127,6 +127,58 @@ struct mt7915_twt_flow {
  
  DECLARE_EWMA(avg_signal, 10, 8)
  
@@ -815,7 +814,7 @@
  struct mt7915_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -151,6 +203,7 @@ struct mt7915_sta {
+@@ -148,6 +200,7 @@ struct mt7915_sta {
  		u8 flowid_mask;
  		struct mt7915_twt_flow flow[MT7915_MAX_STA_TWT_AGRT];
  	} twt;
@@ -823,7 +822,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -465,6 +518,8 @@ struct mt7915_dev {
+@@ -461,6 +514,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -832,7 +831,7 @@
  };
  
  enum {
-@@ -497,6 +552,15 @@ enum mt7915_rdd_cmd {
+@@ -493,6 +548,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -848,7 +847,7 @@
  static inline struct mt7915_phy *
  mt7915_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -624,6 +688,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+@@ -621,6 +685,10 @@ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
  int mt7915_mcu_set_test_param(struct mt7915_dev *dev, u8 param, bool test_mode,
  			      u8 en);
  int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band);
@@ -860,7 +859,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 3365f3f3..a8ffefd4 100644
+index 919cae4..c8df2d0 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1301,7 +1301,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
@@ -1011,5 +1010,5 @@
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
old mode 100755
new mode 100644
index fd0f0b6..bc013c7
--- a/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
@@ -1,7 +1,7 @@
-From 6a67d8e3c682c1f4332c2a45e0e4214c54605e67 Mon Sep 17 00:00:00 2001
+From cd6fa73880e4e69622f5e4f0ee30b0c3a60cc797 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 2 Dec 2022 17:17:06 +0800
-Subject: [PATCH 3011/3012] mt76: mt7915: wed: add mt7916 2 pcie support when
+Subject: [PATCH 3011/3013] mt76: mt7915: wed: add mt7916 2 pcie support when
  wed on
 
 It should use bit 23 in interrupt mask for wfdma band1 data
@@ -15,7 +15,7 @@
  3 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 1ae6c339..36260085 100644
+index 1ae6c33..3626008 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -88,8 +88,12 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
@@ -34,10 +34,10 @@
  				   MT7916_RXQ_MCU_WA_MAIN);
  			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3db8e436..2a689e92 100644
+index 029d7e3..387967d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2351,7 +2351,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2365,7 +2365,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  		return ret;
  
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
@@ -48,10 +48,10 @@
  						0, 0, 0);
  		else
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index ecc38e05..992beca3 100644
+index b29fe7a..4bc8e8c 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -964,13 +964,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
+@@ -966,13 +966,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
  	struct mt7915_dev *dev = dev_instance;
  	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
  
@@ -71,5 +71,5 @@
  	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
  		return IRQ_NONE;
 -- 
-2.25.1
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch b/recipes-wifi/linux-mt76/files/patches/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
old mode 100755
new mode 100644
index dc594ef..93bf1a4
--- a/recipes-wifi/linux-mt76/files/patches/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
+++ b/recipes-wifi/linux-mt76/files/patches/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
@@ -1,4 +1,4 @@
-From c326d38bf0da40d6b0ccbd13de2bb267398598d0 Mon Sep 17 00:00:00 2001
+From 3841127f712794f45b9078215feaa8221ed18851 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Wed, 14 Dec 2022 17:19:00 +0800
 Subject: [PATCH 3012/3013] mt76: mt7915: wed: add rxwi for further in chip rro
@@ -16,7 +16,7 @@
  7 files changed, 86 insertions(+), 78 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 0914266a..7ef272e2 100644
+index 0914266..7ef272e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -263,7 +263,7 @@
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
 diff --git a/mac80211.c b/mac80211.c
-index de9ef237..818f4f0c 100644
+index de9ef23..818f4f0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -597,7 +597,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -283,7 +283,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index f1795778..42364b81 100644
+index b10a16f..631c4cc 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -166,6 +166,7 @@ struct mt76_queue_entry {
@@ -322,7 +322,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  
-@@ -805,7 +812,6 @@ struct mt76_dev {
+@@ -809,7 +816,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -330,7 +330,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1394,8 +1400,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1400,8 +1406,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -341,7 +341,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1541,9 +1547,9 @@ struct mt76_txwi_cache *
+@@ -1547,9 +1553,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -354,7 +354,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 36260085..9cbd3625 100644
+index 3626008..9cbd362 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -492,7 +492,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -374,10 +374,10 @@
  
  		/* rx data queue for band1 */
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 992beca3..ba728dd0 100644
+index 4bc8e8c..09b3973 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -603,18 +603,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -605,18 +605,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  	for (i = 0; i < dev->mt76.rx_token_size; i++) {
@@ -403,7 +403,7 @@
  	}
  
  	mt76_free_pending_rxwi(&dev->mt76);
-@@ -639,7 +639,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -641,7 +641,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  				sizeof(struct skb_shared_info));
  
  	for (i = 0; i < size; i++) {
@@ -412,7 +412,7 @@
  		dma_addr_t phy_addr;
  		int token;
  		void *ptr;
-@@ -658,7 +658,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -660,7 +660,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  		}
  
  		desc->buf0 = cpu_to_le32(phy_addr);
@@ -421,7 +421,7 @@
  		if (token < 0) {
  			dma_unmap_single(dev->mt76.dma_dev, phy_addr,
  					 wed->wlan.rx_size, DMA_TO_DEVICE);
-@@ -786,7 +786,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -788,7 +788,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
  	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
  
@@ -430,7 +430,7 @@
  
  	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -992,6 +992,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -994,6 +994,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  				SURVEY_INFO_TIME_RX |
  				SURVEY_INFO_TIME_BSS_RX,
  		.token_size = MT7915_TOKEN_SIZE,
@@ -439,19 +439,19 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ed293e70..6def0596 100644
+index 30e878f..58ed90b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -65,6 +65,7 @@
- 
+@@ -57,6 +57,7 @@
  #define MT7915_EEPROM_BLOCK_SIZE	16
  #define MT7915_TOKEN_SIZE		8192
+ #define MT7915_HW_TOKEN_SIZE		4096
 +#define MT7915_RX_TOKEN_SIZE		4096
  
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index 6d55566f..a72b7779 100644
+index 6d55566..a72b777 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -756,16 +756,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
@@ -496,5 +496,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 -- 
-2.18.0
+2.36.1
 
diff --git a/recipes-wifi/linux-mt76/files/patches/3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch b/recipes-wifi/linux-mt76/files/patches/3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch
new file mode 100644
index 0000000..4399ad0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch
@@ -0,0 +1,86 @@
+From 164ff4c03d6f221bbb8b7dac87be102e1deab87c Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 16 Dec 2022 12:16:40 +0800
+Subject: [PATCH 3013/3013] mt76: mt7915: wed: fix potential memory leakage
+
+release rx queue pages in mt7915_mmio_wed_release_rx_buf.
+recycle rxwi when mt76_dma_add_buf() call fails.
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ dma.c         | 16 ++++++++++------
+ mt7915/mmio.c | 15 +++++++++++++++
+ 2 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index 7ef272e..0925daf 100644
+--- a/dma.c
++++ b/dma.c
+@@ -633,9 +633,11 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ 		qbuf.len = len - offset;
+ 		qbuf.skip_unmap = false;
+ 		if (mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL, r) < 0) {
++			mt76_put_rxwi(dev, r);
+ 			dma_unmap_single(dev->dma_dev, addr, len,
+ 					 DMA_FROM_DEVICE);
+-			skb_free_frag(buf);
++			if (!skip_alloc)
++				skb_free_frag(buf);
+ 			break;
+ 		}
+ 		frames++;
+@@ -758,12 +760,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ 	} while (1);
+ 	spin_unlock_bh(&q->lock);
+ 
+-	if (!q->rx_page.va)
+-		return;
++	if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) != MT76_WED_Q_RX) {
++		if (!q->rx_page.va)
++			return;
+ 
+-	page = virt_to_page(q->rx_page.va);
+-	__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
+-	memset(&q->rx_page, 0, sizeof(q->rx_page));
++		page = virt_to_page(q->rx_page.va);
++		__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++		memset(&q->rx_page, 0, sizeof(q->rx_page));
++	}
+ }
+ 
+ static void
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 09b3973..419338c 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -621,12 +621,27 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+ 
+ 	mt76_free_pending_rxwi(&dev->mt76);
+ 
++	mt76_for_each_q_rx(&dev->mt76, i) {
++		if (FIELD_GET(MT_QFLAG_WED_TYPE,
++			      dev->mt76.q_rx[i].flags) == MT76_WED_Q_RX) {
++			struct mt76_queue *q = &dev->mt76.q_rx[i];
++
++			if (!q->rx_page.va)
++				continue;
++
++			page = virt_to_page(q->rx_page.va);
++			__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
++			memset(&q->rx_page, 0, sizeof(q->rx_page));
++		}
++	}
++
+ 	if (!wed->rx_buf_ring.rx_page.va)
+ 		return;
+ 
+ 	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
+ 	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
+ 	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
++
+ }
+ 
+ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+-- 
+2.36.1
+
diff --git a/recipes-wifi/linux-mt76/files/patches/4000-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches/4000-mt76-revert-get_of_mac_addr.patch
deleted file mode 100644
index c284213..0000000
--- a/recipes-wifi/linux-mt76/files/patches/4000-mt76-revert-get_of_mac_addr.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 393196a25088287cd0e7d6b96ccaae65d44cd25e Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 13 Dec 2022 10:51:46 +0800
-Subject: [PATCH 4000/4002] mt76: revert get_of_mac_addr
-
----
- eeprom.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/eeprom.c b/eeprom.c
-index 6290156..306c641 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -126,9 +126,15 @@ void
- mt76_eeprom_override(struct mt76_phy *phy)
- {
- 	struct mt76_dev *dev = phy->dev;
-+#ifdef CONFIG_OF
- 	struct device_node *np = dev->dev->of_node;
-+	const u8 *mac = NULL;
- 
--	of_get_mac_address(np, phy->macaddr);
-+	if (np)
-+		mac = of_get_mac_address(np);
-+	if (!IS_ERR_OR_NULL(mac))
-+		ether_addr_copy(phy->macaddr, mac);
-+#endif
- 
- 	if (!is_valid_ether_addr(phy->macaddr)) {
- 		eth_random_addr(phy->macaddr);
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches/4001-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches/4001-mt76-include-header-files-for-module-param.patch
deleted file mode 100644
index 02d22be..0000000
--- a/recipes-wifi/linux-mt76/files/patches/4001-mt76-include-header-files-for-module-param.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 651309c679bcab8d573a64c5504aeb6fbdb228fb Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 13 Dec 2022 10:38:13 +0800
-Subject: [PATCH 4001/4002] mt76: include header files for module param
-
----
- mcu.c             | 1 +
- mt7615/mcu.c      | 1 +
- mt76_connac_mcu.c | 1 +
- mt7915/mcu.c      | 1 +
- 4 files changed, 4 insertions(+)
-
-diff --git a/mcu.c b/mcu.c
-index a8cafa3..fa4b054 100644
---- a/mcu.c
-+++ b/mcu.c
-@@ -4,6 +4,7 @@
-  */
- 
- #include "mt76.h"
-+#include <linux/moduleparam.h>
- 
- struct sk_buff *
- __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
-diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index 83f3030..e917d02 100644
---- a/mt7615/mcu.c
-+++ b/mt7615/mcu.c
-@@ -10,6 +10,7 @@
- #include "mcu.h"
- #include "mac.h"
- #include "eeprom.h"
-+#include <linux/moduleparam.h>
- 
- static bool prefer_offload_fw = true;
- module_param(prefer_offload_fw, bool, 0644);
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 291a7c1..5649377 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -4,6 +4,7 @@
- #include <linux/firmware.h>
- #include "mt76_connac2_mac.h"
- #include "mt76_connac_mcu.h"
-+#include <linux/module.h>
- 
- int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
- {
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1cdb9d4..69f1a0d 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -6,6 +6,7 @@
- #include "mcu.h"
- #include "mac.h"
- #include "eeprom.h"
-+#include <linux/moduleparam.h>
- 
- #define fw_name(_dev, name, ...)	({			\
- 	char *_fw;						\
--- 
-2.36.1
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch b/recipes-wifi/linux-mt76/files/patches/4001-mt76-revert-get_of_mac_addr.patch
similarity index 78%
copy from recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
copy to recipes-wifi/linux-mt76/files/patches/4001-mt76-revert-get_of_mac_addr.patch
index c284213..24765d3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4000-mt76-revert-get_of_mac_addr.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4001-mt76-revert-get_of_mac_addr.patch
@@ -1,17 +1,17 @@
-From 393196a25088287cd0e7d6b96ccaae65d44cd25e Mon Sep 17 00:00:00 2001
+From 244af26d38efede627e99cdc3acdb0f6f15f48fb Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:51:46 +0800
-Subject: [PATCH 4000/4002] mt76: revert get_of_mac_addr
+Subject: [PATCH 4001/4003] mt76: revert get_of_mac_addr
 
 ---
  eeprom.c | 8 +++++++-
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 6290156..306c641 100644
+index d161264..1f29cf9 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -126,9 +126,15 @@ void
+@@ -128,9 +128,15 @@ void
  mt76_eeprom_override(struct mt76_phy *phy)
  {
  	struct mt76_dev *dev = phy->dev;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch b/recipes-wifi/linux-mt76/files/patches/4002-mt76-include-header-files-for-module-param.patch
similarity index 87%
copy from recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
copy to recipes-wifi/linux-mt76/files/patches/4002-mt76-include-header-files-for-module-param.patch
index 02d22be..12b4622 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/4001-mt76-include-header-files-for-module-param.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4002-mt76-include-header-files-for-module-param.patch
@@ -1,7 +1,7 @@
-From 651309c679bcab8d573a64c5504aeb6fbdb228fb Mon Sep 17 00:00:00 2001
+From 7d95234bbc996b0fcfb9500a24b600d769f819d4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:38:13 +0800
-Subject: [PATCH 4001/4002] mt76: include header files for module param
+Subject: [PATCH 4002/4003] mt76: include header files for module param
 
 ---
  mcu.c             | 1 +
@@ -35,7 +35,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 291a7c1..5649377 100644
+index 14ce09e..d406013 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -47,7 +47,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1cdb9d4..69f1a0d 100644
+index 387967d..88ce44f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch b/recipes-wifi/linux-mt76/files/patches/4003-mt76-revert-for-backports-5.15-wireless-stack.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
rename to recipes-wifi/linux-mt76/files/patches/4003-mt76-revert-for-backports-5.15-wireless-stack.patch
index d8b267e..17e80ac 100644
--- a/recipes-wifi/linux-mt76/files/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/recipes-wifi/linux-mt76/files/patches/4003-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,7 +1,7 @@
-From 696f1e5e4f64e1426b74fe3d881390cb6cd47ebe Mon Sep 17 00:00:00 2001
+From 156663f40f0af9fef71e64fd573b2a113bb90098 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 12 Dec 2022 18:17:12 +0800
-Subject: [PATCH 4002/4002] mt76: revert for backports-5.15 wireless stack
+Subject: [PATCH 4003/4003] mt76: revert for backports-5.15 wireless stack
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -39,10 +39,10 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 0914266..21e88a2 100644
+index 0925daf..08169ba 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -939,7 +939,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -945,7 +945,7 @@ mt76_dma_init(struct mt76_dev *dev,
  	dev->napi_dev.threaded = 1;
  
  	mt76_for_each_q_rx(dev, i) {
@@ -52,10 +52,10 @@
  		napi_enable(&dev->napi[i]);
  	}
 diff --git a/mac80211.c b/mac80211.c
-index 15d300a..be4a140 100644
+index 818f4f0..909ab25 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1511,7 +1511,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
+@@ -1508,7 +1508,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
  static void
  __mt76_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -64,7 +64,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -1533,7 +1533,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1530,7 +1530,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct mt76_dev *dev = priv;
  
@@ -160,7 +160,7 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 5649377..99851dc 100644
+index d406013..703ca73 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -197,7 +197,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
@@ -541,10 +541,10 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 3626008..e3d4ebc 100644
+index 9cbd362..5743dc5 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -555,8 +555,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -553,8 +553,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  	if (ret < 0)
  		return ret;
  
@@ -556,10 +556,10 @@
  
  	mt7915_dma_enable(dev);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index c347509..e643c0e 100755
+index ef752e1..9ccbc7b 100755
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
-@@ -1148,8 +1148,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
+@@ -1152,8 +1152,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
  			mt7915_gen_ppe_thresh(he_cap->ppe_thres, nss);
  		} else {
  			he_cap_elem->phy_cap_info[9] |=
@@ -570,10 +570,10 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d5df73d..3bbe757 100644
+index 0d0ae7a..d759912 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -913,7 +913,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -915,7 +915,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  	u16 fc, tid;
  	u32 val;
  
@@ -583,10 +583,10 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index dcf1583..5d678df 100644
+index c87f04b..28509d9 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -503,7 +503,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -523,7 +523,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  
  static int
  mt7915_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -595,7 +595,7 @@
  	       const struct ieee80211_tx_queue_params *params)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-@@ -598,7 +598,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
+@@ -618,7 +618,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
  static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  				    struct ieee80211_vif *vif,
  				    struct ieee80211_bss_conf *info,
@@ -604,7 +604,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -618,7 +618,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -638,7 +638,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	}
  
  	if (changed & BSS_CHANGED_ASSOC)
@@ -613,7 +613,7 @@
  
  	if (changed & BSS_CHANGED_ERP_CTS_PROT)
  		mt7915_mac_enable_rtscts(dev, vif, info->use_cts_prot);
-@@ -1226,10 +1226,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
+@@ -1223,10 +1223,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
@@ -627,7 +627,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 69f1a0d..87c2822 100644
+index 88ce44f..f2c848d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -64,7 +64,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
@@ -681,7 +681,7 @@
  }
  
  static int
-@@ -230,7 +230,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+@@ -231,7 +231,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
  static void
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -690,7 +690,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -331,7 +331,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -332,7 +332,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
  static void
  mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -699,7 +699,7 @@
  		return;
  
  	ieee80211_color_change_finish(vif);
-@@ -731,13 +731,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -745,13 +745,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  		      struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -715,7 +715,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -823,8 +823,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -837,8 +837,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -726,7 +726,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -874,7 +874,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -888,7 +888,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -735,7 +735,7 @@
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -898,11 +898,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -912,11 +912,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
  
@@ -750,7 +750,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -936,13 +936,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -950,13 +950,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_ht *ht;
  	struct tlv *tlv;
  
@@ -766,7 +766,7 @@
  }
  
  static void
-@@ -951,15 +951,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -965,15 +965,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
  
@@ -786,7 +786,7 @@
  }
  
  static void
-@@ -974,7 +974,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -988,7 +988,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -795,7 +795,7 @@
  	    return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -983,7 +983,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -997,7 +997,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	amsdu->amsdu_en = true;
  	msta->wcid.amsdu = true;
  
@@ -804,7 +804,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		if (!is_mt7915(&dev->mt76)) {
  			amsdu->max_mpdu_size =
-@@ -1046,8 +1046,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1060,8 +1060,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	if (!bfee && tx_ant < 2)
  		return false;
  
@@ -815,7 +815,7 @@
  
  		if (bfee)
  			return mvif->cap.he_su_ebfee &&
-@@ -1057,8 +1057,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1071,8 +1071,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -826,7 +826,7 @@
  
  		if (bfee)
  			return mvif->cap.vht_su_ebfee &&
-@@ -1084,7 +1084,7 @@ static void
+@@ -1098,7 +1098,7 @@ static void
  mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		       struct sta_rec_bf *bf)
  {
@@ -835,7 +835,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1109,7 +1109,7 @@ static void
+@@ -1123,7 +1123,7 @@ static void
  mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  			struct sta_rec_bf *bf, bool explicit)
  {
@@ -844,7 +844,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1130,14 +1130,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
+@@ -1144,14 +1144,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -861,7 +861,7 @@
  			bf->ibf_nrow = 1;
  	}
  }
-@@ -1146,7 +1146,7 @@ static void
+@@ -1160,7 +1160,7 @@ static void
  mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
  {
@@ -870,7 +870,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1171,7 +1171,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1185,7 +1185,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -879,7 +879,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1219,7 +1219,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1233,7 +1233,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -888,7 +888,7 @@
  		return;
  
  	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1233,21 +1233,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1247,21 +1247,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -916,7 +916,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1257,7 +1257,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1271,7 +1271,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -925,7 +925,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1282,7 +1282,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1296,7 +1296,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -934,7 +934,7 @@
  		return;
  
  	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1291,13 +1291,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1305,13 +1305,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
  	bfee = (struct sta_rec_bfee *)tlv;
  
@@ -952,7 +952,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1353,7 +1353,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -1367,7 +1367,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -961,7 +961,7 @@
  		break;
  	case RATE_PARAM_SPE_UPDATE:
  		ra->spe_idx = *(u8 *)data;
-@@ -1428,7 +1428,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1442,7 +1442,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  	do {									\
  		u8 i, gi = mask->control[band]._gi;				\
  		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
@@ -970,7 +970,7 @@
  			phy.sgi |= gi << (i << (_he));				\
  			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
  		}								\
-@@ -1442,11 +1442,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1456,11 +1456,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		}								\
  	} while (0)
  
@@ -985,7 +985,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -1480,7 +1480,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1494,7 +1494,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		 * actual txrate hardware sends out.
  		 */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
@@ -994,7 +994,7 @@
  			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1513,7 +1513,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1527,7 +1527,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra *ra;
  	struct tlv *tlv;
@@ -1003,7 +1003,7 @@
  	u32 cap = sta->wme ? STA_CAP_WMM : 0;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1523,9 +1523,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1537,9 +1537,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	ra->auto_rate = true;
  	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
  	ra->channel = chandef->chan->hw_value;
@@ -1016,7 +1016,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -1545,22 +1545,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1559,22 +1559,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		}
  	}
  
@@ -1047,7 +1047,7 @@
  			cap |= STA_CAP_LDPC;
  
  		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1568,37 +1568,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1582,37 +1582,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
  	}
  
@@ -1095,7 +1095,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  
-@@ -1807,7 +1807,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -1821,7 +1821,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1104,7 +1104,7 @@
  	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
  					   &bcn->sub_ntlv, &bcn->len);
  	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -1892,9 +1892,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1906,9 +1906,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1116,7 +1116,7 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -2078,7 +2078,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2092,7 +2092,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (!en)
  		goto out;
  
@@ -1125,7 +1125,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -3280,17 +3280,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3308,17 +3308,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1147,11 +1147,11 @@
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 2ae6c07..75be1ed 100644
+index 70382b9..5c71116 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
-@@ -360,12 +360,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
- 	}
+@@ -397,12 +397,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+ 		memcpy(sta->addr, td->addr[0], ETH_ALEN);
  
  	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
 -		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
@@ -1168,7 +1168,7 @@
  	sta->wme = 1;
  
 diff --git a/tx.c b/tx.c
-index 6d55566..91c8dd8 100644
+index a72b777..04b6f2e 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 1c27c78..fd3b6f2 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -4,6 +4,8 @@
     file://0002-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_throt.patch \
     file://0003-wifi-mt76-mt7915-rework-mt7915_thermal_temp_store.patch \
     file://0004-wifi-mt76-mt7915-add-error-message-in-mt7915_thermal.patch \
+    file://0005-wifi-mt76-mt7915-set-sku-initial-value-to-zero.patch \
+    file://0006-wifi-mt76-mt7915-add-chip-id-condition-in-mt7915_che.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
     file://1003-mt76-mt7915-air-monitor-support.patch \
@@ -13,26 +15,27 @@
     file://1007-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
     file://1008-mt76-mt7915-drop-undefined-action-frame.patch \
     file://1009-mt76-mt7915-add-fw_version-dump.patch \
-    file://1111-mt76-mt7915-rework-testmode-init-registers.patch \
+    file://1111-mt76-testmode-rework-testmode-init-registers.patch \
     file://1112-mt76-testmode-additional-supports.patch \
     file://1113-mt76-testmode-add-pre-cal-support.patch \
     file://1114-mt76-testmode-add-iBF-command-mode-support.patch \
     file://1115-mt76-testmode-add-ZWDFS-test-mode-support.patch \
-    file://1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
-    file://1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
-    file://1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch \
-    file://1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
-    file://1120-mt76-mt7915-add-phy-capability-vendor-command.patch \
-    file://1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch \
-    file://1122-mt76-mt7915-implement-bin-file-mode.patch \
-    file://1123-mt76-mt7915-initialize-wcid.patch \
-    file://1124-mt76-mt7915-Add-hemu-dump-support.patch \
-    file://1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
-    file://1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
-    file://1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
-    file://1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
-    file://1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
-    file://1130-mt76-mt7915-add-amsdu-set-get-ctrl.patch \
+    file://1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch \
+    file://1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
+    file://1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
+    file://1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch \
+    file://1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch \
+    file://1121-mt76-mt7915-add-phy-capability-vendor-command.patch \
+    file://1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch \
+    file://1123-mt76-mt7915-implement-bin-file-mode.patch \
+    file://1124-mt76-mt7915-initialize-wcid.patch \
+    file://1125-mt76-mt7915-Add-hemu-dump-support.patch \
+    file://1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
+    file://1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch \
+    file://1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch \
+    file://1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch \
+    file://1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch \
+    file://1131-mt76-mt7915-amsdu-set-and-get-control.patch \
     file://3001-mt76-mt7915-wed-add-wed-tx-support.patch \
     file://3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch \
     file://3003-mt76-connac-wed-add-wed-rx-copy-skb.patch \
@@ -45,7 +48,8 @@
     file://3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch \
     file://3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch \
     file://3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch \
-    file://4000-mt76-revert-get_of_mac_addr.patch \
-    file://4001-mt76-include-header-files-for-module-param.patch \
-    file://4002-mt76-revert-for-backports-5.15-wireless-stack.patch \
+    file://3013-mt76-mt7915-wed-fix-potential-memory-leakage.patch \
+    file://4001-mt76-revert-get_of_mac_addr.patch \
+    file://4002-mt76-include-header-files-for-module-param.patch \
+    file://4003-mt76-revert-for-backports-5.15-wireless-stack.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7915_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7915_rom_patch.bin
index aba89e9..2bef065 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7915_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7915_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7915_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7915_wa.bin
index 9c620cf..52db6e4 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7915_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7915_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7915_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7915_wm.bin
index 417b7e6..ec62e79 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7915_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7915_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin
index b020d70..0bc8571 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin
index 1324b8c..ce8a678 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin
index a414a1c..c68b298 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
index e2ab607..7df304c 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
index 409fbf6..80bb361 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin
index a8a813f..768975e 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin
index 2d71ab7..b441153 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
index 9566b18..75913a4 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin
index a2dfb96..f048b4f 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin
index f7bbf39..3ce6cfe 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin
Binary files differ